OPNsense Forum
English Forums => Development and Code Review => Topic started by: interfaSys on March 08, 2016, 01:25:33 pm
-
This is what I get when trying to install the generated packages
# cd /usr/tools
# make base
# cd /tmp/sets
# pkg add -f base-16.7.a_15-amd64.txz
pkg: base-16.7.a_15-amd64.txz is not a valid package: no manifest found
Failed to install the following 1 package(s): base-16.7.a_15-amd64.txz
-
Base/kernel are not packages, just release tarballs that FreeBSD's build provides (base.txz and kernel.txz).
This command sequence is probably what you want:
https://github.com/opnsense/update/blob/master/update/opnsense-update.sh#L235-L244
opnsense-update can fetch sets from remote locations, it would need a command line switch to install the set from a flat file, something like the following (not implemented!).
# opnsense-update -K kernel-16.7.a_15-amd64.txz
# opnsense-update -B base-16.7.a_15-amd64.txz
# opnsense-update -O base-16.7.a_15-amd.obsolete
It would probably also need to honour the "-i" flag, which means insecure as in don't try to verify against a $SET.sig file. Signature verification should remain the default. :)
It will be really tricky not to break the system with a manual sequence through an ABI push, especially applying a new base set without the associated kernel, but I'm not against adding these flags. Incidentally, I have this on my firmware TODO list... Changes would be small, testing is harder as it may leave your system in a dysfunctional state.
FWIW, FreeBSD is doing proper base packaging for 11.0, which we'll adapt eventually so there is no use over-engineering the current upgrade method.
-
Base/kernel are not packages, just release tarballs that FreeBSD's build provides (base.txz and kernel.txz).
This command sequence is probably what you want:
https://github.com/opnsense/update/blob/master/update/opnsense-update.sh#L235-L244
A, thanks. I might try that.
opnsense-update can fetch sets from remote locations, it would need a command line switch to install the set from a flat file, something like the following (not implemented!).
# opnsense-update -K kernel-16.7.a_15-amd64.txz
# opnsense-update -B base-16.7.a_15-amd64.txz
# opnsense-update -O base-16.7.a_15-amd.obsolete
It would probably also need to honour the "-i" flag, which means insecure as in don't try to verify against a $SET.sig file. Signature verification should remain the default. :)
Some thing like moving the signature check outside of fetch_set and creating something like DO_BASE_LOCAL and DO_KERNEL_LOCAL which would check the sig (or not) and call their respective, existing installation sub-routine?
It will be really tricky not to break the system with a manual sequence through an ABI push, especially applying a new base set without the associated kernel, but I'm not against adding these flags. Incidentally, I have this on my firmware TODO list... Changes would be small, testing is harder as it may leave your system in a dysfunctional state.
FWIW, FreeBSD is doing proper base packaging for 11.0, which we'll adapt eventually so there is no use over-engineering the current upgrade method.
I agree. I only modified the kernel (disabled what I don't need or what hinders performance), but thought I could "make base" as well although I expect very little difference in terms of performance.
I would never use it to switch major platform, it's too risky unless you know OPNsense really well. Maybe make it clear that it's an unsupported upgrade path? I don't think it's too much of a problem to go temporarily to a vanilla platform.
And yes, base packaging will be great :)
-
I found something simpler, take a look:
https://github.com/opnsense/update/commit/edbe10e1406f3448a9b52e7c5e1f70cd05123a9e
Given that you've updated to the next version and want to replace your kernel, this is your command now:
# opnsense-update -ifkl /your/local/dir
o "-i" is for insecure, you don't have a signature to verify
o "-f" means force, you override the current kernel
o "-k" means kernel only
o "-l /your/local/dir" is the directory where the set is stored
You can also update base with this, just remember to also copy the *.obsolete file as it's needed for a clean upgrade:
# opnsense-update -ifbl /your/local/dir
o "-b" is for base only
"-b" and "-k" can be combined, that's how it's usually run from the firmware code.
-
Well done. I'll give it a go once I've updated to 16.1.6.
And thank you :)
-
No problem. Note that this feature is not on 16.1.6, you'll need to pull it from the git.