Unable to check for updates (SOLVED)

[techpro2004]

bug is still there

A little more info: It wont even let me manually install a package. in pfSense.conf it only lists part of the urls. Not sure what the rest are to correct it but the beginning of the urls are missing.

[techpro2004]

I have developed a temporary fix.

edit /usr/local//etc/pkg/repos/pfSense.conf

add the following to the beginning of both urls inside the quotes

pkg+https://firmware.netgate.com/pkg

[bingo600]

I have the same issue on my "Home Firewall in DK" (22.05)

Discovered by me , due to extremely long Web-Gui login time.
And some fumbling around revealed the "Unable to check for updates" in the GUI.

Saw this in the system log:

Sep 17 01:00:03 	pkg-static 	24861 	pfSense-repo upgraded: 22.05_2 -> 22.05_5
Sep 17 01:00:03 	pkg-static 	24861 	pfSense-upgrade upgraded: 1.0_26 -> 1.0_27 

And running "pkg-static -d update" .. Barfs at me:

22.05-RELEASE][admin@fw-01]/root: pkg-static -d update
DBG(1)[74683]> pkg initialized
pkg-static: invalid url: /pfSense_plus-v22_05_amd64-core
pkg-static: Cannot parse configuration file!
[22.05-RELEASE][admin@fw-01]/root:

If i go to Installed Packages it says none is installed, but if i goto my zabbix package , it shows up fine , and Zabbix isn't Barfing.

The Summerhouse (22.05) in SE , don't have this issue

Saw this in the system log:

Sep 17 08:11:49 	pkg-static 	55031 	pfSense-repo upgraded: 22.05_2 -> 22.05_9
Sep 17 08:11:49 	pkg-static 	55031 	pfSense-upgrade upgraded: 1.0_26 -> 1.0_27 

Would there be a difference in upgrades pulled at 01.00 vs 08.00

I'm in the summerhouse right now, and my ATV (AppleTv) exit's in DK.

Due to "Possible Wife imposed health issues, or Ear-Pain" if the ATV connection is lost. I will "Chiken out" on doing reboot or other "dangerous things to the DK firewall"

Edit - Just noticed the :
DK firewall did a 22.05_2 -> 22.05_5 upgrade (has issues)
SE firewall did a 22.05_2 -> 22.05_9 upgrade (has no issues)

So the update repos version switched in that timeframe.
Did Netgate fix a goof ??

Edit2:
Reading the nice hint from @techpro2004

I see that important info is missing in my DK
/usr/local/etc/pkg/repos/pfSense.conf

cat /usr/local/etc/pkg/repos/pfSense.conf
FreeBSD: { enabled: no }

pfSense-core: {
  url: "/pfSense_plus-v22_05_amd64-core",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/local/share/pfSense/keys/pkg",
  enabled: yes
}

pfSense: {
  url: "/pfSense_plus-v22_05_amd64-pfSense_plus_v22_05",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/local/share/pfSense/keys/pkg",
  enabled: yes
}

SE (working) contains:
/usr/local/etc/pkg/repos/pfSense.conf

cat /usr/local/etc/pkg/repos/pfSense.conf
FreeBSD: { enabled: no }

pfSense-core: {
  url: "pkg+https://firmware.netgate.com/pkg/pfSense_plus-v22_05_amd64-core",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/local/share/pfSense/keys/pkg",
  enabled: yes
}

pfSense: {
  url: "pkg+https://firmware.netgate.com/pkg/pfSense_plus-v22_05_amd64-pfSense_plus_v22_05",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/local/share/pfSense/keys/pkg",
  enabled: yes
}

NB:
The path should be : /usr/local/etc/pkg/repos/pfSense.conf

Solved:
Replacing the two url: entries in the /usr/local/etc/pkg/repos/pfSense.conf , on my DK firewall, with the contents from my SE fiewwall. And running a pkg-static -d update , seems to have fixed the issue.

I how have this in the GUI:

And my Installed Packages shows up again.
Indicating that System_Patches package should be manually updated.
The new System_Patches, adds the CRL fix as recommended.

@techpro2004
Thanx for the hint

/Bingo

[mvikman]

I had this exact same problem (noticed it yesterday) and can confirm the findings from techpro2004 and bingo6000

After fixing the URLs in "/usr/local/etc/pkg/repos/pfSense.conf" everything went back to normal.

[Bob.Dig]

Still would be nice to have an automatic fix for the lazy people. I was frightened seeing this until I came here.

[bingo600]

Here is a "One Liner" , that ought to fix it.

sed -i "" 's/url: "/url: "pkg+https:\/\/firmware.netgate.com\/pkg/g' /usr/local/share/pfSense/pkg/repos/pfSense-repo.conf

Note:
/usr/local/etc/pkg/repos/pfSense.conf - Is symlinked to /usr/local/share/pfSense/pkg/repos/pfSense-repo.conf

ls -l /usr/local/etc/pkg/repos/pfSense.conf                                            lrwxr-xr-x  1 root  wheel  52 Sep  2 19:36 /usr/local/etc/pkg/repos/pfSense.conf -> /usr/local/share/pfSense/pkg/repos/pfSense-repo.conf

And sed won't work on a symlink

Therefore the "One-Liner" refers to the real file , not the symlinked one.

sed -i "" 's/url: "/url: "pkg+https:\/\/firmware.netgate.com\/pkg/g' /usr/local/share/pfSense/pkg/repos/pfSense-repo.conf

Backup your existing : /usr/local/share/pfSense/pkg/repos/pfSense-repo.conf , before using the above command.

Something like

cp /usr/local/share/pfSense/pkg/repos/pfSense-repo.conf /usr/local/share/pfSense/pkg/repos/pfSense-repo.conf.org

After fixing with the "One-Liner" maybe update the repos from CLI:

pkg-static -d update 

/Bingo

[Bob.Dig]

@jimp I hope netgate will fix it too.

[bingo600]

@bob-dig said in Unable to check for updates:

@jimp I hope netgate will fix it too.

That could be a "Chicken / Egg" issue, if the pfS uses those url's to fetch everything.

Even though it's weekend , i find it a bit strange that we haven't heard anything from Netgate, not even an ACK.

/Bingo

[Bob.Dig]

@bingo600 But why now, it has worked until yesterday, I am on 22.05 for months now. So what has changed when? Sry, for not getting the root of the problem.

[bingo600]

@bob-dig
See my initial post here

https://forum.netgate.com/post/1062012

And note that my DK FW (with the issue) updated to 22.05_5 at 01:00 CEST

Sep 17 01:00:03 	pkg-static 	24861 	pfSense-repo upgraded: 22.05_2 -> 22.05_5

My SE FW (with no issue) updated to 22.05_9 at 08:11 CEST

Sep 17 08:11:49 	pkg-static 	55031 	pfSense-repo upgraded: 22.05_2 -> 22.05_9

My guess is that the 22.05_05 update somehow FSCK'ed up the repos url's. And that Netgate got it fixed, sometime in the 01:00 to 08:11 timeframe.

So "Slow updaters" are not affected , "Fast updaters" are affected.

/Bingo

[Bob.Dig]

@bingo600 So we are talking not about an update of pfSense to a new version but to the repos stored in pfSense? And there is no Boot Environment for fixing it. Also there is nothing in Config History, maybe because I changed stuff today.

But lets say, I didn't changed something of interest in the last two days, I can use my own backup und it should be good. I will try that.

[bingo600]

@bob-dig said in Unable to check for updates:

@bingo600 So we are talking not about an update of pfSense to a new version but to the repos stored in pfSense?

Yes, a repos update ... And the naming might hint that 22.09 is close.

And there is no Boot Environment for fixing it.

I do not know pfSense well enough to know if there is another way of downloading a fix.

Also there is nothing in Config History, maybe because I changed stuff today.

I saw it (the update) in the System General Log

.
.

But lets say, I didn't changed something of interest in the last two days, I can use my own backup und it should be good. I will try that.

Your config should not have been affected , and restoring the config would not fix it.

A full reinstall would probably fix it, as it would pull the '09 repos update not the '05.
But that would (IMHO) be a lot of hassle, in order to avoid doing a ssh admin@xxxxxx , select 8 , and do the "One-Liner"

/Bingo

[mcury]

@bingo600 said in Unable to check for updates:

Yes, a repos update ... And the naming might hint that 22.09 is close.

I think it is close indeed..
https://redmine.pfsense.org/projects/pfsense-plus/issues?fixed_version_id=60&set_filter=1&status_id=%2A

[sgc]

This is what NetGate support sent to me about this problem.

Diagnostics --> Edit File --> and in the "Path to file to be Edited", please enter the following and click "Load":

/usr/local/share/pfSense/pkg/repos/pfSense-repo.conf

You can then replace the file with the following contents and hit "Save". This will resolve your issue:

FreeBSD: { enabled: no }

pfSense-core: {
url: "pkg+https://firmware.netgate.com/pkg/pfSense_plus-v22_05_amd64-core",
mirror_type: "srv",
signature_type: "fingerprints",
fingerprints: "/usr/local/share/pfSense/keys/pkg",
enabled: yes
}

pfSense: {
url: "pkg+https://firmware.netgate.com/pkg/pfSense_plus-v22_05_amd64-pfSense_plus_v22_05",
mirror_type: "srv",
signature_type: "fingerprints",
fingerprints: "/usr/local/share/pfSense/keys/pkg",
enabled: yes
}

The problem is gone after changing this.

[Bob.Dig]

@bingo600
I rolled back an "Image" from yesterday mornings backup, fixed it as well. The good thing about all that, I just noticed that I can't roll back an Image of pfSense when it is not running, do to the way I built my network lately, so I had to change that again.

I think the (official) solution should be pinned somehow.

[bingo600]

@bob-dig
How did you do that "image backup" ?
Via the new Boot Environment in 22.05 ?

Wonder if that one would restore the system too ?
Anyone knows ???

[stephenw10]

This is fixed now. As noted the newer repo pkg has the correct URL.

If you're still seeing it, because the firewall pulled in the bad pkg, then switching the update branch to development and then back to latest stable will pull in the fixed pkg.

Doing that you will see logged:

Sep 17 15:36:45 	pkg-static 	13430 	pfSense-repo upgraded: 22.05_5 -> 22.09.a.20220802.0600
Sep 17 15:37:19 	pkg-static 	22387 	pfSense-repo downgraded: 22.09.a.20220802.0600 -> 22.05_9 

Steve

[Bob.Dig]

@bingo600 said in Unable to check for updates:

@bob-dig
How did you do that "image backup" ?

I use a vm for pfSense.

@stephenw10 said in Unable to check for updates:

This is fixed now.

Too bad I can't test this slick approach to that problem anymore.

[bingo600]

@bob-dig said in Unable to check for updates:

@bingo600 said in Unable to check for updates:

@bob-dig
How did you do that "image backup" ?

I use a vm for pfSense.

Ahh

[Innz]

Awesome! Worked on my 6100 without any issues