Call for testing: pkgbase support in 15.0

if you want to create jails with pkgbase, this is pretty simple: pkg -r /jails/myjail install FreeBSD-set-base.
How can I find out what the different meta-packages are and which packages they pull in?

More generally: suppose I want to create a jail that supports dynamic linking, as well as init (for rc.d) but not a shell. How do I know which packages I install?
 
How can I find out what the different meta-packages are and which packages they pull in?

for now the best way to find the available set packages is to run pkg search FreeBSD-set- and look at descriptions. i'm working on a manpage for this, but it hasn't landed yet.

More generally: suppose I want to create a jail that supports dynamic linking, as well as init (for rc.d) but not a shell. How do I know which packages I install?

you can't use rc(8) without a shell, so there's no way to do that. theoretically you may be able to convince pkg(8) to install FreeBSD-rc without FreeBSD-runtime, but rcorder(8) also requires libutil from the FreeBSD-runtime package, which is where /bin/sh lives.

if you're trying to build a system which has FreeBSD /sbin/init but you're providing a custom replacement for rc(8) that doesn't require a shell, that sort of configuration isn't really supported in pkgbase right now, but you may be able to play with the pkg FILES_IGNORE_GLOB option to get something suitable.
 
Code:
With pkgbase landing in 15.0, I decided that it's time to announce the
timeline for deprecation of the legacy "distribution sets".  Here's the
plan:

15.0-RELEASE:
* PKGBASE becomes the default in release/Makefile and a new NOPKGBASE
option is added.
* The installer supports both install options, with dist sets marked
as "legacy" in the pick-how-to-install menu.
* The disc1 images only contain a pkgbase repo; people who want to install
from disc1 without pkgbase will need an internet connection.
* The dvd images contain both dist sets and a pkgbase repo suitable for
offline installation with either mechanism.
* Traditional FreeBSD Update will work for the entire 15.x branch, including
security updates, since this is relatively easy to do as long as we have dist
sets.
* Work is underway to make freebsd-update behave as a wrapper around pkgbase
on pkgbase-enabled systems (right now it just refuses to do anything).
 
Does the system need to be “pkg-base” to be able to detect the proper packages?

I’m not finding any “FreeBSD-*” packages.
 
Does the system need to be “pkg-base” to be able to detect the proper packages?
if you're talking about packages in the (remote) repository, then no, you can query the repository regardless of whether the local system uses pkgbase. the repository config looks like this:
Code:
FreeBSD-base: {
        url: "pkg+https://pkg.FreeBSD.org/${ABI}/base_latest",
        mirror_type: "srv",
        signature_type: "fingerprints",
        fingerprints: "/usr/share/keys/pkg",
        enabled: yes
}
this will not be the final repository used for the release version, which is why it's not in /etc/pkg by default.

however be careful, because if you enable this repository to examine its contents, then install a ports package, pkg may try to install base system packages as dependencies, which will overwrite your installed system. so if you don't want to switch the running system to pkgbase, i suggest putting the repository config in a non-default directory like /etc/pkg.disabled and using pkg -R /etc/pkg.disabled search ..., which will ensure no other pkg commands pick it up.
 
if you want to create jails with pkgbase, this is pretty simple: pkg -r /jails/myjail install FreeBSD-set-base
May be not now but in the future, a mechanism that could pick packages already downloaded from /var/cache/pkg would be lovely, instead of downloading the same packages every time one wants to fire a jail.
freebsd-set-minimal is 41 MiB
freebsd-set-base is 174 MiB
I know both packages are not that big, but depending on the internet speed and/or bandwidth in some cases this can be tiresome in a long run.
Perhaps the user could create a dedicated repo where both packages would be there on the host? or something like that?


EDIT:
Forget about it I found a workaround, and I am not sure that's up to the devs to fill such a request.
Sorry for the noise.
 
Last edited:
Code:
FREEBSD-UPDATE SHOULD NOT BE USED TO UPGRADE TO 15.0-ALPHA4 AT PRESENT.

An Errata Notice will be issued shortly to correct a bug in freebsd-update
which renders systems inoperative when upgrading to 15.0.
Code:
upgrading from previous 15.0 alphas with "pkg upgrade" is supported and
should work fine; if not, that's a bug.  however, do read UPDATING as
there were quite a few changes to pkgbase during the 15.0 release cycle.

the pkg.f.o packages are currently built twice a day, so if ALPHA4 isn't
available there yet, it will be shortly.
 
How can I find out what the different meta-packages are and which packages they pull in?

More generally: suppose I want to create a jail that supports dynamic linking, as well as init (for rc.d) but not a shell. How do I know which packages I install?
Forgive me, but no packages available for “FreeBSD-set-base”
 
Forgive me, but no packages available for “FreeBSD-set-base”
did you install from 15.0 installation media (in which case, which version)? what version are you currently using? what pkg(8) command are you using? what pkg repositories do you have configured?
 
did you install from 15.0 installation media (in which case, which version)? what version are you currently using? what pkg(8) command are you using? what pkg repositories do you have configured?
I’m actually using 14.3 converted using pkg-basify tool.

Do I need 15.0 for this?
 
I’m actually using 14.3 converted using pkg-basify tool.

Do I need 15.0 for this?
yes, the package sets won't be backported to 14.x.

edit: to expand on that a bit, there are a lot of pkgbase changes in 15.0 as part of the work to get it ready for a production release. these changes are all interconnected so it's difficult to backport some but not others, but even if someone did the work for that, i think it's a bad idea to backport major changes like package sets because the new packages can break assumptions about how pkgbase works, e.g. for things that want to install FreeBSD-* (like poudriere).

i will fix specific bugs reported in 14.x pkgbase, but as far as features go, what you have now is basically what you get until 14 is EOL.
 
We need a safe path to migrate from a pkgbase installation to source-based because you can't uninstall those packages without removing files installed by `make installworld` & `make installkernel` and should be documented at:

 
can you outline the use-case for this, i.e. when would you want to do that?
I'm using pkgbase for now just for testing it but I'll eventually migrate to compiling from source like always.

Also, how are security vulnerabilities handled with pkgbase?

I tried yesterday a `pkg update` to mitigate against this OpenSSL vulnerability but there are no updated packages, so I contemplated compiling myself, but then realized I couldn't realibly do it because the binaries would no longer be those installed by the FreeBSD-* packages:

 
For what it's worth, I have a few 14.3's, two are pkgbasified. The non-basified showed something to update (using freebsd-update) after I read the advisory. The two pkgbasified ones showed nothing. But then a few hours later they showed a lot of things to be updated. So, maybe it just takes a bit longer right now?
 
For what it's worth, I have a few 14.3's, two are pkgbasified. The non-basified showed something to update (using freebsd-update) after I read the advisory. The two pkgbasified ones showed nothing. But then a few hours later they showed a lot of things to be updated. So, maybe it just takes a bit longer right now?
Nice to hear it works on 14.3. 15.0-ALPHA4 wasn't updated yet.
 
Also, how are security vulnerabilities handled with pkgbase?
I believe it should be done via pkg just like this:
Code:
$ pkg update -r FreeBSD-base
$ pkg upgrade -r FreeBSD-base

Like you I tried to patch ALPHA4 via pkg without success.
My little theory on this: if patched packages didn't landed on ALPHA4 it could be because BETA1 is coming out tomorrow, therefore they might not want to waste resources to build those packages for a version that will be dead very soon. The next upgrade will probably make us jump from ALPHA4 to BETA1 directly with the correct patches.
BTW 14.2-RELEASE is EOL too, packages based on 14.3(only) might also be cooking right now? That could explain the resources management ... or not.
 
I'm using pkgbase for now just for testing it but I'll eventually migrate to compiling from source like always.
hm... i'm not sure if this is something we want to commit to supporting long-term, which would probably be necessary if it's documented in the Handbook since someone will find a way to rely on it. going in the other direction (dist sets -> pkgbase) will only be supported for 15.0, and maybe 16.0, as a temporary migration path.

but you should be able to do this by saving a list of installed ports, then deleting /var/db/pkg, then re-installing your ports. obviously create a new BE to try this on, i've never tested it.
Also, how are security vulnerabilities handled with pkgbase?
if you build pkgbase from source, there's no difference. if you're using the packages from pkg.freebsd.org, those are not supported by secteam, so security updates are on a best-effort basis. in practice, those packages are rebuilt from each branch twice daily, so it shouldn't take too long for updated packages to arrive.

for 15.0-RELEASE there will be a new repository which will be managed by releng/secteam and update information will be in the security notifications.
I tried yesterday a `pkg update` to mitigate against this OpenSSL vulnerability but there are no updated packages, so I contemplated compiling myself, but then realized I couldn't realibly do it because the binaries would no longer be those installed by the FreeBSD-* packages
you still get FreeBSD-* packages if you build pkgbase from source, the problem (at least for development branches like -CURRENT and -STABLE) is the packages are stamped with the build date, so if you switch from pkg.freebsd.org to local packages, then back, pkg might be confused about what the latest version of the package is. i expect that would sort itself out after a couple of days though.

My little theory on this: if patched packages didn't landed on ALPHA4 it could be because BETA1 is coming out tomorrow, therefore they might not want to waste resources to build those packages for a version that will be dead very soon.
the package builds for pkg.freebsd.org are automated, releng has nothing to do with that. (i believe bapt is the one who mostly takes care of them.)
 
I’ve now tried to upgrade to 15.0 from a 14.3 basified install. No dice.

Multiple errors (not consistent) that randomly stopped at different places during upgrading the packages from 14.3 > 15.0

I followed the instruction given at https://wiki.freebsd.org/pkgbase

I also tried a fresh install of 14.3 with no changes, but same issue.
 
I’ve now tried to upgrade to 15.0 from a 14.3 basified install. No dice.

Multiple errors (not consistent) that randomly stopped at different places during upgrading the packages from 14.3 > 15.0

I followed the instruction given at https://wiki.freebsd.org/pkgbase

I also tried a fresh install of 14.3 with no changes, but same issue.
I experienced the same on my test system. Will retry when the next alpha is released.
 
pkg -r /jails/myjail install FreeBSD-set-base
I seem to need /usr/share/keys/pkg in the root directory:

Code:
root@jailhost:~ # freebsd-version -kru
15.0-ALPHA4
15.0-ALPHA4
15.0-ALPHA4

root@jailhost:~ # zfs create zroot/jails/templates/15

root@jailhost:~ # pkg -r /jails/templates/15 install -y FreeBSD-set-minimal-jail

this results in pkg: Error loading trusted certificates. After I copy /usr/share/keys/pkg into the root directory it works, but I wouldn't expect that to be necessary.
 
Back
Top