Solaris 11: Quick way to fetch and install patches after initial install

Question

Is there a quick command that will fetch patches from the internet and install them?

Answer 1

You can fetch patches with the pkg command. However, you first need to add a repository and certificate. Your Oracle rep will no doubt provide you with information on how to do this.

Patches are not available without a support contract, which is the reason there is per definition an Oracle rep involved...

Answer 2

Patches, i.e. partial packages bundles, as they were available with Solaris 10 and older are no more built or available with IPS (Image Packaging System) introduced with Solaris 11 Express (and OpenSolaris before). The new way is to replace full packages.

A system can be updated to the latest version (or SRUs service repository updates) with the pkg update command.

http://blogs.oracle.com/observatory/entry/srus

Answer 3

The documentation from Oracle is your best friend when it comes to Solaris questions.

The short answer is that pkg update or pkg update --accept will update Solaris to the most recent packages available from the IPS repositories you have enabled on your system.

The long answer: For Solaris 11+, software has moved from SVR4 packages and patches to IPS repositories. Similar to YUM or apt-get, IPS repositories host packages which replace older packages during updates. The pkg command is the general-purpose client utility for IPS repos. IPS repositories are also integrated with Solaris 11 boot environments to easily rollback if issues arise (check out man beadm, the Solaris 11 improvement on live upgrading)

To list publishers:

$ pkg publisher
PUBLISHER                   TYPE    STATUS P URI
solaris                     origin  online T http://pkg.oracle.com/solaris/release/
solaris                     origin  online T https://pkg.oracle.com/solaris/support/           

Now, most of my experience is with pre-built images so I don't know which repositories are enabled by default on a 100% fresh install. If you don't have any or the correct repositories, adding a repository (in this case, the public release repository) is as easy as

# pkg set-publisher -g http://pkg.oracle.com/solaris/release/ solaris

To get access to the support repository where Oracle publishes their Support Repository Updates, you'll need to get a certificate and key from Oracle. If you have a My Oracle Support login associated with a valid Support Identifier you can get these yourself. Directions to use a key/cert to enable the support repository are here, which contains a link to the certificate generation page. I'd post a link to the cert page directly, but my reputation only allows 2 links; documentation and instruction trump the convenience of a saved mouseclick.

In short once you have the key and certificate you can add the support IPS repository thusly

# pkg set-publisher \
    -k </path/to/key.pem> \
    -c <path/to/certificate.pem>  \
    -g https://pkg.oracle.com/solaris/support/ solaris

From here you can pkg update or pkg update --accept as above.

A final gotcha: If you're using the Oracle support repositories and want to keep your system in an Oracle supported configuration, you'll want to specifically update the entire consolidation package. The entire consolidation forces all relevant packages to stay on version configurations that have been tested and verified by Oracle. For that, you can use pkg update entire --accept which will selectively update packages to an exact supported configuration.

Answer 4

I know that previously under Sun from the GUI, updatemanager could be used. However, this is only a suggestion as I have not tried Solaris 11 or systems under the Oracle brand.