3 files changed, 12 insertions(+), 7 deletions(-)

M images/netbsd/8.x/genimg
M images/netbsd/9.x/genimg
M images/netbsd/genimg

@@ 2,5 2,5 @@
 arch="${1:-amd64}"
 export netbsd_dist="https://cdn.netbsd.org/pub/NetBSD/NetBSD-8.2/$arch"
 export netbsd_suffix="tgz"
-export pkgin_dist="http://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$arch/8.2/All"
+export pkgin_dist="cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$arch/8.2/All"
 exec ../genimg "$@"

@@ 1,6 1,6 @@
 #!/bin/sh -eu
 arch="${1:-amd64}"
-export netbsd_dist="https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.2/$arch"
+export netbsd_dist="https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.3/$arch"
 export netbsd_suffix="tar.xz"
-export pkgin_dist="https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$arch/9.2/All"
+export pkgin_dist="cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/$arch/9.3/All"
 exec ../genimg "$@"

@@ 113,14 113,19 @@ EOF
 sed -e 's/^rc_configured=NO/rc_configured=YES/' \
 	-i /mnt/etc/rc.conf
 
-run_root pkg_add "$pkgin_dist/pkgin"
-echo "$pkgin_dist" > /mnt/usr/pkg/etc/pkgin/repositories.conf
+# NB: Use HTTP to obtain latest root certificates to prevent connection
+# errors.
+run_root PKG_PATH="http://$pkgin_dist" pkg_add "pkgin"
+echo "http://$pkgin_dist" > /mnt/usr/pkg/etc/pkgin/repositories.conf
 run_root pkgin -y update
+run_root pkgin -y install mozilla-rootcerts
+run_root mozilla-rootcerts install
+# Now we can rely on HTTPS
+echo "https://$pkgin_dist" > /mnt/usr/pkg/etc/pkgin/repositories.conf
 # TODO: Remove bash
 run_root pkgin -y install sudo gnupg git-base mercurial \
-	moreutils mozilla-rootcerts bash
+	moreutils bash
 run_root pkgin clean
-run_root mozilla-rootcerts install
 
 cat <<EOF >/mnt/etc/login.conf
 default:\