Skip to content
OpenBSD upgrade tool (OpenBSD,Shell)
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
old_pubkeys move old keys to dir Feb 3, 2016
Makefile move man page, add phony to makefile Jun 19, 2018
SHA256.sig sign Dec 12, 2018
snap docs for -s Dec 12, 2018 integrity checking working Feb 3, 2016

SNAP(8) - System Manager's Manual


snap - snapshot upgrade tool


snap [-bBcdDehiIkKmMnrRsSuUvWx] [-b [boot device]] [-c [config_file]] [-D [destination]] [-m [machine]] [-M [mirror]] [-V [version]] [-s [pubkey]]


snap is a ksh(1) script designed to upgrade an OpenBSD machine to the latest snapshot available. Upgrading from release to release is not supported.

snap checks the `BUILDINFO` file located on the remote mirror, and will warn you if the snapshot is not newer than the currently running version.

By default snap verifies signatures for the set files it downloads. This can be prevented by specifying the -S option, however, skipping verification is very much not recommended!

The options are as follows:

-D destination

Destination directory to place the `.tgz` files.


Skip signature verification. This is not recommended!

-c config_file

Location of configuration file (default is /etc/snap.conf or $HOME/.snaprc ).


Extract sets into destination directory and exit. The destination directory can be overwritten by the -D option, or by setting the DST line in config_file.


Download sets to the destination directory, verify ( -S prevents signature verification) and exit. By default the destination directory is set to /tmp/upgrade

-m machine

Use machine instead of what the `machine` command returns.

-V setversion

Use to specify a specific version of sets. This option will need to be used when there is a version jump, say from 6.0 to 6.1.


Run sysmerge after extracting {x}sets. This option may cause issues if the newer snapshot introduces ABI changes. Not recommended.


Do not extract x11 sets.

-M mirror

Specify which mirror to use.

-I sigfile

Verify integrity of the snap tool. If sigfile is omitted, snap will pull a copy of SHA256.sig from the GitHub page.

-s pubkey

Signify pub key to do verification with.


Run in interactive mode (has colors).


Force snap to install as /bsd


Only install the kernels and exit.


Prevent snap from making a backup of the kernel files.


Check for update to the snap script.


Download and install the latest version of snap (will overwrite currently installed version). Signature verification is also done.

-b device

Tells snap which device to install bootstrap on.


Reboot after running snap





Contains timestamp of the previous snapshot.


Global configuration options. See SNAPRC for more information on these options.


User specific configuration options.


snap supports the following configuration options via /etc/snap.conf or $HOME/.snaprc file:


If true, snap will operate as if -i was specified. Defaults to false.

DST directory

Tells snap where to download the snapshot sets and signature files. Defaults to /tmp/upgrade


Tells snap to exit after extracting the sets. Defaults to false.

FTP_OPTS string

Lets you overwrite the options passed to ftp(1). This can be handy if your mirror supports file continuation! Defaults to: " -V ".

See ftp(1) for options.

MERGE bool

Tells snap to merge files in /etc using the sysmerge(8) utility. Defaults to false.

NO_X11 bool

Tells snap to forgo download and extraction of xsets. Defaults to false.


Setting this to `true` will cause snap to reboot the system after successful extraction of sets. Defaults to false.

AFTER script

Specifies a script to be copied to /etc/rc.firsttime. The script will then be executed upon successful reboot. Default is not set.

MIRROR string

Defaults to ``.



To upgrade to the latest snapshot:

$ doas snap

To upgrade to the latest snapshot using an explicit mirror region:

$ doas snap -M

To upgrade to a snapshot without updating xsets:

$ doas snap -x


A typical ~/.snaprc would look something like this:



Here is an `AFTER` script that makes sure we have the latest devices in /dev, upgrades all the firmware currently installed and upgrades currently installed packages:

    cd /dev && sh MAKEDEV all
    /usr/sbin/fw_update -v
    /usr/sbin/pkg_add -uVm # -m is needed to see progress in this context


snap can be verified using the signify utility.

Public key

untrusted comment: public key


After installing the above public key in /etc/signify/ and downloading the SHA256.sig file, you can verify snap by running one the following:

Have snap download the SHA256.sig file and run verification:

$ snap -I

Have snap verify a pre-downloaded SHA256.sig file:

$ snap -I SHA256.sig

Manual verification with the signify utility:

$ signify -C -p /etc/signify/ -x SHA256.sig snap


ftp(1), signify(1), installboot(8), rc(8), release(8), sysmerge(8)


The first version of snap was released in September of 2012.


snap was written by Aaron Bieber <>.

OpenBSD 6.4 - September 19, 2012

You can’t perform that action at this time.