5188 SVR4 packaging shouldn't depend on openssl or libwanboot

Reviewed by: Igor Kozhukhov <igor@dilos.org>
Reviewed by: Alexander Eremin <alexander.r.eremin@gmail.com>
Approved by: Gordon Ross <gordon.w.ross@gmail.com>

2 files changed, 15 insertions, 549 deletions

diff --git a/usr/src/man/man1m/pkgadd.1m b/usr/src/man/man1m/pkgadd.1m
index 29a7d3ae08..65120ba7d5 100644
--- a/usr/src/man/man1m/pkgadd.1m
+++ b/usr/src/man/man1m/pkgadd.1m
@@ -1,18 +1,18 @@
 '\" te
+.\" Copyright (c) 2017 Peter Tribble.
 .\" Copyright (c) 2007, Sun Microsystems, Inc. All Rights Reserved
 .\" Copyright 1989 AT&T
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH PKGADD 1M "April 9, 2016"
+.TH PKGADD 1M "Mar 2, 2017"
 .SH NAME
 pkgadd \- transfer software packages to the system
 .SH SYNOPSIS
 .LP
 .nf
-\fBpkgadd\fR [\fB-nv\fR] [\fB-a\fR \fIadmin\fR] [\fB-G\fR] [\fB-x\fR \fIproxy\fR]
-     [ [\fB-M\fR] \fB-R\fR \fIroot_path\fR] [\fB-r\fR \fIresponse\fR] [\fB-k\fR \fIkeystore\fR]
-     [\fB-P\fR \fIpasswd\fR] [\fB-V\fR \fIfs_file\fR]
+\fBpkgadd\fR [\fB-nv\fR] [\fB-a\fR \fIadmin\fR] [\fB-G\fR] [ [\fB-M\fR] \fB-R\fR \fIroot_path\fR]
+     [\fB-r\fR \fIresponse\fR] [\fB-V\fR \fIfs_file\fR]
      [\fB-d\fR \fIdevice\fR | \fB-d\fR \fIdatastream\fR \fIpkginst\fR | all]
      [\fIpkginst\fR | \fB-Y\fR \fIcategory\fR [\fI, category\fR]...]
 .fi
@@ -120,19 +120,6 @@ for a package, \fBSUNW_PKG_ALLZONES\fR is set to true. See \fBpkginfo\fR(4).
 .sp
 .ne 2
 .na
-\fB\fB-k\fR \fIkeystore\fR\fR
-.ad
-.sp .6
-.RS 4n
-Use \fIkeystore\fR as the location from which to get trusted certificate
-authority certificates when verifying digital signatures found in packages. If
-no keystore is specified, then the default keystore locations are searched for
-valid trusted certificates. See \fBKEYSTORE LOCATIONS\fR for more information.
-.RE
-
-.sp
-.ne 2
-.na
 \fB\fB-M\fR\fR
 .ad
 .sp .6
@@ -157,18 +144,6 @@ installed files. The default mode is interactive.
 .sp
 .ne 2
 .na
-\fB\fB-P\fR \fIpasswd\fR\fR
-.ad
-.sp .6
-.RS 4n
-Password to use to decrypt keystore specified with \fB-k\fR, if required. See
-\fBPASS PHRASE ARGUMENTS\fR for more information about the format of this
-option's argument.
-.RE
-
-.sp
-.ne 2
-.na
 \fB\fB\fR\fB-r\fR \fIresponse\fR\fR
 .ad
 .sp .6
@@ -237,20 +212,6 @@ file is non-existent or unreliable.
 .RE
 
 .sp
-.ne 2
-.na
-\fB\fB-x\fR \fIproxy\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specify a HTTP[S] proxy to use when downloading packages The format of proxy is
-\fIhost\fR:\fIport\fR, where \fIhost\fR is the hostname of the HTTP[S] proxy,
-and \fIport\fR is the port number associated with the proxy. This switch
-overrides all other methods of specifying a proxy. See ENVIRONMENT VARIABLES
-for more information on alternate methods of specifying a default proxy.
-.RE
-
-.sp
 .LP
 When executed without options or operands, \fBpkgadd\fR uses
 \fB/var/spool/pkg\fR (the default spool directory).
@@ -295,13 +256,6 @@ A device alias (for example, \fB/floppy/floppy0\fR).
 .el o
 A datastream created by \fBpkgtrans\fR (see \fBpkgtrans\fR(1)).
 .RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-A URL pointing to a datastream created by \fBpkgtrans\fR. The supported
-Universal Resource Identifiers (URIs) are \fBhttp:\fR and \fBhttps:\fR.
-.RE
 The second form of the \fB-d\fR specifier, above, indicates the syntax you use
 when specifying a datastream. In this case you must specify either a
 comma-separated list of package names or the keyword \fBall\fR.
@@ -342,135 +296,6 @@ the package's \fBpkginfo\fR(4) file. All packages on the source medium whose
 installation or spooling.
 .RE
 
-.SH KEYSTORE LOCATIONS
-.LP
-Package and tools such as \fBpkgadd\fR use a set of trusted certificates to
-perform signature validation on any signatures found within the packages. If
-there are no signatures included in the packages then signature validation is
-skipped. The certificates can come from a variety of locations. If \fB-k\fR
-\fIkeystore\fR is specified, and \fIkeystore\fR is a directory, then
-\fIkeystore\fR is assumed to be the base directory of the certificates to be
-used. If \fIkeystore\fR is a file, then the file itself is assumed to have all
-required keys and certificates. When \fB-k\fR is not specified, then
-\fB/var/sadm/security\fR is used as the base directory.
-.sp
-.LP
-Within the specified base directory, the store locations to be searched are
-different based on the application doing the searching and the type of store
-being searched for. The following directories are searched in the specified
-order:
-.RS +4
-.TP
-1.
-\fI<store_dir>\fR/\fI<app_name>\fR/\fI<store_type>\fR
-.RE
-.RS +4
-.TP
-2.
-\fI<store_dir>\fR/\fI<store_type>\fR
-.RE
-.sp
-.LP
-Where \fI<store_dir>\fR is the directory specified by \fB-k\fR,
-\fI<app_name>\fR is the name of the application doing the searching, and
-\fI<store_type>\fR is one of \fBkeystore\fR (for private keys), \fBcertstore\fR
-(for untrusted public key certificates), or \fBtruststore\fR (for trusted
-certificate authority certificates).
-.sp
-.LP
-For example, when \fBpkgadd\fR is run with \fB-k\fR \fB/export/certs\fR, then
-the following locations are successively searched to find the trust store:
-.RS +4
-.TP
-1.
-/export/certs/pkgadd/truststore
-.RE
-.RS +4
-.TP
-2.
-/export/certs/truststore
-.RE
-.sp
-.LP
-This searching order enables administrators to have a single location for most
-applications, and special certificate locations for certain applications.
-.SH KEYSTORE AND CERTIFICATE FORMATS
-.LP
-The packaging utilities, such as \fBpkgtrans\fR, require access to a set of
-keys and certificates in order to sign, and optionally verify, packages.
-.sp
-.LP
-The keystore files found by following the search pattern specified in
-\fBKEYSTORE LOCATIONS\fR must each be a self-contained PKCS#12-format file.
-.sp
-.LP
-When signing a package with \fBpkgtrans\fR, if a \fBcertstore\fR has more than
-one public key certificate, then each public key must have a \fBfriendlyName\fR
-attribute in order to be identifiable and selectable with the \fB-a\fR option
-when signing packages. In addition, the public key certificate selected with
-\fB-a\fR and found in the \fBcertstore\fR must have an associated private key
-in the keystore.
-.sp
-.LP
-Several browsers and utilities can be used to export and import certificates
-and keys into a PKCS#12 keystore. For example, a trusted certificate can be
-exported from Mozilla, and then imported into a PKCS#12 keystore for use with
-\fBpkgadd\fR with the OpenSSL Toolkit.
-.SH PASS PHRASE ARGUMENTS
-.LP
-\fBpkgtrans\fR and \fBpkgadd\fR accept password arguments, typically using
-\fB-p\fR to specify the password. These allow the password to be obtained from
-a variety of sources. Both of these options take a single argument whose format
-is described below. If no password argument is given and a password is required
-then the user is prompted to enter one: this will typically be read from the
-current terminal with echoing turned off.
-.sp
-.ne 2
-.na
-\fB\fBpass:\fIpassword\fR\fR\fR
-.ad
-.sp .6
-.RS 4n
-The actual password is \fIpassword\fR. Because the password is visible to
-utilities such as \fBps\fR this form should only be used where security is not
-important.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBenv:\fIvar\fR\fR\fR
-.ad
-.sp .6
-.RS 4n
-Obtain the password from the environment variable \fIvar\fR. Because the
-environment of other processes is visible on certain platforms this option
-should be used with caution.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBfile:\fIpathname\fR\fR\fR
-.ad
-.sp .6
-.RS 4n
-The first line contained within \fIpathname\fR is the password. \fIpathname\fR
-need not refer to a regular file: it could, for example, refer to a device or
-named pipe. For example, to read the password from standard input, use
-\fBfile:/dev/stdin\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBconsole\fR\fR
-.ad
-.sp .6
-.RS 4n
-Read the password from \fB/dev/tty\fR.
-.RE
-
 .SH EXAMPLES
 .LP
 \fBExample 1 \fRInstalling a Package from a Solaris DVD
@@ -588,39 +413,6 @@ Reboot after installation of all packages.
 Reboot after installation of this package.
 .RE
 
-.SH ENVIRONMENT VARIABLES
-.ne 2
-.na
-\fB\fBHTTPPROXY\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies an HTTP proxy host. Overrides administration file setting, and
-\fBhttp_proxy\fR environment variable.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBHTTPPROXYPORT\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies the port to use when contacting the host specified by
-\fBHTTPPROXY\fR. Ignored if \fBHTTPPROXY\fR is not set.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBhttp_proxy\fR\fR
-.ad
-.sp .6
-.RS 4n
-URL format for specifying proxy host and port. Overrides administration file
-setting.
-.RE
-
 .SH FILES
 .ne 2
 .na
@@ -652,12 +444,7 @@ Interface Stability	Evolving
 \fBpkgtrans\fR(1), \fBinstallf\fR(1M), \fBpkgadm\fR(1M), \fBpkgask\fR(1M),
 \fBpkgchk\fR(1M), \fBpkgrm\fR(1M), \fBremovef\fR(1M), \fBadmin\fR(4),
 \fBpkginfo\fR(4), \fBattributes\fR(5), \fBlargefile\fR(5), \fBzones\fR(5)
-.sp
-.LP
-\fI\fR
-.sp
-.LP
-\fBhttp://www.openssl.org\fR
+
 .SH NOTES
 .LP
 When transferring a package to a spool directory, the \fB-r\fR, \fB-n\fR, and
@@ -681,9 +468,3 @@ needed to complete it.
 If the default \fIadmin\fR file is too restrictive, the administration file may
 need to be modified to allow for total non-interaction during a package
 installation. See \fBadmin\fR(4) for details.
-.sp
-.LP
-If a package stream is specified with \fB-d\fR, and a digital signature is
-found in that stream, the default behavior is to attempt to validate the
-certificate and signature found. This behavior can be overridden with
-\fBadmin\fR file settings. See \fBadmin\fR(4) for more information.
diff --git a/usr/src/man/man1m/pkgadm.1m b/usr/src/man/man1m/pkgadm.1m
index 9f7a3d020d..2a5180eb5e 100644
--- a/usr/src/man/man1m/pkgadm.1m
+++ b/usr/src/man/man1m/pkgadm.1m
@@ -1,33 +1,15 @@
 '\" te
+.\" Copyright (c) 2017 Peter Tribble.
 .\" Copyright (c) 2003, Sun Microsystems, Inc. All Rights Reserved
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
 .\"  See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with
 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH PKGADM 1M "Mar 20, 2009"
+.TH PKGADM 1M "Mar 2, 2017"
 .SH NAME
-pkgadm \- manage packaging and patching system
+pkgadm \- manage packaging system
 .SH SYNOPSIS
 .LP
 .nf
-\fBpkgadm addcert\fR [\fB-ty\fR] [\fB-a\fR \fIapp\fR] [\fB-k\fR \fIkeystore\fR] [\fB-e\fR \fIkeyfile\fR]
-     [\fB-f\fR \fIformat\fR] [\fB-n\fR \fIname\fR] [\fB-P\fR \fIpassarg\fR]
-     [\fB-p\fR \fIimport_passarg\fR] [\fB-R\fR \fIrootpath\fR] certfile
-.fi
-
-.LP
-.nf
-\fBpkgadm removecert\fR [\fB-a\fR \fIapp\fR] [\fB-k\fR \fIkeystore\fR] \fB-n\fR \fIname\fR
-     [\fB-P\fR \fIpassarg\fR] [\fB-R\fR \fIrootpath\fR]
-.fi
-
-.LP
-.nf
-\fBpkgadm listcert\fR [\fB-a\fR \fIapp\fR] [\fB-f\fR \fIformat\fR] [\fB-k\fR \fIkeystore\fR] \fB-n\fR \fIname\fR
-     [\fB-P\fR \fIpassarg\fR] [\fB-o\fR \fIoutfile\fR] [\fB-R\fR \fIrootpath\fR]
-.fi
-
-.LP
-.nf
 \fBpkgadm dbstatus\fR [\fB-R\fR \fIrootpath\fR]
 .fi
 
@@ -47,55 +29,10 @@ pkgadm \- manage packaging and patching system
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
-The \fBpkgadm\fR utility is used for managing the packaging and patching
+The \fBpkgadm\fR utility is used for managing the packaging
 system. It has several subcommands that perform various operations relating to
-packaging. The \fBpkgadm\fR command includes subcommands for managing
-certificates and keys used.
-.SS "Managing Keys and Certificates"
-.sp
-.LP
-\fBpkgadm\fR maintains the packaging-system-wide keystore in
-\fB/var/sadm/security\fR, and individual user's certificates in
-\fB~/.pkg/security\fR. The following subcommands operate on the package
-keystore database:
-.sp
-.ne 2
-.na
-\fB\fBaddcert\fR\fR
-.ad
-.sp .6
-.RS 4n
-Add (import) a certificate into the database, with optional trust. Once added,
-trusted certificates can be used to verify signed packages and patches.
-Non-trusted user certificates and their associated keys can be used to sign
-packages and patches. Added user certificates are \fBnot\fR used to build
-certificate chains during certificate verification.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBremovecert\fR\fR
-.ad
-.sp .6
-.RS 4n
-Removes a user certificate/private key pair, or a trusted certificate authority
-certificate from the keystore. Once removed, the certificate and keys cannot be
-used.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBlistcert\fR\fR
-.ad
-.sp .6
-.RS 4n
-Print details of one or more certificates in the keystore.
-.RE
-
+packaging.
 .sp
 .ne 2
 .na
@@ -108,7 +45,6 @@ Writes the contents file and rolls the contents log file. With use of the
 .RE
 
 .SS "Internal Install Database"
-.sp
 .LP
 The Solaris operating system relies upon enhanced System V revision 4 (SVr4)
 packages as the basis for its software installation and revision management.
@@ -118,161 +54,14 @@ determine how the package internal database is implemented. The \fBdbstatus\fR
 command returns a string that indicates the type of internal database in use.
 In the current implementation, the \fBdbstatus\fR command always returns the
 string \fBtext\fR, which indicates that the \fBcontents\fR(4) package database
-is inuse. Future releases of Solaris might supply alternative database
+is in use. Future releases of Solaris might supply alternative database
 implementations.
 .SH OPTIONS
-.sp
 .LP
 The following options are supported:
 .sp
 .ne 2
 .na
-\fB\fB-a\fR \fIapp\fR\fR
-.ad
-.sp .6
-.RS 4n
-If this option is used, then the command only affects the keystore associated
-with a particular application. Otherwise, the global keystore is affected.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-e\fR \fIkeyfile\fR\fR
-.ad
-.sp .6
-.RS 4n
-When adding a non-trusted certificate/key combination, this option can be used
-to specify the file that contains the private key. If this option is not used,
-the private key must be in the same file as the certificate being added.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-f\fR \fIformat\fR\fR
-.ad
-.sp .6
-.RS 4n
-When adding certificates, this specifies the format to expect certificates and
-private keys in. Possible values when adding are:
-.sp
-.ne 2
-.na
-\fB\fBpem\fR\fR
-.ad
-.sp .6
-.RS 4n
-Certificate and any private key uses PEM encoding.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBder\fR\fR
-.ad
-.sp .6
-.RS 4n
-Certificate and any private key uses DER encoding.
-.RE
-
-When printing certificates, this specifies the output format used when
-printing. Acceptable values for format are:
-.sp
-.ne 2
-.na
-\fB\fBpem\fR\fR
-.ad
-.sp .6
-.RS 4n
-Output each certificate using PEM encoding.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBder\fR\fR
-.ad
-.sp .6
-.RS 4n
-Output each certificate using DER encoding.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBtext\fR\fR
-.ad
-.sp .6
-.RS 4n
-Output each certificate in human-readable format.
-.RE
-
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-k\fR \fIkeystore\fR\fR
-.ad
-.sp .6
-.RS 4n
-Overrides the default location used when accessing the keystore.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-n\fR \fIname\fR\fR
-.ad
-.sp .6
-.RS 4n
-Identifies the entity in the store on which you want to operate. When adding a
-user certificate, or removing certificates, this name is required. The name is
-associated with the certificate/key combination, and when adding, can be used
-later to reference the entity. When printing certificates, if no alias is
-supplied, then all keystore entities are printed.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-o\fR \fIoutfile\fR\fR
-.ad
-.sp .6
-.RS 4n
-Output the result of the command to \fIoutfile\fR. Only used when examining
-(printing) certificates from the key store. Standard out is the default.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-P\fR \fIpassarg\fR\fR
-.ad
-.sp .6
-.RS 4n
-Password retrieval method to use to decrypt keystore specified with \fB-k\fR,
-if required. See \fBPASS PHRASE ARGUMENTS\fR in \fBpkgadd\fR(1M) for more
-information about the format of this option's argument. \fBconsole\fR is the
-default.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-p\fR \fIimport_passarg\fR\fR
-.ad
-.sp .6
-.RS 4n
-This option's argument is identical to \fB-P\fR, but is used for supplying the
-password used to decrypt the certificate and/or private key being added.
-\fBconsole\fR is the default.
-.RE
-
-.sp
-.ne 2
-.na
 \fB\fB-q\fR\fR
 .ad
 .sp .6
@@ -287,13 +76,7 @@ password used to decrypt the certificate and/or private key being added.
 .ad
 .sp .6
 .RS 4n
-Defines the full name of a directory to use as the root (\fB/\fR) path. The
-default user location of the certificate operations is \fB${HOME}/.pkg\fR. If
-the \fB-R\fR option is supplied, the certificates and keys will be stored under
-\fB\fI<altroot>\fR/var/sadm/security\fR. Note that this operation fails if the
-user does not have sufficient permissions to access this directory. The
-\fBlistcert\fR command requires read permission, while \fBaddcert\fR and
-\fBremovecert\fR require both read and write permission.
+Defines the full name of a directory to use as the root (\fB/\fR) path.
 .LP
 Note -
 .sp
@@ -308,22 +91,6 @@ zone's file system. See \fBzones\fR(5).
 .sp
 .ne 2
 .na
-\fB\fB-t\fR\fR
-.ad
-.sp .6
-.RS 4n
-Indicates the certificate being added is a trusted CA certificate. The details
-of the certificate (including the Subject Name, Validity Dates, and
-Fingerprints) are printed and the user is asked to verify the data. This
-verification step can be skipped with \fB-y\fR. When importing a trusted
-certificate, a private key should not be supplied, and will be rejected if
-supplied. Once a certificate is trusted, it can be used as a trust anchor when
-verifying future untrusted certificates.
-.RE
-
-.sp
-.ne 2
-.na
 \fB\fB-V\fR\fR
 .ad
 .sp .6
@@ -334,19 +101,6 @@ Print version associated with packaging tools.
 .sp
 .ne 2
 .na
-\fB\fB-y\fR\fR
-.ad
-.sp .6
-.RS 4n
-When adding a trusted certificate, the details of the certificate (Subject
-name, Issuer name, Validity dates, Fingerprints) are shown to the user and the
-user is asked to verify the correctness before proceeding. With \fB-y\fR, this
-additional verification step is skipped.
-.RE
-
-.sp
-.ne 2
-.na
 \fB\fB-?\fR\fR
 .ad
 .sp .6
@@ -354,88 +108,22 @@ additional verification step is skipped.
 Print help message.
 .RE
 
-.SH OPERANDS
-.sp
-.LP
-The following operand is supported:
-.sp
-.ne 2
-.na
-\fB\fBcertfile\fR\fR
-.ad
-.sp .6
-.RS 4n
-File containing the certificate and optional private key, used when adding a
-trust anchor or certificate/key combination. Certificates must be encoded using
-PEM or binary DER.
-.RE
-
-.SH KEYSTORE ALIASES
-.sp
-.LP
-All keystore entries (user cert/key and trusted certificate entries) are
-accessed via unique aliases. Aliases are case-sensitive.
-.sp
-.LP
-An alias is specified when you add an entity to a keystore using the
-\fBaddcert\fR or \fBtrustcert\fR subcommand. If an alias is not supplied for a
-trust anchor, the trust anchor's Common Name is used as the alias. An alias is
-required when adding a signing certificate or chain certificate. Subsequent
-\fBpkgcert\fR or other package tool commands must use this same alias to refer
-to the entity.
-.SH KEYSTORE PASSWORDS
-.sp
-.LP
-See the \fBpkgadd\fR(1M) man page for a description of the passwords supplied
-to the \fBpkgadm\fR utility.
 .SH EXAMPLES
 .LP
-\fBExample 1 \fRAdding a Trust Anchor
-.sp
-.LP
-The following example adds a well-known and trusted certificate to be used when
-verifying signatures on packages.
-
-.sp
-.in +2
-.nf
-example% pkgadm addcert -t /tmp/certfile.pem
-.fi
-.in -2
-.sp
-
-.LP
-\fBExample 2 \fRAdding a Signing Certificate
+\fBExample 1 \fRSynchronizing the contents file
 .sp
 .LP
-The following example adds a signing certificate and associated private key,
-each of which is in a separate file, which can then be used to sign packages.
+The following example forces any pending changes to the contents(4) file to be flushed and the pkgserv daemon to shut down.
 
 .sp
 .in +2
 .nf
-example% pkgadm addcert -a pkgtrans -e /tmp/keyfile.pem \e
-/tmp/certfile.pem
-.fi
-.in -2
-.sp
-
-.LP
-\fBExample 3 \fRPrinting Certificates
-.sp
-.LP
-The following example prints all certificates in the root keystore.
-
-.sp
-.in +2
-.nf
-example% pkgadm listcert
+example% pkgadm sync -q
 .fi
 .in -2
 .sp
 
 .SH EXIT STATUS
-.sp
 .ne 2
 .na
 \fB\fB0\fR\fR
@@ -456,7 +144,6 @@ fatal error
 .RE
 
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -472,7 +159,6 @@ Interface Stability	Evolving
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBpkginfo\fR(1), \fBpkgmk\fR(1), \fBpkgparam\fR(1), \fBpkgproto\fR(1),
 \fBpkgtrans\fR(1), \fBsvcs\fR(1), \fBinstallf\fR(1M), \fBpkgadd\fR(1M),
@@ -483,7 +169,6 @@ Interface Stability	Evolving
 .LP
 \fI\fR
 .SH NOTES
-.sp
 .LP
 The service for \fBpkgadm\fR is managed by the service management facility,
 \fBsmf\fR(5), under the service identifier: