1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
.Dd September 27, 2026
.Dt BULK 8
.Os
.Sh NAME
.Nm bulk
.Nd fetch pre-built packages
.Sh SYNOPSIS
.Nm
.Ar port ...
.Nm
.Fl u
.Nm
.Fl h
.Sh DESCRIPTION
.Nm
downloads pre-built packages for ports from the rawnix.org package
server into the port directories, and verifies them.
It does not install them; use
.Xr addpkg 8
or
.Xr pkg 8
for that.
.Pp
For each
.Ar port ,
.Nm
looks for a directory of that name holding a
.Pa MAKEPKG
in the collections listed in
.Pa /etc/ports/ports.rsync ,
then:
.Bl -enum -offset indent
.It
Refuses if the port is locked, with a
.Pa MAKEPKG.lock :
the package on the server was built from upstream's recipe, not from
the lock.
.It
Derives the package file name from the
.Pa MAKEPKG .
Only
.Pa .pkg.tar.gz
packages are fetched.
.It
Takes the expected SHA256 of that file from the port's
.Pa .signature ,
and verifies
.Pa .signature
the way
.Xr mkpkg 8
does: the key in the recipe's
.Fn signify
block must match a trusted key in
.Pa /etc/ports/keys/ ,
and
.Xr signify 1
must accept the signature with that key.
.It
Does nothing if the package in the port directory already has that
checksum.
.It
Otherwise fetches it with
.Xr rsync 1
from the
.Li bulk
module, as
.Sm off
.Li bulk/ Ar collection No / Ar port No /
.Sm on
on the server, and checks its SHA256.
A package that does not match is deleted.
.El
.Pp
Any failure refuses the package.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl h , Fl Fl help
Print a usage summary.
.It Fl u , Fl Fl update
For every installed package whose port is found and not locked, make
sure the port directory holds the current verified package, fetching
it if needed.
Locked ports are skipped.
.El
.Sh FILES
.Bl -tag -width Ds -compact
.It Pa /etc/ports/ports.rsync
Server, token and collections, as described in
.Xr ports 8 .
.Cm host
and
.Cm token
are required;
.Cm module
is ignored.
.It Pa /etc/ports/keys/*.pub
Trusted public keys.
.It Pa /var/lib/pkg/db
Package database, read by
.Fl u .
.El
.Sh EXIT STATUS
.Ex -std
It fails if any package could not be fetched and verified.
.Sh EXAMPLES
Fetch two packages, then install one:
.Bd -literal -offset indent
# bulk zlib openssl
# addpkg -u '/ports/core/zlib/zlib#1.3.2-1.pkg.tar.gz'
.Ed
.Sh SEE ALSO
.Xr rsync 1 ,
.Xr signify 1 ,
.Xr addpkg 8 ,
.Xr mkpkg 8 ,
.Xr pkg 8 ,
.Xr ports 8
|
