git: 978e04ff5bcf - releng/14.3 - freebsd-update: Library ordering

The branch releng/14.3 has been updated by gordon:

URL: https://cgit.FreeBSD.org/src/commit/?id=978e04ff5bcf0a750cd3ef19561f5e0f67860620

commit 978e04ff5bcf0a750cd3ef19561f5e0f67860620
Author:     Colin Percival <cperciva@FreeBSD.org>
AuthorDate: 2025-09-23 06:55:08 +0000
Commit:     Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2025-09-30 04:57:23 +0000

    freebsd-update: Library ordering
    
    Upgrading from 14.x to 15.x with freebsd-update broke because libc
    depends on the new libsys library; freebsd-update installed the new
    libc before creating libsys, and every step after that failed because
    all the tools (including gunzip and install) are dynamically linked
    and need a working libc.
    
    Enforce ordering when installing shared objects: First libsys, then
    libc, then libthr, and then all the rest of the shared object files.
    
    This is a candidate for an Errata Notice since the issue this fixes
    breaks upgrades.
    
    PR:             289769
    Reported by:    Graham Perrin
    Reviewed by:    kib
    MFC after:      3 days
    Sponsored by:   https://www.patreon.com/cperciva
    Differential Revision:  https://reviews.freebsd.org/D52688
    Approved by:    so
    Security:       FreeBSD-EN-25:18.freebsd-update
    
    (cherry picked from commit 7ece602e00e85195fc426a2401c49921cd39735e)
    (cherry picked from commit e26928669f39c8683aea74040b9e2472e944c43a)
---
 usr.sbin/freebsd-update/freebsd-update.sh | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/usr.sbin/freebsd-update/freebsd-update.sh b/usr.sbin/freebsd-update/freebsd-update.sh
index f575f89bcf82..cf314a256b81 100644
--- a/usr.sbin/freebsd-update/freebsd-update.sh
+++ b/usr.sbin/freebsd-update/freebsd-update.sh
@@ -3063,10 +3063,28 @@ Kernel updates have been installed.  Please reboot and run
 		    grep -E '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' > INDEX-NEW
 		install_from_index INDEX-NEW || return 1
 
-		# Install new shared libraries next
+		# Next, in order, libsys, libc, and libthr.
 		grep -vE '^/boot/' $1/INDEX-NEW |
 		    grep -vE '^[^|]+\|d\|' |
 		    grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' |
+		    grep -E '^[^|]*/lib/libsys\.so\.[0-9]+\|' > INDEX-NEW
+		install_from_index INDEX-NEW || return 1
+		grep -vE '^/boot/' $1/INDEX-NEW |
+		    grep -vE '^[^|]+\|d\|' |
+		    grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' |
+		    grep -E '^[^|]*/lib/libc\.so\.[0-9]+\|' > INDEX-NEW
+		install_from_index INDEX-NEW || return 1
+		grep -vE '^/boot/' $1/INDEX-NEW |
+		    grep -vE '^[^|]+\|d\|' |
+		    grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' |
+		    grep -E '^[^|]*/lib/libthr\.so\.[0-9]+\|' > INDEX-NEW
+		install_from_index INDEX-NEW || return 1
+
+		# Install the rest of the shared libraries next
+		grep -vE '^/boot/' $1/INDEX-NEW |
+		    grep -vE '^[^|]+\|d\|' |
+		    grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' |
+		    grep -vE '^[^|]*/lib/(libsys|libc|libthr)\.so\.[0-9]+\|' |
 		    grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW
 		install_from_index INDEX-NEW || return 1