Re: pkg update broke

"William F. Dudley Jr." <[email protected]> Mon, 6 Jul 2026 10:04:53 -0400
Newsgroups gmane.os.freebsd.questions
Message-ID <[email protected]>
This is a multi-part message in MIME format.
--------------pBwIqMW0OieL1922VoQ0O570
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

relax, it's just a debugging step.  I don't plan to do that forever.

Bill Dudley

On 7/6/26 4:38 AM, Michael Sierchio wrote:
> A hacktastic shortcut to disable SSL/TLS certificate validation?  Why 
> does that seem like a good idea to anyone?
>
> On Mon, Jul 6, 2026 at 6:23 AM Steve Rikli <[email protected]> wrote:
>
>     Yes, sorry -- that's my badness on the flag|command mis-ordering.
>
>     Last thought for now: afaik the pkg commands use fetch(1) to do the
>     download work, the fetch(1) and fetch(3) man pages mention an env var:
>
>        SSL_NO_VERIFY_PEER
>
>     among others. Maybe try setting that and re-do your bootstrap attempt.
>
>     Wrt your system files, I dunno what would have gotten
>     removed/corrupted
>     to cause this particular error. Since you have a still-working system
>     for reference, I'd compare things like their /var/db/pkg/ subdirs, see
>     if anything obvious is missing or scrambled.
>
>     If you find something obvious that can be restored from backups that's
>     great; otherwise I suspect you're still looking at a re-bootstrap if
>     we can work out how to force that.
>
>     sr.
>
>
>     On Mon, Jul 06, 2026 at 12:06:31AM -0400, William F. Dudley Jr. wrote:
>     > Steve,
>     >
>     > The clock is correct.
>     >
>     > pkg-static bootstrap -f
>     >
>     > made no improvement.  pkg update still fails as before.
>     >
>     > Interestingly, the position of the "-f" is important:
>     >
>     > pkg-static -f bootstrap
>     > pkg-static: illegal option -- f
>     > pkg-static: Invalid argument provided
>     >
>     > Thanks,
>     > Bill Dudley
>     >
>     > On 7/6/26 12:02 AM, Steve Rikli wrote:
>     > > On Sun, Jul 05, 2026 at 09:37:04PM -0400, William F. Dudley
>     Jr. wrote:
>     > > > I am running "FreeBSD 14.3-RELEASE-p16 amd64".
>     > > >
>     > > > I did "freebsd-update fetch" followed by "freebsd-update
>     install", and the
>     > > > power (and my UPS) failed, I think, during the
>     "freebsd-update install"
>     > > > step.
>     > > >
>     > > > Now, when I run "pkg update", I get this:
>     > > >
>     > > > pkg: Failed to fetch
>     > > > https://pkg.FreeBSD.org/FreeBSD:14:amd64/quarterly/meta.conf
>     <https://pkg.FreeBSD.org/FreeBSD:14:amd64/quarterly/meta.conf>:
>     SSL peer
>     > > > certificate or SSH remote key was not OK
>     > > >
>     > > > And identical lines for meta.txz, data.pkg, data.tzst, etc.
>     > > >
>     > > > I have a nearly identical machine, and that machine can do
>     pkg update
>     > > > successfully.
>     > > >
>     > > > I have tried to figure out where pkg stores the SSL
>     certificate or SSH key
>     > > > that it's complaining about but have been unsuccessful. 
>     Running "man pkg",
>     > > > "man pkg.conf", scanning output of "pkg -vv", running "pkg
>     -f bootstrap" all
>     > > > failed to help.
>     > > >
>     > > > What is broken and how can I fix it?
>     > >
>     > > Longshot guess: is your system clock time very far off, perhaps?
>     > >
>     > > If you're okay with re-bootstrap, maybe try
>     > >     pkg-static -f bootstrap
>     > >
>     > > ... rather than the normal 'pkg' command.
>     > >
>     > > Cheers,
>     > > sr.
>
--------------pBwIqMW0OieL1922VoQ0O570
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>relax, it's just a debugging step.  I don't plan to do that
      forever.</p>
    <p>Bill Dudley</p>
    <div class="moz-cite-prefix">On 7/6/26 4:38 AM, Michael Sierchio
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAHu1Y73K7tx-3y4YjtbMGftP-r84ypfxFQWkXD95KQcSXdc47w@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="ltr">A hacktastic shortcut to disable SSL/TLS
        certificate validation?  Why does that seem like a good idea to
        anyone?</div>
      <br>
      <div class="gmail_quote gmail_quote_container">
        <div dir="ltr" class="gmail_attr">On Mon, Jul 6, 2026 at 6:23 AM
          Steve Rikli &lt;<a href="mailto:[email protected]"
            moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>&gt;
          wrote:<br>
        </div>
        <blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Yes,
          sorry -- that's my badness on the flag|command mis-ordering.<br>
          <br>
          Last thought for now: afaik the pkg commands use fetch(1) to
          do the<br>
          download work, the fetch(1) and fetch(3) man pages mention an
          env var:<br>
          <br>
             SSL_NO_VERIFY_PEER<br>
          <br>
          among others. Maybe try setting that and re-do your bootstrap
          attempt.<br>
          <br>
          Wrt your system files, I dunno what would have gotten
          removed/corrupted<br>
          to cause this particular error. Since you have a still-working
          system<br>
          for reference, I'd compare things like their /var/db/pkg/
          subdirs, see<br>
          if anything obvious is missing or scrambled.<br>
          <br>
          If you find something obvious that can be restored from
          backups that's<br>
          great; otherwise I suspect you're still looking at a
          re-bootstrap if<br>
          we can work out how to force that.<br>
          <br>
          sr.<br>
          <br>
          <br>
          On Mon, Jul 06, 2026 at 12:06:31AM -0400, William F. Dudley
          Jr. wrote:<br>
          &gt; Steve,<br>
          &gt; <br>
          &gt; The clock is correct.<br>
          &gt; <br>
          &gt; pkg-static bootstrap -f<br>
          &gt; <br>
          &gt; made no improvement.  pkg update still fails as before.<br>
          &gt; <br>
          &gt; Interestingly, the position of the "-f" is important:<br>
          &gt; <br>
          &gt; pkg-static -f bootstrap<br>
          &gt; pkg-static: illegal option -- f<br>
          &gt; pkg-static: Invalid argument provided<br>
          &gt; <br>
          &gt; Thanks,<br>
          &gt; Bill Dudley<br>
          &gt; <br>
          &gt; On 7/6/26 12:02 AM, Steve Rikli wrote:<br>
          &gt; &gt; On Sun, Jul 05, 2026 at 09:37:04PM -0400, William F.
          Dudley Jr. wrote:<br>
          &gt; &gt; &gt; I am running "FreeBSD 14.3-RELEASE-p16 amd64".<br>
          &gt; &gt; &gt; <br>
          &gt; &gt; &gt; I did "freebsd-update fetch" followed by
          "freebsd-update install", and the<br>
          &gt; &gt; &gt; power (and my UPS) failed, I think, during the
          "freebsd-update install"<br>
          &gt; &gt; &gt; step.<br>
          &gt; &gt; &gt; <br>
          &gt; &gt; &gt; Now, when I run "pkg update", I get this:<br>
          &gt; &gt; &gt; <br>
          &gt; &gt; &gt; pkg: Failed to fetch<br>
          &gt; &gt; &gt; <a
href="https://pkg.FreeBSD.org/FreeBSD:14:amd64/quarterly/meta.conf"
            rel="noreferrer" target="_blank" moz-do-not-send="true">https://pkg.FreeBSD.org/FreeBSD:14:amd64/quarterly/meta.conf</a>:
          SSL peer<br>
          &gt; &gt; &gt; certificate or SSH remote key was not OK<br>
          &gt; &gt; &gt; <br>
          &gt; &gt; &gt; And identical lines for meta.txz, data.pkg,
          data.tzst, etc.<br>
          &gt; &gt; &gt; <br>
          &gt; &gt; &gt; I have a nearly identical machine, and that
          machine can do pkg update<br>
          &gt; &gt; &gt; successfully.<br>
          &gt; &gt; &gt; <br>
          &gt; &gt; &gt; I have tried to figure out where pkg stores the
          SSL certificate or SSH key<br>
          &gt; &gt; &gt; that it's complaining about but have been
          unsuccessful.  Running "man pkg",<br>
          &gt; &gt; &gt; "man pkg.conf", scanning output of "pkg -vv",
          running "pkg -f bootstrap" all<br>
          &gt; &gt; &gt; failed to help.<br>
          &gt; &gt; &gt; <br>
          &gt; &gt; &gt; What is broken and how can I fix it?<br>
          &gt; &gt; <br>
          &gt; &gt; Longshot guess: is your system clock time very far
          off, perhaps?<br>
          &gt; &gt; <br>
          &gt; &gt; If you're okay with re-bootstrap, maybe try<br>
          &gt; &gt;     pkg-static -f bootstrap<br>
          &gt; &gt; <br>
          &gt; &gt; ... rather than the normal 'pkg' command.<br>
          &gt; &gt; <br>
          &gt; &gt; Cheers,<br>
          &gt; &gt; sr.<br>
          <br>
        </blockquote>
      </div>
    </blockquote>
  </body>
</html>

--------------pBwIqMW0OieL1922VoQ0O570--