Unable to check for updates

TheGushi · Feb 19, 2023, 11:59 PM

Hey there. I'm presently on:

22.05-RELEASE (arm64)
built on Wed Jun 22 18:56:18 UTC 2022
FreeBSD 12.3-STABLE

On netgate hardware (Netgate 1100)

Both spots in the GUI (dashboard and update page) are reporting "Unable to check for updates" and when I try via ssh, I get:

pkg update
Updating pfSense-core repository catalogue...
pkg: https://repo00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/meta.txz: Service Unavailable
repository pfSense-core has no meta file, using default settings
pkg: https://repo00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/packagesite.pkg: Service Unavailable
pkg: https://repo00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/packagesite.txz: Service Unavailable
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
pkg: https://repo00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-pfSense_plus_v23_01/meta.txz: Service Unavailable
repository pfSense has no meta file, using default settings
pkg: https://repo00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-pfSense_plus_v23_01/packagesite.pkg: Service Unavailable
pkg: https://repo00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-pfSense_plus_v23_01/packagesite.txz: Service Unavailable
Unable to update repository pfSense
Error updating repositories!

Is something going on with the pkg repos?

bmeeks · Feb 20, 2023, 1:23 AM

There is a post from the Netgate team here: https://forum.netgate.com/topic/178049/pfsense-plus-23-01-updates-on-the-1100-and-2100-systems, that indicates the updates have been temporarily pulled for SG-1100 and SG-2100 appliances.

I suspect they have "switched off" that repository to accomplish the pause, and that will probably break package upgrades and checking for updates if have either of those two Netgate appliances.

rcoleman-netgate · Feb 20, 2023, 1:23 AM

@bmeeks They can request the image if they want via TAC.

TheGushi · Feb 20, 2023, 12:27 PM

@rcoleman-netgate

Interesting. The whole "service unavailable" error seemed more like a webserver misconfiguration, but the designers of pkg didn't give a way to pass a friendly error along to end users.

Ah well. Thanks!

GPz1100 · Feb 23, 2023, 10:30 PM

Probably related. On bare metal, I can't even go from 2.6.0CE to 22.05. Comes back with the same error.

Sanderluc 0 · Feb 24, 2023, 7:27 PM

Exactly the same problem.

This is very annoying because I can't install Packages either..🔒 Log in to view

I'm running the SG 2100 edition (Router). Any ETA or workaround on this? Even my CE in Proxmox (x64_x86) version runs better than this SG 2100 router....

Currently running: 22.05-RELEASE (arm64).

I need to install ACME, so a fast workaround would be nice.

SteveITS · Feb 24, 2023, 9:15 PM

@sanderluc-0 If you're on 22.05 you would set the update branch to Previous Stable Version anyway so you aren't installing packages designed for 23.01 (and therefore breaking things). Does that still work? (not clear if they disabled everything or just 23.01, but I would think the latter)

Edit: yeah never mind, I tried a client's 2100 and Previous doesn't work either.

The other day I saw Netgate post they were testing a fix, IIRC.

Mission-Ghost · Feb 24, 2023, 11:59 PM

@bmeeks It'd be great if pfSense would give us more detailed messages about the updates. I spent four hours chasing the previous bug that stated my 1100 was unable to check for updates when it turns out it could check for updates, but the update had been withdrawn. A message to that effect would be very helpful. Google searches weren't returning this thread either. Could netgate's SQA use some invigorating, too?

bmeeks · Feb 25, 2023, 12:12 AM

@mission-ghost said in Unable to check for updates:

@bmeeks It'd be great if pfSense would give us more detailed messages about the updates. I spent four hours chasing the previous bug that stated my 1100 was unable to check for updates when it turns out it could check for updates, but the update had been withdrawn. A message to that effect would be very helpful. Google searches weren't returning this thread either. Could netgate's SQA use some invigorating, too?

I can't speak to any Netgate issues. But it may be that the pkg utility and associated infrastructure is limited in what you can display to users. That is not something Netgate created. I think all it can understand is "I can't get the info". I don't think it can then turn around and ask for a "why" and display that.

TheGushi · Feb 25, 2023, 12:37 AM

@bmeeks yeah, “service unavailable” sounds like a straight mapping of an http response code.

You’re welcome to put in a FreeBSD bug, but it might take a while before it makes it into pfsense, since most changes are applied to -CURRENT.

Dobby_ · Feb 25, 2023, 7:08 PM

PC Engines APU4D4
pfSense+ 23.01 Release
Option (13) Update from console
I got sometimes this answer;

ERROR: It was not possible to determine pkg remote version

If I have rebooted the pfSense I got even back this answer;

>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: . done
Processing entries: .. done
pfSense-core repository update completed. 15 packages processed.
Updating pfSense repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: .......... done
Processing entries: .......... done
pfSense repository update completed. 537 packages processed.
All repositories are up to date.
Your packages are up to date
Netgate pfSense Plus - Netgate Device ID:xxxxxxxxxxx

But if I use the option (8) entering the Shell and I set up a

pfSense-upgrade

I got two things back, one is looking like that one from entrance post of that threat here but only for the arch amd64 and the other one gives me back nearly the same as before but without the Netgate pfSense Plus -Netgate Device ID: line at the end


[23.01-RELEASE][root@xxxx.xxxx]/root: pfSense-upgrade
>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: . done
Processing entries: .. done
pfSense-core repository update completed. 15 packages processed.
Updating pfSense repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: .......... done
Processing entries: .......... done
pfSense repository update completed. 537 packages processed.
All repositories are up to date.
Your packages are up to date

So I personally think this problem is not hitting alone the 1100 and 2100 series repositorries alone.

rosadog · Feb 25, 2023, 8:08 PM

Wondering if anyone is getting this message.

Messages "We could not connect to Netgate servers. Please try again later."

I'm not able to register Pfsense Plus

TheGushi · Feb 25, 2023, 9:35 PM

@rosadog You should probably post your own thread on this, as it's related to something completely different. (Also, it's not relevant here, as it's not about installation or upgrades).

jonathan.johnson · Feb 25, 2023, 9:55 PM

Found the following forum first when attempting to resolve this issue.
https://forum.netgate.com/topic/174768/unable-to-check-for-updates-solved/9

*Tried recommendation by @bingo600

Attempted to update pfSense.conf with "url: pkg+https://firmware.netgate.com..." instead of current "url: pkg+https://repo.netgate.com..."

Then ran pkg-static -d update.

This did not fix the issue although it seemed it would.

When running pkg-static -d update it fetches from https://repo01.atx.netgate.com.

When looking up that address or https://repo.netgate.com in a browser it doesn't resolve. When browsing firmware location https://firmware.netgate.com you do get to a site in your browser. Not sure if this is all expected/normal behavior, but thought I'd mention.

Dobby_ · Feb 25, 2023, 10:00 PM

@jonathan-johnson

pkg-static -d update

It was working well for me, thanks.

@TheGushi

Have a look on my output now, perhaps it will work for you too if the repo is up again;

[23.01-RELEASE][root@xxxx.xxxx]/root: pkg-static -d update
DBG(1)[19878]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[19878]> PkgRepo: verifying update for pfSense-core
DBG(1)[19878]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[19878]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf
DBG(1)[19878]> opening libfetch fetcher
DBG(1)[19878]> Fetch > libfetch: connecting
DBG(1)[19878]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.conf with opts "i"
DBG(1)[19878]> Fetch: fetcher chosen: https
DBG(1)[19878]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg
DBG(1)[19878]> opening libfetch fetcher
DBG(1)[19878]> Fetch > libfetch: connecting
DBG(1)[19878]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg with opts "i"
DBG(1)[19878]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz
DBG(1)[19878]> opening libfetch fetcher
DBG(1)[19878]> Fetch > libfetch: connecting
DBG(1)[19878]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz with opts "i"
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
DBG(1)[19878]> PkgRepo: verifying update for pfSense
DBG(1)[19878]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense.sqlite'
DBG(1)[19878]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf
DBG(1)[19878]> opening libfetch fetcher
DBG(1)[19878]> Fetch > libfetch: connecting
DBG(1)[19878]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.conf with opts "i"
DBG(1)[19878]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg
DBG(1)[19878]> opening libfetch fetcher
DBG(1)[19878]> Fetch > libfetch: connecting
DBG(1)[19878]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg with opts "i"
DBG(1)[19878]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz
DBG(1)[19878]> opening libfetch fetcher
DBG(1)[19878]> Fetch > libfetch: connecting
DBG(1)[19878]> Fetch: fetching from: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz with opts "i"
pfSense repository is up to date.
All repositories are up to date.

TheGushi · Feb 25, 2023, 10:09 PM

@dobby_

The configured update was disabled by Netgate to stop people from bricking their devices due to a problem with the update. This was covered by a netgate staffer earlier.

Presumably, once they've resolved that, the main site will no longer report unavailable.

If you want to try and outsmart them by running shell commands, which may find a method that they haven't updated, because their devices don't try it by default, please do so at your own risk.

jonathan.johnson · Feb 25, 2023, 10:18 PM

@dobby_

Thanks for the information.

I updated my pfSense.conf again to account for your url of "...https://pfsense-plus-pkg.netgate.com..."

This resulted in the following:

DBG(1)[28253]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[28253]> PkgRepo: verifying update for pfSense-core
DBG(1)[28253]> PkgRepo: need forced update of pfSense-core
DBG(1)[28253]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[28253]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/meta.conf
DBG(1)[28253]> opening libfetch fetcher
DBG(1)[28253]> Fetch > libfetch: connecting
DBG(1)[28253]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/meta.conf with opts "i"
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
1086423040:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
DBG(1)[28253]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/meta.conf with opts "i"
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
1086423040:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
DBG(1)[28253]> Fetch: fetching from: https://pfsense-plus-pkg00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/meta.conf with opts "i"
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
1086423040:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
DBG(1)[28253]> Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/meta.txz
...
Unable to update repository pfSense
Error updating repositories!

The certificate error may be the issue?

I think the main difference being you're on amd64 and I'm on arm64 for a Netgate2100 which as above commenters have been stating that it's currently problematic for this branch.

jonathan.johnson
Netgate 2100
pfSense+ 22.05 (arm64)

Dobby_ · Feb 26, 2023, 8:08 PM

@jonathan-johnson

I only want to say to @TheGushi that not only the arm repo is not available, nothing more.

rcoleman-netgate · Mar 6, 2023, 2:38 PM

@jonathan-johnson said in Unable to check for updates:

I think the main difference being you're on amd64 and I'm on arm64 for a Netgate2100 which as above commenters have been stating that it's currently problematic for this branch.

Not problematic. The upgrade path is turned off while our engineers work on a solution to the storage space issue faced on some devices.

To upgrade to 23.01 right now on the 1100 and 2100 you have to request the image from TAC, back up your config, write the new image to your device, restore your backup config and reboot.

If you wish to maintain ZFS snapshots and roll-back capability you will have to wait for the online upgrade to be released.

tshaw256 · Feb 26, 2023, 8:06 PM

Sorry if I missed it but has there been any resolution found?

There's no DNS issues that i've found, but I can say that https://repo.netgate.com/ could not resolve and https://firmware.netgate.com/ was able to populate.

Is the repo just down and my timing on the initial setup was just bad?