CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

sysutils/firstboot-pkg-upgrade 1.4

Update the system using pkg when it first boots

Port info

Maintainer
ziaee@FreeBSD.org
Packages
latest: 1.4
Upstream
up to date
Last update
to 1.4 · e22698bc7c
Quarterly
2026Q4: 1.4
Links
cgit · VuXML

Install

Package
# pkg install firstboot-pkg-upgrade
installs 1.4 from latest; from quarterly (2026Q4) 1.4
Port
# cd /usr/ports/sysutils/firstboot-pkg-upgrade && make install clean
Size
2.1 KiB download · 1.7 KiB installed
Depends on
nothing
License
BSD2CLAUSE

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.41.4–
FreeBSD 151.41.4–
FreeBSD 141.41.41.4

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.41.4–
FreeBSD 141.41.41.4

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.4.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (5)

Colin Percival (cperciva) · 1.4
sysutils/firstboot_pkg_upgrade: Ignore OSVERSION

Don't just ignore OSVERSION for the 'pkg upgrade' command; we also
need to ignore OSVERSION for the 'pkg update' and also for the 'pkg
bootstrap' (if we somehow don't have pkg installed yet).

Rather than setting it individually for each command, export
IGNORE_OSVERSION=YES into the environment where it will apply to
all of the pkg commands.

Reviewed by:	ziaee
Fixes:	b67d354b6656 ("sysutils/firstboot-pkg-upgrade: Ignore OSVERSION")
Sponsored by:	Amazon
Reported by:	akiyano
Differential Revision:	https://reviews.freebsd.org/D59584
e22698bc7c
Colin Percival (cperciva) · 1.3
sysutils/firstboot-pkg-upgrade: Ignore OSVERSION

Without IGNORE_OSVERSION=yes, images built from HEAD or stable branches
will hang during boot waiting for the user to agree to install updates
every time OSVERSION gets bumped.

This is a no-op for releases, since OSVERSION never changes there.

Reviewed by:	ziaee
Sponsored by:	Amazon
Differential Revision:	https://reviews.freebsd.org/D59053
b67d354b66
Colin Percival (cperciva) · 1.2
sysutils/firstboot-pkg-upgrade: 1.1 -> 1.2

If a list of repositories has been specified, only run 'pkg update'
on those repositories; in particular, avoiding downloading the entire
FreeBSD-ports repository when we're not going to be using it allows
FreeBSD/EC2 instances (and presumably those other clouds too) to
launch roughly 5 seconds faster.

Reviewed by:	ziaee
Sponsored by:	Amazon
Differential Revision:	https://reviews.freebsd.org/D57033
ac4933ff6f
Colin Percival (cperciva) · 1.1
sysutils/firstboot-pkg-upgrade: Fix script typo

With hat:	re
922cd95369
Alexander Ziaee (ziaee) · 1.0
sysutils/firstboot-pkg-upgrade: New port

Introduce an rc.d service to upgrade all packages on first boot,
ensuring cloud images are deployed with no known vulnerabilities. By
default, it will patch everything from all enabled repos, and record
this in syslog. It accepts an optional additional line that specifies
a list of space-separated specific repos to limit the upgrade to.

Note specifying bogus repos results in the upgrade aborting,
it will log This and will not try to not run again.

MFH:			2026Q2
Sponsored by:		Amazon
Sponsored by:		Google Cloud
Sponsored by:		OVHcloud
Reviewed by:		bapt, cperciva
Discussed with:		bapt, cperciva, delphij, lwhsu
Differential Revision: https://reviews.freebsd.org/D56381
89d217ad06