I'm trying to update my Solaris 11.3 x86 system. The system hasSun/Oracle software on it, including Sun Developer Studio and Sun SSH server. It does not have other software on it, and I don't have anything in /usr/local.

I'm catching this error:

$ sudo pkg update

Creating Plan (Package planning:  1/10): -

pkg update: Chain was rooted in an untrusted self-signed certificate.

The package involved is pkg://solaris/consolidation/ddt/ddt-incorporation@18.3.18.7.13,0.5.11-11.4.0.0.1.11.0:20180718T212443Z

According to Packaging and Delivering Software With the Image Packaging System | Untrusted Self-Signed Certificate, the docs say it is because of using a self-signed OpenSSL certificate. Another similar page is Troubleshooting Signed Packages, but it rehashes the earlier page and adds nothing new. The Oracle docs on updating a package is at Updating a Package but it does not appear to provide the information I need.

The Sun article lacks step-by-step instructions to clear the issue. I'm trying to get Solaris to trust the Sun certificate but I can't get beyond usage errors:

$ sudo pkg set-publisher --approve-ca-cert  solaris/consolidation/ddt/ddt-incorporation

pkg set-publisher: requires a publisher name

Usage:

    pkg set-publisher [-Ped] [-k ssl_key] [-c ssl_cert]

        [-g origin_to_add|--add-origin=origin_to_add ...]

        [-G origin_to_remove|--remove-origin=origin_to_remove ...]

    ....

And:

$ sudo pkg set-publisher --approve-ca-cert  solaris/consolidation/ddt/ddt-incorporation sun

pkg set-publisher: Could not find /export/home/jwalton/solaris/consolidation/ddt/ddt-incorporation

I've tried other combinations, like prepending pkg:// and using the full name but the problems persist.

How do I get beyond this error?

It's not self-signed, but it's not signed by a certificate authority that the Solaris 11.3 GA version knows about. Support for the new certificate authority is one of the reasons you need to first update to Solaris 11.3 SRU 23 or later before you can upgrade to Solaris 11.4, as documented in the upgrade instructions.

I think I know exactly what you're trying to do, but you'll also fail at the next step which is where I'm up to.

pkg(1) stashes a copy of the certificate chain in /var/pkg/publisher/(publisher name)/certs, so you'll have the signing and root certificate in /var/pkg/publisher/solaris/certs. Copy the root certificate to the CA certificate directory in /etc/certs/CA/ and then pkg(1) will trust the certificate chain.

In my case, it's as easy as

cp /var/pkg/publisher/solaris/certs/370b6b4fba7b0ad472465ffe9377f8f6040b2cfd /etc/certs/CA/temp-solaris-object-signing.pem

svcadm restart system/ca-certificates

The next hurdle you'll find is that pkg://solaris/system/core-os@11.4,5.11-11.4.0.0.1.15.0 has an origin root-image dependency on pkg:/system/core-os@0.5.11-0.175.3.23.0.4.0 (see https://docs.oracle.com/cd/E53394_01/html/E54820/dependtypes.html#PKDEVglumq for details about pkg dependencies). There is probably a very good reason that is there...

EDIT: the rest of what you're probably trying to do is...

If you choose to ignore that giant red flag, and don't mind your Solaris 11.3 system becoming unsupportable (probably because you don't have a support contract in order to download 11.3SRU23), you can do something like:

pkgrecv -s /path/to/solaris11_4 -d /var/tmp/sol114 --raw pkg://solaris/system/core-os@11.4,5.11-11.4.0.0.1.15.0:20180817T002753Z

vi /var/tmp/sol114/system%2Fcore-os/11.4%2C5.11-11.4.0.0.1.15.0%3A20180817T002753Z/manifest*

Remove the dependency:

depend fmri=pkg:/system/core-os@0.5.11-0.175.3.23.0.4.0 root-image=true type=origin

Publish back to your local repo:

pkgsend publish -s /path/to/solaris11_4 -d /var/tmp/sol114/system%2Fcore-os/11.4%2C5.11-11.4.0.0.1.15.0%3A20180817T0023Z/ /var/tmp/sol114/system%2Fcore-os/11.4%2C5.11-11.4.0.0.1.15.0%3A20180817T002753Z/manifest

pkgrepo -s /path/to/solaris11_4 rebuild

Then run the upgrade.

You need to ensure that /var/tmp is completely empty before upgrading because it seems to create a new ZFS dataset for /var/tmp during the upgrade, otherwise it seems to work fine with a couple of fixable errors. YMMV, I tested this on an old T4-2 SPARC system (not x86), so I don't know if there are other quirks around GRUB upgrades etc.

The following command will install 11.3 sru21 which will install new CA.
DDT-incorporation is a diagnostic package which has explorer etc..

pkg update --reject ddt-incorporation --accept entire@0.5.11-0.175.3.21.0.5.0

Later you can install the individual package if required or subsequent pkg update will not fail.
pkg install ddt-incorporation

To resolve the pkg update issue:
Specify the exact version of the "package involved".

pkg update --reject pkg://solaris/consolidation/ddt/ddt-incorporation@18.3.18.7.13,0.5.11-11.4.0.0.1.11.0:20180718T212443Z entire@0.5.11-0.175.3.35

or simply reject it:

pkg update consolidation/ddt/ddt-incorporation@18.3.18.7.4-0.175.3.35.0.1.0 entire@0.5.11-0.175.3.35

pkg uninstall consolidation/ddt/ddt-incorporation support/explorer