freebsd-update loop 15.1-RELEASE-p6

J

joe81tx

I have freebsd-update cron run every day. I received an email yesterday about 15.1-RELEASE-p6 which I installed. Then today I got another email about the same patch:
src component not installed, skipped
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 15.1-RELEASE from update1.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.
The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem
The following files will be removed as part of updating to
15.1-RELEASE-p6:
/etc/ssl/certs/406c9bb1.0
/etc/ssl/certs/4b718d9b.0

I deleted /etc/ssl/cert.pem, ran freebsd-update fetch, then freebsd-update install and everything succeeded without any errors. But running freebsd-update fetch again still prompts:
The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem
(END)

The following files will be removed as part of updating to
15.1-RELEASE-p6:
/etc/ssl/certs/406c9bb1.0
/etc/ssl/certs/4b718d9b.0
(END)

I fear I will keep getting the same email every day.
 
Is /etc/ssl/cert.pem expected to remain static or is it something that may get updated as certs are added or removed? If one cat's it, it looks like a "bundle"
 
I am experiencing exactly the same thing. I receive updates via freebsd-update.

freebsd-version
15.1-RELEASE-p6

freebsd-version -kru
15.1-RELEASE-p5
15.1-RELEASE-p5
15.1-RELEASE-p6

uname -a
FreeBSD super.secret.hostname 15.1-RELEASE-p5 FreeBSD 15.1-RELEASE-p5 releng/15.1-n283639-893c7c99b60d GENERIC amd64

head -n1 /etc/motd
FreeBSD 15.1-RELEASE-p5 (GENERIC) releng/15.1-n283639-893c7c99b60d

head -n1 /var/run/motd
FreeBSD 15.1-RELEASE-p5 (GENERIC) releng/15.1-n283639-893c7c99b60d

uname and motd continue to show -p5 following reboot.
 
jaz85 said:
I am experiencing exactly the same thing. I receive updates via freebsd-update.

freebsd-version
15.1-RELEASE-p6

freebsd-version -kru
15.1-RELEASE-p5
15.1-RELEASE-p5
15.1-RELEASE-p6

uname -a
FreeBSD super.secret.hostname 15.1-RELEASE-p5 FreeBSD 15.1-RELEASE-p5 releng/15.1-n283639-893c7c99b60d GENERIC amd64

head -n1 /etc/motd
FreeBSD 15.1-RELEASE-p5 (GENERIC) releng/15.1-n283639-893c7c99b60d

head -n1 /var/run/motd
FreeBSD 15.1-RELEASE-p5 (GENERIC) releng/15.1-n283639-893c7c99b60d

uname and motd continue to show -p5 following reboot.
Click to expand...
Because patch 6 did not update the kernel uname and motd will not update. Only the userland (-u) was updated with p6, so the kernel (-k) and running kernel (-r) as reported by freebsd-version will not change.

I ran the command below and then freebsd-update cron did not send an email so hopefully manually removing those two files will help me avoid the daily loop.
mdo rm -f /etc/ssl/certs/406c9bb1.0 /etc/ssl/certs/4b718d9b.0
 
joe81tx said:
Because patch 6 did not update the kernel uname and motd will not update. Only the userland (-u) was updated with p6, so the kernel (-k) and running kernel (-r) as reported by freebsd-version will not change.

I ran the command below and then freebsd-update cron did not send an email so hopefully manually removing those two files will help me avoid the daily loop.
mdo rm -f /etc/ssl/certs/406c9bb1.0 /etc/ssl/certs/4b718d9b.0
Click to expand...
But problem with freebsd-update exist still. How long it will be not solved? It is the second time that we users of freebsd-update have a problem.
 
My machine also has the security/ca_root_nss package installed and /etc/ssl/cert.pm is also a regular file on my machine. I did manually remove the two files (after saving them elsewhere, just in case) that joe81tx mentioned, and it does remove one of the errors/messages that freebsd-update gives me when I run it, but I still get the message about a modified /etc/ssl/cert.pm. I'm pretty sure I and we have the intended /etc/ssl/cert.pem file, but perhaps some bookkeeping that freebsd-update performs must have gotten mixed up. I'm somewhat new to "modern" FreeBSD and definitely new to freebsd-update having started using it in Dec 2025. I did use FreeBSD many Moons ago, but we're talking late '90s and early 2000s. The update process was different back then. I don't know if this is helpful, but my new cert.pem looks like:

-r--r--r-- 1 root wheel 180744 Oct 22 11:07 /etc/ssl/cert.pem
SHA2-256(/etc/ssl/cert.pem)= c3c7ed134bbb50f64aaf2a4c9ea665f46e5bee90603e0e89e9a8cfa03ec283fe

and I'm guessing this is the correct file, and just that freebsd-update is a bit confused about it.
 
jaz85 said:
My machine also has the security/ca_root_nss package installed and /etc/ssl/cert.pm is also a regular file on my machine. I did manually remove the two files (after saving them elsewhere, just in case) that joe81tx mentioned, and it does remove one of the errors/messages that freebsd-update gives me when I run it, but I still get the message about a modified /etc/ssl/cert.pm. I'm pretty sure I and we have the intended /etc/ssl/cert.pem file, but perhaps some bookkeeping that freebsd-update performs must have gotten mixed up. I'm somewhat new to "modern" FreeBSD and definitely new to freebsd-update having started using it in Dec 2025. I did use FreeBSD many Moons ago, but we're talking late '90s and early 2000s. The update process was different back then. I don't know if this is helpful, but my new cert.pem looks like:

-r--r--r-- 1 root wheel 180744 Oct 22 11:07 /etc/ssl/cert.pem
SHA2-256(/etc/ssl/cert.pem)= c3c7ed134bbb50f64aaf2a4c9ea665f46e5bee90603e0e89e9a8cfa03ec283fe

and I'm guessing this is the correct file, and just that freebsd-update is a bit confused about it.
Click to expand...
And what happened if you are running freebsd-update fetch, please?
 
joe81tx said:
Because patch 6 did not update the kernel uname and motd will not update. Only the userland (-u) was updated with p6, so the kernel (-k) and running kernel (-r) as reported by freebsd-version will not change.

I ran the command below and then freebsd-update cron did not send an email so hopefully manually removing those two files will help me avoid the daily loop.
mdo rm -f /etc/ssl/certs/406c9bb1.0 /etc/ssl/certs/4b718d9b.0
Click to expand...
After remove those 2 files it works:
Code: 
freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 15.1-RELEASE from update2.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 15.1-RELEASE-p6.
 
Why is this notification system checking uname instead of freebsd-version to identify whether the system is up to date? That strikes me as the problem here. If the patch doesn't affect the kernel the kernel version won't change, but if the patchlevel of the system is correct we shouldn't be getting messages telling us we need to update.
 
fernandel, as of yesterday, when I ran freebsd-update fetch, I would receive the same error referenced in the first post. After I removed the two files manually (/etc/ssl/certs/406c9bb1.0 and /etc/ssl/certs/4b718d9b.0), freebsd-update fetch would report on the error/message about a modified /etc/ssl/cert.pem:

"The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem"

Just a few minutes ago I applied new pkg patches ("pkg update" followed by "pkg upgrade") and for me that updated three packages:

"Installed packages to be UPGRADED:
bind-tools: 9.20.29 -> 9.20.30 [FreeBSD-ports]
ca_root_nss: 3.131 -> 3.131.1 [FreeBSD-ports]
curl: 8.22.0 -> 8.23.0 [FreeBSD-ports]"

Please note the inclusion of ca_root_nss, which I suspect is important relative to the originally reported issue. Following the installation of the updated packages, I again re-ran freebsd-update fetch and it returned with no error nor messages other than to report that my system appears up-to-date at least relative to what freebsd-update checks:

"sudo freebsd-update fetch

src component not installed, skipped
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 15.1-RELEASE from update2.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 15.1-RELEASE-p6."
 
jaz85 said:
Just a few minutes ago I applied new pkg patches ("pkg update" followed by "pkg upgrade") and for me that updated three packages:

"Installed packages to be UPGRADED:
bind-tools: 9.20.29 -> 9.20.30 [FreeBSD-ports]
ca_root_nss: 3.131 -> 3.131.1 [FreeBSD-ports]
curl: 8.22.0 -> 8.23.0 [FreeBSD-ports]"
Click to expand...
Upgrading "ca_root_nss" also fixed the issues for me.

Installed packages to be UPGRADED:
ca_root_nss: 3.131 -> 3.132 [FreeBSD-ports]

All affected servers now show no updates needed with no mention of /etc/ssl/cert.pem.
 
Same over here:

Code: 
# freebsd-update install; freebsd-update fetch; freebsd-update updatesready
No updates are available to install.

[...]
Preparing to download files... done.
The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem
The following files will be removed as part of updating to
15.1-RELEASE-p6:
/etc/ssl/certs/406c9bb1.0
/etc/ssl/certs/4b718d9b.0

There are updates available to install.
Run 'freebsd-update [options] install' to proceed.

# freebsd-update install; freebsd-update fetch; freebsd-update updatesready
Creating snapshot of existing boot environment... done.
Installing updates...
Restarting sshd after upgrade
Performing sanity check on sshd configuration.
Stopping sshd.
Waiting for PIDS: 60973.
Performing sanity check on sshd configuration.
Starting sshd.
 done.

[....]
Preparing to download files... done.
The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem
The following files will be removed as part of updating to
15.1-RELEASE-p6:
/etc/ssl/certs/406c9bb1.0
/etc/ssl/certs/4b718d9b.0

There are updates available to install.
Run 'freebsd-update [options] install' to proceed.

Where did you get ca_root_nss 3.132 from? Oh, it's available for amd64 only, I guess I have to wait a bit longer on aarch64:

Code: 
$ curl -sL https://pkg.freebsd.org/FreeBSD:15:aarch64/latest/data.pkg | zstd -dc | tar -O -xf - data | jq | grep -A2 'name.*ca_root_nss'
      "name": "ca_root_nss",
      "origin": "security/ca_root_nss",
      "version": "3.131",

$ curl -sL https://pkg.freebsd.org/FreeBSD:15:amd64/latest/data.pkg | zstd -dc | tar -O -xf - data | jq | grep -A2 'name.*ca_root_nss'
      "name": "ca_root_nss",
      "origin": "security/ca_root_nss",
      "version": "3.132",
 
cb0gus said:
Same over here:
[...] I guess I have to wait a bit longer on aarch64
Click to expand...
This then is a problem relating to freebsd-update(8) and security/ca_root_nss for at least amd64 and aarch64.

The only thing that mentions ca_root_nss (nothing from the hacker ML seems to be mentioned) seems to be ca_root_nss -- trusted root certificate from compromised CA eMudhra and, maybe, PR 299630

I'd report this as mentioned by bakul as it may not have been reported and, as security/ca_root_nss is maintained by ports-secteam@FreeBSD.org, they probably would like to know about it too.
(I don't use security/ca_root_nss myself.)
 
What I find interesting is if I do pkg which /etc/ssl/cert.pem returns "/etc/ssl/cert.pem was not found in the database".
This is on a traditional system, not a pkgbase system.

So does ca_root_nss actually update that file? Or is it supposed to be part of "freebsd base"?
Or is there a base version that gets updated/modified when you pkg install ca_root_nss?
 
You must log in or register to reply here.
Back
Top