1. Please see GPG Key Server at MIT University
2. Raw text at Blastwave : GPG Key for software@blastwave.org

• Overview
• pkg-get configuration to use a mirror site
• Current http/ftp mirrors
• Unofficial sites (for out-of-the-way places)
• rsync sites
• Old versions of packages
• GPG public key

Mirror Site Overview and information

  Blastwave Software Stack

  The Blastwave Software Stack ( simply “the stack” ) is broken into three main trees of software packages.   The first tree is called “unstable” and it changes frequently.  Software packages are continually being updated and released to the public via the “unstable” tree.  The next tree is called “stable” and it will only change after release engineering has checked and reviewed all bugs filed against all software packages.  There is also an internal tree simply called “testing” and it is used for QA processes before a package enters the “unstable” tree.  Our current release manager is James Lee and he works closely with numerous others to ensure that only qualified software may enter the “stable” tree.  The “stable” tree will change only when a complete release is ready.  At most this will be four times a year, depending on various factors.  You must install pkg-get and then configure /opt/csw/etc/pkg-get.conf to download software from a mirror listed below.  Simply add either "/unstable" or "/stable" to the end of one of the URLs listed below and then use pkg-get to install software.

  Take note that if you use the “stable” tree then you may be a few months behind in software package versions, for the tradeoff of using packages that dont have as many bugs ( often none ) filed against them. James Lee does a great job of migrating only packages with low or no bug count, into the stable tree.

The best way to access a mirror site for individual machines, is via the pkg-get script, which will install a package, and all its dependancies (although you may also choose to download and install packages manually) .

You must install pkg-get v2.x or later.
blastwave.org catalogs now have md5 hashes for each package, and are 'signed'. Only pkg-get v2.x can fully take advantage of these new formats. To most easily take advantage of the checksums, you can use "pkg-get install textutils"

You must choose whether you want to download packages from the "stable" (tested for a while) tree, or the "unstable" (latest release, potentially untested) tree. The URLs given above are just a base url. You must then set the adjusted 'url' value in /opt/csw/etc/pkg-get.conf . For example:

url=http://blastwave.network.com/csw/unstable

You must also have a working "wget" somewhere in your $PATH. If you dont have one, you can download a binary directly from the top level of any of the mirror sites.
Solaris 9 and Solaris 10 usually provide wget, in /usr/sfw/bin. If present, this will be used, if you do not have wget in your PATH.

You may then use pkg-get to automatically download and install software that you want from the mirror site. For example,

pkg-get install gcc

For more things you can do with pkg-get, see the pkg-get home page

Current public mirrors

GPG public key

gpg verification is optional. However, if you have gpg installed [via "pkg-get install gnupg"], pkg-get will attempt to verify the catalog. If you wish to have the catalog file (with its list of checksums for each package) verified by gpg, then you should save this page and add the public key to your root "keyring". Eg:

If you have gpg installed, but do NOT wish gpg verification to take place, you must set "use_gpg=false" in /opt/csw/etc/pkg-get.conf

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.9 (SunOS)

mQGiBEinbdoRBADIgfysWTNUZVX1COuu0kqsmkKjj5mhj2bGU+k01LauXLnZnJkS
oX5albzpqWHNQ2+QYYcUS/floACyVBLft2w1KYQmqWcAd0nnDu1u5zCOkQYPFKId
eYNQIQLnq66VPGNtEK6u0F4gmqVmFSyqCdnfglSZUprPx2b2iA+94njMkwCgj4nO
547bNv5eCbvW74eKYrXuMGEEALJ/JlRzqnfI2vTYumk8wIYTJ471ett3kzC7HT0P
Ck6a+503c4M0uE7FBukv7bzMFCoZ5tlbaLvMwa3Y8FB/h6Cn5S89/gGxFL7zBki9
HtFo2fBPIPhaAb5AJIAwBUpD+P1/cZ7gBCrPwdZ1juDH3Vu8V7RmDEhLyvMfAXsV
IQDUA/4nYuNk5quJrxVzKZziZMq35UI2dM4wng6tfGexg7AeHumI/2JE8FEI1FM3
A7qIKOF8McohGiEBpfzf2nEVcnTNz9iwsFDS88cSGM2uU7tZzm5Z7uP+tx2x4+HY
LlVltlaHLaVhUB57Yp5trPrZLml18E5f5RoHhJjC6ZC0KompwbRAQmxhc3R3YXZl
IFNvZnR3YXJlIChCbGFzdHdhdmUub3JnIEluYy4pIDxzb2Z0d2FyZUBibGFzdHdh
dmUub3JnPohmBBMRAgAmBQJIp23aAhsDBQkFo5qABgsJCAcDAgQVAggDBBYCAwEC
HgECF4AACgkQTahB6aGZnpDI3QCeLotaGV8Jef+8N+2La2NMnzLPRCkAn2KYBqKw
ZIphLBGm/m0KXXKenI6uuQINBEinbdoQCACRHT7pnpPEMTq4t3SiSTc8n/7bo6YM
udTiYudVSwN7VBeYcrWy3sji4N5oAHzytrWdO3ThIDiQR+iJ1fXrZp9f5ntkx/MV
xArB/bcbWGGnCALbWq9+iYsAnUAnEtlZ+iVwsMThyDpD0wlHT4jCIdOr35H/Raa9
brbjva0Gz/x4DVPKSFwOlUaVl8dFFF7uS3OnA/2jBy5LB2p3dNuP1gTblZGb37oo
3mWR071ERI05u68QgOJKh0FAiZUpnGTLnvI0aQqGYkVJBbJGv4VjEQUS4Spi9XiA
3yGbzD/7pqHxxfYKgg5wSJA0srGPqzvdjVbu2IRu0iGF8RdDJKOGayFDAAMFB/4j
Bh10mhxk6hCUqQKcMcmK2U62bfwaunuZKTvMn7LYmgaJ9CueoI9PQJk1+/to8RM4
vm7Il56Hv4wUOB+n0rOmuXzZ27f261PIuqwn/5fk9NglIuv98CUsfSBRxXUtF30D
qwtYrUIXom7soZtQNPMJFYN3ONC+zn/jllvkHSYrtV3JxC1/xzYpSfQV71DtctJf
US1PFLzzQ2L0vUV1qnv2khMXFFLdy9E7ZuYAEdYBqFVpopjGdjJn/WycanmfvdfY
fxZQmK7erpHso9jy3P6JOIEzmPRKp/2EfEqIrJ9Lg87Ku0iOUMAlOoBczVqmTvev
K91vaYT6XqtoTz/Q1O5LiE8EGBECAA8FAkinbdoCGwwFCQWjmoAACgkQTahB6aGZ
npCUKwCeLQT8CQlZhxiiveS1AAXlbEWk9A4AnjSYnzifQteSa/5llqZAlVaR+WZg
=2Kbo
-----END PGP PUBLIC KEY BLOCK-----