[SOLVED] Update failed on ALIX OPNsense 16.1.8-i386

[kurczak]

Hi,

I have OPNsense 16.1.8-i386 (OPNsense-16.1.8-OpenSSL-nano-i386) on ALIX. When I try to update the system get the message:

Code Select Expand

***GOT REQUEST TO UPGRADE: all***
Updating OPNsense repository catalogue...
OPNsense repository is up-to-date.
All repositories are up-to-date.
Updating OPNsense repository catalogue...
OPNsense repository is up-to-date.
All repositories are up-to-date.
Checking for upgrades (88 candidates): .......... done
Processing candidates (88 candidates): ..... done
The following 53 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
opnsense-lang: 16.1.13
p7zip: 15.14

Installed packages to be UPGRADED:
suricata: 3.0_1 -> 3.0.1
strongswan: 5.3.5_4 -> 5.4.0
squid: 3.5.15_1 -> 3.5.17
sqlite3: 3.11.1 -> 3.12.1
smartmontools: 6.4_1 -> 6.4_2
python27: 2.7.11_1 -> 2.7.11_2
py27-Babel: 2.2.0_1 -> 2.3.3
php56-zlib: 5.6.19 -> 5.6.21
php56-xml: 5.6.19 -> 5.6.21
php56-sqlite3: 5.6.19 -> 5.6.21
php56-sockets: 5.6.19 -> 5.6.21
php56-simplexml: 5.6.19 -> 5.6.21
php56-session: 5.6.19 -> 5.6.21
php56-pdo: 5.6.19 -> 5.6.21
php56-openssl: 5.6.19 -> 5.6.21
php56-mcrypt: 5.6.19 -> 5.6.21
php56-ldap: 5.6.19 -> 5.6.21
php56-json: 5.6.19 -> 5.6.21
php56-hash: 5.6.19 -> 5.6.21
php56-gettext: 5.6.19 -> 5.6.21
php56-filter: 5.6.19 -> 5.6.21
php56-dom: 5.6.19 -> 5.6.21
php56-curl: 5.6.19 -> 5.6.21
php56-ctype: 5.6.19 -> 5.6.21
php56: 5.6.19 -> 5.6.21
perl5: 5.20.3_8 -> 5.20.3_12
pcre: 8.38 -> 8.38_1
opnsense-update: 16.1.8 -> 16.1.9_1
opnsense: 16.1.8 -> 16.1.13
openvpn: 2.3.10 -> 2.3.10_2
openssl: 1.0.2_11 -> 1.0.2_12
ntp: 4.2.8p6 -> 4.2.8p7
libedit: 3.1.20150325_1 -> 3.1.20150325_2
curl: 7.47.1 -> 7.48.0_2
bind910: 9.10.3P4 -> 9.10.4
apinger: 0.6.1_4 -> 0.6.1_9

Installed packages to be REINSTALLED:
openldap-client-2.4.44
lzo2-2.09
libyaml-0.1.6_2
libxml2-2.9.3
libucl-0.8.0
libnet-1.1.6_4,1
libmcrypt-2.5.8_3
libltdl-2.4.6
libhtp-0.5.18
libffi-3.2.1
libevent2-2.0.22_1
jansson-2.7_1
idnkit-1.0_5
gettext-runtime-0.19.7
GeoIP-1.6.9

The process will require 10 MiB more space.
61 MiB to be downloaded.
Restarting webConfigurator...done.
***DONE***

How to fix this?

[jhh]

Hi,

could you please try this:

edit /usr/local/etc/pkg/repos/origin.conf
change url from http to https. url looks like this afterwards:
url: "pkg+https://pkg.opnsense.org/${ABI}/16.1/latest"

run update again.

Regards,

Joerg

[kurczak]

edit /usr/local/etc/pkg/repos/origin.conf
change url from http to https. url looks like this afterwards:
url: "pkg+https://pkg.opnsense.org/${ABI}/16.1/latest"

Thanks for the advice but still don't work. I tried upgrade from console and I found the cause

Code Select Expand

pkg-static: Not enough space in /var/cache/pkg, needed 61 MiB available 17 MiB


Code Select Expand

df -h
Filesystem            Size    Used   Avail Capacity  Mounted on
/dev/ufs/OPNsense0    1.8G    644M    1.0G    38%    /
devfs                 1.0K    1.0K      0B   100%    /dev
tmpfs                  18M    452K     18M     2%    /tmp
tmpfs                  33M     15M     18M    45%    /var
devfs                 1.0K    1.0K      0B   100%    /var/dhcpd/dev


Code Select Expand

mount
/dev/ufs/OPNsense0 on / (ufs, local, noatime, soft-updates)
devfs on /dev (devfs, local, multilabel)
tmpfs on /tmp (tmpfs, local)
tmpfs on /var (tmpfs, local)
devfs on /var/dhcpd/dev (devfs, local, multilabel)

4GB Flash Card is too small?

[fabian]

4GB Flash Card is too small?

no but /var is not on your flash - it is a tmpfs which is too small (33MB)

[franco]

The RAM on ALIX is not sufficient for larger updates, we recommend 512 MB RAM for that reason.

We're fixing these issues to write to the SD card instead with an upcoming 16.1.x version, but the real issue is that although we've adopted our tools, we found an upstream bug in the FreeBSD package manager that prevents rollout for a least a couple of more works.

You can disable the /var /tmp MFS in System: Settings: Misc. and reboot to be able to perform the upgrade.

The update to RAM was nice as it does not grind the flash cards and is a lot speedier than writing persistent memory. Now for Nano in 16.7 and beyond that changes in order to allow backwards-compatibility with older hardware out of our own specifications.

In any case, please consider buy new hardware. Issues will be bigger once we migrate to ASLR and there is some beef with i386 platforms that we will have to go through...


Cheers,
Franco

[gpac]

As mentionned in 15.7 forum (https://forum.opnsense.org/index.php?topic=1241.30) there is a workaround with an additionnal USB stick used to cope with larger update.

Please note I had to change my batch file on 16.1.14 with the last 2 lines (since now upgrades seems to use also /var/cache/opnsense-update) :

mkdir -p /var/cache/pkg
fsck -y -t ufs /dev/da0p1
mount /dev/da0p1 /var/cache/pkg
mkdir -p /tmp/opnsense-update
fsck -y -t ufs /dev/da0p2
mount /dev/da0p2 /tmp/opnsense-update
mkdir -p /var/cache/opnsense-update
mount -t nullfs /tmp/opnsense-update /var/cache/opnsense-update

Best regards.

[franco]

/tmp/opnsense-update moved to /var/cache/opnsense-update for consistency with e.g. FreeBSD package management tool that would push its downloads into /var/cache/pkg.

The current -devel version has code for moving the updates to a permanent storage even with the /var MFS setting, but it requires us to upgrade to pkg 1.8 as 1.7 had a bug with directory symlinks. pkg 1.8 has other changes that need testing and manual coding from our side to stay consistent with 1.7 in some areas, so the whole thing drags on, but I'm confident that this will be all settled with 16.7.


Cheers,
Franco