FreeBSD 13 – pkg repository signature verification failed – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

pkg update fails with signature verification errors and package operations stop. Security and bug-fix rollouts are delayed until trust configuration is corrected.

Environment & Reproduction

Often seen after mirror or repository definition changes.

pkg -vv
pkg update -f
ls -la /usr/local/etc/pkg/repos

Root Cause Analysis

Repository metadata cannot be validated because trusted fingerprints or repository definitions are missing, stale, or inconsistent with enabled mirrors.

Quick Triage

Verify DNS, mirror reachability, and repository configuration quickly.

fetch -o - https://pkg.FreeBSD.org
cat /etc/resolv.conf
service netif status

Step-by-Step Diagnosis

Inspect pkg debug output and repo files to identify failing trust checks.

pkg -d update
grep -R "signature|fingerprints" /usr/local/etc/pkg/repos /etc/pkg
ls -la /usr/share/keys/pkg

Solution – Primary Fix

Restore correct repository definitions and trusted keys, then refresh metadata.

cp -a /usr/local/etc/pkg/repos /usr/local/etc/pkg/repos.bak
pkg bootstrap -f
pkg update -f
pkg upgrade -y

Solution – Alternative Approaches

Use a vetted internal mirror with managed trust or temporarily switch to official quarterly repository for stabilization.

Verification & Acceptance Criteria

Repository metadata refreshes successfully and package transactions complete.

pkg update
pkg audit -F
pkg check -da

Rollback Plan

Restore previous repository files if unexpected package source changes appear.

rm -rf /usr/local/etc/pkg/repos
mv /usr/local/etc/pkg/repos.bak /usr/local/etc/pkg/repos
pkg update -f

Prevention & Hardening

Manage repository configs with configuration management and monitor signature failures in periodic checks.

Related Errors & Cross-Refs

Related to ABI mismatch errors, locked pkg database issues, and mirror timeout failures.

Related tutorial: View the step-by-step tutorial for freebsd-13.

View all freebsd-13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD Handbook and pkg.conf repository trust documentation.