When asking to install patches and none are available, return 2.

man page and inputs from schwarze@
ok sthen@

Add a EXIT STATUS section

"no objection" ajacoutot@

"If any sets are missing, patches are skipped accordingly."

wording help and ok jmc@

Add support for KARL:
- only extract the according /usr/share/compile/GENERIC{,.MP}
- if a "kernel" patch was properly installed (or rolled back), run
/usr/libexec/reorder_kernel _once_ just before

Add support for KARL:
- only extract the according /usr/share/compile/GENERIC{,.MP}
- if a "kernel" patch was properly installed (or rolled back), run
/usr/libexec/reorder_kernel _once_ just before exiting
- don't backup /bsd anymore, reorder_kernel already does it for us
- drop 2 now unused functions: install_kernel() and sp_cleanup()

While it appears to work fine after some quick testing, it should still be
considered WIP.

show more ...

Document that patches are cumulative and as such it is not possible to install
only a subset of them.

with input from jmc@

Add a `-R' switch that reverts all patches.

prodded by deraadt@
knobs sorting input jmc@
ok sthen@

use .Em for emphasis, not .Pa

Ox on its own line;

Add installurl to FILES and SEE ALSO.

Make it possible to install patches even if we don't have all sets installed
(e.g. no x sets); in this case, syspatch will skip the patch *but* it will still
be listed as available. This will allow a

Make it possible to install patches even if we don't have all sets installed
(e.g. no x sets); in this case, syspatch will skip the patch *but* it will still
be listed as available. This will allow applying the patch in case sets are
installed later on.

show more ...

Change the hierarchy under /var/syspatch/ so that the output of installed or
missing patches matches the official names.
e.g.
$ doas syspatch -c
015_libssl

Add a bit more output on what we are doing

Change the hierarchy under /var/syspatch/ so that the output of installed or
missing patches matches the official names.
e.g.
$ doas syspatch -c
015_libssl

Add a bit more output on what we are doing.
Tighten a few checks and rename some vars.

People playing with syspatch on 6.0 should update syspatch.sh asap from current
as I will soon remove the temporary quirks glue.

show more ...

Document the fact that *for now* syspatch only works on official releases and
will always sync and apply all patches regardless of the installed sets.

/bsd.rollbackXX -> bsd.syspatchXX to make it more obvious where it comes from
and less prone to conflict.
Simplify ls_installed while here.

Small wording tweak and a couple of fixes from jmc@

Extend documentation a bit. It'll probably need some adjustments soon.

Simplify.

rollback -> revert where it makes sense.

apply_patches should not take any arguments.
Few tweaks while here.

Minimal man page.

syspatch goal is not to act as a package manager but to sync the system to the
corresponding stable. So prevent rollbacking a specific binpatch but instead
always rollback the latest one. It's the on

syspatch goal is not to act as a package manager but to sync the system to the
corresponding stable. So prevent rollbacking a specific binpatch but instead
always rollback the latest one. It's the only way we can know the system is
consistent.

discussed with halex@ jasper@ robert@

show more ...

No need to install the /var/syspatch/$REL directory, the binpatch does it for us.
Put /var/syspatch into a variable, it's used more than 10 times.

prodded by robert@

Welcome syspatch(8), a binary patch management utility for the base system.

This is currently a POC, maybe it will become something, maybe not.
Therefore it will not be hooked to the build before we

Welcome syspatch(8), a binary patch management utility for the base system.

This is currently a POC, maybe it will become something, maybe not.
Therefore it will not be hooked to the build before we are happy with it.

Workflow would be something like:
- fetch and verify signed tarballs containing the patched binaries from a mirror
- create a rollback tarball of the files we are about to replace
- extract and install the patched files

*** BIG FAT RED DISCLAIMER ***
This is very much WIP, it does *NOT* work, don't bikeshed, don't use it!

"get it in" deraadt@

show more ...