OpenRiot v7.9.65 — The Machine Asks doas

“The machine had patches. It always had patches. You just had to know they were there, then type a command, then type your password, then read the output, then decide if you wanted them. That’s five things. We made it one. openriot --syspatch-check. The machine checks, the machine asks, the machine applies. Then it reminds you to reboot. The Turing Police would call it ‘automated patch management.’ We call it not making you memorize errata numbers.” — The OpenRiot Crew, v7.9.65

---

Release Overview

A single command checks for system security patches, shows what’s pending, asks if you want them, and applies them. Then it reminds you to reboot. No more memorizing doas syspatch -c then doas syspatch then wondering if it worked.

Total changes: --syspatch-check command.

---

🔐 –syspatch-check

Before:

$ doas syspatch -c
022_nsd
023_unbound
...

$ doas syspatch
...scrolls for 30 seconds...

$ # did it work? do I reboot? whatever

After:

$ openriot --syspatch-check
Checking for system patches...
Patches available: 022_nsd
023_unbound
024_libressl
...
Apply system patches now? [y/N] y

Running: doas syspatch
...applies patches...
Patches applied. Reboot when convenient to activate the new kernel.

One command. The machine checks with doas syspatch -c, lists every pending patch by errata number, prompts you, and runs doas syspatch with full terminal output if you say yes. Then it explicitly tells you to reboot — not a hint, not a footnote, an instruction.

On -current snapshots it explains that sysupgrade -s handles updates and exits cleanly. No false prompts, no unnecessary doas calls.

The same logic powers the post-install patch prompt during openriot --install — the installer now delegates to a single shared function.

The Turing Police would say “read the errata page and run two commands.” We say we already know the errata page exists and we’d rather just type one word and hit enter.

---

🧾 Files Changed

File	Change
source/commands/commands.go	--syspatch-check command registered
source/commands/helpers.go	checkAndRunSyspatch() function:
	checks doas syspatch -c, prompts,
	runs doas syspatch, prints reboot
	reminder. runPostInstallPatch()
	delegates to shared function.
install/openriot	Compiled binary

---

🗣️ Final Words

“The machine was holding thirteen patches and waiting for you to ask about them. You weren’t asking. The machine wasn’t telling. We taught the machine to speak first and ask second and do third — the right order, the only order that makes sense when the silence is costing you security. The Turing Police would say ‘subscribe to the errata mailing list.’ We say the machine knows what it needs and now it knows how to ask.” — The OpenRiot Crew, v7.9.65