Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I'm using OpenBSD for quite a while now. All I do, however is go from one release to the next, always just doing an update. I configured the system so it works as my router and firewall, and it works quite well like that. But I never update packages. All I do is just move on to the next release.
Coming from the Linux world, I'm used to applying updates a few times a week; but how do I do that on *BSD? - Or is this not part of the *BSD philosophy?
OpenBSD is binary-centric. Patching the base system (e.g., because of a security flaw in the kernel) requires rebuilding the system from source or running syspatch.
You can update the package binaries (if any updates/changes are available) by executing pkg_add:
pkg_add -Uu
The OpenBSD team recommends using the packages over building from ports - The OpenBSD packages and ports system
FreeBSD can be updated via packages or ports.
pkg_add -u is enough on OpenBSD. Use -U when installing a single package (or set of packages) if you want to update packages that this (these) depend on.
In general, when using OpenBSD you only update your packages when you update your system. So, as a final step, after upgrading to the latest release, you should execute:
# pkg_add -ui
Which will (u)pgrade your installed packages asking you any questions (i)nteractive when needed.
In general, packages for a given release are not updated until the next release (OpenBSD lacks the developer resources for providing updates to packages on versions other than 'current'). If you want to upgrade your packages more regularly, you either need to use ports, or upgrade to a new snapshot, and then run pkg_add -ui again.
For further reading, check: http://www.openbsd.org/faq/faq15.html
OpenBSD lacks the developer resources for providing updates to packages on versions other than 'current' Does that also apply to security updates? So if a critical security hole is found in a binary package I use, I have to reinstall it from Stable ports?
-current. OpenBSD will not rebuild packages for -stable.
The various BSD systems have a very clear separation into "base system" and "3rd party software (ports/packages)". You upgrade the two separately.
This assumes that you have an installation of OpenBSD 6.5 or later (see further down for old answer):
The base system is upgraded with sysupgrade(8):
doas sysupgrade
This will download and upgrade the base system to the next "stable" version of OpenBSD if you are following the stable or release branch, or to the latest "snapshot" if you are using snapshots. Note that you should not use sysupgrade if you have a customised installation without all the base system sets.
After upgrading the base system, you may want to run syspatch(8) (only to get your system up from "release" to "stable", snapshot systems don't use syspatch).
Ports are updated with pkg_add(1):
doas pkg_add -u
On a snapshot system, you may want to add -D snap to that (see the manual).
You will also want to check the relevant section of the OpenBSD FAQ before upgrading, e.g. the section on "Following -current and using snapshots" or the section relating to upgrading to the latest stable release.
There is also a port/package called sysclean (in sysutils/sysclean) that will help you with pointing out base system libraries and other files that are no longer part of the default installation. It will also tell you what ports are using outdated libraries.
Old answer, relevant to OpenBSD releases before 6.5:
In the case of OpenBSD, assuming you want to move from one stable release to the next stable release (jumping releases is not supported unless you make a fresh install), you start off by reading the specific FAQ for the upgrade you're performing. In the case of upgrading from 5.9 to 6.0, you read the "Upgrade Guide: 5.9 to 6.0".
In general, the gist of it involves booting the installation media for the release you'd like to upgrade to and selecting "(U)pgrade" from the menu. Once the base system is upgraded, you boot it and, as root, upgrade any installed packages with pkg_add -u.
It is unusual for packages belonging to a stable OpenBSD release to update very often. Usually that only happens when critical bugs are fixed. So running pkg_add -u several times a week will probably not do very much (but do keep doing it as it may pull in critical fixes).
If you follow "current", things are very different. Then you'd be building your packages from the ports tree checked out with CVS under /usr/ports, and you would probably be rebuilding the base system manually too (see "Building the System from Source"). Installed ports may be updated with dpb (in /usr/ports/infrastructure/bin) if given the correct options and a list of manually installed packages.
I'm using
#!/bin/sh -x
pkg_info -P -q -m | sort -o "$HOME/packages"
/usr/ports/infrastructure/bin/dpb -scuR -P "$HOME/packages"
Followed by
$ doas pkg_add -u -D unsigned
$ doas pkg_delete -a
This is not encouraged for new users.
OpenBSD: M:Tier provides stable packages for the amd64 and i386 architectures. This allows you to keep your system up to date with the most recent security fixes from the -stable ports branch.
An article on OpenBSD Journal explains the details:
In practice, this means that as soon as a security fix/update is committed to the OPENBSD_5_3 tree a package will be built from the CVS tree. This package is then being tested and pushed to our fan-out server over at Stable.MTier.org, for everyone to use!
I needed to get updates because I installed bash and didn't want to suffer from the Shellshock vulnerability, so I went with Holu's suggestion https://unix.stackexchange.com/a/103661/93476 and it got me patched up.
On NetBSD, you usually upgrade pkgsrc to the latest version (which is nothing more than tar -xvzf pkgsrc-version.tar.gz) and updates the installed software individually.
More information on the NetBSD/pkgsrc website:
For me updating NetBSD packages is a command in /usr/pkgsrc:
# cvs update -dP && csup /some-path-to-wip-supfile/netbsd-pkgsrc-wip && pkg_rolling-replace -u
Always read FAQ /manual : http://www.openbsd.org/faq/upgrade58.html
Whenever you go from release to release you need to do packages update as final step.
Sorry, NetBSD pkgsrc doesn't support a careless solution. Instead you should use a package manager like nih or pkgin. Under pkgsrc you have to force upgrades that ignores often linked file dependencies. Also copying the new version over the old pkgsrc can bring your pkgsrc tree in an inconsitent state.
pkg_addispkg_add -uvi, right?