diff --git a/build-go.sh b/build-go.sh index c126e51..f964289 100755 --- a/build-go.sh +++ b/build-go.sh @@ -13,7 +13,7 @@ V14="go1.4.3" bootstrap="${INSTALL}/bootstrap-${V14}" TGZ14="${V14}.tar.gz" -Vnew="go1.8" +Vnew="go1.9.1" TGZnew="${Vnew}.tar.gz" rm -rf ${INSTALL}/go* diff --git a/openup b/openup old mode 100755 new mode 100644 index 2bcc0ba..07cf9ec --- a/openup +++ b/openup @@ -1,6 +1,6 @@ #!/bin/sh # -# Copyright (c) 2013 - 2016 M:tier Ltd. +# Copyright (c) 2013 - 2017 M:tier Ltd. # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -15,6 +15,7 @@ # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. # # Author: Antoine Jacoutot +# Maintainer: M:Tier Ltd. # ChangeLog # http://cgit.mtier.org:8000/openup/log/ @@ -31,7 +32,10 @@ OPENUP_URL="https://stable.mtier.org/openup" PKG_PUBKEY_URL="https://stable.mtier.org/mtier-$(uname -r | tr -d '.')-pkg.pub" # PKG_PATH for currently running OpenBSD release -PKG_PATH_MAIN="http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)" +PKG_PATH_MAIN="https://ftp.hostserver.de/pub/OpenBSD/$(uname -r)/packages/$(arch -s)" + +# ERRATA_PATH +ERRATA_PATH="https://ftp.hostserver.de/pub/OpenBSD/patches/$(uname -r)/common" # PKG_PATH for the corresponding release stable service PKG_PATH_UPDATE="https://stable.mtier.org/updates/$(uname -r)/$(arch -s)" @@ -43,7 +47,7 @@ PKG_PATH_UPDATE="https://stable.mtier.org/updates/$(uname -r)/$(arch -s)" VUXML_URL="https://stable.mtier.org/vuxml/$(uname -r | tr -d '.').xml" # fetch command (must behave like "ftp -o"); e.g. "wget -qO" -FETCH="ftp -Vo" +FETCH="ftp -MVo" # exclusion list: pkg names without version/flavor, separated by space EXCLUDE_PKG="" @@ -58,6 +62,7 @@ usage() { echo echo "Options:" echo " -K do not check for kernel binpatches (when running non GENERIC)" + echo " -N do not check for syspatches" echo " -S ignore binpatch/package signatures" echo " -c check/cron mode, report only (cannot be used with -S)" echo " -e echo the PKG_PATH that ${0##*/} would use" @@ -127,6 +132,15 @@ rm_old_bp() { done } +update_syspatches() { + pr "Installing/updating syspatches" + syspatch + if [ $? -gt 0 ]; then + pr_err "syspatch failed; please run syspatch manually" + bye_bye + fi +} + update_binpatches() { local _BP _b _e @@ -166,33 +180,56 @@ update_pkg() { fi } +# this only outputs the missing syspatches on the system +check_syspatches() { + _SYSPATCHES=$(syspatch -c) + for _p in ${_SYSPATCHES}; do + ${FETCH} ${_TMPERRATA} ${ERRATA_PATH}/${_p}.patch.sig + [ -e ${_TMPERRATA} ] || continue + echo "--- ${_p} ---" + echo -n "Available errata: " + awk '/OpenBSD/{f=1;next} /Apply/{f=0;next} f' ${_TMPERRATA} | grep -ve '^$' + done +} + # this only outputs the most recent vulnerability for each matching pkg check_vuxml() { local _BP_MATCH _OUTDATED _PKG_MATCH _b _e _p - # XXX5.6 drop redirect to /dev/null when 5.6 is out of support - ${FETCH} ${_TMPVUXML} ${VUXML_URL} >/dev/null || bye_bye + ${FETCH} ${_TMPVUXML} ${VUXML_URL} || bye_bye perl -pi -e 's,\$ARCH,'"${_ARCH}"',g' ${_TMPVUXML} - _BP_MATCH="$(grep binpatch ${_TMPVUXML} | sed -e 's,,,g;s,,,g;s,\$ARCH,'"${_ARCH}"',g' | sort -u)" - for _e in ${EXCLUDE_PKG}; do - set -A _BP_MATCH -- ${_BP_MATCH} - _BP_MATCH="$(for _b in ${_BP_MATCH[@]}; do echo ${_b} | grep -v "^${_e}$"; done)" - done + if [ "${_REL_INT}" -lt 61 ]; then + _BP_MATCH="$(grep binpatch ${_TMPVUXML} | sed -e 's,,,g;s,,,g;s,\$ARCH,'"${_ARCH}"',g' | sort -u)" + for _e in ${EXCLUDE_PKG}; do + set -A _BP_MATCH -- ${_BP_MATCH} + _BP_MATCH="$(for _b in ${_BP_MATCH[@]}; do echo ${_b} | grep -v "^${_e}$"; done)" + done + fi _PKG_MATCH=$(pkg_info -q | grep -v binpatch${_REL_INT}-${_ARCH}) + for _e in ${EXCLUDE_PKG}; do set -A _PKG_MATCH -- ${_PKG_MATCH} _PKG_MATCH="$(for _p in ${_PKG_MATCH[@]}; do echo ${_p} | grep -v "^${_e}-.*"; done)" done - # set to "quirks" if empty to prevent running pkg_add against an empty pkg list - _OUTDATED=$((pkg_add -Iqn -Dnosig -Dunsigned ${_BP_MATCH:=quirks}; pkg_add -Iqnuz -Dnosig -Dunsigned ${_PKG_MATCH:=quirks}) 2>&1 | \ + if [ "${_REL_INT}" -lt 61 ]; then + # set to "quirks" if empty to prevent running pkg_add against an empty pkg list + _OUTDATED=$((pkg_add -Iqn -Dnosig -Dunsigned ${_BP_MATCH:=quirks}; pkg_add -Iqnuz -Dnosig -Dunsigned ${_PKG_MATCH:=quirks}) 2>&1 | \ grep '^NOT CHECKING DIGITAL SIGNATURE FOR ' | \ sed -e 's,^NOT CHECKING DIGITAL SIGNATURE FOR ,,g' | \ grep -v '^quirks-' | \ perl -ne '/^(.*)-(\d[^-]*)[-]?(\w*)(.*)$/ && print "$1\n"' | \ sort -u) + else + # set to "quirks" if empty to prevent running pkg_add against an empty pkg list + _OUTDATED=$((pkg_add -Inuvz -Dnosig -Dunsigned ${_PKG_MATCH:=quirks}) 2>&1 | \ + grep '^Adding.*(pretending)' | sort -u | sed -e 's,Adding ,,;s,(pretending),,;s,->.*,,' | \ + grep -v '^quirks-' | \ + perl -ne '/^(.*)-(\d[^-]*)[-]?(\w*)(.*)$/ && print "$1\n"' | \ + sort -u) + fi for p in ${_OUTDATED} do @@ -210,10 +247,14 @@ check_vuxml() { do_i_need_to_reboot() { # XXX hardcoded PKG_DBDIR - local kern_bp_time=$(stat -qf "%Um" /var/db/pkg/binpatch${_REL_INT}-${_ARCH}-kernel-*) + local kern_time local wake_up=$(sysctl -n kern.boottime) - if [ "${wake_up}" -lt "${kern_bp_time}" ]; then + # Check /bsd.booted first if available due to kernel relinking + [ -e /bsd.booted ] && kern_time=$(stat -qf "%Um" /bsd.booted) || \ + kern_time=$(stat -qf "%Um" /bsd) + + if [ "${wake_up}" -lt "${kern_time}" ]; then pr_err pr_err "System must be rebooted after the last kernel update" pr_err @@ -234,8 +275,8 @@ fi # regex taken from fw_update(1) set -A _REL -- $(sysctl -n kern.version | sed 's/^OpenBSD \([0-9]\.[0-9]\)\([^ ]*\).*/\1 \2/;q') _REL_INT="$(echo ${_REL[0]} | tr -d '.')" -_OPENUP_MINREL=59 -_OPENUP_VERSION=24 +_OPENUP_MINREL=60 +_OPENUP_VERSION=29 if [ -n "${_REL[1]}" -a "${_REL[1]}" != "-stable" ]; then _badrel=1; fi if [ "${_REL_INT}" -lt "${_OPENUP_MINREL}" ]; then _badrel=1; fi if [ -n "${_badrel}" ]; then @@ -243,14 +284,10 @@ if [ -n "${_badrel}" ]; then exit 1 fi -# XXX5.6 drop when 5.6 is out of support -if [ "${_REL_INT}" -ge 57 ]; then - FETCH="ftp -MVo" -fi - -while getopts 'KSce' arg; do +while getopts 'KNSce' arg; do case ${arg} in - K) nokrn=1 ;; + K) if [ "${_REL_INT}" -lt 61 ]; then nokrn=1; fi ;; + N) nosyspatch=1 ;; S) nosig=1; pkgopt="${pkgopt} -Dnosig -Dunsigned" ;; c) checkrun=1 ;; e) showenv=1 ;; @@ -274,6 +311,7 @@ _TMP="${TMPDIR:=/tmp}" _TMPDIR=$(mktemp -dp ${_TMP} .openup-XXXXXXXXXX) || exit 1 _TMPKEY="${_TMPDIR}/key" _TMPVUXML="${_TMPDIR}/vuxml" +_TMPERRATA="${_TMPDIR}/errata" export PKG_PATH=${PKG_PATH_UPDATE_LTS}:${PKG_PATH_UPDATE}:${PKG_PATH_MAIN} @@ -294,11 +332,18 @@ fi check_openupd if [ "${checkrun}" ]; then + if [ "${_REL_INT}" -ge 61 -a -z "${nosyspatch}" ]; then + check_syspatches + fi check_vuxml else [ -z "${nosig}" ] && get_key rm_old_bp - update_binpatches + if [ "${_REL_INT}" -lt 61 -a -z "${nosyspatch}" ]; then + update_binpatches + else + [ -z "${nosyspatch}" ] && update_syspatches + fi update_pkg fi