ston1th/openup
1
0
Fork 0
forked from mirrors/openup
Code Releases Activity

Use SSL fingerprint to check the certificate.

Browse source 
Move generic rm(1) call in trap.
Run a wildcard rm(1) at the end of the script.
Cope with multiple certificates in one PEM file.
This commit is contained in:
Antoine Jacoutot 2013-08-09 10:37:43 +02:00
commit 01dde390fc
1 changed files with 12 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

23
openup
View file

@ -24,7 +24,7 @@
### user defined variables
OPENUP_URL='https://stable.mtier.org/openup'
PKG_CERT_URL='https://stable.mtier.org/mtier.cert'
PKG_CERT_REGEX='M:Tier Ltd. OpenBSD Stable Updates'
PKG_CERT_FPRINT='DE:29:0F:7F:B8:0E:36:5A:AF:A9:BF:E0:4E:08:C2:0F:2D:50:16:97'
### end of user defined variables
@ -59,8 +59,9 @@ MEESA=$(readlink -f $0)
TMPDIR="${TMPDIR:=/tmp}"
TMPCERT=$(mktemp -p ${TMPDIR} openup-pkg_cert.XXXXXX) || exit 1
TMPUPD=$(mktemp -p ${TMPDIR} openup-update.XXXXXX) || exit 1
TMPSPLITCERT=$(mktemp -p ${TMPDIR} openup-split_cert.XXXXXX) || exit 1
trap "rm -f ${TMPCERT} ${TMPUPD}" 1 2 3 13 15
trap "rm -f ${TMPDIR}/openup-*" 1 2 3 13 15
error() {
echo -n "*** ERROR: $@"
@ -69,10 +70,13 @@ error() {
get_cert() {
local _CMD
if [ -r /etc/ssl/pkgca.pem ]; then
openssl x509 -noout -in /etc/ssl/pkgca.pem -issuer 2>/dev/null | \
grep -q "${PKG_CERT_REGEX}" && return
fi
[[ -r /etc/ssl/pkgca.pem ]] && \
split -p '^-----BEGIN CERTIFICATE-----$' /etc/ssl/pkgca.pem ${TMPSPLITCERT}
for i in ${TMPSPLITCERT}* ; do
openssl x509 -noout -in $i -fingerprint 2>/dev/null |
grep -q "${PKG_CERT_FPRINT}" && return
done
echo "===> Downloading certificate"
_CMD="ftp -Vo ${TMPCERT} ${PKG_CERT_URL}"
@ -87,8 +91,6 @@ get_cert() {
if [ -z "${DRYRUN}" ]; then
eval ${_CMD} || exit 1
fi
rm -f ${TMPCERT}
}
update_self() {
@ -110,14 +112,11 @@ update_self() {
eval ${_CMD} # non-fatal
if [ $? -eq 0 ]; then
# XXX
rm -f ${TMPUPD}
echo "successfully updated openup(8) to version ${_N}, restarting myself"
${MEESA} -U $@
exit $?
fi
fi
rm -f ${TMPUPD}
}
update_binpatches() {
@ -166,3 +165,5 @@ done
update_binpatches
update_pkg
update_fw
rm -f ${TMPDIR}/openup-*