Client setup

For hosts that have a token. Replace HOST and TOKEN with the values issued to that host.

pkgin

One line per repository in /usr/pkg/etc/pkgin/repositories.conf. Remove the stock entry instead of keeping both — pkgin takes the first repository that offers a package, and mixed branches conflict at install time.

https://client:TOKEN@HOST/pkgsrc/2026Q3/NetBSD-10.1/x86_64/All

pkgin -y update
pkgin list | wc -l

pkg_add

For hosts without pkgin, or when pkgin is what you are installing.

export PKG_PATH=https://client:TOKEN@HOST/pkgsrc/2026Q3/NetBSD-10.1/x86_64/All
pkg_add -U pkgin

Distfiles for local builds

Hosts that build from source point at the cache instead of upstream. This also covers tarballs upstream has removed.

MASTER_SITE_OVERRIDE= https://client:TOKEN@HOST/distfiles/
MASTER_SITE_BACKUP=

MASTER_SITE_BACKUP is empty on purpose. A build should fail when a tarball is missing here, not fetch something else quietly.

Verify

pkgin -v update
pkgin show-keep | head -3
pkg_info -Q PKGPATH pkgin

If pkgin update reports a summary from a host other than this one, a stock repository line is still present.

Moving to a new branch

Branch labels are in the path, so a move is one edit and a full upgrade. Do not mix branches on one host.

sed -i '' -e 's/2026Q2/2026Q3/' /usr/pkg/etc/pkgin/repositories.conf
pkgin -y update
pkgin -y full-upgrade

Tokens

Tokens are issued per host and rotated at each quarterly freeze. A rotated token keeps working for fourteen days, then stops. An expired token gets the same 404 as an unknown path.