From 01dde390fc872e4e2e6d5e58fad8b5eeac3dbb2d Mon Sep 17 00:00:00 2001
From: Antoine Jacoutot <antoine@mtier.org>
Date: Fri, 9 Aug 2013 10:37:43 +0200
Subject: [PATCH] Use SSL fingerprint to check the certificate. Move generic
 rm(1) call in trap. Run a wildcard rm(1) at the end of the script. Cope with
 multiple certificates in one PEM file.

---
 openup | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/openup b/openup
index 9ee7590..9db9e99 100755
--- a/openup
+++ b/openup
@@ -24,7 +24,7 @@
 ### user defined variables
 OPENUP_URL='https://stable.mtier.org/openup'
 PKG_CERT_URL='https://stable.mtier.org/mtier.cert'
-PKG_CERT_REGEX='M:Tier Ltd. OpenBSD Stable Updates'
+PKG_CERT_FPRINT='DE:29:0F:7F:B8:0E:36:5A:AF:A9:BF:E0:4E:08:C2:0F:2D:50:16:97'
 ### end of user defined variables
 
 
@@ -59,8 +59,9 @@ MEESA=$(readlink -f $0)
 TMPDIR="${TMPDIR:=/tmp}"
 TMPCERT=$(mktemp -p ${TMPDIR} openup-pkg_cert.XXXXXX) || exit 1
 TMPUPD=$(mktemp -p ${TMPDIR} openup-update.XXXXXX) || exit 1
+TMPSPLITCERT=$(mktemp -p ${TMPDIR} openup-split_cert.XXXXXX) || exit 1
 
-trap "rm -f ${TMPCERT} ${TMPUPD}" 1 2 3 13 15
+trap "rm -f ${TMPDIR}/openup-*" 1 2 3 13 15
 
 error() {
 	echo -n "*** ERROR: $@"
@@ -69,10 +70,13 @@ error() {
 get_cert() {
 	local _CMD
 
-	if [ -r /etc/ssl/pkgca.pem ]; then
-		openssl x509 -noout -in /etc/ssl/pkgca.pem -issuer 2>/dev/null | \
-			grep -q "${PKG_CERT_REGEX}" && return
-	fi
+	[[ -r /etc/ssl/pkgca.pem ]] && \
+		split -p '^-----BEGIN CERTIFICATE-----$' /etc/ssl/pkgca.pem ${TMPSPLITCERT}
+
+	for i in ${TMPSPLITCERT}* ; do
+		openssl x509 -noout -in $i -fingerprint 2>/dev/null |
+			grep -q "${PKG_CERT_FPRINT}" && return
+	done
 
 	echo "===> Downloading certificate"
 	_CMD="ftp -Vo ${TMPCERT} ${PKG_CERT_URL}"
@@ -87,8 +91,6 @@ get_cert() {
 	if [ -z "${DRYRUN}" ]; then
 		eval ${_CMD} || exit 1
 	fi
-
-	rm -f ${TMPCERT}
 }
 
 update_self() {
@@ -110,14 +112,11 @@ update_self() {
 			eval ${_CMD} # non-fatal
 			if [ $? -eq 0 ]; then
 				# XXX
-				rm -f ${TMPUPD}
 				echo "successfully updated openup(8) to version ${_N}, restarting myself"
 				${MEESA} -U $@
 				exit $?
 			fi
 		fi
-
-	rm -f ${TMPUPD}
 }
 
 update_binpatches() {
@@ -166,3 +165,5 @@ done
 update_binpatches
 update_pkg
 update_fw
+
+rm -f ${TMPDIR}/openup-*