pkg_add ignores TRUSTED_PKG_PATH

[brudan]

I am on OpenBSD 6.4 and have a local mirror of official packages ("openbsd" directory), as well as a local repository of custom packages ("openbsd-bruno" directory).

Here everything works fine:

# export PKG_PATH=https://bruno:MyPassword@mydomain.net/openbsd-bruno/6.4/packages/amd64:https://bruno:MyPassword@mydomain.net/openbsd/6.4/packages/amd64
# pkg_add myscripts

But no luck with this:

# export TRUSTED_PKG_PATH=https://bruno:MyPassword@mydomain.net/openbsd-bruno/6.4/packages/amd64
# export PKG_PATH=https://bruno:MyPassword@mydomain.net/openbsd/6.4/packages/amd64
# pkg_add myscripts
quirks-3.16 signed on 2018-10-12T15:26:25Z
Can't find myscripts

I'd like to make TRUSTED_PKG_PATH work so that I don't have to sign my custom packages. I tried putting quotes and/or trailing forward slash around the url and no luck.

Am I doing something wrong, or did I find a bug (pkg_add ignores TRUSTED_PKG_PATH)?

[jggimi]

According to the pkg_add(1) man page, TRUSTED_PKG_PATH is searched prior to PKG_PATH. If you are certain that TRUST_PKG_PATH is only working for you when PKG_PATH is undefined, then you have uncovered a reportable bug.

www.openbsd.org/report.html

[brudan]

Yes, I've done further testing and am convinced the behavior is unexpected. I will report it as a bug. Thanks for the link, jggimi.

[brudan]

If user wants to use TRUSTED_PKG_PATH (by defining it in either an interactive shell or in a shell configuration file such as ~/.bashrc), don't forget to export it so that pkg_add sees it. (For some reason, PKG_PATH does not need to be exported for pkg_add to see it, but TRUSTED_PKG_PATH does need to be exported.)

I think the main issue I was having with TRUSTED_PKG_PATH has to do with the fact that I use sudo(8). Defining and exporting plain PKG_PATH in ~/.bashrc automatically works with sudo because sudo keeps the value of PKG_PATH in its environment by default. Not so with TRUSTED_PKG_PATH, which needs to be manually appended to the env_keep section of /etc/sudoers so that it looks something like this:

Defaults env_keep +="FTPMODE PKG_CACHE PKG_PATH SM_PATH SSH_AUTH_SOCK TRUSTED_PKG_PATH"

Hope this helps someone. Once I figured out that, unlike PKG_PATH, TRUSTED_PKG_PATH needs to be exported and added to /etc/sudoers, all the "unexpected behavior" went away.