Software Distributor (SD-UX) Administration Guide HP-UX 11i v1, 11i v2, and 11i v3 (762797-001, March 2014)

To register the same depot (mounted at /mnt/cd on the local host) as a depot to be available on
the network, type:
swreg -l depot /mnt/cd
The following example enables direct access from one or two other systems to the HWEnable11i
depot on the Support Plus CD, assuming the Support Plus CD is mounted at/cdrom:
swreg -l depot /cdrom/HWEnable11i
Verifying Signed Software Signatures
Every software that is a part of the HP-UX 11i v3 March 2013 (update) release is now digitally
signed by Hewlett-Packard. SD supports signed software signature verification in a depot to ensure
that the software has not been tampered with and is released by HP. This functionality is supported
only with SD B.11.31.1303 and later versions. The product WLI-PROD (revision A.01.01.06 or
later) from WhiteListInf bundle must be installed to enable signature verification.
The swverify command supports two modes of signature verification:
• The -x verify_signatures=true option verifies the signatures as well as dependencies,
file modes, permissions, timestamps, etc.
• The -x verify_signatures_only=true option verifies only the signatures and can be
used if the user intends to verify only the authenticity and integrity of the software before
installation.
To verify only the signatures in a signed directory depot:
swverify -d -x verify_signatures_only=true \* @ /depots/mydep
To verify the signatures along with complete directory depot verification (recommended):
swverify -d -x verify_signatures=true \* @ /depots/mydep
To specify your own public key path instead of the default, use the -x
public_key=/path/to/public/key option. This option can only be used with
verify_signatures_only=true or verify_signatures=true.
swverify -d -x verify_signatures_only=true -x
public_key=/path/to/public/key \* @ /depots/mydep
If the depot is located on a remote machine, the remote machine must have a version of SD installed
that supports signature verification.
To see the details of signature verification, run the swjob command displayed at the end of the
swverify session.
Verifying Signed Software Signatures 95