Re: pkg update broke

Michael Sierchio <[email protected]> Mon, 6 Jul 2026 10:38:09 +0200
Newsgroups gmane.os.freebsd.questions
Message-ID <CAHu1Y73K7tx-3y4YjtbMGftP-r84ypfxFQWkXD95KQcSXdc47w@mail.gmail.com>
--000000000000d7ad710655ed335c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

A hacktastic shortcut to disable SSL/TLS certificate validation?  Why does
that seem like a good idea to anyone?

On Mon, Jul 6, 2026 at 6:23=E2=80=AFAM Steve Rikli <[email protected]> wrote:

> Yes, sorry -- that's my badness on the flag|command mis-ordering.
>
> Last thought for now: afaik the pkg commands use fetch(1) to do the
> download work, the fetch(1) and fetch(3) man pages mention an env var:
>
>    SSL_NO_VERIFY_PEER
>
> among others. Maybe try setting that and re-do your bootstrap attempt.
>
> Wrt your system files, I dunno what would have gotten removed/corrupted
> to cause this particular error. Since you have a still-working system
> for reference, I'd compare things like their /var/db/pkg/ subdirs, see
> if anything obvious is missing or scrambled.
>
> If you find something obvious that can be restored from backups that's
> great; otherwise I suspect you're still looking at a re-bootstrap if
> we can work out how to force that.
>
> sr.
>
>
> On Mon, Jul 06, 2026 at 12:06:31AM -0400, William F. Dudley Jr. wrote:
> > Steve,
> >
> > The clock is correct.
> >
> > pkg-static bootstrap -f
> >
> > made no improvement.  pkg update still fails as before.
> >
> > Interestingly, the position of the "-f" is important:
> >
> > pkg-static -f bootstrap
> > pkg-static: illegal option -- f
> > pkg-static: Invalid argument provided
> >
> > Thanks,
> > Bill Dudley
> >
> > On 7/6/26 12:02 AM, Steve Rikli wrote:
> > > On Sun, Jul 05, 2026 at 09:37:04PM -0400, William F. Dudley Jr. wrote=
:
> > > > I am running "FreeBSD 14.3-RELEASE-p16 amd64".
> > > >
> > > > I did "freebsd-update fetch" followed by "freebsd-update install",
> and the
> > > > power (and my UPS) failed, I think, during the "freebsd-update
> install"
> > > > step.
> > > >
> > > > Now, when I run "pkg update", I get this:
> > > >
> > > > pkg: Failed to fetch
> > > > https://pkg.FreeBSD.org/FreeBSD:14:amd64/quarterly/meta.conf: SSL
> peer
> > > > certificate or SSH remote key was not OK
> > > >
> > > > And identical lines for meta.txz, data.pkg, data.tzst, etc.
> > > >
> > > > I have a nearly identical machine, and that machine can do pkg upda=
te
> > > > successfully.
> > > >
> > > > I have tried to figure out where pkg stores the SSL certificate or
> SSH key
> > > > that it's complaining about but have been unsuccessful.  Running
> "man pkg",
> > > > "man pkg.conf", scanning output of "pkg -vv", running "pkg -f
> bootstrap" all
> > > > failed to help.
> > > >
> > > > What is broken and how can I fix it?
> > >
> > > Longshot guess: is your system clock time very far off, perhaps?
> > >
> > > If you're okay with re-bootstrap, maybe try
> > >     pkg-static -f bootstrap
> > >
> > > ... rather than the normal 'pkg' command.
> > >
> > > Cheers,
> > > sr.
>
>

--000000000000d7ad710655ed335c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">A hacktastic shortcut to disable SSL/TLS certificate valid=
ation?=C2=A0 Why does that seem like a good idea to anyone?</div><br><div c=
lass=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_=
attr">On Mon, Jul 6, 2026 at 6:23=E2=80=AFAM Steve Rikli &lt;<a href=3D"mai=
lto:[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex">Yes, sorry -- that&#39;s my badness on =
the flag|command mis-ordering.<br>
<br>
Last thought for now: afaik the pkg commands use fetch(1) to do the<br>
download work, the fetch(1) and fetch(3) man pages mention an env var:<br>
<br>
=C2=A0 =C2=A0SSL_NO_VERIFY_PEER<br>
<br>
among others. Maybe try setting that and re-do your bootstrap attempt.<br>
<br>
Wrt your system files, I dunno what would have gotten removed/corrupted<br>
to cause this particular error. Since you have a still-working system<br>
for reference, I&#39;d compare things like their /var/db/pkg/ subdirs, see<=
br>
if anything obvious is missing or scrambled.<br>
<br>
If you find something obvious that can be restored from backups that&#39;s<=
br>
great; otherwise I suspect you&#39;re still looking at a re-bootstrap if<br=
>
we can work out how to force that.<br>
<br>
sr.<br>
<br>
<br>
On Mon, Jul 06, 2026 at 12:06:31AM -0400, William F. Dudley Jr. wrote:<br>
&gt; Steve,<br>
&gt; <br>
&gt; The clock is correct.<br>
&gt; <br>
&gt; pkg-static bootstrap -f<br>
&gt; <br>
&gt; made no improvement.=C2=A0 pkg update still fails as before.<br>
&gt; <br>
&gt; Interestingly, the position of the &quot;-f&quot; is important:<br>
&gt; <br>
&gt; pkg-static -f bootstrap<br>
&gt; pkg-static: illegal option -- f<br>
&gt; pkg-static: Invalid argument provided<br>
&gt; <br>
&gt; Thanks,<br>
&gt; Bill Dudley<br>
&gt; <br>
&gt; On 7/6/26 12:02 AM, Steve Rikli wrote:<br>
&gt; &gt; On Sun, Jul 05, 2026 at 09:37:04PM -0400, William F. Dudley Jr. w=
rote:<br>
&gt; &gt; &gt; I am running &quot;FreeBSD 14.3-RELEASE-p16 amd64&quot;.<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; I did &quot;freebsd-update fetch&quot; followed by &quot;fre=
ebsd-update install&quot;, and the<br>
&gt; &gt; &gt; power (and my UPS) failed, I think, during the &quot;freebsd=
-update install&quot;<br>
&gt; &gt; &gt; step.<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; Now, when I run &quot;pkg update&quot;, I get this:<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; pkg: Failed to fetch<br>
&gt; &gt; &gt; <a href=3D"https://pkg.FreeBSD.org/FreeBSD:14:amd64/quarterl=
y/meta.conf" rel=3D"noreferrer" target=3D"_blank">https://pkg.FreeBSD.org/F=
reeBSD:14:amd64/quarterly/meta.conf</a>: SSL peer<br>
&gt; &gt; &gt; certificate or SSH remote key was not OK<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; And identical lines for meta.txz, data.pkg, data.tzst, etc.<=
br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; I have a nearly identical machine, and that machine can do p=
kg update<br>
&gt; &gt; &gt; successfully.<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; I have tried to figure out where pkg stores the SSL certific=
ate or SSH key<br>
&gt; &gt; &gt; that it&#39;s complaining about but have been unsuccessful.=
=C2=A0 Running &quot;man pkg&quot;,<br>
&gt; &gt; &gt; &quot;man pkg.conf&quot;, scanning output of &quot;pkg -vv&q=
uot;, running &quot;pkg -f bootstrap&quot; all<br>
&gt; &gt; &gt; failed to help.<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; What is broken and how can I fix it?<br>
&gt; &gt; <br>
&gt; &gt; Longshot guess: is your system clock time very far off, perhaps?<=
br>
&gt; &gt; <br>
&gt; &gt; If you&#39;re okay with re-bootstrap, maybe try<br>
&gt; &gt;=C2=A0 =C2=A0 =C2=A0pkg-static -f bootstrap<br>
&gt; &gt; <br>
&gt; &gt; ... rather than the normal &#39;pkg&#39; command.<br>
&gt; &gt; <br>
&gt; &gt; Cheers,<br>
&gt; &gt; sr.<br>
<br>
</blockquote></div>

--000000000000d7ad710655ed335c--