pkg can't access repository

A browser doesn't have access to theses directories, it's normal. What is the problem with pkg?
What do you try exactly and what you get as a result?
 
DirectoryIndex (i.e. 'browsing' through files in that directory) is turned off. Doesn't affect pkg(8) though because it doesn't rely on being able to browse those directories.

This is preventing me from using pkg to install a jail.
What is the exact error you're getting?
 
[root@server ~]# pkg -vv
Version : 2.7.5
libpkg : 2.7.5
libarchive : libarchive 3.8.7
sqlite : 3.51.1
openssl : OpenSSL 3.5.6 7 Apr 2026
PKG_DBDIR = "/var/db/pkg";
PKG_CACHEDIR = "/var/cache/pkg";
PORTSDIR = "/usr/ports";
INDEXDIR = "";
INDEXFILE = "INDEX-15";
HANDLE_RC_SCRIPTS = false;
DEFAULT_ALWAYS_YES = false;
ASSUME_ALWAYS_YES = false;
REPOS_DIR [
"/etc/pkg/",
"/usr/local/etc/pkg/repos/",
]
PLIST_KEYWORDS_DIR = "";
SYSLOG = true;
DEVELOPER_MODE = false;
VULNXML_SITE = "https://vuxml.freebsd.org/freebsd/vuln.xml.xz";
FETCH_RETRY = 3;
PKG_PLUGINS_DIR = "/usr/local/lib/pkg/";
PKG_ENABLE_PLUGINS = true;
PLUGINS [
]
DEBUG_SCRIPTS = false;
PLUGINS_CONF_DIR = "/usr/local/etc/pkg/";
PERMISSIVE = false;
REPO_AUTOUPDATE = true;
NAMESERVER = "";
HTTP_USER_AGENT = "pkg/2.7.5";
EVENT_PIPE = "";
FETCH_TIMEOUT = 30;
UNSET_TIMESTAMP = false;
SSH_RESTRICT_DIR = "";
PKG_ENV {
}
PKG_SSH_ARGS = "";
DEBUG_LEVEL = 0;
ALIAS {
all-depends = "query %dn-%dv";
annotations = "info -A";
build-depends = "info -qd";
cinfo = "info -Cx";
comment = "query -i \"%c\"";
csearch = "search -Cx";
desc = "query -i \"%e\"";
download = "fetch";
iinfo = "info -ix";
isearch = "search -ix";
prime-list = "query -e '%a = 0' '%n'";
prime-origins = "query -e '%a = 0' '%o'";
leaf = "query -e '%#r == 0' '%n-%v'";
list = "info -ql";
noauto = "query -e '%a == 0' '%n-%v'";
options = "query -i \"%n - %Ok: %Ov\"";
origin = "info -qo";
orphans = "version -vRl?";
provided-depends = "info -qb";
rall-depends = "rquery %dn-%dv";
raw = "info -R";
rcomment = "rquery -i \"%c\"";
rdesc = "rquery -i \"%e\"";
required-depends = "info -qr";
roptions = "rquery -i \"%n - %Ok: %Ov\"";
sets = "info -d -C -x '^FreeBSD-set-'";
shared-depends = "info -qB";
show = "info -f -k";
size = "info -sq";
unmaintained = "query -e '%m = \"ports@FreeBSD.org\"' '%o (%w)'";
runmaintained = "rquery -e '%m = \"ports@FreeBSD.org\"' '%o (%w)'";
}
CUDF_SOLVER = "";
SAT_SOLVER = "";
RUN_SCRIPTS = true;
CASE_SENSITIVE_MATCH = true;
LOCK_WAIT = 1;
LOCK_RETRIES = 5;
SQLITE_PROFILE = false;
WORKERS_COUNT = 0;
READ_LOCK = false;
IP_VERSION = 0;
AUTOMERGE = true;
MERGETOOL = "";
VERSION_SOURCE = "";
CONSERVATIVE_UPGRADE = true;
FORCE_CAN_REMOVE_VITAL = true;
PKG_CREATE_VERBOSE = false;
AUTOCLEAN = false;
AUTOREMOVE = false;
DOT_FILE = "";
DEBUG_SCHEDULER_DOT_FILE = "";
REPOSITORIES {
}
VALID_URL_SCHEME [
"pkg+http",
"pkg+https",
"https",
"http",
"file",
"ssh",
"tcp",
]
WARN_SIZE_LIMIT = 1048576;
METALOG = "";
IGNORE_OSVERSION = false;
IGNORE_OSMAJOR = false;
BACKUP_LIBRARIES = false;
BACKUP_LIBRARY_PATH = "/usr/local/lib/compat/pkg";
PKG_TRIGGERS_DIR [
"/usr/share/pkg/triggers/",
"/usr/local/share/pkg/triggers",
]
PKG_TRIGGERS_ENABLE = true;
AUDIT_IGNORE_GLOB [
]
AUDIT_IGNORE_REGEX [
]
COMPRESSION_FORMAT = "";
COMPRESSION_LEVEL = -1;
REPO_ACCEPT_LEGACY_PKG = false;
FILES_IGNORE_GLOB [
]
FILES_IGNORE_REGEX [
]
SHLIB_PROVIDE_PATHS_NATIVE [
]
SHLIB_PROVIDE_PATHS_COMPAT_32 [
]
SHLIB_PROVIDE_PATHS_COMPAT_LINUX [
]
SHLIB_PROVIDE_PATHS_COMPAT_LINUX_32 [
]
SHLIB_PROVIDE_IGNORE_GLOB [
]
SHLIB_PROVIDE_IGNORE_REGEX [
]
SHLIB_REQUIRE_IGNORE_GLOB [
]
SHLIB_REQUIRE_IGNORE_REGEX [
]
PKG_DEBUG_FLAGS [
"all",
]
COMPRESSION_THREADS = -1;
PKG_REINSTALL_ON_OPTIONS_CHANGE = true;
TRACK_LINUX_COMPAT_SHLIBS = false;
ABI = "FreeBSD:15:amd64";
ALTABI = "freebsd:15:x86:64";
OSVERSION = "1501000";


Repositories:
FreeBSD-ports: {
url : "pkg+https://pkg.freebsd.org/FreeBSD:15:amd64/quarterly",
enabled : yes,
priority : 0,
mirror_type : "SRV",
signature_type : "FINGERPRINTS",
fingerprints : "/usr/share/keys/pkg"
}
FreeBSD-ports-kmods: {
url : "pkg+https://pkg.freebsd.org/FreeBSD:15:amd64/kmods_quarterly_1",
enabled : yes,
priority : 0,
mirror_type : "SRV",
signature_type : "FINGERPRINTS",
fingerprints : "/usr/share/keys/pkg"
}
FreeBSD-base: {
url : "pkg+https://pkg.freebsd.org/FreeBSD:15:amd64/base_release_1",
enabled : yes,
priority : 0,
mirror_type : "SRV",
signature_type : "FINGERPRINTS",
fingerprints : "/usr/share/keys/pkgbase-15"
}
 
DirectoryIndex (i.e. 'browsing' through files in that directory) is turned off. Doesn't affect pkg(8) though because it doesn't rely on being able to browse those directories.


What is the exact error you're getting?

It hangs trying to retrieve the files for FreeBSD-base. But it looks like it's IPv6. Works fine if I force IPv4. My IPv6 access tested perfect before and nothing has changed. Will run the tests again from another machine. Is there a IPv6 test site that works with lynx or something?
 
It hangs trying to retrieve the files for FreeBSD-base. But it looks like it's IPv6. Works fine if I force IPv4. My IPv6 access tested perfect before and nothing has changed. Will run the tests again from another machine.
How is the jail connected to the host network? 'Regular' or 'vnet' jail? Any firewall that might be blocking that IPv6 traffic?
 
Why just those two directories? https://pkg.freebsd.org/FreeBSD:15:amd64/base_latest/ and https://pkg.freebsd.org/FreeBSD:15:amd64/base_weekly/ are fully accessible as are all other directories.
And why why? It's a design of this site, not my choice. They have probably good reasons to do so. I just pointed out that your tests are erroneous.

So, as you discovered by yourself, it looks like a network problem.

Here, I tested pkg with FreeBSD-base, seems to work, but I don't use ipv6.
 
How is the jail connected to the host network? 'Regular' or 'vnet' jail? Any firewall that might be blocking that IPv6 traffic?
VNET, epair to a bridge attached to the network card. It retrieves the files for the first two repositories fine (most of the time, I get timeouts there too). I does look like it's an IPv6 issue further upstream from me somewhere. :(

But pkg does not fall back to IPv4 quickly. Probably something that would be difficult to implement.
 
And why why? It's a design of this site, not my choice. They have probably good reasons to do so.
So, as you discovered by yourself, it looks like a network problem.

Here, I tested pkg with FreeBSD-base, seems to work, but I don't use ipv6.
There is no good reason to block just two directories out of a dozen from human inspection. That's just security by obscurity. And now it added another point of failure.

Yes, it's an IPv6 issue but that blocking mechanism prevents it from working at all. pkg could retrieve files from https://pkg.freebsd.org/FreeBSD:15:amd64/quarterly and https://pkg.freebsd.org/FreeBSD:15:amd64/kmods_quarterly_1 about 99% of the time. But https://pkg.freebsd.org/FreeBSD:15:amd64/base_release_1 gives a 0% success rate.
 
But even if pkg can't use the happy eyeballs (fast fallback) algorithm it can still switch after the long timeout instead of giving up.
 
I just completely disabled IPv6 on my network. I don't have time to troubleshoot what some intermediate party on the internet broke.

Now I need to obtain the files that should have been added in /usr/share/keys/pkg/ by the installer.
 
or why just those two directories need to be hidden from people.
All directories containing the actual packages have directory browsing turned off. The web server has to generate the HTML for your browser and this caused way too much unnecessary strain on the web servers.

 
All directories containing the actual packages have directory browsing turned off. The web server has to generate the HTML for your browser and this caused way too much unnecessary strain on the web servers.
Not all. Both https://pkg.freebsd.org/FreeBSD:15:amd64/base_latest/ and https://pkg.freebsd.org/FreeBSD:15:amd64/base_weekly/ have packages and have directory browsing turned on. Thank you for the explanation. With this new information it looks like the other two directories have the correct permission while latest and weekly don't.
 
Back
Top