# OpenBSD adds dbupdate(8) utility for signed timezone and CA certificate updates

> **Key takeaway:** Theo de Raadt committed dbupdate(8) to OpenBSD -current as a new lightweight utility to update signed zoneinfo and cert.pem databases independently of syspatch(8).

**Published:** 2026-10-21T19:17:36+00:00 
**Source:** OpenBSD Journal (Undeadly) 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/openbsd-adds-dbupdate8-utility-for-signed-timezone-and-ca-ce.html 

## Summary
OpenBSD founder Theo de Raadt has committed dbupdate(8) to the -current development branch as a work-in-progress utility for updating system databases. The tool fetches signed zoneinfo timezone data and cert.pem CA certificates from a new cdn.openbsd.org/pub/OpenBSD/dbupdates/ directory. It was created because syspatch(8) requires sequential patches, making it unsuitable for these occasional but sometimes urgent updates. The implementation is deliberately simple to facilitate security review, as it is intended to run from root's cron. The tool is already linked to the build but not yet automatically invoked. The need was highlighted by the recent Emudhra CA compromise, which required rapid certificate authority database changes.

## How dbupdate(8) differs from syspatch
- **Decoupled from patch sequencing:** syspatch(8) requires patches to be applied in strict sequence, which is unnecessary and inefficient for database files like zoneinfo and cert.pem that change independently of the base system version.
- **Signed updates from dedicated CDN:** dbupdate(8) pulls from cdn.openbsd.org/pub/OpenBSD/dbupdates/, a new dedicated path separate from the main distribution mirrors, with cryptographic signatures verified on the downloaded database files.
- **Root cron integration by design:** The tool is explicitly architected to run unattended from root's crontab, with what de Raadt describes as "non-simple parts" that rapidly determine when no update is needed to avoid unnecessary network traffic and processing.
- **Shell script implementation:** dbupdate(8) is implemented as a shell script (dbupdate.sh) with a manual page (dbupdate.8), keeping the codebase small and auditable rather than a compiled binary.
- **Build-linked but not yet auto-enabled:** The utility is already connected to the OpenBSD build system but administrators must currently invoke it manually; automatic scheduling is planned for a future -current snapshot.

## Why it matters
For OpenBSD administrators and security-focused operators, dbupdate(8) closes a practical gap where timezone and CA certificate updates previously required full syspatch cycles or manual intervention. The Emudhra CA incident demonstrated that rapid CA database rotation is a real operational need; decoupling this from the base system's patch sequence reduces exposure window for trust-anchor compromises. The design choice of a small, auditable shell script also reinforces OpenBSD's longstanding prioritization of code simplicity for security-critical infrastructure.