The ports collection does not go through the same thorough security audit that is performed on the OpenBSD base system. Although we strive to keep the quality of the packages high, we just do not have enough resources to ensure the same level of robustness and security.
The OpenBSD ports team considers packages to be the goal of their porting work, not the ports themselves. In general, you are advised to use packages over building an application from ports. Security updates are the exception to this rule, as they are only available via ports. Binary packages for -release and -stable are not updated.
Packages can be easily managed with the help of several utilities:
Packages look like simple
Basically they are just that, but there is one crucial difference:
they contain some extra packing information.
This information is used by
pkg_add(1) for several purposes:
/var/db/pkgby default. This will, among other things, prevent the dependencies of a package from being deleted before the package itself has been deleted. This helps ensure that an application cannot be accidentally broken by a careless user.
/etc/installurl) or the
PKG_PATHenvironment variable. The former is the preferred method and is configured by default on new installations.
If the use of multiple mirrors is needed,
PKG_PATH allows this
via a colon-separated list:
# export PKG_PATH=scp://user@company-build-server/usr/ports/packages/%a/all:https://trusted-public-server/%m:installpathWhile the default should work well for most people, a list of alternate locations can be found on the mirrors page.
To search for any given package name, use the
-Q flag of
$ pkg_info -Q unzip lunzip-1.8 unzip-6.0p9 unzip-6.0p9-iconvAnother way to find what you're looking for is with the
pkglocatecommand, available from the
$ pkglocate mutool mupdf-1.11p1-js:textproc/mupdf,js:/usr/local/bin/mutool mupdf-1.11p1-js:textproc/mupdf,js:/usr/local/man/man1/mutool.1 mupdf-1.11p1:textproc/mupdf:/usr/local/bin/mutool mupdf-1.11p1:textproc/mupdf:/usr/local/man/man1/mutool.1If you're looking for a specific filename, it can be used to find which package(s) contain that file.
You will notice that certain packages are available in a few different varieties. These are called flavors. The ports FAQ explains flavors in detail, but it basically means they're configured with different sets of options. For example, a package might have optional database support, support for systems without X11, etc. Some packages are also divided into subpackages that may be installed separately.
Not all possible packages are necessarily available on the mirror servers. Some applications simply don't work on all architectures. Some applications cannot be distributed via mirrors for licensing reasons.
# pkg_add rsync Ambiguous: choose package for rsync a 0: <None> 1: rsync-3.1.2p0 2: rsync-3.1.2p0-iconv Your choice:Here you would select 1 if you want the standard package or 2 if you need iconv support. You can also choose the flavor directly on the command line by using
pkg_add rsync--(for the default) or
pkg_add rsync--iconv(for the iconv flavor).
It is possible to specify multiple package names on one line, which then all get installed at once, along with their dependencies. You may also specify the absolute location of a package, be it a local file or remote URL. Supported URL prefixes are http, https, ftp and scp.
For some packages, important additional information will be given about the configuration or use of the application.
# pkg_add jove jove-188.8.131.52p0: ok --- +jove-184.108.40.206p0 ------------------- See /usr/local/share/jove/README about changes to /etc/rc or /etc/rc.local so that the system recovers jove files on reboot after a system crashAdditionally, some packages provide configuration and other information in a file located in
For your safety, if you are installing a package which you had installed earlier and removed, configuration files which have been modified will not be overwritten. The same is true for when you upgrade a package.
Sometimes you may encounter an error like the one in the following example:
# pkg_add xv quirks-2.367 signed on 2017-10-03T11:21:28Z xv-3.10ap4:jpeg-6bp3: ok xv-3.10ap4:png-1.2.14p0: ok xv-3.10ap4:tiff-3.8.2p0: ok Can't install xv-3.10ap15 because of libraries |library X11.16.1 not found | not found anywhere Direct dependencies for xv-3.10ap15 resolve to png-1.6.31 jasper-1.900.1p5 tiff-4.0.8p1 jpeg-1.5.1p0v0 Full dependency tree is png-1.6.31 tiff-4.0.8p1 jasper-1.900.1p5 jpeg-1.5.1p0v0The packing information bundled in the package includes information about shared libraries that the package expects to be installed. If one of the required libraries can't be found, the package is not installed because it would not function anyway.
There are several things to check:
# pkg_add -u unzip unzip-5.52->unzip-5.52p0: ok Read shared items: okWhen a package has dependencies, they are also examined for updates. Invoking pkg_add(1) with only the
-uflag will try to update all installed packages. This is highly recommended over updating individual packages on their own.
# pkg_delete screen screen-4.0.3p6: ok Read shared items: okAgain, modified configuration files will not be removed. Unneeded dependencies can be trimmed by running
pkg_delete -aat any time.
-mzflags of pkg_info(1) will yield appropriate results to make this task easier.
-mflag only selects packages that were manually installed. Dependencies are not recorded, as they're pulled in automatically.
-zflag excludes version information from the output. Only the flavor and branch are displayed, ensuring that future package installations will select the appropriate version.
$ pkg_info -mz | tee list abcde-- mpv-- python--%3.6 vim--no_x11Copy the "list" file over to the other machine and run:
# pkg_add -l listEvery package specification has a flavor (
--being the default) appended to its name, and packages that co-exist in several versions also have branch information. In this case, subsequent pkg_add(1) commands will select the current python package of the
More dire system failures, such as file system issues, may
/var/db/pkg becoming corrupted or inconsistent.
The pkg_check(8) utility can help clean things up.