Add signify(1) support.

openup

@@ -16,22 +16,28 @@
 #
 # Author: Antoine Jacoutot <antoine@mtier.org>
 
+# regex taken from fw_update(1)
+set -A _REL -- $(sysctl -n kern.version | sed 's/^OpenBSD \([0-9]\.[0-9]\)\([^ ]*\).*/\1 \2/;q')
+_REL_INT="$(echo ${_REL[0]} | tr -d '.')"
+
 ########################################################################
 ### DO NOT EDIT THIS FILE!!!                                         ###
 ### User defined variables: overrides are read from /etc/openup.conf ###
 ########################################################################
 # URL to the latest openup version
 OPENUP_URL="https://stable.mtier.org/openup"
-# URL to the certificate that was used to sign the packages
+# URL to the certificate that was used to sign the packages (OpenBSD =< 5.4)
 PKG_CERT_URL="https://stable.mtier.org/mtier.cert"
-# fingerprint of the certificate that was used to sign the packages
+# fingerprint of the certificate that was used to sign the packages (OpenBSD =< 5.4)
 PKG_CERT_FPRINT="DE:29:0F:7F:B8:0E:36:5A:AF:A9:BF:E0:4E:08:C2:0F:2D:50:16:97"
+# signify(1) public key (OpenBSD >= 5.5)
+PKG_PUBKEY_URL="https://stable.mtier.org/mtier-${_REL_INT}-pkg.pub"
 # PKG_PATH for currently running OpenBSD release
 PKG_PATH_MAIN="http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)"
 # PKG_PATH for the corresponding release stable packages service
 PKG_PATH_UPDATE="https://stable.mtier.org/updates/$(uname -r)/$(arch -s)"
 # URL to the latest vuxml (vulnerabilities database)
-VUXML_URL="https://stable.mtier.org/vuxml/$(uname -r | tr -d '.').xml"
+VUXML_URL="https://stable.mtier.org/vuxml/${_REL_INT}.xml"
 ########################################################################
 ### End of user defined variables                                    ###
 ########################################################################
@@ -71,10 +77,6 @@ if [ -f /etc/openup.conf ]; then
 	. /etc/openup.conf
 fi
 
-# regex taken from fw_update(1)
-set -A _REL -- $(sysctl -n kern.version | sed 's/^OpenBSD \([0-9]\.[0-9]\)\([^ ]*\).*/\1 \2/;q')
-_REL_INT="$(echo ${_REL[0]} | tr -d '.')"
-
 if [ -n "${_REL[1]}" -a "${_REL[1]}" != "-stable" ]; then _badrel=1; fi
 if [ "${_REL_INT}" -lt "${_OPENUP_MINREL}" ]; then _badrel=1; fi
 
@@ -85,7 +87,7 @@ fi
 
 _ARCH=$(arch -s)
 _TMPDIR="${TMPDIR:=/tmp}"
-_TMPCERT=$(mktemp -p ${_TMPDIR} .openup-pkg_cert.XXXXXXXXXX) || exit 1
+_TMPKEY=$(mktemp -p ${_TMPDIR} .openup-pkg_key.XXXXXXXXXX) || exit 1
 _TMPSPLITCERT=$(mktemp -p ${_TMPDIR} .openup-split_cert.XXXXXXXXXX) || exit 1
 _TMPVUXML=$(mktemp -p ${_TMPDIR} .openup-vuxml.XXXXXXXXXX) || exit 1
 
@@ -124,12 +126,27 @@ get_cert() {
 	done
 
 	pr_bigarrow "Downloading certificate"
-	_CMD="ftp -Vo ${_TMPCERT} ${PKG_CERT_URL}"
+	_CMD="ftp -Vo ${_TMPKEY} ${PKG_CERT_URL}"
 	pr_smallarrow "${_CMD}"
 	cmd.exe ${_CMD}
 
 	pr_bigarrow "Installing certificate"
-	_CMD="cat ${_TMPCERT} >>/etc/ssl/pkgca.pem"
+	_CMD="cat ${_TMPKEY} >>/etc/ssl/pkgca.pem"
+	pr_smallarrow "${_CMD}"
+	cmd.exe ${_CMD}
+}
+
+get_pubkey() {
+	[ -r /etc/signify/mtier-${_REL_INT}-pkg.pub ] && return
+	local _CMD
+
+	pr_bigarrow "Downloading public key"
+	_CMD="ftp -Vo ${_TMPKEY} ${PKG_PUBKEY_URL}"
+	pr_smallarrow "${_CMD}"
+	cmd.exe ${_CMD}
+
+	pr_bigarrow "Installing public key"
+	_CMD="install -m0644 ${_TMPKEY} /etc/signify/mtier-${_REL_INT}-pkg.pub"
 	pr_smallarrow "${_CMD}"
 	cmd.exe ${_CMD}
 }
@@ -188,19 +205,21 @@ update_pkg() {
 
 	_PKG=$(pkg_info -q | grep -v binpatch${_REL_INT}-${_ARCH})
 
-	pr_bigarrow "Updating package(s)"
+	if [ -n "${_PKG}" ]; then
-	_CMD="pkg_add -qrz ${pkg_opt}"
+		pr_bigarrow "Updating package(s)"
-	pr_smallarrow "${_CMD}"
+		_CMD="pkg_add -qrz ${pkg_opt}"
-	# we don't want to display ${_PKG}, there could be hundreds
+		pr_smallarrow "${_CMD}"
-	_CMD="${_CMD} ${_PKG}"
+		# we don't want to display ${_PKG}, there could be hundreds
-	cmd.exe ${_CMD}
+		_CMD="${_CMD} ${_PKG}"
+		cmd.exe ${_CMD}
+	fi
 }
 
 # this only outputs the most recent vulnerability for each matching pkg
 check_vuxml() {
 	local _BP_MATCH _OUTDATED _PAT _PKG_MATCH
 
-	ftp -Vo ${_TMPVUXML} ${VUXML_URL} >/dev/null
+	ftp -Vo ${_TMPVUXML} ${VUXML_URL} >/dev/null || exit 1
 	perl -pi -e 's,\$ARCH,'"${_ARCH}"',g' ${_TMPVUXML}
 
 	_BP_MATCH="$(grep binpatch ${_TMPVUXML} | sed -e 's,<name>,,g;s,</name>,,g;s,\$ARCH,'"${_ARCH}"',g' | sort -u)"
@@ -272,7 +291,13 @@ if [ "${checkmode}" ]; then
 	check_vuxml
 
 else
-	if [ -z "${nosig}" ]; then get_cert; fi
+	if [ -z "${nosig}" ]; then
+		if [ "${_REL_INT}" -lt 55 ]; then
+			get_cert
+		else
+			get_pubkey
+		fi
+	fi
 	rm_old_bp
 	update_binpatches
 	update_pkg