Software Distributor (SD-UX) Administration Guide HP-UX 11i v1, 11i v2, and 11i v3 (762797-001, March 2014)

NOTE:
• If a signed directory depot is provided by HP (for example in a DVD media or an ISO),
signature verification must pass at all levels, including depot metadata and bundle.
• If a signed tape depot is provided by HP, signature verification must pass at all levels.
• If a signed directory depot provided by HP is copied to another location using swcopy, then
the target depot metadata signature and bundle signature verification is expected to fail, but
product and fileset signatures must pass verification in the copied depot.
• If a signed tape depot provided by HP is converted to a directory depot, then the directory
depot metadata signature and bundle signature verification is expected to fail, but product
and fileset signatures must pass verification in the copied depot.
• If a signed directory depot is converted to a tape depot, signature verification is expected to
fail at depot metadata and bundle levels in the tape depot.
• To preserve depot metadata and bundle level signatures in the signed HP-UX directory depots,
a filesystem copy of the depot must be done (with file timestamps retained) instead of using
swcopy.
• SD requires enough free space in the temporary directory (/tmp by default) for performing
signature verification. For a directory depot, free space of approximately 3–5% of the depot
size is required (for example, 300–400 MB for an 8.5 GB OE depot). For tape depots (such
as patch depots, web-releases, etc. provided as .depot files), free space of approximately
103–105% of the size of the tape depot is required.
• Currently, swverify verifies signatures for entire depot irrespective of the
software_selections, when verify_signatures=true or
verify_signatures_only=true.
• Signature verification of a large OE depot on a DVD media might take up to a few hours to
complete.
Using swsign
Syntax
swsign -v -s source_depot [-l level] [-k public_key ] [-n num_threads] [-x
option=value ]
Options and Operands
-v Verifies software signatures in the specified depot.
-s source Specifies the source depot for which signature verification is needed.
-llevel Specifies the level at which software verification must be performed. You
can specify multiple -l levels. The levels include:
depot Verifies depot metadata signatures
bundle Verifies bundle signatures
product Verifies product signatures
fileset Verifies fileset signatures
By default, signatures at all levels are verified. Each level is independent
of the other. For example, if bundle level is specified, then product
signatures are not verified unless -l product is also specified.
-k public_key Uses the path specified by public_key for the public key file to be used
for signature verification. By default, the key located in the depot is used.
96 Managing Software Depots