mjhjmtu

I'm trying to update my Solaris 11.3 x86 system. The system hasSun/Oracle software on it, including Sun Developer Studio and Sun SSH server. It does not have other software on it, and I don't have anything in /usr/local.

I'm catching this error:

$ sudo pkg update
Creating Plan (Package planning: 1/10): -
pkg update: Chain was rooted in an untrusted self-signed certificate.
The package involved is pkg://solaris/consolidation/ddt/ddt-incorporation@18.3.18.7.13,0.5.11-11.4.0.0.1.11.0:20180718T212443Z

According to Packaging and Delivering Software With the Image Packaging System | Untrusted Self-Signed Certificate, the docs say it is because of using a self-signed OpenSSL certificate. Another similar page is Troubleshooting Signed Packages, but it rehashes the earlier page and adds nothing new. The Oracle docs on updating a package is at Updating a Package but it does not appear to provide the information I need.

The Sun article lacks step-by-step instructions to clear the issue. I'm trying to get Solaris to trust the Sun certificate but I can't get beyond usage errors:

$ sudo pkg set-publisher --approve-ca-cert solaris/consolidation/ddt/ddt-incorporation
pkg set-publisher: requires a publisher name
Usage:
 pkg set-publisher [-Ped] [-k ssl_key] [-c ssl_cert]
 [-g origin_to_add|--add-origin=origin_to_add ...]
 [-G origin_to_remove|--remove-origin=origin_to_remove ...]
 ....

And:

$ sudo pkg set-publisher --approve-ca-cert solaris/consolidation/ddt/ddt-incorporation sun
pkg set-publisher: Could not find /export/home/jwalton/solaris/consolidation/ddt/ddt-incorporation

I've tried other combinations, like prepending pkg:// and using the full name but the problems persist.

How do I get beyond this error?

It's not self-signed, but it's not signed by a certificate authority that the Solaris 11.3 GA version knows about. Support for the new certificate authority is one of the reasons you need to first update to Solaris 11.3 SRU 23 or later before you can upgrade to Solaris 11.4, as documented in the upgrade instructions.

I think I know exactly what you're trying to do, but you'll also fail at the next step which is where I'm up to.

pkg(1) stashes a copy of the certificate chain in /var/pkg/publisher/(publisher name)/certs, so you'll have the signing and root certificate in /var/pkg/publisher/solaris/certs. Copy the root certificate to the CA certificate directory in /etc/certs/CA/ and then pkg(1) will trust the certificate chain.

In my case, it's as easy as

cp /var/pkg/publisher/solaris/certs/370b6b4fba7b0ad472465ffe9377f8f6040b2cfd /etc/certs/CA/temp-solaris-object-signing.pem
svcadm restart system/ca-certificates

The next hurdle you'll find is that pkg://solaris/system/core-os@11.4,5.11-11.4.0.0.1.15.0 has an origin root-image dependency on pkg:/system/core-os@0.5.11-0.175.3.23.0.4.0 (see https://docs.oracle.com/cd/E53394_01/html/E54820/dependtypes.html#PKDEVglumq for details about pkg dependencies). There is probably a very good reason that is there...

(and yes, it seems Oracle has blocked any kind of upgrade to Solaris 11.4 without having a support contract to be able to download 11.3SRU23)

pkg uninstall consolidation/ddt/ddt-incorporation support/explorer