Oracle Solaris 11 Image Packaging System (IPS) Frequently Asked Questions

Hanh Nguyen
Oct 3, 2015
9 min read

Questions and Answers

How do I register my system to obtain Support Repository Updates (SRU)?

https://pkg-register.oracle.com

Please see the details in Document 1021281.1

How do I update my system to a specific Support Repository Update (SRU)?

First, get a list of all the available versions of the “entire” pkg (formatting modified slightly for this document):

$ pkg search entire INDEX ACTION VALUE PACKAGE pkg.fmri set solaris/entire pkg:/entire@0.5.11-0.175.0.1.0.4.0 pkg.fmri set solaris/entire pkg:/entire@0.5.11-0.175.0.2.0.3.0 pkg.fmri set solaris/entire pkg:/entire@0.5.11-0.175.0.3.0.4.0 pkg.fmri set solaris/entire pkg:/entire@0.5.11-0.175.0.4.0.5.0 pkg.fmri set solaris/entire pkg:/entire@0.5.11-0.175.0.4.0.6.0 pkg.summary set entire incorporation including Support Repository Update (Oracle Solaris 11 11/11 SRU 01). For more information see Document 1372094.1 pkg:/entire@0.5.11-0.175.0.1.0.4.0 pkg.summary set entire incorporation including Support Repository Update (Oracle Solaris 11 11/11 SRU 02). For more information see Document 1372094.1 pkg:/entire@0.5.11-0.175.0.2.0.3.0 pkg.summary set entire incorporation including Support Repository Update (Oracle Solaris 11 11/11 SRU 03). For more information see Document 1372094.1 pkg:/entire@0.5.11-0.175.0.3.0.4.0 pkg.summary set entire incorporation including Support Repository Update (Oracle Solaris 11 11/11 SRU 04). For more information see Document 1372094.1 pkg:/entire@0.5.11-0.175.0.4.0.5.0 pkg.summary set entire incorporation including Support Repository Update (Oracle Solaris 11 11/11 SRU 04a). For more information see Document 1372094.1 pkg:/entire@0.5.11-0.175.0.4.0.6.0 $

By default this will return a list of available SRUs equal to or newer than the current system as pkg(1) by default prunes results which are older. You can display all available SRUs by appending the -f flag. Take note of the “pkg:/entire@” field and the numbers after the @. This is the value you will be using to upgrade (<SRU_version> below). You can now upgrade to that specific version using one of two methods:

The long method – this method is good if you like to specify a nice name for for your boot environment in the grub menu using the -d option:

# beadm create -d “BE Description” <New_BE> # beadm mount <new-be> /mnt # pkg -R /mnt install entire@<SRU_version> # bootadm update-archive -R /mnt # beadm unmount <New_BE> # beadm activate <New_BE>

The short single command method:

# pkg update –be-name <New_BE> entire@<SRU_version>

The –be-name argument is an optional argument.

How do I associate a Non-Global Zone Boot Environment (ZBE) to the Global Zone Boot Environment ?

Association of Non-Global Zone Boot Environments (ZBE) to the Global Zone Boot Environment via beadm Document 1993776.1

How to prevent pkg(1) from keeping a large download cache in /var/pkg/download?

You can prevent pkg(1) from keeping a cache of successfully installed pkgs as by telling it to flush the content cache on success. First check what the current property is:

# pkg property PROPERTY VALUE be-policy default ca-path /etc/openssl/certs check-certificate-revocation False display-copyrights True flush-content-cache-on-success False <—– HERE mirror-discovery False preferred-authority solaris publisher-search-order [‘solaris’] pursue-latest True require-optional False send-uuid True signature-policy verify signature-required-names [] trust-anchor-directory etc/certs/CA use-system-repo False #

Change this property to true:

# pkg set-property flush-content-cache-on-success true

The download cache will only be cleared the next time you install a pkg or perform an update. You can manually empty this directory in the mean time.

How to change the current publisher?

You can use the GUI (easy and intuitive) or the CLI:

# pkg set-publisher -G http://<old_publisher>/ -g http://<new_publisher>/ solaris

How to remove a publisher via the CLI?

# pkg unset-publisher <publisher_name>

How can I check which Support Repository Update (SRU) I have currently installed?

You can use “pkg info entire” to get a clear and concise description of the SRU you currently have installed:

$ pkg info entire Name: entire Summary: entire incorporation including Support Repository Update (Oracle Solaris 11 11/11 SRU 04a). For more information see Document 1372094.1 Description: This package constrains system package versions to the same build. WARNING: Proper system update and correct package selection depend on the presence of this incorporation. Removing this package will result in an unsupported system. Category: Meta Packages/Incorporations State: Installed Publisher: solaris Version: 0.5.11 Build Release: 5.11 Branch: 0.175.0.4.0.6.0 Packaging Date: March 2, 2012 04:01:06 PM Size: 5.45 kB FMRI: pkg://solaris/entire@0.5.11,5.11-0.175.0.4.0.6.0:20120302T160106Z $

Or you can use “pkg list entire” for a short output that doesn’t explicitly state the SRU, but you can determine it from the version string returned in conjunction with Document 1378134.1. A full list of SRU to version strings can be found here: Oracle Solaris 11 Support Repository Updates (SRU) Index (Doc ID 1372094.1) Oracle Solaris 11.1 Support Repository Updates (SRU) Index (Doc ID 1501435.1)

How do I install pkgs into an alternate root?

# pkg -R /path/to/alt/root install <pkg>

But do NOT do this with zones. It may work, but it is better to do install the pkg from within the zone itself:

# zlogin <zone> pkg install <pkg>

How do I configure proxy access to pkg.oracle.com?

In the global zone, you need to set the http_proxy environment variable in the shell in which you are running the pkg(1) commands:

# export http_proxy=http://<proxy_server>:<proxy_port> # export https_proxy=https://<proxy_server>:<proxy_port>

For non-global zones, you need to configure the system-repository svc as follows:

# svccfg -s svc:/application/pkg/system-repository:default setprop config/http_proxy=astring: “http://<proxy_server>:<proxy_port>” # svcadm refresh svc:/application/pkg/system-repository:default # svcadm restart svc:/application/pkg/system-repository:default

If your proxy server requires a username and password, you need to set your environment variables as follows:

# export http_proxy=http://<username>:<password>@<proxy_server>:<proxy_port> # export https_proxy=https://<username>:<password>@<proxy_server>:<proxy_port>

The corresponding system-repository command is as follows:

# svccfg -s svc:/application/pkg/system-repository:default setprop config/http_proxy=astring: “http://<username>:<password>@<proxy_server>:<proxy_port>” # svcadm refresh svc:/application/pkg/system-repository:default # svcadm restart svc:/application/pkg/system-repository:default

Starting with Solaris 11.1 you can also set the proxy in the global zone via pkg(1) command.

# pkg unset-publisher solaris # pkg set-publisher –proxy http://proxy:80 -g http://pkg.oracle.com/solaris/release/ solaris

# pkg publisher PUBLISHER TYPE STATUS P LOCATION solaris origin online T http://pkg.oracle.com/solaris/release/

The T in the P column means this origin has a proxy.

# pkg publisher -F tsv PUBLISHER STICKY SYSPUB ENABLED TYPE STATUS URI PROXY solaris true false true origin online http://pkg.oracle.com/solaris/release/ http://proxy:80

How do I check if a bug is fixed on Solaris 11?

$ pkg search -f ‘:set:com.oracle.service.bugid:7146824’ INDEX ACTION VALUE PACKAGE com.oracle.service.bugid set 7146824 pkg:/library/security/openssl@1.0.0.7-0.175.0.5.0.3.0 $

How do I list all the available package groups?

$ pkg info -r *group*

How do I find which Package Delivers a Specific File?

$ pkg search -l -H -o pkg.name /lib/libpower.so.1 system/kernel/power

How do I list the contents of a package group?

There are two ways:

$ pkg contents -r -m group/system/<GROUP>

$ pkg contents -o fmri -r -t depend <GROUP>

How do I determine which group is installed on my system?

$ pkg list group/system/*

How do I list the packages contained in a group ?

$ pkg list -as `pkg contents -r -H -o fmri -t depend -a type=group solaris-large-server`

http://docs.oracle.com/cd/E26502_01/html/E36136/gmkgl.html#scrolltoc Oracle Solaris 11.1 Package Lists Oracle Solaris 11.1 Information Library

Relaxing Version Constraints Specified by Incorporations

http://docs.oracle.com/cd/E26502_01/html/E28984/gmias.html

How do I create a local copy of a remote repository?

Full details on configuring a local repository, including creating a copy of a remote repository can be found in the Copying and Creating Oracle Solaris 11 Package Repositories documentation.

How do I update a local repository with only the changes from a remote repository?

You update a repository in the same way as you do to create it by using the pkgrecv(1M) command:

# pkgrecv -s http://source-repo

This will download only the new packages and changes. It will not download the entire repository again. Further details on updating your local repository can be found in the Copying and Creating Oracle Solaris 11 Package Repositories documentation.

How do I list the changes that would apply to my local repository during an update without actually updating my local repository?

You can use the -n argument to pkgrecv(1M):

# pkgrecv -s http://source-repo -n

How do I install a Support Repository Update (SRU) Image?

The best source for details on how to install a Support Repository Update (SRU) will be provided in the SRU’s README file, for example SRU 8.5’s README.

How do I locate the pkg that delivers a particular file?

You can determine the pkg that delivers a file using the following command:

$ pkg contents -o pkg.name,path -a path=’path/to/file’ // examples $ pkg contents -o pkg.name,path -a path=”*/binding” PKG.NAME PATH system/network/nis var/yp/binding $ pkg contents -o pkg.name,path -a path=”boot/solaris/bin/create_ramdisk” PKG.NAME PATH system/kernel boot/solaris/bin/create_ramdisk

Do not include the initial forward slash (/) in the path. The pkg contents you are searching record relative path names not absolute path names.

How do I list pkg dependencies?

You can determine the pkgs that a certain pkg depends on using the following command:

$ pkg contents -o fmri -H -r -t depend <pkg/uri/>

How to Update Your Local System From a Support Repository Update (SRU) ISO Image

The procedure is documented in the README file that comes with the SRU ISO image. This is the example from the SRU 9.5 README:

Mount the ISO image as a filesystem

# mount -F hsfs full_path_to/sol-11-1111-sruN-bldnum-incr-repo.iso /mnt

Add an additional origin to the existing solaris publisher

# pkg set-publisher -g file:///mnt/repo solaris

Perform the update of the packages

# pkg update

How to Update an Oracle Solaris 11 Package Repository

The procedure is documented in the README file that comes with the SRU ISO image. This is the example from the SRU 9.5 README:

Mount the ISO image as a filesystem

# mount -F hsfs full_path_to/sol-11-1111-sruN-bldnum-incr-repo.iso /mnt

Import the SRU packages to your existing Solaris 11 repository

# pkgrecv -s /mnt/repo -d full_path_to_existing_s11_repo ‘*’

For example:

# pkgrecv -s /mnt/repo -d file:///export/s11repo ‘*’

Rebuild the search indexes for the repository

# pkgrepo rebuild -s full_path_to_existing_s11_repo

If the repository is managed by pkgserv, restart the appropriate service:

# svcadm restart svc:/application/pkg/server:your_repo_instance

How do I set the default version of pkgs that allow multiple versions to be installed, like Java?

Solaris 11 uses the “mediator” option within pkgs that offer multiple versions that allow you to set the default version. You can use the “pkg mediator” command to view the current settings…

# pkg mediator MEDIATOR VER. SRC. VERSION IMPL. SRC. IMPLEMENTATION automake system 1.11 system java system 1.7 system php system 5.2 system python vendor 2.6 vendor

If “local” occurs in the “VER. SRC.” column, it indicates the default version has already been changed. Use “pkg mediator -a” to display all options available on your system…

# pkg mediator -a MEDIATOR VER. SRC. VERSION IMPL. SRC. IMPLEMENTATION java system 1.7 system java system 1.6 system php system 5.2 system python vendor 2.6 vendor

This will only show all the versions for the software installed on your system. You can set the mediator to be the desired version using “pkg set-mediator”

# pkg set-mediator -V 1.6 java Packages to update: 3 Mediators to change: 1 Create boot environment: No Create backup boot environment: No PHASE ITEMS Removing old actions 2/2 Updating modified actions 3/3 Updating image state Done Creating fast lookup database Done Reading search index Done Updating search index 3/3

Note: there is a problem with signed pkgs, like the Java pkgs: 7156990 setting a mediator with signed packages containing variants doesn’t work Workaround from bug report: In the global zone, turning off signature checking solves the issue: # pkg set-property signature-policy ignore # pkg set-publisher –set-property signature-policy=ignore solaris In a zone, these approaches don’t work. The workaround is to uninstall the package providing the unused mediated links or to reconfigure the links manually. This bug will be fixed in Solaris 11 update 1.

How do I list all setuid and setgid programs?

$ pkg contents -a mode=4??? -a mode=2??? -t file -o pkg.name,path,mode

You can limit the output to a specific pkg by appending the pkg name to the end of the above command.

How do I search for a SHA1 hash of a file in IPS (fingerprint)

# digest -a sha1 /usr/bin/su 855f2256abb440b0e37810e464783ae6cc304ab0 # pkg search -f 855f2256abb440b0e37810e464783ae6cc304ab0 INDEX ACTION VALUE PACKAGE 855f2256abb440b0e37810e464783ae6cc304ab0 file usr/bin/su pkg:/system/core-os@0.5.11-0.175.2.4.0.4.2 hash file usr/bin/su pkg:/system/core-os@0.5.11-0.175.2.4.0.4.2

Please see more examples at: https://blogs.oracle.com/cmt/entry/solaris_fingerprint_database_how_it

How To tune parallel connections to the depot server when performing network operations?

according to the Solaris 11 documentation -> Copying and Creating Package Repositories in Oracle® Solaris 11.2 The pkg(5) client opens 20 parallel connections to the depot server when performing network operations. Make sure the number of depot threads matches the expected connections to the server at any given time. Use the following commands to set the number of threads per depot:

$ svccfg -s pkg/server:repo setprop pkg/threads = 200 $ svcadm refresh pkg/server:repo $ svcadm restart pkg/server:repo

What are the Environment variables and timeout values ?

pkg(1) User Commands pkg(1) NAME pkg – Image Packaging System retrieval client

ENVIRONMENT VARIABLES PKG_IMAGE

The directory containing the image to use for package operations. Ignored if -R is specified.

PKG_CLIENT_CONNECT_TIMEOUT

Seconds to wait trying to connect during transport operations (for each attempt) before the client aborts the operation. A value of 0 means wait indefinitely.

Default value: 60

PKG_CLIENT_LOWSPEED_TIMEOUT

Seconds below the lowspeed limit (1024 bytes/second) during trans- port operations before the client aborts the operation. A value of 0 means do not abort the operation.

Default value: 30

PKG_CLIENT_MAX_CONSECUTIVE_ERROR

Maximum number of transient transport errors before the client aborts the operation. A value of 0 means do not abort the opera- tion.

Default value: 4

PKG_CLIENT_MAX_REDIRECT

Maximum number of HTTP or HTTPS redirects allowed during transport operations before a connection is aborted. A value of 0 means do not abort the operation.

Default value: 5

PKG_CONCURRENCY

The number of child images to update in parallel. Ignored if the -C option is specified.

When recursing into child images (usually installed solaris branded non-global zones), update at most $PKG_CONCURRENCY child images in parallel. If $PKG_CONCURRENCY is 0 or a negative number, all child images are updated in parallel.

Default value: 1

PKG_CLIENT_MAX_TIMEOUT

Maximum number of transport attempts per host before the client aborts the operation. A value of 0 means do not abort the opera- tion.