OPNsense 26.1.2_5 → 26.1.4 Upgrade Fails – python313 size mismatch / pkg cannot

[nmthang282]

Code Select Expand

***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.1.2_5 (amd64) at Fri Mar 13 16:40:51 +07 2026
Updating OPNsense repository catalogue...
Waiting for another process to update repository OPNsense
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (117 candidates): .......... done
Processing candidates (117 candidates): .. done
The following 68 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
colordiff: 1.0.22
py313-Babel: 2.18.0
py313-Jinja2: 3.1.6
py313-aioquic: 1.3.0_1
py313-anyio: 4.12.1
py313-async_generator: 1.10_1
py313-attrs: 25.4.0
py313-bottleneck: 1.6.0
py313-certifi: 2026.1.4
py313-cffi: 2.0.0
py313-charset-normalizer: 3.4.4
py313-cryptography: 46.0.4,1
py313-dnspython: 2.8.0_1,1
py313-duckdb: 1.4.4
py313-h11: 0.16.0
py313-h2: 4.1.0_1
py313-hpack: 4.0.0_1
py313-httpcore: 1.0.9
py313-httpx: 0.28.1_1
py313-hyperframe: 6.0.0_1
py313-idna: 3.11
py313-jq: 1.11.0
py313-ldap3: 2.9.1_1
py313-markupsafe: 3.0.3
py313-numexpr: 2.14.1
py313-numpy: 1.26.4_12,1
py313-outcome: 1.3.0_2
py313-packaging: 26.0
py313-pandas: 2.3.3,1
py313-pyasn1: 0.6.0
py313-pyasn1-modules: 0.4.1
py313-pycparser: 2.23
py313-pylsqpack: 0.3.23
py313-pyopenssl: 25.3.0_1,1
py313-pysocks: 1.7.1_1
py313-python-dateutil: 2.9.0
py313-pytz: 2025.2_1,1
py313-pyyaml: 6.0.3
py313-requests: 2.32.5
py313-service-identity: 24.2.0
py313-six: 1.17.0
py313-sniffio: 1.3.1
py313-socksio: 1.0.0_1
py313-sortedcontainers: 2.4.0_1
py313-sqlite3: 3.13.12_10
py313-trio: 0.33.0
py313-truststore: 0.10.4
py313-tzdata: 2025.3
py313-ujson: 5.11.0
py313-urllib3: 2.6.3,1
py313-vici: 6.0.3
python313: 3.13.12

Installed packages to be UPGRADED:
dnsmasq: 2.92,1 -> 2.92_2,1
jansson: 2.14.1 -> 2.15.0
libucl: 0.9.3 -> 0.9.4
libunistring: 1.4.1 -> 1.4.2
libxml2: 2.15.1_1 -> 2.15.2
nss: 3.120 -> 3.121
opnsense: 26.1.2_5 -> 26.1.4
opnsense-installer: 25.1_1 -> 25.1_2
opnsense-lang: 26.1.1 -> 26.1.4
opnsense-update: 26.1.1_1 -> 26.1.3
strongswan: 6.0.3_1 -> 6.0.4
suricata: 8.0.3_1 -> 8.0.3_2
syslog-ng: 4.10.2 -> 4.11.0

Installed packages to be REINSTALLED:
glib-2.84.4,2 (direct dependency changed: python313)
kea-3.0.2_1 (direct dependency changed: python313)
unbound-1.24.2_1 (direct dependency changed: python313)

Number of packages to be installed: 52
Number of packages to be upgraded: 13
Number of packages to be reinstalled: 3

The process will require 500 MiB more space.
120 MiB to be downloaded.
[1/52] Fetching python313-3.13.12.pkg:
pkg-static: cached package python313-3.13.12: missing or size mismatch, fetching from remote
[2/52] Fetching python313-3.13.12.pkg:
pkg-static: cached package python313-3.13.12: missing or size mismatch, cannot continue
Consider running 'pkg update -f'
[3/52] Fetching python313-3.13.12.pkg: ..
Hi OPNsense team,

I'm currently running:

OPNsense 26.1.2_5 (amd64)
Fri Mar 13 16:40:51 +07 2026

When attempting to upgrade to 26.1.4, the update process fails with the following error:

pkg-static: cached package python313-3.13.12: missing or size mismatch, fetching from remote
pkg-static: cached package python313-3.13.12: missing or size mismatch, cannot continue
Consider running 'pkg update -f'

Upgrade summary:

52 new packages (mostly python313 related)

13 upgrades

3 reinstalled (glib, kea, unbound – direct dependency changed: python313)

120 MiB download

500 MiB additional space required

The process stops during fetching python313.

Questions:

Is this related to repository sync issues?

Is it safe to run pkg clean -a -f and pkg update -f on production?

Is there any known issue with the Python 3.13 migration in 26.1.4?

Thank you for your assistance.

[franco]

Can you run the cleanup audit and retry?


Cheers,
Franco

[nmthang282]

Dear Franco,

The issue was resolved after rebooting OPNsense as you suggested, and the system is working normally now.

However, the audit still shows a kernel/base version mismatch (26.1.1 installed, expected 26.1.3). The kernel update previously failed with a "signature invalid" error, so it seems the update did not complete.
Thanks again for your help.

Code Select Expand

***GOT REQUEST TO AUDIT HEALTH*** Currently running OPNsense 26.1.4 (amd64) at Mon Mar 16 15:49:38 +07 2026 >>> Root file system: zroot/ROOT/default >>> Check installed kernel version Version 26.1.1 is incorrect, expected: 26.1.3 >>> Check for missing or altered kernel files No problems detected. >>> Check installed base version Version 26.1.1 is incorrect, expected: 26.1.3 >>> Check for missing or altered base files No problems detected. >>> Check installed repositories OPNsense (Priority: 11) >>> Check installed plugins No plugins found. >>> Check locked packages No locks found. >>> Check for missing package dependencies Checking all packages: .......... done >>> Check for missing or altered package files Checking all packages: .......... done >>> Check for core packages consistency Core package "opnsense" at 26.1.4 has 68 dependencies to check. Checking packages: ..................................................................... done ***DONE***


[franco]

Well, looks like you have general trouble downloading update files? Is this a 5G/LTE mobile connection?


Cheers,
Franco

[nmthang282]

Dear Franco,

Thank you for your reply.

No, this system is not using a 5G/LTE mobile connection. It is connected through a wired fiber connection from my ISP (Viettel). The internet connection is generally stable, but it seems the update download might have failed earlier.

I have already run the cleanup and tried checking for updates again. The system is working normally at the moment, although the audit still reports the kernel/base version mismatch.

[newsense]

Try to update manually and post here the output:

Code Select Expand

opnsense-update -bkr 26.1.3
If no errors show up reboot the machine when asked.

[nmthang282]

Dear Franco and newsense ,

After running cleanup and retrying the update a few times, the update completed successfully. The kernel and base are now in sync, and the audit no longer reports any issues.

Everything is working normally now.

Thank you for your support.

[adk20]

Dear forum,

I am getting this error when running a health audit:

Code Select Expand

python313-3.13.13: checksum mismatch for /usr/local/lib/python3.13/__pycache__/weakref.cpython-313.pyc
Neither a reboot nor running a cleanup job fixed it.

I am currently on 26.1.7_3 but the issue had been present also in 26.1.6 or maybe even .5.

Any thoughts or ideas are much valued.

[franco]

Reinstall python313 package from firmware packages tab?


Cheers,
Franco

[adk20]

Thanks, Franco, good call. This indeed fixed the issue.

Two more questions, if I may:
* Did this condition constitute a security risk whatsoever?
* What may have been the root cause of it?

[franco]

File system inconsistency or perhaps early indication of disk failures. Wouldn't think this is a security issue.

Python has a lot of small files that need to be written. From a FreeBSD disk expert I once got the answer that the disks lie more often than they should when they were supposed to sync data. Or it had to do with power loss / unclean shutdown.


Cheers,
Franco