Hi,

I encountered an issue recently while upgrading to OpenBSD 8.0, where 
sysmerge -d was asking to revert errata80/005 because erratas are not 
taken into account by this tool. Luckily i noticed this issue but others 
might not.

So to make sysmerge a little more monkey-proof (i'm the monkey), here's 
a patch that adds cert.pem to the ignorelist. I've detailed the 
reasoning and examples in the commit message.

Cheers,
Kate
From fea12d5b724022912b39307e00de440d641abbac Mon Sep 17 00:00:00 2001
From: Kate <kit-ty-kate@exn.st>
Date: Sat, 24 Oct 2026 20:26:31 +0100
Subject: [PATCH] usr.sbin/sysmerge: Add /etc/ssl/cert.pem to the ignorefiles
 list

Since 15cbf8b7c56f62e653ad919590ebb0d4f7272534 dbupdate is the preferred
way to update /etc/ssl/cert.pem. However sysmerge still takes this file
into account and will try to change that file.

If cert.pem has been updated by syspatch for example, a subsequent
sysmerge would try to revert that fix.

This can happen if the user entered upgrade commands in the wrong order:
> sysupgrade && syspatch ; sysmerge -d
rather than:
> sysupgrade && sysmerge -d ; syspatch


---
 usr.sbin/sysmerge/sysmerge.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/usr.sbin/sysmerge/sysmerge.sh b/usr.sbin/sysmerge/sysmerge.sh
index 967faf888ca..700321972d3 100644
--- a/usr.sbin/sysmerge/sysmerge.sh
+++ b/usr.sbin/sysmerge/sysmerge.sh
@@ -243,6 +243,7 @@ sm_run() {
 		      /etc/passwd
 		      /etc/pwd.db
 		      /etc/spwd.db
+		      /etc/ssl/cert.pem
 		      /var/db/locate.database
 		      /var/mail/root"
 	# in case X(7) is not installed, xetcsum is not removed by the loop above
-- 
2.56.0

• sysmerge-ignore-sslcert.patch (1K)