Solved curl not updating, but maybe that's how pkg works?

D

drtebi

Hello,

I am a bit confused... :

I have FreeBSD 13.1-RELEASE-p7 installed. I noticed that curl is out of date. Thus I figured doing a pkg update, pkg upgrade would bring it to the newest version.

Well, my daily status report still tells me curl is out of date (curl-7.88.1).

In ports, curl is at version 8.0.1.

I read through the handbook... and now this is what I understand:
- The binary packages are compiled from ports, and that happens every quarter.
- None of these binary packages will be updated until the next quarter, with the exception of severe security flawed packages

And thus... my curl with stay at version 7.88-1 until I update to FreeBSD 13.2.

Did I get this right?

Thanks :)
 
No not right.
Curl will stay with version 7.88-1 on "quarterly". This for any kernel/userland/world upgrade.
For versions see:

FreshPorts -- ftp/curl: Command line tool and library for transferring data with URLs

curl is used in command lines or scripts to transfer data. It is also used in cars, television sets, routers, printers, audio equipment, mobile phones, tablets, settop boxes, media players and is the internet transfer backbone for thousands of software applications affecting billions of humans...
www.freshports.org www.freshports.org
 
drtebi said:
- The binary packages are compiled from ports, and that happens every quarter.
Click to expand...
No, it happens continuously (soon after a specific build is finished, it starts again). But the quarterly branch (from which the quarterly pkg repo is built) normally isn't updated, except:

drtebi said:
- None of these binary packages will be updated until the next quarter, with the exception of severe security flawed packages
Click to expand...
Yep, almost like that. Other severe issues that e.g. render a package unusable should be fixed on quarterly as well.

As others said, there's also a "latest" repository, which is built from the main ports branch, so it always contains the latest versions (minus a few days for the time needed to batch-build them).

Which repo you want to use is your decision. "quarterly" reduces the amount of updates you have to install. "latest" provides the latest software versions.
 
Alain De Vos said:
No not right.
Curl will stay with version 7.88-1 on "quarterly". This for any kernel/userland/world upgrade.
For versions see:

FreshPorts -- ftp/curl: Command line tool and library for transferring data with URLs

curl is used in command lines or scripts to transfer data. It is also used in cars, television sets, routers, printers, audio equipment, mobile phones, tablets, settop boxes, media players and is the internet transfer backbone for thousands of software applications affecting billions of humans...
www.freshports.org www.freshports.org
Click to expand...

curl will not stay on version 7.88.1 on quarterly. https://cgit.freebsd.org/ports/commit/?h=2023Q2&id=8c231c32ec19ad809270d847bef16cd231736119
You'll have to wait a wee bit before the packages are build though.
 
Thank you for all your replies.

What's the best way to go now if I want curl to be up-to-date?

Or maybe I should explain my situation and goal a bit:
My FreeBSD machine is purely used as a web server. There really isn't much else running besides Apache and TinyDNS. I just want to be sure to have no security vulnerabilities on the web server.

Are there any other downsides in using the "Latest" repository? That's how Arch Linux works, which I use for my desktop computer. It's fairly rare that being "on the edge" has caused some incompatibilities between libraries, or other issues...
 
drtebi said:
What's the best way to go now if I want curl to be up-to-date?
Click to expand...
In general: use "latest". Here, you might just as well wait for it on quarterly, takes a few days...

drtebi said:
I just want to be sure to have no security vulnerabilities on the web server.
Click to expand...
The goal of "quarterly" is to fix security vulns (and other severe issues) only. I won't say it always works perfectly. But here you see, the curl update landed in quarterly.

drtebi said:
Are there any other downsides in using the "Latest" repository?
Click to expand...
No. You'll just have a lot more updates to download and install than on "quarterly".
 
drtebi said:
Hello,

I am a bit confused... :

I have FreeBSD 13.1-RELEASE-p7 installed. I noticed that curl is out of date. Thus I figured doing a pkg update, pkg upgrade would bring it to the newest version.

Well, my daily status report still tells me curl is out of date (curl-7.88.1).

In ports, curl is at version 8.0.1.

I read through the handbook... and now this is what I understand:
- The binary packages are compiled from ports, and that happens every quarter.
- None of these binary packages will be updated until the next quarter, with the exception of severe security flawed packages

And thus... my curl with stay at version 7.88-1 until I update to FreeBSD 13.2.

Did I get this right?

Thanks :)
Click to expand...
Nah, not quite...

curl-7.88.1 is not THAT out of date... You can still run pkg upgrade ftp/curl if you want to upgrade just curl to the latest available.
1682004867218.png


When packages get compiled, the dependency rules in the Makefiles usually specify a minimum acceptable version. Curl is a dependency to several packages. Anything in quarterly that you have installed (and depends on curl), I bet it specifies the minimum acceptable version to be at 7.80.0... or something like that. My point is, dependencies don't always specify the very latest curl, but don't prohibit it, either. Very old stuff can be prohibited as a dependency.

So, no, OP is not stuck with 7.88_1, upgrading to 8.0_1 on 13.1-RELEASE-p7 is easy, shouldn't break anything, but is probably pointless (unless OP has a real interest in having the very latest curl installed).
 
Thanks once again.

I will stick to pkg update, pkg upgrade. And no, I don't need the latest curl package for its features; I was just generally curious.

My questions have been answered :)

Great forum.
 
Well it looks like curl received an update :


~ : curl --version
curl 8.0.1 (amd64-portbld-freebsd13.1) libcurl/8.0.1 OpenSSL/1.1.1o zlib/1.2.12 libpsl/0.21.2 (+libidn2/2.3.4) libssh2/1.10.0 nghttp2/1.52.0
Release-Date: 2023-03-20
Protocols: dict file ftp ftps gopher gophers http https imap imaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets


Rejoice :)
 
You must log in or register to reply here.
Back
Top