On Tue, Sep 22, 2026 at 02:29:40PM +0100, Stuart Henderson wrote: > moving to ports@, cc'ing espie > > On 2026-09-20, Luigi Vianello <[email protected]> wrote: > > Hello guys, > > There seems to be a problem with the -C option of pkg_info. This > > option is supposed to verify the signature of a given package. I > > didn't encounter this problem on OpenBSD 7.8, but it appears to be > > present in 7.9. > > I ran these tests on a virtual machine I had running version 7.8, but > > after updating to 7.9, the problem arose. > > About the "-C" option the manual says: > > -C Show certificate information for signed packages. > > To be specific, the problem is the last line, which should indicate > > that the package is correctly signed. > > Here it is (I removed the white lines); the problem is the final error: > > ----- > > # pkg_info -C xz > > Information for inst:xz-5.8.3 > > Comment: > > library and tools for XZ and LZMA compressed files > > Required by: > > python-3.13.14 > > tiff-4.7.1p2 > > zstd-1.5.7p0 > > Description: > > XZ Utils provide a general purpose data compression library and > > command line tools. The native file format is the .xz format, but > > also the legacy .lzma format is supported. The .xz format supports > > multiple compression algorithms, of which LZMA2 is currently the > > primary algorithm. With typical files, XZ Utils create about 30 % > > smaller files than gzip. > > Maintainer: Christian Weisgerber <[email protected]> > > WWW: https://tukaani.org/xz/ > > Can't call method "name" on an undefined value at > > /usr/libdata/perl5/OpenBSD/PkgInfo.pm line 433. > > ---- > > I also tried running a diff between the /usr/libdata/perl5/OpenBSD > > directory in OpenBSD 7.8 and 7.9, but they don't seem very different > > to me... so I assume the problem stems more generally from the > > directory structure higher up. > > Seems the @signer tags started getting dropped sometime after 7.8 > I have a few old installed packages with them (these have PKG_ARCH=* > so don't see updates from _SYSTEM_VERSION hence the older packages > stay around) but none with 7.9:
I'll have a closer look tonight hopefully, but the signature information is taken from the location, then passed into the installed packing-list through decorate (in PackageRepository/Installed.pm) The location info is done through uncompress, that does parse the gzip comment. Maybe IO::Uncompress::Gunzip changed recently and does not pass the full comment around ? that would be my best guess.
