I'm using OpenBSD for quite a while now. All I do, however is go from one release to the next, always just doing an update. I configured the system so it works as my router and firewall, and it works quite well like that. But I never update packages. All I do is just move on to the next release.

Coming from the Linux world, I'm used to applying updates a few times a week; but how do I do that on *BSD? - Or is this not part of the *BSD philosophy?

10 Answers 10

up vote 21 down vote accepted

OpenBSD is binary-centric. You can update the binaries (if any updates/changes are available) by executing pkg_add:

pkg_add -Uu

The OpenBSD team recommends using the packages over building from ports - The OpenBSD packages and ports system

FreeBSD can be updated via packages or ports.

  • 1
    pkg_add -u is enough on OpenBSD. Use -U when installing a single package (or set of packages) if you want to update packages that this (these) depend on. – Kusalananda Jan 18 at 7:12

In general, when using OpenBSD you only update your packages when you update your system. So, as a final step, after upgrading to the latest release, you should execute:

# pkg_add -ui

Which will (u)pgrade your installed packages asking you any questions (i)nteractive when needed.

In general, packages for a given release are not updated until the next release (OpenBSD lacks the developer resources for providing updates to packages on versions other than 'current'). If you want to upgrade your packages more regularly, you either need to use ports, or upgrade to a new snapshot, and then run pkg_add -ui again.

For further reading, check: http://www.openbsd.org/faq/faq15.html

  • 3
    OpenBSD lacks the developer resources for providing updates to packages on versions other than 'current' Does that also apply to security updates? So if a critical security hole is found in a binary package I use, I have to reinstall it from Stable ports? – imgx64 Nov 6 '12 at 4:42
  • @imgx64 Security fixes to ports are done on -current. OpenBSD will not rebuild packages for -stable. – Kusalananda Jan 18 at 7:14

OpenBSD: M:Tier provides stable packages for the amd64 and i386 architectures. This allows you to keep your system up to date with the most recent security fixes from the -stable ports branch.

An article on OpenBSD Journal explains the details:

In practice, this means that as soon as a security fix/update is committed to the OPENBSD_5_3 tree a package will be built from the CVS tree. This package is then being tested and pushed to our fan-out server over at Stable.MTier.org, for everyone to use!

The various BSD systems have a very clear separation into "base system" and "3rd party software (ports/packages)". You upgrade the two separately.

In the case of OpenBSD, assuming you want to move from one stable release to the next stable release (jumping releases is not supported unless you make a fresh install), you start off by reading the specific FAQ for the upgrade you're performing. In the case of upgrading from 5.9 to 6.0, you read the "Upgrade Guide: 5.9 to 6.0".

In general, the gist of it involves booting the installation media for the release you'd like to upgrade to and selecting "(U)pgrade" from the menu. Once the base system is upgraded, you boot it and, as root, upgrade any installed packages with pkg_add -u.

It is unusual for packages belonging to a stable OpenBSD release to update very often. Usually that only happens when critical bugs are fixed. So running pkg_add -u several times a week will probably not do very much (but do keep doing it as it may pull in critical fixes).

If you follow "current", things are very different. Then you'd be building your packages from the ports tree checked out with CVS under /usr/ports, and you would probably be rebuilding the base system manually too (see "Building the System from Source"). Installed ports may be updated with dpb (in /usr/ports/infrastructure/bin) if given the correct options and a list of manually installed packages.

I'm using

#!/bin/sh -x

pkg_info -P -q -m | sort -o "$HOME/packages"
/usr/ports/infrastructure/bin/dpb -scuR -P "$HOME/packages"

Followed by

$ doas pkg_add -u -D unsigned
$ doas pkg_delete -a

This is not encouraged for new users.

I needed to get updates because I installed bash and didn't want to suffer from the Shellshock vulnerability, so I went with Holu's suggestion https://unix.stackexchange.com/a/103661/93476 and it got me patched up.

portupgrade -arR

  • 1
    Updating with OpenBSD with pkg_add is pkg_add -uvi, right? – polemon Oct 30 '11 at 2:56
  • yes – usermane Oct 30 '11 at 3:39

On NetBSD, you usually upgrade pkgsrc to the latest version (which is nothing more than tar -xvzf pkgsrc-version.tar.gz) and updates the installed software individually.

More information on the NetBSD/pkgsrc website:



Hope this helps!

Always read FAQ /manual : http://www.openbsd.org/faq/upgrade58.html

Whenever you go from release to release you need to do packages update as final step.

For me updating NetBSD packages is a command in /usr/pkgsrc:

# cvs update -dP && csup /some-path-to-wip-supfile/netbsd-pkgsrc-wip && pkg_rolling-replace -u

Sorry, NetBSD pkgsrc doesn't support a careless solution. Instead you should use a package manager like nih or pkgin. Under pkgsrc you have to force upgrades that ignores often linked file dependencies. Also copying the new version over the old pkgsrc can bring your pkgsrc tree in an inconsitent state.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.