freebsd-update loop 15.1-RELEASE-p6

joe81tx · Thursday at 12:04 PM

I have freebsd-update cron run every day. I received an email yesterday about 15.1-RELEASE-p6 which I installed. Then today I got another email about the same patch:
src component not installed, skipped
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 15.1-RELEASE from update1.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.
The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem
The following files will be removed as part of updating to
15.1-RELEASE-p6:
/etc/ssl/certs/406c9bb1.0
/etc/ssl/certs/4b718d9b.0

I deleted /etc/ssl/cert.pem, ran freebsd-update fetch, then freebsd-update install and everything succeeded without any errors. But running freebsd-update fetch again still prompts:
The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem
(END)

The following files will be removed as part of updating to
15.1-RELEASE-p6:
/etc/ssl/certs/406c9bb1.0
/etc/ssl/certs/4b718d9b.0
(END)

I fear I will keep getting the same email every day.

fernandel · Thursday at 2:39 PM

I have the same problem with freebsd-update fetch/freebsd-update install as joe81tx
freebsd-version -kru
15.1-RELEASE-p5
15.1-RELEASE-p5
15.1-RELEASE-p6

mer · Thursday at 4:02 PM

Is /etc/ssl/cert.pem expected to remain static or is it something that may get updated as certs are added or removed? If one cat's it, it looks like a "bundle"

Joel Lopes Da Silva · Thursday at 6:37 PM

Same problem on my end as well on my FreeBSD machines that still use `freebsd-update`.

My FreeBSD machines that use `pkgbase` seem unaffected by this problem though.

jaz85 · Thursday at 9:49 PM

I am experiencing exactly the same thing. I receive updates via freebsd-update.

freebsd-version
15.1-RELEASE-p6

freebsd-version -kru
15.1-RELEASE-p5
15.1-RELEASE-p5
15.1-RELEASE-p6

uname -a
FreeBSD super.secret.hostname 15.1-RELEASE-p5 FreeBSD 15.1-RELEASE-p5 releng/15.1-n283639-893c7c99b60d GENERIC amd64

head -n1 /etc/motd
FreeBSD 15.1-RELEASE-p5 (GENERIC) releng/15.1-n283639-893c7c99b60d

head -n1 /var/run/motd
FreeBSD 15.1-RELEASE-p5 (GENERIC) releng/15.1-n283639-893c7c99b60d

uname and motd continue to show -p5 following reboot.

joe81tx · Thursday at 10:40 PM

jaz85 said:
I am experiencing exactly the same thing. I receive updates via freebsd-update.

freebsd-version
15.1-RELEASE-p6

freebsd-version -kru
15.1-RELEASE-p5
15.1-RELEASE-p5
15.1-RELEASE-p6

uname -a
FreeBSD super.secret.hostname 15.1-RELEASE-p5 FreeBSD 15.1-RELEASE-p5 releng/15.1-n283639-893c7c99b60d GENERIC amd64

head -n1 /etc/motd
FreeBSD 15.1-RELEASE-p5 (GENERIC) releng/15.1-n283639-893c7c99b60d

head -n1 /var/run/motd
FreeBSD 15.1-RELEASE-p5 (GENERIC) releng/15.1-n283639-893c7c99b60d

uname and motd continue to show -p5 following reboot.

Because patch 6 did not update the kernel uname and motd will not update. Only the userland (-u) was updated with p6, so the kernel (-k) and running kernel (-r) as reported by freebsd-version will not change.

I ran the command below and then freebsd-update cron did not send an email so hopefully manually removing those two files will help me avoid the daily loop.
mdo rm -f /etc/ssl/certs/406c9bb1.0 /etc/ssl/certs/4b718d9b.0

fernandel · Friday at 10:59 AM

joe81tx said:
Because patch 6 did not update the kernel uname and motd will not update. Only the userland (-u) was updated with p6, so the kernel (-k) and running kernel (-r) as reported by freebsd-version will not change.

I ran the command below and then freebsd-update cron did not send an email so hopefully manually removing those two files will help me avoid the daily loop.
mdo rm -f /etc/ssl/certs/406c9bb1.0 /etc/ssl/certs/4b718d9b.0

But problem with freebsd-update exist still. How long it will be not solved? It is the second time that we users of freebsd-update have a problem.

ttfn · Friday at 2:14 PM

For me, this only seems to be a problem on those servers where the security/ca_root_nss package has been installed. Also, my /etc/ssl/cert.pem doesn't appear to be a link, but a regular file.

fernandel · Friday at 6:27 PM

ttfn said:
For me, this only seems to be a problem on those servers where the security/ca_root_nss package has been installed. Also, my /etc/ssl/cert.pem doesn't appear to be a link, but a regular file.

Mine is regular too and I believe you what you wrote but it is not good from security team that ignore the problem which they were made.

bakul · Friday at 7:27 PM

You may wish to report this via email (to security and/or hackers).

jaz85 · Saturday at 6:48 AM

My machine also has the security/ca_root_nss package installed and /etc/ssl/cert.pm is also a regular file on my machine. I did manually remove the two files (after saving them elsewhere, just in case) that joe81tx mentioned, and it does remove one of the errors/messages that freebsd-update gives me when I run it, but I still get the message about a modified /etc/ssl/cert.pm. I'm pretty sure I and we have the intended /etc/ssl/cert.pem file, but perhaps some bookkeeping that freebsd-update performs must have gotten mixed up. I'm somewhat new to "modern" FreeBSD and definitely new to freebsd-update having started using it in Dec 2025. I did use FreeBSD many Moons ago, but we're talking late '90s and early 2000s. The update process was different back then. I don't know if this is helpful, but my new cert.pem looks like:

-r--r--r-- 1 root wheel 180744 Oct 22 11:07 /etc/ssl/cert.pem
SHA2-256(/etc/ssl/cert.pem)= c3c7ed134bbb50f64aaf2a4c9ea665f46e5bee90603e0e89e9a8cfa03ec283fe

and I'm guessing this is the correct file, and just that freebsd-update is a bit confused about it.

drhowarddrfine · Saturday at 1:56 PM

fwiw, I don't have the problem but I don't have ca_root_nss

fernandel · Saturday at 2:00 PM

I have ca_root_nss because claws-mail has dependencies on it.

fernandel · Saturday at 2:02 PM

jaz85 said:
My machine also has the security/ca_root_nss package installed and /etc/ssl/cert.pm is also a regular file on my machine. I did manually remove the two files (after saving them elsewhere, just in case) that joe81tx mentioned, and it does remove one of the errors/messages that freebsd-update gives me when I run it, but I still get the message about a modified /etc/ssl/cert.pm. I'm pretty sure I and we have the intended /etc/ssl/cert.pem file, but perhaps some bookkeeping that freebsd-update performs must have gotten mixed up. I'm somewhat new to "modern" FreeBSD and definitely new to freebsd-update having started using it in Dec 2025. I did use FreeBSD many Moons ago, but we're talking late '90s and early 2000s. The update process was different back then. I don't know if this is helpful, but my new cert.pem looks like:

-r--r--r-- 1 root wheel 180744 Oct 22 11:07 /etc/ssl/cert.pem
SHA2-256(/etc/ssl/cert.pem)= c3c7ed134bbb50f64aaf2a4c9ea665f46e5bee90603e0e89e9a8cfa03ec283fe

and I'm guessing this is the correct file, and just that freebsd-update is a bit confused about it.

And what happened if you are running freebsd-update fetch, please?

fernandel · Saturday at 4:17 PM

joe81tx said:
Because patch 6 did not update the kernel uname and motd will not update. Only the userland (-u) was updated with p6, so the kernel (-k) and running kernel (-r) as reported by freebsd-version will not change.

I ran the command below and then freebsd-update cron did not send an email so hopefully manually removing those two files will help me avoid the daily loop.
mdo rm -f /etc/ssl/certs/406c9bb1.0 /etc/ssl/certs/4b718d9b.0

After remove those 2 files it works:

Code:

freebsd-update fetch
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 15.1-RELEASE from update2.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 15.1-RELEASE-p6.

kjpetrie · Saturday at 4:53 PM

Why is this notification system checking uname instead of freebsd-version to identify whether the system is up to date? That strikes me as the problem here. If the patch doesn't affect the kernel the kernel version won't change, but if the patchlevel of the system is correct we shouldn't be getting messages telling us we need to update.

jaz85 · Sunday at 12:11 AM

fernandel, as of yesterday, when I ran freebsd-update fetch, I would receive the same error referenced in the first post. After I removed the two files manually (/etc/ssl/certs/406c9bb1.0 and /etc/ssl/certs/4b718d9b.0), freebsd-update fetch would report on the error/message about a modified /etc/ssl/cert.pem:

"The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem"

Just a few minutes ago I applied new pkg patches ("pkg update" followed by "pkg upgrade") and for me that updated three packages:

"Installed packages to be UPGRADED:
bind-tools: 9.20.29 -> 9.20.30 [FreeBSD-ports]
ca_root_nss: 3.131 -> 3.131.1 [FreeBSD-ports]
curl: 8.22.0 -> 8.23.0 [FreeBSD-ports]"

Please note the inclusion of ca_root_nss, which I suspect is important relative to the originally reported issue. Following the installation of the updated packages, I again re-ran freebsd-update fetch and it returned with no error nor messages other than to report that my system appears up-to-date at least relative to what freebsd-update checks:

"sudo freebsd-update fetch

src component not installed, skipped
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 15.1-RELEASE from update2.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

No updates needed to update system to 15.1-RELEASE-p6."

ttfn · Monday at 2:04 PM

jaz85 said:
Just a few minutes ago I applied new pkg patches ("pkg update" followed by "pkg upgrade") and for me that updated three packages:

"Installed packages to be UPGRADED:
bind-tools: 9.20.29 -> 9.20.30 [FreeBSD-ports]
ca_root_nss: 3.131 -> 3.131.1 [FreeBSD-ports]
curl: 8.22.0 -> 8.23.0 [FreeBSD-ports]"

Upgrading "ca_root_nss" also fixed the issues for me.

 Installed packages to be UPGRADED:

        ca_root_nss: 3.131 -> 3.132 [FreeBSD-ports]

All affected servers now show no updates needed with no mention of /etc/ssl/cert.pem.