OgmaProtect v0.5.5

Run all four in the same shell session — each step uses the record read in 1.1. Nothing is copied by hand except the check in 1.2.

1.1 — Read the anchor record into a variable.

rec=$(dig +short TXT security.ogmaconnect.com | tr -d '"' | grep signer=ogmaprotect-05-pkg)
echo "$rec"

You should see one line, the record for your release series:

v=ogmaprotect-anchor1; signer=ogmaprotect-05-pkg; keynum=d1ea448c55bce1d6; key=<base64>; sha256=<hash>

Nothing printed? The lookup failed, or that host is not resolving — fix that before going on, rather than continuing with an empty variable.

1.2 — Compare the keynum against the one published here. This is the one value you check by eye, against this page rather than against the record itself:

d1ea448c55bce1d6

keynum=$(echo "$rec" | sed -n 's/.*keynum=\([^;]*\).*/\1/p')
[ "$keynum" = "d1ea448c55bce1d6" ] && echo "keynum OK" || echo "STOP - keynum does not match the page"

Anything but keynum OK: stop, and tell us.

1.3 — Write the key to disk under exactly that filename, taken straight from the record. This one runs as root: keep the doas if your box has doas(1) configured; on a fresh install with no /etc/doas.conf, run it from a root shell (su) and drop the doas.

key=$(echo "$rec" | sed -n 's/.*key=\([^;]*\).*/\1/p')
printf 'untrusted comment: OgmaProtect 0.5 series package signing key public key\n%s\n' "$key" | doas tee /etc/signify/ogmaprotect-05-pkg.pub > /dev/null

1.4 — Confirm the file matches the record's own hash. This covers the exact bytes of the key file, so a truncated or mangled key is caught here rather than as a puzzling pkg_add refusal later:

hash=$(echo "$rec" | sed -n 's/.*sha256=\([^;]*\).*/\1/p')
[ "$(sha256 -q /etc/signify/ogmaprotect-05-pkg.pub)" = "$hash" ] && echo "key OK" || echo "STOP - key does not match the record"

You want key OK. Then you are done with the key, on this box, for good.

doas sh -c 'cat > /etc/signify/ogmaprotect-05-pkg.pub <<EOF
untrusted comment: OgmaProtect 0.5 series package signing key public key
<the base64 value of key= from the TXT record>
EOF'

signify -C -p /etc/signify/ogmaprotect-05-pkg.pub -x SHA256.sig ogmaprotect-0.5.5.tgz ogmaprotect-0.5.5.tar.gz RELEASE-INFO

You want this — OK on every file line:

Signature Verified
ogmaprotect-0.5.5.tgz: OK
ogmaprotect-0.5.5.tar.gz: OK
RELEASE-INFO: OK

Signature Verified
ogmaprotect-0.5.5.tgz: FAIL

3a — Check it was built for the OpenBSD release this box runs. A package is built against one release; a cross-release install verifies perfectly and then fails on a library mismatch.

grep '^built_for_openbsd:' RELEASE-INFO; uname -r

The two lines must name the same release. If they do not, stop — this package is not for this box.

doas ogmaprotect-setup bootstrap

One command from installed package to working HTTPS login: it starts the 16 daemons in order and provisions the box — TLS certificate, first administrator, firewall, web front end last.

It prints a one-time admin password to the machine console, and nowhere else. Sign in as admin at https://<this-host>/ogmaprotect/ and change it when prompted.

Get started covers what bootstrap does, first login, and doing it by hand instead.

Same steps 1 to 3 — verify the new release exactly as above, since an upgrade is where a substituted artifact would do the most damage. Snapshot your state first, then replace in place:

doas pkg_add -r ./ogmaprotect-0.5.5.tgz

Or by name, from the hosted package repository — pkg_add verifies the signature inside the package itself, and the second path entry is where the dependencies come from:

doas env PKG_PATH="https://ogmaprotect.com/pkg/%c/packages/%a/:installpath" pkg_add -u ogmaprotect

Upgrades are forward-only, so the snapshot of /var/db/ogmaprotect is your only way back — the product's own two-step update takes it for you.

That is the artifact half. The full sequence — stopping the daemons, taking the snapshot correctly, and starting back up — is on the Get started page.