Skip to content

09-openbsd-79-sdlc-maintenance.md

Latest commit

 

History

History
110 lines (79 loc) · 4.32 KB

09-openbsd-79-sdlc-maintenance.md

File metadata and controls

110 lines (79 loc) · 4.32 KB
Raw

OpenBSD 7.9 SDLC maintenance runbook

Authority

OpenBSD 7.9 is the current release, released 2026-05-19:

syspatch maintains base-system errata. pkg_add -u updates packages. pkg_check -n -I validates installed package consistency without repair. They are separate operations.

Change preparation

  1. Confirm console or alternate root access.
  2. Confirm a recent verified backup and rollback artifacts.
  3. Confirm /usr and /var free space.
  4. Review the 7.9 errata and package change notices.
  5. Rehearse in the 7.9 QEMU path when service or package changes are material.
  6. Record the repo commit, host snapshot, config checksums, package list, and installed patches.

Do not alter /etc/installurl as a fallback during a maintenance run. Diagnose mirror or network failure and retry only after the cause is understood.

Read-only report

From a clean host checkout:

cd /path/to/openbsd-mailstack
doas ksh scripts/ops/maintenance-run.ksh --report

This runs preflight checks, records a timestamped snapshot and checksums, previews syspatch and package updates, runs pkg_check -n -I, validates services and configs, and performs read-only OSMAP checks.

Individual checks are:

doas ksh maint/openbsd-syspatch.ksh --check
doas ksh maint/openbsd-pkg-upgrade.ksh --check
doas ksh maint/production-regression.ksh --host

Apply OpenBSD 7.9 errata and package updates

Use a defined change window:

cd /path/to/openbsd-mailstack
doas ksh scripts/ops/maintenance-run.ksh --apply

The apply path runs, in order:

syspatch
pkg_add -u -I
pkg_check -n -I
ksh maint/production-regression.ksh --host

Review package readmes and logs before restarting a service. Use rcctl configtest service where the rc script supports it. The explicit syntax checks used here are:

postfix check
doveconf -n >/dev/null
rspamadm configtest
nginx -t
pfctl -nf /etc/pf.conf
unbound-checkconf /var/unbound/etc/unbound.conf
acme-client -n mail.blackbagsecurity.com

These choices follow the OpenBSD manuals and the upstream Postfix, Dovecot, Rspamd, and nginx documentation.

Mail-flow probe

The default regression run never queues mail. Queue a controlled probe only with explicit authorization:

doas ksh maint/production-regression.ksh \
  --host --apply --probe-to operator@example.net

Verify Postfix acceptance, Rspamd processing, Dovecot LMTP delivery, and mailbox visibility from logs and the recipient mailbox. Do not put a real address in tracked config.

Release upgrades

sysupgrade is not part of routine 7.9 errata maintenance. For a future release:

  1. wait for the official next-release guide;
  2. upgrade only from one release to the immediately following release;
  3. test an equivalent local system first;
  4. review configuration and package changes;
  5. run sysupgrade, complete sysmerge, remove obsolete files as directed, run pkg_add -u, update firmware, reboot, and run the regression suite.

Never infer a future command sequence from this 7.9 runbook alone.

Rollback and failure handling

  • Stop on the first failed patch, package, consistency, syntax, service, TLS, or OSMAP check.
  • Preserve /var/syspatch rollback data. syspatch -r reverts the most recent installed patch; -R reverts all patches.
  • Do not claim general package rollback. Restore the verified package and configuration state or recover from backup.
  • Restore OSMAP binary and environment files as one reviewed unit.
  • Re-run syntax checks before service restart, then run the full regression suite.
  • Keep failed and successful evidence directories. Do not edit evidence after checksums are written.