OpenRiot v8.0.8: Only the Named
“The doorman had one job and a photocopied list. Somebody handed him a new name on a napkin, and he went upstairs and woke the entire building to check it. The list was right there. The napkin was right there. The building did not need to know.” – The OpenRiot Crew, v8.0.8
OpenRiot 8.0.8 fixes one bad habit in the package installer: confusing “the list changed” with “everyone is invited.”
Adding a single line to install/packages.yaml used to fail
the --packages-current check, which sent setup down the
--pkg-update path. That path ran pkg_add -Iu with no
package names attached. On OpenBSD, that means update
everything installed on the machine. One new library, one
hour, one very confused user watching unrelated packages
cycle through the terminal.
--pkg-update now reads the guest list before it opens the
door.
Total changes: one command learned to read names, and one night of unnecessary upgrades ended.
The Line Outside
The setup script has a guard. It asks whether the pins in
packages.yaml match what is installed. If they do, it skips
the package update and moves on. If they do not, it calls
--pkg-update.
The guard was correct. The thing it called was not. Going from 8.0.7 to 8.0.8, one added dependency was enough to make the pins disagree, and the disagreement was answered by updating every package in the system. The new package would still be installed afterward. So would a hundred packages nobody asked about.
That is not an update. That is a sweep.
The List
installer.UpdatePinnedPackages() loads install/packages.yaml,
takes the base name of every pin, removes duplicates, and
passes that list to pkg_add -Iu. On a snapshot system it
passes -D snapshot the way the rest of the installer does.
The result is narrow on purpose. If the only change is one added library, the updater updates one library. If ten pins moved, it updates ten. If nothing moved, it checks the list and does nothing worth watching.
The rule is simple enough to say out loud: update what somebody named, leave the rest alone.
The Door
The command still streams pkg_add output, so a slow mirror
or a large package still shows progress. The old “up to an
hour” warning is gone with the old behavior. A short line
warns that it may take a while, because honesty does not
require a specific number when the list is the only thing
being fetched.
Snapshot handling, mirror setup, and the fallback paths in the installer are unchanged. This is a scope fix, not a rewrite.
What It Refuses to Do
It refuses to treat the machine as a single lump. It refuses to decide that a pin change is permission to touch packages that were never in the file. It refuses to spend an hour on a one-line diff.
Bulk is a business model, not a maintenance strategy. The list is the list. Read it.
🧾 Files Changed
| File | Change |
|---|---|
source/installer/packages.go |
NEW UpdatePinnedPackages(): |
packages.yaml pins only, deduped base names |
|
source/commands/commands.go |
--pkg-update uses the pinned |
| list, warning text matches the new scope |
🗣️ Final Words
“The napkin said libwebp. The doorman read libwebp, checked libwebp at the door, and went back to his stool. The rest of the building slept. That is the whole release. Somebody finally read the list.” – The OpenRiot Crew, v8.0.8