Messages

Sorry for the lack or replies here franco - I can't find any way to make this forum notify me of replies to topics, which makes it very hard to keep track of anything.  The changes look good.

Okay, modifiying /usr/local/etc/pkg/repos/OPNsense.conf to contain:

Code Select Expand

OPNsense: {
  url: "pkg+http://pkg.opnsense.org/${ABI}/latest",
  mirror_type: "srv",
  priority: 10,
  enabled: yes
}

correctly prioritizes the OPNsense repo over the FreeBSD repo.  So, with CONSERVATIVE_UPGRADE=1 (this may not be necessary with priority, but it seems like the safe option), bumped OPNsense repo priority, and a repository annotation on the base packages, it looks like multiple repos is working pretty optimally.  Did a pkg upgrade to 15.1.6.1 no problem.  I chose priority 10 here so that I can add any additional repositories at a lower priority (I'd like to get this system added to my FreeIPA domain via sssd for example - not yet in the main FreeBSD repos).

I'll take a closer look at opnsense-update when I have a little time, but I'd suggest at least supporting the --help/-h argument to display some usage information.

Right you are, installed vim-light from the OPNsense repo.

If PRIORITY=1 worked, this would be nice, but are you sure that's valid?  I can't find it documented anywhere, and it's not the correct format for the repo config, which is a JSON-like format, as opposed to pkg.conf.  There's already other stuff I'm pulling in from the FreeBSD repos, like duply/duplicity to get this box in my regular backups.

As for opnsense-update, it seems to be lacking a manpage, and:

Code Select Expand

opnsense-update --help
Fetching kernel---help-amd64.txz... fetch: http://pkg.opnsense.org/sets/kernel---help-amd64.txz: Not Found
failed

That's a bit scary...

Thanks franco, for now I'm just running them straight from the FreeBSD repos because I had to get this sorted over the weekend.

I guarantee I'll find other stuff that I need/want.  I've also installed socat, vim(-lite) and bash.

I'm running the latest snapshot, that reports 10.1-RELEASE-p5, so at least for right now, I believe openssl is patched up past the last advisory.  Going forward, is there any analogue to `freebsd-update` that would let us update the base OS for stuff like this?

Thanks for the tip on the pkg query - I haven't run FreeBSD for probably over 10 years, so I'm just sussing all of this out.

Annotations appear to work fine for me on 1.4.12:

Code Select Expand

# pkg --version
1.4.12
# pkg query %n | xargs -I {} pkg annotate -qy -A "{}" repository OPNsense
# pkg annotate -S zip repository
zip-3.0_1: Tag: repository Value: OPNsense


Things I immediately need to install are haproxy and rsync, but having access to the full FreeBSD package list is certainly desirable.

Seems like enabling the:

Code Select Expand

CONSERVATIVE_UPGRADE=yes

option in /usr/local/etc/pkg.conf does the trick.

But stock packages probably need to have their repository set:

Code Select Expand

pkg info | awk '{print $1}' | sed -e 's#-[^-]*$##g' | xargs -I {} pkg annotate -y -A "{}" repository OPNsense

After those two steps, pkg should only try to upgrade from the repository that a package is originally installed from.