Run 'pkg upgrade' when the system first boots to check for any software
updates, apply them, and request a reboot.
Obviously, this port is not useful after a system is already running; it is
intended to be included as part of the installation or disk image building
process.
sysutils/firstboot_pkg_upgrade: Ignore OSVERSION
Don't just ignore OSVERSION for the 'pkg upgrade' command; we also
need to ignore OSVERSION for the 'pkg update' and also for the 'pkg
bootstrap' (if we somehow don't have pkg installed yet).
Rather than setting it individually for each command, export
IGNORE_OSVERSION=YES into the environment where it will apply to
all of the pkg commands.
Reviewed by: ziaee
Fixes: b67d354b6656 ("sysutils/firstboot-pkg-upgrade: Ignore OSVERSION")
Sponsored by: Amazon
Reported by: akiyano
Differential Revision: https://reviews.freebsd.org/D59584
sysutils/firstboot-pkg-upgrade: Ignore OSVERSION
Without IGNORE_OSVERSION=yes, images built from HEAD or stable branches
will hang during boot waiting for the user to agree to install updates
every time OSVERSION gets bumped.
This is a no-op for releases, since OSVERSION never changes there.
Reviewed by: ziaee
Sponsored by: Amazon
Differential Revision: https://reviews.freebsd.org/D59053
sysutils/firstboot-pkg-upgrade: 1.1 -> 1.2
If a list of repositories has been specified, only run 'pkg update'
on those repositories; in particular, avoiding downloading the entire
FreeBSD-ports repository when we're not going to be using it allows
FreeBSD/EC2 instances (and presumably those other clouds too) to
launch roughly 5 seconds faster.
Reviewed by: ziaee
Sponsored by: Amazon
Differential Revision: https://reviews.freebsd.org/D57033
sysutils/firstboot-pkg-upgrade: New port
Introduce an rc.d service to upgrade all packages on first boot,
ensuring cloud images are deployed with no known vulnerabilities. By
default, it will patch everything from all enabled repos, and record
this in syslog. It accepts an optional additional line that specifies
a list of space-separated specific repos to limit the upgrade to.
Note specifying bogus repos results in the upgrade aborting,
it will log This and will not try to not run again.
MFH: 2026Q2
Sponsored by: Amazon
Sponsored by: Google Cloud
Sponsored by: OVHcloud
Reviewed by: bapt, cperciva
Discussed with: bapt, cperciva, delphij, lwhsu
Differential Revision: https://reviews.freebsd.org/D56381
