check_upgrade: "Updating repositories metadata" returned error code 1

static418

I'm also getting stacks of
check_upgrade: "Updating repositories metadata" returned error code 1 @ 2025-11-07 18:29:51

66 on my main firewall, less frequently on some remote installs but I cleared a pile of them on each earlier in the week. Switching from pfsense CE to pfsense plus as an upgrade path on machines I've never registered, then back again.

tariqali

Jumping in with a "me too", seeing a bunch of these errors recently as well.

Anyone figure out how to stop them yet?

stephenw10

A backend change has been reverted. You should not hit this issue now. Or at least not for that reason.

Kelpie

@stephenw10 Thankyou

tariqali

@stephenw10 Thank you, so far so good today, no errors.

ghc88

Can also confirm the high number of errors has stopped here as well. Do we have any idea what it is about 2.8 onwards that causes them to occur occasionally?

static418

@stephenw10
Looks like success to me! No new alerts since yesterday afternoon on any of my sites. Much appreciated :)

stephenw10

@ghc88 said in check_upgrade: "Updating repositories metadata" returned error code 1:

Do we have any idea what it is about 2.8 onwards that causes them to occur occasionally?

It appears to be a race condition. It mostly happens at boot. The re-write of the certctl hashing function will likely prevent it in the next version. It's much, much faster!

py

I'm getting the same error. Other symptoms include:

Available Packages is empty;

"pkg -d update"
returns
"ld-elf.so.1: Shared object "libutil.so.10" not found, required by "pkg"";

"pfSense-repoc -ND"
returns
OS: FreeBSD
OS Version: 15.0-CURRENT
Platform: amd64
Product: Netgate pfSense Plus
Version: 25.07.1-RELEASE
FS type: zfs
Language: en_US
Model: unknown hardware
NDI: <redacted>
Package prefix: pfSense-pkg-
Serial: (null)
Repo path: /usr/local/etc/pfSense
Request query: {"platform":"unknown hardware","os":"FreeBSD","osver":"15.0-CURRENT","prod":"Netgate pfSense Plus","ver":"25.07.1-RELEASE","ed":"Plus","fstype":"zfs","pkgs":"<redacted>
POST data: uid=<redacted>
Messages:
Your device has not been registered for pfSense+. Please purchase a pfSense+ subscription to receive future updates. <a href="https://shop.netgate.com/products/pfsense-software-subscription" target="_blank" rel="noopener noreferrer">Netgate store</a>;

I few days ago the console showed errors indicating possible problems with the SSD, but the SMART monitoring seems good. I just attempted a reinstall to format the SSD, but it ends up indicating this machine is not registered with Negate and offers to install CE. I've got my original order no. from Netgate if that helps.

stephenw10

Looks like your NDI might have changed. Send it to me in chat and I'll check it.

morreale

same issues here - I have not renewed my scubscription because of all the issues I have had since upating to this latest version. also how do i change my signature? or please delete it - very old

[25.07.1-RELEASE][admin@pfSense.home.arpa]/root: pkg -d update
ld-elf.so.1: Shared object "libutil.so.10" not found, required by "pkg"

[25.07.1-RELEASE][admin@pfSense.home.arpa]/root: pfSense-repoc -ND
OS: FreeBSD
OS Version: 15.0-CURRENT
Platform: amd64
Product: Netgate pfSense Plus
Version: 25.07.1-RELEASE
FS type: zfs
Language: en_US
Model: unknown hardware
NDI: <redacted>
Package prefix: pfSense-pkg-
Serial: <redacted>
Repo path: /usr/local/etc/pfSense
Request query: {"platform":"unknown hardware","os":"FreeBSD","osver":"15.0-CURRENT","prod":"Netgate pfSense Plus","ver":"25.07.1-RELEASE","ed":"Plus","fstype":"zfs","pkgs":"[{"name":"Cron","ver":"0.3.8_6"},{"name":"acme","ver":"1.0"},{"name":"Avahi","ver":"2.2_7"},{"name":"Nexus","ver":"25.07.1_1"},{"name":"snort","ver":"4.1.6_28"},{"name":"arping","ver":"1.2.2_6"},{"name":"arpwatch","ver":"0.2.3"},{"name":"Tailscale","ver":"0.1.8"},{"name":"RRD_Summary","ver":"2.2"},{"name":"pfBlockerNG","ver":"3.2.7"},{"name":"System_Patches","ver":"2.2.23"},{"name":"Service_Watchdog","ver":"1.8.7_4"},{"name":"Status_Traffic_Totals","ver":"2.3.3"},{"name":"openvpn-client-export","ver":"1.9.5"},{"name":"openvpn-client-import","ver":"1.2_3"}]"}
POST data: uid=<redacted>
Messages:
Your TAC Subscription expired on 2025-11-01 00:00:00. Please renew your TAC Subscription or purchase a pfSense+ subscription by visiting the <a href="https://shop.netgate.com/products/pfsense-software-subscription" target="_blank" rel="noopener noreferrer">Netgate store</a>.

[25.07.1-RELEASE][admin@pfSense.home.arpa]/root: pfSense-upgrade -dc
Messages:
Your TAC Subscription expired on 2025-11-01 00:00:00. Please renew your TAC Subscription or purchase a pfSense+ subscription by visiting the <a href="https://shop.netgate.com/products/pfsense-software-subscription" target="_blank" rel="noopener noreferrer">Netgate store</a>.
ERROR: It was not possible to determine pkg remote version

Updating repositories metadata...
Updating pfSense-core repository catalogue...
pkg-static: Repository pfSense-core has a wrong packagesite, need to re-create database
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
pkg-static: Repository pfSense has a wrong packagesite, need to re-create database
Unable to update repository pfSense
Error updating repositories!
ERROR: It was not possible to determine pfSense-base remote version
ERROR: It was not possible to determine pfSense-kernel-pfSense remote version
ERROR: It was not possible to determine pfSense remote version
Your system is up to date

tinfoilmatt

@morreale said in check_upgrade: "Updating repositories metadata" returned error code 1:

also how do i change my signature? or please delete it - very old

Home / morreale / Edit

stephenw10

@morreale said in check_upgrade: "Updating repositories metadata" returned error code 1:

Messages:
Your TAC Subscription expired on 2025-11-01 00:00:00. Please renew your TAC Subscription or purchase a pfSense+ subscription

That is the expected response if your Plus subscription expired. The Plus pkg repos won't be accessible until it's renewed.

You can always reinstall as CE and import the config.

morreale

@tinfoilmatt nope - i think it limited now

tinfoilmatt

@morreale Any browser extensions in use?

stephenw10

I think you need some reputation to see it. Try again now

morreale

@stephenw10 thanks

pfpv

I want to add that I had this problem when I updated to 2.8.0 and changed DHCP server to KEA, and I switched from the DNS Forwarder to DNS Resolver.

I switched from the DNS Forwarder to DNS Resolver only because the new KEA settings state: "DNS Registration. When checked, DHCP leases will automatically be registered with the DNS Resolver." So, I thought if I kept using the DNS Forwarder I'd lose DHCP lease registration. I wanted to use KEA but didn't want to lose DHCP lease registration and I wanted to use my pi-holes on my LAN that run unbound anyway. I used the forward-zone:
setting in pfSense's unbound to forward all DNS queries to my pi-hole(s).

With this setup I had the aforementioned error frequently. I have to say that I had had it before I made the changes in the unbound settings, i.e., when unbound was running without predefined upstream resolver.

When I realized that my DHCP leases will still be registered when I use the DNS Forwarder I switched to it and haven't seen this error ever since. So,

This error has something to do with unbound. I think the culprit has already been found (some kind of a race condition).
Please change the description in the DHCP Server settings from "When checked, DHCP leases will automatically be registered with the DNS Resolver" to "When checked, DHCP leases will automatically be registered with the DNS Resolver or Forwarder."

stephenw10

Hmm, so you hit it even using Unbound in forwarding mode?

pfpv

@stephenw10 Yes, that is correct. I thought maybe because I pointed to IPs on my LAN but it should work.