Contributed by rueda on from the lets go on a dbup date dept.
Theo de Raadt (deraadt@) has
committed
to -current
a (WIP) new utility for updating system databases:
CVSROOT: /cvs Module name: src Changes by: deraadt@cvs.openbsd.org 2026/10/20 19:08:58 Added files: usr.sbin/dbupdate: Makefile dbupdate.8 dbupdate.sh Log message: initial draft of dbupdate(8) for updating (signed) zoneinfo and cert.pem from a new cdn.openbsd.org/pub/OpenBSD/dbupdates/ directory. We can't do this nicely with syspatch(8) because it requires patches in sequence so a new tool had to be written. It is intentionally kept very simple so that it can be studied because we intend to run this in root cron, (the non-simple parts figure out quickly when not to update). looked at by sthen beck lucas dgl
This should provide a smooth mechanism for dealing with the occasional change to timezone and CA databases, including urgent CA ones such as that necessitated by the recently-revealed Emudhra fiasco!
dbupdate(8) is already linked to the build
but, at the time of writing, is not yet automatically invoked.