issue with update with pkg manager? segmentation fault.

[edomatic4576]

Hi Team,

I am running opnsense 26.1.8_5 but have this issue when i do upgrade check that the package manager does this:
"Upgrading package manager from version '2.5.1' to '2.3.1_1'"
Also i see my zenarmor and crowdsec as orphaned packages in the output of plugins?

Here is the health check and update output, tell me if more is needed:

***GOT REQUEST TO CHECK FOR UPDATES***
Currently running OPNsense 26.1.8_5 (amd64) at Sat May 23 17:03:47 CEST 2026
Fetching changelog information, please wait... done
Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching data: .......... done
Processing entries: .......... done
OPNsense repository update completed. 928 packages processed.
All repositories are up to date.
Child process pid=20934 terminated abnormally: Segmentation fault
Upgrading package manager from version '2.5.1' to '2.3.1_1'
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
OPNsense is up to date.
Checking integrity... done (0 conflicting)
Your packages are up to date.
Child process pid=27872 terminated abnormally: Segmentation fault
Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching data: .......... done
Processing entries: .......... done
OPNsense repository update completed. 928 packages processed.
All repositories are up to date.
Child process pid=32060 terminated abnormally: Segmentation fault
Checking for upgrades (145 candidates): .......... done
Processing candidates (145 candidates): . done
Checking integrity... done (0 conflicting)
Your packages are up to date.
***DONE***

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 26.1.8_5 (amd64) at Sat May 23 17:02:50 CEST 2026
>>> Root file system: zroot/ROOT/default
>>> Check installed kernel version
Version 26.1.7 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 26.1.7 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
os-crowdsec 1.0.12
os-ddclient 1.31
os-haproxy 5.1
os-intrusion-detection-content-et-open 1.0.2_2
os-intrusion-detection-content-ptopen 1.0
os-isc-dhcp 1.0_4
os-ntopng 1.3
os-redis 1.1_4
>>> Check locked packages
pkg-2.5.1
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" at 26.1.8_5 has 68 dependencies to check.
Checking packages: ................................................
pkg-2.5.1 repository mismatch: FreeBSD
pkg-2.5.1 version mismatch, expected 2.3.1_1
Checking packages: ..................... done
***DONE***

[nero355]

I am running opnsense 26.1.8_5 but have this issue when i do upgrade check that the package manager does this:
"Upgrading package manager from version '2.5.1' to '2.3.1_1'"

There are multiple topics and posts about the whole PKG weirdness that occurs for some people so grab the Forum Search and see what applies to you in those olders topics and posts :)

[newsense]

Nothing applies to this user!

Somehow they've got a new a new level of hell where while being oblivious (?) to any changes they manage to get the incompatible pkg from the FreeBSD repo and then cemented their choice by locking pkg to make sure the breakage is consistent and nonfixable by the available tools.

Pkg now needs to be unlocked, downgraded to the OPN version then future upgrades can proceed.

[franco]

Well at least if it's locked this works ;)

# opnsense-revert pkg

Ironically the segfault is from libcurl for which we have a workaround. And pkg already abandoned libcurl to go back to libfetch in more recent 2.x.


Cheers,
Franco

[nero355]

Nothing applies to this user!

As we say here : "Did not know you would get mad!"

LOL! :P

[edomatic4576]

ok so i did the following and hopefully solved it this way:
started with the unlocking of the package:
pkg unlock pkg
pkg-2.5.1: unlock this package? [y/N]: y
Unlocking pkg-2.5.1

then force installed 2.3.1_1 :

pkg install -fy pkg-2.3.1_1
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be DOWNGRADED:
   pkg: 2.5.1 -> 2.3.1_1 [OPNsense]

Number of packages to be downgraded: 1

The process will require 2 MiB more space.
6 MiB to be downloaded.
[1/1] Fetching pkg-2.3.1_1: 100%    6 MiB   6.6 M/s    00:01   
Checking integrity... done (0 conflicting)
[1/1] Downgrading pkg from 2.5.1 to 2.3.1_1...
[1/1] Extracting pkg-2.3.1_1: 100%
Child process pid=27169 terminated abnormally: Segmentation fault

Then proceeded with:

# opnsense-revert pkg

pkg-static: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
pkg-static: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
pkg-static: warning: database version 37 is newer than libpkg(3) version 36, but still compatible

No packages are required to be fetched.
Integrity check was successful.
pkg-static: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
pkg-2.3.1_1: already unlocked
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
pkg-static: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
Checking integrity... done (0 conflicting)
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
   pkg-2.3.1_1 [OPNsense]

Number of packages to be reinstalled: 1
[1/1] Reinstalling pkg-2.3.1_1...
[1/1] Extracting pkg-2.3.1_1: 100%
pkg-static: warning: database version 37 is newer than libpkg(3) version 36, but still compatible

Finally : opnsense-revert pkg

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 26.1.8_5 (amd64) at Thu May 28 17:28:29 CEST 2026
>>> Root file system: zroot/ROOT/default
>>> Check installed kernel version
Version 26.1.7 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 26.1.7 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
pkg: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
os-crowdsec 1.0.12
os-ddclient 1.31
os-haproxy 5.1
os-intrusion-detection-content-et-open 1.0.2_2
os-intrusion-detection-content-ptopen 1.0
os-isc-dhcp 1.0_4
os-ntopng 1.3
os-redis 1.1_4
>>> Check locked packages
pkg: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
>>> Check for missing package dependencies
pkg: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
Checking all packages: .......... done
>>> Check for missing or altered package files
pkg: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" at 26.1.8_5 has 68 dependencies to check.
Checking packages: ..................................................................... done
***DONE***

I hope this solved it, if i need to run something else, please let me know.

Thanks,
Ed

[LuanaMiller]

Looks like you're in a much better place now. The downgrade/reinstall path you followed is basically the correct recovery procedure when pkg gets replaced by the FreeBSD version instead of the OPNsense-maintained one. The locked package was probably what kept the system stuck in that broken state and prevented normal upgrades from fixing themselves automatically.

The remaining "database version 37 is newer than libpkg(3) version 36" warnings are pretty normal after forcing pkg backwards. Usually they disappear after the next proper pkg update cycle once everything is aligned again. The important thing is that your health audit now completes without repository mismatch or dependency errors.

I'd probably run another reboot just to ensure no stale libraries or processes are hanging around, then do another update check afterwards. If the segfaults are gone and the repo mismatch stays resolved, you should be fine.

Also worth checking that none of the FreeBSD repos are enabled anywhere under pkg config. That's often how these situations start in the first place, especially after experimenting with plugins or third-party instructions.

[edomatic4576]

thanks for you response , following it, i checked the repos and it looks ok?

in the /usr/local/etc/pkg/repos which should override the base conf file has the freeBSD repo to disabled.
 

cat /etc/pkg/FreeBSD.conf
#
# To disable this repository, instead of modifying or removing this file,
# create a /usr/local/etc/pkg/repos/FreeBSD.conf file:
#
#   mkdir -p /usr/local/etc/pkg/repos
#   echo "FreeBSD: { enabled: no }" > /usr/local/etc/pkg/repos/FreeBSD.conf
#

FreeBSD: {
  url: "pkg+https://pkg.freebsd.org/${ABI}/quarterly",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/share/keys/pkg",
  enabled: yes
}
FreeBSD-kmods: {
  url: "pkg+https://pkg.freebsd.org/${ABI}/kmods_quarterly_${VERSION_MINOR}",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/share/keys/pkg",
  enabled: yes
}

# ls /usr/local/etc/pkg/repos/
FreeBSD.conf         OPNsense-aux.conf      OPNsense.conf         SunnyValley.conf
FreeBSD.conf.sample      OPNsense-aux.conf.sample   OPNsense.conf.sample      SunnyValley.conf.sample

cat /usr/local/etc/pkg/repos/*.conf

FreeBSD: { enabled: no }
FreeBSD-kmods: { enabled: no }
OPNsense-aux: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/OPNsense",
  url: "https://pkg.opnsense.org/${ABI}/26.1/aux",
  signature_type: "fingerprints",
  priority: 11,
  enabled: no