FreeBSD pkg

libder is a lightweight library designed for encoding and decoding DER-encoded objects. Its primary use case is decoding and encoding ECC keys to ensure interoperability with OpenSSL.

Key characteristics:

• BER Compatibility: It is capable of decoding any BER-encoded buffer.
• Normalization: When re-encoding a decoded tree, libder applies DER normalization rules.
• Opaque Data Handling: For complex data types, libder expects the consumer to provide a type/payload/size triple, treating the payload as relatively opaque while still applying encoding normalization.
• Validation Model: The library does not perform strict validation of input. For example, a boolean might occupy multiple bytes in the input; libder will present it as-is, but will normalize it to 0xff or 0x00 upon re-encoding based on whether any bits are set.

libucl is a C library for parsing configurations written in the Universal Configuration Language (UCL). It is designed to be a more convenient and powerful alternative to JSON, heavily inspired by the nginx configuration syntax.

In addition to UCL, the library provides functions to read, write, and format other data formats:

• JSON: Read, write, and pretty format.
• Messagepack: Read and write.
• S-Expressions: Read-only (canonical form).
• Yaml: Limited write support (primarily for compatibility).

The pkg command-line tool is built on top of libpkg. This library provides the interface for package registration backends and abstracts core package management tasks, including:

• Package registration
• Remote repository management
• Package creation
• Package updating

UCL is fully compatible with the JSON format and can parse any valid JSON file. However, it offers a more ergonomic syntax similar to nginx.

Key differences in syntax:

• Nginx-style: Uses = for assignment and {} for blocks. Supports suffixes for numbers (e.g., 10k, 0.2s).
• JSON-style: Standard key-value pairs with quotes and colons.

UCL allows you to mix these styles or use the more concise Nginx-like notation for easier manual editing.

# Nginx-like UCL
param = value;
section {
    param1 = value1;
    flag = true;
    number = 10k;
    time = 0.2s;
    string = "something";
    subsection {
        host = { host = "hostname"; port = 900; }
    }
}

libecc implements several approaches to limit Side Channel Attacks (SCA):

• SPA (Simple Power Analysis): Thwarted using the Montgomery Ladder. You can optionally use the ADALWAYS=1 switch to use 'Double and Add Always' to avoid leaking the point at infinity.
• DDPA (Data DPA): Thwarted using blinding of the point (projective coordinates) and the scalar. This must be manually enabled via BLINDING=1 due to performance costs.
• ADPA (Address-bit DPA): Limited using the Itoh et al. Double and Add Always masked variant.

Note: All countermeasures should be validated on your specific target hardware using leakage assessments, as C code behavior can vary based on compiler optimizations and CPU microarchitecture.

Lua scripts can be used for package automation and always run before shell scripts. They are designed for security and portability:

• Sandboxing: They run in a Capsicum sandbox, restricting them to filesystem access only.
• No External Execution: They are prevented from executing external programs, making them cross-installation friendly.
• Rootdir Friendly: They run in a modified Lua environment where all I/O operations are seamlessly compatible with rootdir operations.

Supported Phases:

• post-install
• pre-install
• post-deinstall
• pre-deinstall

For the full API specification, refer to pkg-lua-script(5).

UCL supports variable expansion in input strings using the following formats:

• ${VARIABLE}
• $VARIABLE

Note: Nested variables are not currently supported. To escape a dollar sign, use double dollar signs:

• $${VARIABLE} $\rightarrow$ ${VARIABLE}
• $$VARIABLE $\rightarrow$ $VARIABLE

pkg supports shell scripts that run via /bin/sh during specific package lifecycle phases. To prevent scripts from spawning persistent daemons, pkg acts as a 'reaper' and will kill any remaining child processes once the script finishes.

Supported Phases:

• post-install
• pre-install
• post-deinstall
• pre-deinstall

Available Environment Variables:

• PKG_PREFIX
• PKG_ROOTDIR
• PKG_MSGFD
• PKG_UPGRADE

For detailed documentation, refer to pkg-script(5).

UCL supports object validation using the JSON Schema v4 standard. You can use UCL syntax to define your schemas, which is often simpler than using JSON.

Key validation features include:

• Full JSON Schema support: Supports the standard set of JSON schema features (excluding remote references).
• Multi-value constraints: Because UCL allows multiple values for a single key, you can use maxValues and minValues to define constraints on the number of values allowed for that key.

Note: To ensure reliable validation, always provide schemas that strictly adhere to the JSON Schema draft v4 specification.

libecc provides both classical (non-deterministic) and deterministic variants for ECDSA and BIGN. The choice depends heavily on your attack model and usage context:

• Deterministic Variants (e.g., RFC 6979 for ECDSA):

  • Pros: Suitable for environments with no high-quality RNG or weak entropy sources.
  • Cons: Susceptible to fault attacks. If a fault is injected during computation, the private key can be leaked.

• Non-deterministic Variants:

  • Pros: Resistant to fault attacks.
  • Cons: Requires a high-quality, reliable RNG. Any leak of the nonce bits can lead to devastating attacks (e.g., via the Hidden Number Problem).

Recommendation: Carefully evaluate whether your platform is more susceptible to side-channel/fault attacks or entropy exhaustion before selecting a variant.