5

If I install OpenBSD from CD-ROM: http://www.openbsd.org/ftp.html with install48.iso then is it patched?

  1. All 10 patches from here are in the ISO file?
  2. If those are not included, how can I apply these patches? Is there a one-liner command (like under Fedora: yum upgrade or Debian based, apt-get upgrade) or do I have to download and apply all 10 patches one by one?
Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
LanceBaynes
  • 39,295
  • 97
  • 250
  • 349
  • I have always just followed their instructions in patch files, I think it is good idea to let users to let review the patches. It keeps community closer to the development and it does not create other os style wrapper-wrapper-style messy coding. I usually run just the security patches and it is not that big case really and every time I learn something new about the system! Good to keep system clean without stupid bloat. –  Mar 25 '11 at 14:52
  • @hhh: Most people don't review the source code, or check that the provided binaries correspond to the source code. There's no point in specifically reviewing patches. – Gilles 'SO- stop being evil' Mar 25 '11 at 20:03

3 Answers3

6

The canonical reference for this is The OpenBSD FAQ - 5.1

The install4.8.iso in the 4.8 directory is the 4.8 before patches. So, if you want the patches, you need to install 4.8 then patch your system yourself.

The install48.iso in the snapshots directory is more than just the patches to the OS listed on the errata page, it's also everything new that is being developed as the system moves towards 4.9. Snapshots are just that "snapshots" of the code as it's moving towards the next release.

So, to answer your question, no. If you install using the install48.iso CD, you will not have a patched system, you will need to apply the patches yourself.

For information on applying these patches, see each individual patch.

You may also choose to follow the "stable" branch of OpenBSD, the reference is OpenBSD - Following stable, which includes these patches already.

In either case, you will have to have a checkout of the OpenBSD source.

There is no one-liner, or automated way to apply these patches.

gabe.
  • 11,644
  • 11
  • 44
  • 58
  • Do you still need to compile patches from source? I've always wondered how you're supposed to manage an OpenBSD machine that's not powerful enough to recompile the system. – Gilles 'SO- stop being evil' Mar 25 '11 at 20:18
  • Yup. Patches need to be compiled from source, or you need to install a current snapshot via a snapshot binary (but that is more than just the patches). There are no binary patches provided by the project. You can create your own releases from a more powerful machine of the same architecture if needed. – gabe. Mar 25 '11 at 20:23
2

As of release 6.1 of OpenBSD (April 2017), a system installed from a release ISO file (and therefore running the unpatched -release branch of OpenBSD) on an amd64 or i386 machine may be patched to -stable using syspatch. syspatch is part of the OpenBSD base system.

See the syspatch manual on your system.

See also the "Security updates" section of section 10 of the FAQ.

Kusalananda
  • 320,670
  • 36
  • 633
  • 936
-2

Currently OBSD 4.8 is the last released version, so:

ftp://ftp.openbsd.org/pub/OpenBSD/4.8/amd64/
install48.iso - 225 MByte

ftp://piotrkosoft.net/pub/OpenBSD/snapshots/amd64/
install48.iso - 229 MByte


So this means the

ftp://piotrkosoft.net/pub/OpenBSD/snapshots/amd64/install48.iso

is the original 4.8 release + all the 10 patches?

[it's a little bigger then the original one, that's why i suppose this]

If someone says it's true, so that there is an install48.iso that contains all the patches [in the snapshot directory], than it's answered!! :)

LanceBaynes
  • 39,295
  • 97
  • 250
  • 349
  • This is incorrect. Snapshots have many more changes than just the patches listed in errata. – gabe. Mar 25 '11 at 20:12
  • thank you for pointing that one out! - but is the snapshot install48.iso a consistent/stable release, and it could be used on production servers or not? Thank you! – LanceBaynes Mar 25 '11 at 20:56
  • Many people run the snapshots on production servers. It is *not* a release, however. It's really just a build based on whatever is in the tree at the time it's taken. It is rarely broken, but, that's not to say it can't be. There is a section on "SNAPSHOTS" in that first link I posted in my answer. The important thing to note: "There is no promise that the snapshots are completely functional, or even install." If you are new to OpenBSD, the best place to start is with RELEASE, that is the 4.8 iso, not snapshots. – gabe. Mar 25 '11 at 21:19