What's New

This is a partial list of new features and systems included in OpenBSD 6.5. For a comprehensive list, see the changelog leading to 6.5.

• Improved hardware support, including:
  • clang(1) is now provided on mips64.
  • The default linker has been switched from the binutils bfd-based linker to lld on amd64 and i386.
  • octeon: Now the system automatically detects the number of available cores. However, manual setting of the numcores, or coremask, boot parameter is still needed to enable secondary cores.
  • octeon: It is now possible to use the root disk's DUID as the value of the rootdev boot parameter.
  • New octgpio(4) driver for the OCTEON GPIO controller.
  • New pvclock(4) driver for KVM paravirtual clock.
  • New ixl(4) driver for Intel Ethernet 700 series controller devices.
  • New abcrtc(4) driver for Abracon AB1805 real-time clock.
  • New imxsrc(4) driver for i.MX system reset controller.
  • New uxrcom(4) driver for Exar XR21V1410 USB serial adapters.
  • New mvgicp(4) driver for Marvell ARMADA 7K/8K GICP controller.
  • Support for QCA AR816x/AR817x in alc(4).
  • Support for isochronous transfers in xhci(4).
  • uaudio(4) has been replaced by a new driver which supports USB audio class v2.0.
  • Improved support for nmea(4) devices, providing altitude and ground speed values as sensors.

• IEEE 802.11 wireless stack improvements:
  • Reduced usage of RTS frames improves overall throughput and latency.
  • Improved transmit rate selection in the iwm(4) driver.
  • Improved radio hardware calibration in the athn(4) driver.
  • The bwfm(4) driver now provides more accurate device configuration information to userland.
  • Added new routing socket message RTM_80211INFO to provide details of 802.11 interface state changes to dhclient(8) and route(8).
  • If an auto-join list is configured, wireless interfaces will no longer connect to unknown open networks by default. This behaviour must now be explicitly enabled by adding the empty network name to the auto-join list, e.g. ifconfig iwm0 join "", or join "" in hostname.if files.
  • The iwn(4) and iwm(4) drivers will now automatically try to connect to a network if the radio kill switch is toggled to allow radio transmissions while the interface is marked UP.

• Generic network stack improvements:
  • New bpe(4) Backbone Provider Edge pseudo-device.
  • New mpip(4) MPLS IP layer 2 pseudowire driver.
  • MPLS encapsulation interfaces support configuration of alternative MPLS route domains.
  • The vlan(4) driver bypasses queue processing and outputs directly to the parent interface.
  • New per SAD counters visible via ipsecctl(8).
  • The bpf(4) filter drop mechanism has been extended to allow dropping without capturing packets, and use of the mechanism with tcpdump(8) as a filtering mechanism early in the device receive path.
  • ifconfig(8) gains txprio for controlling the encoding of priority in tunnel headers, and support in drivers including vlan(4), gre(4), gif(4), and etherip(4).

• Installer improvements:
  • rdsetroot(8) (a build-time tool) is now available for general use.
  • During upgrades, some components of old releases are deleted.

• Security improvements:
  • unveil(2) has been improved to understand and find covering unveil matches above the working directory of the running process for relative path accesses. As a result many programs now can use unveil in broad ways such as unveil("/", "r").
  • unveil(2) no longer silently allows stat(2) and access(2) to work on any unveiled path component.
  • Now using unveil(2) in ospfd(8), ospf6d(8), rebound(8), getconf(1), kvm_mkdb(8), bdftopcf(1), Xserver(1), passwd(1), spamlogd(8), spamd(8), sensorsd(8), snmpd(8), htpasswd(1), ifstated(8). Some pledge(2) changes were required to accommodate unveil.
  • ROP mitigations in clang(1) have been improved, resulting in a significant decrease in the number of polymorphic ROP gadgets in binaries on i386/amd64.
  • RETGUARD performance and security has been improved in clang(1) by keeping data on registers instead of on the stack when possible, and lengthening the epilogue trapsled on amd64 to consume the rest of the cache line before the return.
  • RETGUARD replaces the stack protector on amd64 and arm64, since RETGUARD instruments every function that returns and provides better security properties than the traditional stack protector.

• Routing daemons and other userland network improvements:
  • pcap-filter(3) can now filter on MPLS packets.
  • The routing priority for ospfd(8), ospf6d(8) and ripd(8) is now configurable.
  • ripd(8) is now pledged.
  • First release of unwind(8), a validating, recursive nameserver for 127.0.0.1. It is particularly suitable for laptops moving between networks.
  • ifconfig(8) gains sff and sffdump modes, displaying diagnostic information from fibre transceivers and similar modules. Currently ix(4) and ixl(4) are supported.
  • ldpd(8) now supports configuration of TCP MD5 for networks, not just specific neighbors.

• bgpd(8) improvements:
  • bgpd(8) has now a real Adj-RIB-Out which improved overall memory usage.
  • Implemented a simple ruleset optimizer that merges filter rules that differ only by filter sets.
  • First release of OpenBGPD-portable. There is currently no FIB support in the portable version and some other features are also disabled.
  • The configuration of BGP MPLS VPN changed and the config needs to be adjusted if VPNs are used.
  • Added support for IPv6 BGP MPLS VPNs.
  • Implemented as-override in bgpd(8), a feature where the neighbor AS is replaced by the local AS in AS paths.
  • It is now possible to match multiple communities, ext-communities or large-communities per filter rule.
  • Added support for *, local-as and neighbor-as for ext-community matching and addition or removal.
  • Prevent bgpd(8) from being started more than once with the same config.
  • announce inet none no longer clears announce settings of other address families.
  • Removed potential for a spurious End-of-RIB marker being sent.
  • Fixed mrt table dumps and the route collector mode.
  • Improved throttling of initial routing table dump.
  • bgpd(8) terminates RIB table walks if bgpctl(8) terminates early.
  • Improved handling of communities, large-communities and ext-communities in bgpctl(8)
  • It is now possible to use neighbor group <name> to run bgpctl(8) commands against the specified group of neighbors:
    bgpctl neighbor group <name> [clear|destroy|down|refresh|up]
bgpctl show neighbor group <name> [messages|terse|timers]
bgpctl show rib neighbor group <name> ...

  • bgpctl(8) can now add networks into BGP VPN tables by specifying the route distinguisher rd on the network command.
  • bgplg(8) and bgplgsh(8) can now filter on Origin Validation State and Extended Communities.
  • bgplgsh(8) can now [clear|destroy|down|refresh|up] and show groups of neighbors.

• Assorted improvements:
  • kcov(4) gained support for KCOV_MODE_TRACE_CMP.
  • A 'video' promise was added to pledge(2).
  • The kern.witnesswatch sysctl(8) has been renamed to kern.witness.watch.
  • New pthread rwlock implementation improving latency of threaded applications.
  • kubsan(4) capable of detecting undefined behavior in the kernel.
  • signify -n option to zero date header in -z mode.
  • Remove OXTABS from default pty flags.
  • install(1) now always copies files safely (as with -S), avoiding race conditions.
  • syslog.conf(5) now supports program names containing dots and underscores.
  • tcpdump(8) already used privsep, pledge(2) and unveil(2) containment. It now also drops root privileges completely (switching to a reserved uid).
  • The multi-threaded performance of malloc(3) has been improved.
  • malloc(3) now uses sysctl(2) to get its settings, making it respect the system-wide settings in chroots as well.
  • Various improvements to the join command.
  • Work has started on a ISC-licensed rsync-compatible program called OpenRSYNC. In this release it has basic functionality such as -a, --delete, but lacks --exclude. Work will continue.
  • New Spleen font 8x16, 12x24, 16x32 and 32x64 variants added and enabled in wsfont, along with font selection logic to allow selecting larger fonts when available at runtime in rasops(9).

• OpenSMTPD 6.5.0
  • New Features
    • Added the new matching criteria "from rdns" to smtpd.conf(5) to allow matching of sessions based on the reverse DNS of the client.
    • Added regex(3) support to table lookups in smtpd.conf(5).

• LibreSSL 2.9.1
  • API and Documentation Enhancements
    • CRYPTO_LOCK is now automatically initialized, with the legacy callbacks stubbed for compatibility.
    • Added the SM3 hash function from the Chinese standard GB/T 32905-2016.
    • Added the SM4 block cipher from the Chinese standard GB/T 32907-2016.
    • Added more OPENSSL_NO_* macros for compatibility with OpenSSL.
    • Partial port of the OpenSSL EC_KEY_METHOD API for use by OpenSSH.
    • Implemented further missing OpenSSL 1.1 API.
    • Added support for XChaCha20 and XChaCha20-Poly1305.
    • Added support for AES key wrap constructions via the EVP interface.
  • Compatibility Changes
    • Added pbkdf2 key derivation support to openssl(1) enc.
    • Changed the default digest type of openssl(1) enc to sha256.
    • Changed the default digest type of openssl(1) dgst to sha256.
    • Changed the default digest type of openssl(1) x509 -fingerprint to sha256.
    • Changed the default digest type of openssl(1) crl -fingerprint to sha256.
  • Testing and Proactive Security
    • Added extensive interoperability tests between LibreSSL and OpenSSL 1.0 and 1.1.
    • Added additional Wycheproof tests and related bug fixes.
  • Internal Improvements
    • Simplified sigalgs option processing and handshake signing algorithm selection.
    • Added the ability to use the RSA PSS algorithm for handshake signatures.
    • Added bn_rand_interval() and use it in code needing ranges of random bn values.
    • Added functionality to derive early, handshake, and application secrets as per RFC8446.
    • Added handshake state machine from RFC8446.
    • Removed some ASN.1 related code from libcrypto that had not been used since around 2000.
    • Unexported internal symbols and internalized more record layer structs.
    • Removed SHA224 based handshake signatures from consideration for use in a TLS 1.2 handshake.
  • Portable Improvements
    • Added support for assembly optimizations on 32-bit ARM ELF targets.
    • Added support for assembly optimizations on Mingw-w64 targets.
    • Improved Android compatibility
  • Bug Fixes
    • Improved protection against timing side channels in ECDSA signature generation.
    • Coordinate blinding was added to some elliptic curves. This is the last bit of the work by Brumley et al. to protect against the Portsmash vulnerability.
    • Ensure transcript handshake is always freed with TLS 1.2.

• OpenSSH 8.0
  • New Features
    • ssh(1), ssh-agent(1), ssh-add(1): Add support for ECDSA keys in PKCS#11 tokens.
    • ssh(1), sshd(8): Add experimental quantum-computing resistant key exchange method, based on a combination of Streamlined NTRU Prime 4591^761 and X25519.
    • ssh-keygen(1): Increase the default RSA key size to 3072 bits, following NIST Special Publication 800-57's guidance for a 128-bit equivalent symmetric security level.
    • ssh(1): Allow "PKCS11Provider=none" to override later instances of the PKCS11Provider directive in ssh_config; bz#2974
    • sshd(8): Add a log message for situations where a connection is dropped for attempting to run a command but a sshd_config ForceCommand=internal-sftp restriction is in effect; bz#2960
    • ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes". This allows the user to paste a fingerprint obtained out of band at the prompt and have the client do the comparison for you.
    • ssh-keygen(1): When signing multiple certificates on a single command-line invocation, allow automatically incrementing the certificate serial number.
    • scp(1), sftp(1): Accept -J option as an alias to ProxyJump on the scp and sftp command-lines.
    • ssh-agent(1), ssh-pkcs11-helper(8), ssh-add(1): Accept "-v" command-line flags to increase the verbosity of output; pass verbose flags though to subprocesses, such as ssh-pkcs11-helper started from ssh-agent.
    • ssh-add(1): Add a "-T" option to allowing testing whether keys in an agent are usable by performing a signature and a verification.
    • sftp-server(8): Add a "lsetstat@openssh.com" protocol extension that replicates the functionality of the existing SSH2_FXP_SETSTAT operation but does not follow symlinks. bz#2067
    • sftp(1): Add "-h" flag to chown/chgrp/chmod commands to request they do not follow symlinks.
    • sshd(8): Expose $SSH_CONNECTION in the PAM environment. This makes the connection 4-tuple available to PAM modules that wish to use it in decision-making. bz#2741
    • sshd(8): Add a ssh_config "Match final" predicate Matches in same pass as "Match canonical" but doesn't require hostname canonicalisation be enabled. bz#2906
    • sftp(1): Support a prefix of '@' to suppress echo of sftp batch commands; bz#2926
    • ssh-keygen(1): When printing certificate contents using "ssh-keygen -Lf /path/certificate", include the algorithm that the CA used to sign the cert.
  • Bugfixes
    • sshd(8): Fix authentication failures when sshd_config contains "AuthenticationMethods any" inside a Match block that overrides a more restrictive default.
    • sshd(8): Avoid sending duplicate keepalives when ClientAliveCount is enabled.
    • sshd(8): Fix two race conditions related to SIGHUP daemon restart. Remnant file descriptors in recently-forked child processes could block the parent sshd's attempt to listen(2) to the configured addresses. Also, the restarting parent sshd could exit before any child processes that were awaiting their re-execution state had completed reading it, leaving them in a fallback path.
    • ssh(1): Fix stdout potentially being redirected to /dev/null when ProxyCommand=- was in use.
    • sshd(8): Avoid sending SIGPIPE to child processes if they attempt to write to stderr after their parent processes have exited; bz#2071
    • ssh(1): Fix bad interaction between the ssh_config ConnectTimeout and ConnectionAttempts directives - connection attempts after the first were ignoring the requested timeout; bz#2918
    • ssh-keyscan(1): Return a non-zero exit status if no keys were found; bz#2903
    • scp(1): Sanitize scp filenames to allow UTF-8 characters without terminal control sequences; bz#2434
    • sshd(8): Fix confusion between ClientAliveInterval and time-based RekeyLimit that could cause connections to be incorrectly closed. bz#2757
    • ssh(1), ssh-add(1): Correct some bugs in PKCS#11 token PIN handling at initial token login. The attempt to read the PIN could be skipped in some cases, particularly on devices with integrated PIN readers. This would lead to an inability to retrieve keys from these tokens. bz#2652
    • ssh(1), ssh-add(1): Support keys on PKCS#11 tokens that set the CKA_ALWAYS_AUTHENTICATE flag by requiring a fresh login after the C_SignInit operation. bz#2638
    • ssh(1): Improve documentation for ProxyJump/-J, clarifying that local configuration does not apply to jump hosts.
    • ssh-keygen(1): Clarify manual - ssh-keygen -e only writes public keys, not private.
    • ssh(1), sshd(8): be more strict in processing protocol banners, allowing \r characters only immediately before \n.
    • Various: fix a number of memory leaks, including bz#2942 and bz#2938
    • scp(1), sftp(1): fix calculation of initial bandwidth limits. Account for bytes written before the timer starts and adjust the schedule on which recalculations are performed. Avoids an initial burst of traffic and yields more accurate bandwidth limits; bz#2927
    • sshd(8): Only consider the ext-info-c extension during the initial key eschange. It shouldn't be sent in subsequent ones, but if it is present we should ignore it. This prevents sshd from sending a SSH_MSG_EXT_INFO for REKEX for buggy these clients. bz#2929
    • ssh-keygen(1): Clarify manual that ssh-keygen -F (find host in authorized_keys) and -R (remove host from authorized_keys) options may accept either a bare hostname or a [hostname]:port combo. bz#2935
    • ssh(1): Don't attempt to connect to empty SSH_AUTH_SOCK; bz#2936
    • sshd(8): Silence error messages when sshd fails to load some of the default host keys. Failure to load an explicitly-configured hostkey is still an error, and failure to load any host key is still fatal. pr/103
    • ssh(1): Redirect stderr of ProxyCommands to /dev/null when ssh is started with ControlPersist; prevents random ProxyCommand output from interfering with session output.
    • ssh(1): The ssh client was keeping a redundant ssh-agent socket (leftover from authentication) around for the life of the connection; bz#2912
    • sshd(8): Fix bug in HostbasedAcceptedKeyTypes and PubkeyAcceptedKeyTypes options. If only RSA-SHA2 signature types were specified, then authentication would always fail for RSA keys as the monitor checks only the base key (not the signature algorithm) type against *AcceptedKeyTypes. bz#2746
    • ssh(1): Request correct signature types from ssh-agent when certificate keys and RSA-SHA2 signatures are in use.

• Mandoc 1.14.5
  • Improved POSIX compliance in apropos(1) by accepting case-insensitive extended regular expressions by default.
  • New -O tag output option to open a page at the definition of a term.
  • Many tbl(7) improvements: line drawing, spanning, horizontal and vertical alignment in HTML output, improved column width calculations in terminal output, use of box drawing characters in UTF-8 output.
  • Much better HTML output, in particular with respect to paragraphs, line breaks, and vertical spacing in tagged lists. Tooltips are now implemented in pure CSS, the title attribute is no longer abused.

• Xenocara
  • Xorg(1), the X window server, is no longer installed setuid. xenodm(1) should be used to start X.
  • The radeonsi Mesa driver is now included for hardware acceleration on Southern Islands and Sea Islands radeondrm(4) devices.

• Ports and packages:
  • C++ ports for non-clang architectures are now compiled with ports gcc, so that more packages can be provided.

  Many pre-built packages for each architecture:

  • aarch64: 9654
  • amd64: 10602
  • arm: 8721
  • i386: 10535
  • mips64: 8556
  • mips64el: 7677
  • powerpc: 9515
  • sparc64: 9495

  Some highlights:

  • AFL 2.52b
  • Asterisk 16.2.1
  • Audacity 2.3.1
  • CMake 3.10.2
  • Chromium 73.0.3683.86
  • Emacs 26.1
  • FFmpeg 4.1.3
  • GCC 4.9.4 and 8.3.0
  • GHC 8.2.2
  • GNOME 3.30.2.1
  • Go 1.12.1
  • Groff 1.22.4
  • JDK 8u202 and 11.0.2+9-3
  • LLVM/Clang 7.0.1
  • LibreOffice 6.2.2.2
  • Lua 5.1.5, 5.2.4 and 5.3.5
  • MariaDB 10.0.38
  • Mono 5.18.1.0
  • Mozilla Firefox 66.0.2 and ESR 60.6.1
  • Mozilla Thunderbird 60.6.1
  • Mutt 1.11.4 and NeoMutt 20180716
  • Node.js 10.15.0
  • OCaml 4.07.1
  • OpenLDAP 2.3.43 and 2.4.47
  • PHP 7.1.28, 7.2.17 and 7.3.4
  • Postfix 3.3.3 and 3.4.20190106
  • PostgreSQL 11.2
  • Python 2.7.16 and 3.6.8
  • R 3.5.3
  • Ruby 2.4.6, 2.5.5 and 2.6.2
  • Rust 1.33.0
  • Sendmail 8.16.0.41
  • SQLite3 3.27.2
  • Sudo 1.8.27
  • Suricata 4.1.3
  • Tcl/Tk 8.5.19 and 8.6.8
  • TeX Live 2018
  • Vim 8.1.1048 and Neovim 0.3.4
  • Xfce 4.12

• As usual, steady improvements in manual pages and other documentation.

• The system includes the following major components from outside suppliers:
  • Xenocara (based on X.Org 7.7 with xserver 1.19.7 + patches, freetype 2.9.1, fontconfig 2.12.4, Mesa 18.3.5, xterm 344, xkeyboard-config 2.20 and more)
  • LLVM/Clang 7.0.1 (+ patches)
  • GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
  • Perl 5.28.1 (+ patches)
  • NSD 4.1.27
  • Unbound 1.9.1
  • Ncurses 5.7
  • Binutils 2.17 (+ patches)
  • Gdb 6.3 (+ patches)
  • Awk Aug 10, 2011 version
  • Expat 2.2.6

How to install

Please refer to the following files on the mirror site for extensive details on how to install OpenBSD 6.5 on your machine:

• .../OpenBSD/6.5/alpha/INSTALL.alpha
• .../OpenBSD/6.5/amd64/INSTALL.amd64
• .../OpenBSD/6.5/arm64/INSTALL.arm64
• .../OpenBSD/6.5/armv7/INSTALL.armv7
• .../OpenBSD/6.5/hppa/INSTALL.hppa
• .../OpenBSD/6.5/i386/INSTALL.i386
• .../OpenBSD/6.5/landisk/INSTALL.landisk
• .../OpenBSD/6.5/loongson/INSTALL.loongson
• .../OpenBSD/6.5/luna88k/INSTALL.luna88k
• .../OpenBSD/6.5/macppc/INSTALL.macppc
• .../OpenBSD/6.5/octeon/INSTALL.octeon
• .../OpenBSD/6.5/sgi/INSTALL.sgi
• .../OpenBSD/6.5/sparc64/INSTALL.sparc64

Quick installer information for people familiar with OpenBSD, and the use of the "disklabel -E" command. If you are at all confused when installing OpenBSD, read the relevant INSTALL.* file as listed above!

OpenBSD/alpha:

Write floppy65.fs or floppyB65.fs (depending on your machine) to a diskette and enter boot dva0. Refer to INSTALL.alpha for more details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

OpenBSD/amd64:

If your machine can boot from CD, you can write install65.iso or cd65.iso to a CD and boot from it. You may need to adjust your BIOS options first.

If your machine can boot from USB, you can write install65.fs or miniroot65.fs to a USB stick and boot from it.

If you can't boot from a CD, floppy disk, or USB, you can install across the network using PXE as described in the included INSTALL.amd64 document.

If you are planning to dual boot OpenBSD with another OS, you will need to read INSTALL.amd64.

OpenBSD/arm64:

Write miniroot65.fs to a disk and boot from it after connecting to the serial console. Refer to INSTALL.arm64 for more details.

OpenBSD/armv7:

Write a system specific miniroot to an SD card and boot from it after connecting to the serial console. Refer to INSTALL.armv7 for more details.

OpenBSD/hppa:

Boot over the network by following the instructions in INSTALL.hppa or the hppa platform page.

OpenBSD/i386:

If your machine can boot from CD, you can write install65.iso or cd65.iso to a CD and boot from it. You may need to adjust your BIOS options first.

If your machine can boot from USB, you can write install65.fs or miniroot65.fs to a USB stick and boot from it.

If you can't boot from a CD, floppy disk, or USB, you can install across the network using PXE as described in the included INSTALL.i386 document.

If you are planning on dual booting OpenBSD with another OS, you will need to read INSTALL.i386.

OpenBSD/landisk:

Write miniroot65.fs to the start of the CF or disk, and boot normally.

OpenBSD/loongson:

Write miniroot65.fs to a USB stick and boot bsd.rd from it or boot bsd.rd via tftp. Refer to the instructions in INSTALL.loongson for more details.

OpenBSD/luna88k:

Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the bootloader from the PROM, and then bsd.rd from the bootloader. Refer to the instructions in INSTALL.luna88k for more details.

OpenBSD/macppc:

Burn the image from a mirror site to a CDROM, and power on your machine while holding down the C key until the display turns on and shows OpenBSD/macppc boot.

Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /6.5/macppc/bsd.rd

OpenBSD/octeon:

After connecting a serial port, boot bsd.rd over the network via DHCP/tftp. Refer to the instructions in INSTALL.octeon for more details.

OpenBSD/sgi:

To install, burn cd65.iso on a CD-R, put it in the CD drive of your machine and select Install System Software from the System Maintenance menu. Indigo/Indy/Indigo2 (R4000) systems will not boot automatically from CD-ROM, and need a proper invocation from the PROM prompt. Refer to the instructions in INSTALL.sgi for more details.

If your machine doesn't have a CD drive, you can setup a DHCP/tftp network server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your system type. Refer to the instructions in INSTALL.sgi for more details.

OpenBSD/sparc64:

Burn the image from a mirror site to a CDROM, boot from it, and type boot cdrom.

If this doesn't work, or if you don't have a CDROM drive, you can write floppy65.fs or floppyB65.fs (depending on your machine) to a floppy and boot it with boot floppy. Refer to INSTALL.sparc64 for details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

You can also write miniroot65.fs to the swap partition on the disk and boot with boot disk:b.

If nothing works, you can boot over the network as described in INSTALL.sparc64.

How to upgrade

If you already have an OpenBSD 6.4 system, and do not want to reinstall, upgrade instructions and advice can be found in the Upgrade Guide.

Notes about the source code

src.tar.gz contains a source archive starting at /usr/src. This file contains everything you need except for the kernel sources, which are in a separate archive. To extract:

# mkdir -p /usr/src
# cd /usr/src
# tar xvfz /tmp/src.tar.gz

sys.tar.gz contains a source archive starting at /usr/src/sys. This file contains all the kernel sources you need to rebuild kernels. To extract:

# mkdir -p /usr/src/sys
# cd /usr/src
# tar xvfz /tmp/sys.tar.gz

Both of these trees are a regular CVS checkout. Using these trees it is possible to get a head-start on using the anoncvs servers as described here. Using these files results in a much faster initial CVS update than you could expect from a fresh checkout of the full OpenBSD source tree.

Ports Tree

A ports tree archive is also provided. To extract:

# cd /usr
# tar xvfz /tmp/ports.tar.gz

Go read the ports page if you know nothing about ports at this point. This text is not a manual of how to use ports. Rather, it is a set of notes meant to kickstart the user on the OpenBSD ports system.

The ports/ directory represents a CVS checkout of our ports. As with our complete source tree, our ports tree is available via AnonCVS. So, in order to keep up to date with the -stable branch, you must make the ports/ tree available on a read-write medium and update the tree with a command like:

# cd /usr/ports
# cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_6_5

[Of course, you must replace the server name here with a nearby anoncvs server.]

Note that most ports are available as packages on our mirrors. Updated ports for the 6.5 release will be made available if problems arise.

If you're interested in seeing a port added, would like to help out, or just would like to know more, the mailing list ports@openbsd.org is a good place to know.