Details

Reviewers

Group Reviewers

releng
doceng
secteam
clusteradm

Test Plan

{F138067300}

Diff Detail

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 68978
Build 65861: arc lint + arc unit

Event Timeline

dch requested review of this revision.Fri, Nov 28, 3:02 PM

dch created this revision.

Harbormaster completed remote builds in B68920: Diff 167242.Fri, Nov 28, 3:02 PM

the actual URL for fetching via pkg add -f .. needs to be validated prior to release

dch edited the test plan for this revision. (Show Details)Fri, Nov 28, 3:14 PM

This is great. I am wondering if we need to mention some instructions for verify the pkg before pkg add? Or it's already done in that pkg add command?
I know that some (most?) people will skip that step, but we'd still better to consider this.

cperciva added a subscriber: cperciva.Fri, Nov 28, 5:02 PM

cperciva added inline comments.

website/content/en/releases/15.0R/relnotes.adoc
69	People with 15.0-RC* are fine assuming clusteradm doesn't remove the DNS entry for pkgbase.freebsd.org prematurely. The problem is people running -PRERELEASE, -ALPHA, and -BETA, whose systems expect packages signed with the pkg (not pkgbase) keys.
73	s/FreeBSD's/FreeBSD.org/
79	I don't think we want to recommend this since there's no way for them to verify this package -- they don't have the public key fingerprint.
82	Perhaps worth adding "after 2025-11-27 22:00 UTC".

address all but pkg add -f ... feedback

Harbormaster completed remote builds in B68964: Diff 167374.Mon, Dec 1, 5:19 PM

Updated all but the`pkg add -f ..` bit. I hear what you're saying @cperciva but I have already encountered test users who are not comfortable with git, and I would like to give them a simple alternative with mostly familiar tools.

Alternatively I could expand it out, make an explicit sha256 -c , and provide the actual file hashes in the document?

In D53976#1234085, @dch wrote:

Updated all but the`pkg add -f ..` bit. I hear what you're saying @cperciva but I have already encountered test users who are not comfortable with git, and I would like to give them a simple alternative with mostly familiar tools.

Alternatively I could expand it out, make an explicit sha256 -c , and provide the actual file hashes in the document?

Fair enough. If people are affected by this they're probably smart enough to decide if they want to trust a package without verifying the signature.

Speaking of people affected by this, the heading should probably be "Upgrading from pkgbase installs of PRERELEASE, ALPHA, and BETA builds of FreeBSD 15.0"?

dch marked an inline comment as done.Mon, Dec 1, 9:50 PM

dch added inline comments.

website/content/en/releases/15.0R/relnotes.adoc
79	Updated all but the`pkg add -f ..` bit. I hear what you're saying @cperciva but I have already encountered test users who are not comfortable with git, and I would like to give them a simple alternative with mostly familiar tools. Alternatively I could expand it out, make an explicit sha256 -c , and provide the actual file hashes in the document?