Solaris won't update because ddt-incorporation is using a self-signed certifcate

Question

I'm trying to update my Solaris 11.3 x86 system. The system hasSun/Oracle software on it, including Sun Developer Studio and Sun SSH server. It does not have other software on it, and I don't have anything in /usr/local.

I'm catching this error:

$ sudo pkg update
Creating Plan (Package planning:  1/10): -
pkg update: Chain was rooted in an untrusted self-signed certificate.
The package involved is pkg://solaris/consolidation/ddt/[email protected],0.5.11-11.4.0.0.1.11.0:20180718T212443Z

According to Packaging and Delivering Software With the Image Packaging System | Untrusted Self-Signed Certificate, the docs say it is because of using a self-signed OpenSSL certificate. Another similar page is Troubleshooting Signed Packages, but it rehashes the earlier page and adds nothing new. The Oracle docs on updating a package is at Updating a Package but it does not appear to provide the information I need.

The Sun article lacks step-by-step instructions to clear the issue. I'm trying to get Solaris to trust the Sun certificate but I can't get beyond usage errors:

$ sudo pkg set-publisher --approve-ca-cert  solaris/consolidation/ddt/ddt-incorporation
pkg set-publisher: requires a publisher name
Usage:
    pkg set-publisher [-Ped] [-k ssl_key] [-c ssl_cert]
        [-g origin_to_add|--add-origin=origin_to_add ...]
        [-G origin_to_remove|--remove-origin=origin_to_remove ...]
    ....

And:

$ sudo pkg set-publisher --approve-ca-cert  solaris/consolidation/ddt/ddt-incorporation sun
pkg set-publisher: Could not find /export/home/jwalton/solaris/consolidation/ddt/ddt-incorporation

I've tried other combinations, like prepending pkg:// and using the full name but the problems persist.

How do I get beyond this error?

Have you tried using the full path to `solaris/consolidation/ddt/ddt-incorporation`? — Andrew Henle, Aug 29 '18 at 10:18
FWIW, I get the same error here when trying to update a Solaris virtualbox VM with nothing fancy on it. Suggesting Oracle have messed up something somewhere. — Stéphane Chazelas, Aug 29 '18 at 10:29
It's probably a matter of going through the steps described at https://docs.oracle.com/cd/E37838_01/html/E60977/gmpdi.html — Stéphane Chazelas, Aug 29 '18 at 10:59

score 5 · Answer 1 · answered Aug 29 '18 at 21:51

5

It's not self-signed, but it's not signed by a certificate authority that the Solaris 11.3 GA version knows about. Support for the new certificate authority is one of the reasons you need to first update to Solaris 11.3 SRU 23 or later before you can upgrade to Solaris 11.4, as documented in the upgrade instructions.

answered Aug 29 '18 at 21:51

alanc

2,996
16
27

So does this effectively mean that people without a support contract (i.e. no access to the SRU releases) can't upgrade from Solaris 11.3 to 11.4, and instead must do a clean install? – Tanz87 Sep 07 '18 at 09:03
@Tanz87 unfortunately, that is correct. – alanc Sep 09 '18 at 21:35

jpm · Answer 2 · 2018-09-25T07:14:53.513

I think I know exactly what you're trying to do, but you'll also fail at the next step which is where I'm up to.

pkg(1) stashes a copy of the certificate chain in /var/pkg/publisher/(publisher name)/certs, so you'll have the signing and root certificate in /var/pkg/publisher/solaris/certs. Copy the root certificate to the CA certificate directory in /etc/certs/CA/ and then pkg(1) will trust the certificate chain.

In my case, it's as easy as

cp /var/pkg/publisher/solaris/certs/370b6b4fba7b0ad472465ffe9377f8f6040b2cfd /etc/certs/CA/temp-solaris-object-signing.pem
svcadm restart system/ca-certificates

The next hurdle you'll find is that pkg://solaris/system/[email protected],5.11-11.4.0.0.1.15.0 has an origin root-image dependency on pkg:/system/[email protected] (see https://docs.oracle.com/cd/E53394_01/html/E54820/dependtypes.html#PKDEVglumq for details about pkg dependencies). There is probably a very good reason that is there...

EDIT: the rest of what you're probably trying to do is...

If you choose to ignore that giant red flag, and don't mind your Solaris 11.3 system becoming unsupportable (probably because you don't have a support contract in order to download 11.3SRU23), you can do something like:

pkgrecv -s /path/to/solaris11_4 -d /var/tmp/sol114 --raw pkg://solaris/system/[email protected],5.11-11.4.0.0.1.15.0:20180817T002753Z
vi /var/tmp/sol114/system%2Fcore-os/11.4%2C5.11-11.4.0.0.1.15.0%3A20180817T002753Z/manifest*

Remove the dependency:

depend fmri=pkg:/system/[email protected] root-image=true type=origin

Publish back to your local repo:

pkgsend publish -s /path/to/solaris11_4 -d /var/tmp/sol114/system%2Fcore-os/11.4%2C5.11-11.4.0.0.1.15.0%3A20180817T0023Z/ /var/tmp/sol114/system%2Fcore-os/11.4%2C5.11-11.4.0.0.1.15.0%3A20180817T002753Z/manifest
pkgrepo -s /path/to/solaris11_4 rebuild

Then run the upgrade.

You need to ensure that /var/tmp is completely empty before upgrading because it seems to create a new ZFS dataset for /var/tmp during the upgrade, otherwise it seems to work fine with a couple of fixable errors. YMMV, I tested this on an old T4-2 SPARC system (not x86), so I don't know if there are other quirks around GRUB upgrades etc.

score 1 · Answer 3 · edited May 26 '21 at 07:23

1

this will fix error

cp /var/pkg/publisher/solaris/certs/370b6b4fba7b0ad472465ffe9377f8f6040b2cfd /etc/certs/CA/temp-solaris-object-signing.pem

svcadm restart system/ca-certificates

edited May 26 '21 at 07:23

Archemar

31,183
18
69
104

answered May 22 '21 at 21:35

solaris user

11
1

Welcome to the site, and thank you for your contribution. Perhaps you could edit your post to add some explanation _how_ these steps will solve the problem? – AdminBee May 26 '21 at 08:32

Manja-solaris · Answer 4 · 2018-11-15T20:54:44.927

0

The following command will install 11.3 sru21 which will install new CA. DDT-incorporation is a diagnostic package which has explorer etc..

pkg update --reject ddt-incorporation --accept [email protected]

Later you can install the individual package if required or subsequent pkg update will not fail. pkg install ddt-incorporation

edited Nov 15 '18 at 20:54

answered Nov 14 '18 at 17:58

Manja-solaris

1
1

You are apparently showing a command that is obviously not a valid command — it has unquoted parentheses (and not in an allowed configuration). What do you mean? Please do not respond in comments; [edit] your answer to make it clearer and more complete. – G-Man Says 'Reinstate Monica' Nov 14 '18 at 18:25

score 0 · Answer 5 · edited Jan 29 '19 at 04:04

0

To resolve the pkg update issue: Specify the exact version of the "package involved".

# pkg update --reject pkg://solaris/consolidation/ddt/[email protected],0.5.11-11.4.0.0.1.11.0:20180718T212443Z [email protected]

or simply reject it:

# pkg update consolidation/ddt/[email protected] [email protected]

edited Jan 29 '19 at 04:04

G-Man Says 'Reinstate Monica'

22,130
27
68
117

answered Jan 29 '19 at 03:07

GopiKrishna Jagadam

1

score -1 · Answer 6 · edited Aug 29 '18 at 10:12

-1

pkg uninstall consolidation/ddt/ddt-incorporation support/explorer

edited Aug 29 '18 at 10:12

Jeff Schaller

66,199
35
114
250

answered Aug 29 '18 at 09:25

Vlado

1

In my case, after removing those two packages (support/explorer depending on ddt-incorporation), I still get the error for other packages (`pkg://solaris/library/python/[email protected],5.11-11.4.0.0.1.9.0:20180618T175853Z`), suggesting that it's not only about those packages but that we need somehow to let Solaris know about the new oracle root certificate (`pkg refresh --full` doesn't help). – Stéphane Chazelas Aug 29 '18 at 10:46

Solaris won't update because ddt-incorporation is using a self-signed certifcate

6 Answers6

Linked