Drop support for old /etc/ssl package certificates. Starting with 5.5, only signify is used.

openup

@@ -29,11 +29,7 @@ _REL_INT="$(echo ${_REL[0]} | tr -d '.')"
 ########################################################################
 # URL to the latest openup version
 OPENUP_URL="https://stable.mtier.org/openup"
-# URL to the certificate that was used to sign the packages (OpenBSD =< 5.4)
-PKG_CERT_URL="https://stable.mtier.org/mtier.cert"
-# fingerprint of the certificate that was used to sign the packages (OpenBSD =< 5.4)
-PKG_CERT_FPRINT="DE:29:0F:7F:B8:0E:36:5A:AF:A9:BF:E0:4E:08:C2:0F:2D:50:16:97"
-# signify(1) public key (OpenBSD >= 5.5)
+# signify(1) public key
 PKG_PUBKEY_URL="https://stable.mtier.org/mtier-${_REL_INT}-pkg.pub"
 # PKG_PATH for currently running OpenBSD release
 PKG_PATH_MAIN="http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)"
@@ -95,7 +91,6 @@ _ARCH=$(arch -s)
 _TMP="${TMPDIR:=/tmp}"
 _TMPDIR=$(mktemp -dp ${_TMP} .openup-XXXXXXXXXX) || exit 1
 _TMPKEY="${_TMPDIR}/key"
-_TMPSPLITCERT="${_TMPDIR}/cert"
 _TMPVUXML="${_TMPDIR}/vuxml"
 _PID="/var/run/${0##*/}.pid"
 
@@ -114,24 +109,7 @@ pr() {
 	fi
 }
 
-get_cert() {
-	if [ -r /etc/ssl/pkgca.pem ]; then
-		split -p '^-----BEGIN CERTIFICATE-----$' /etc/ssl/pkgca.pem ${_TMPSPLITCERT}
-	fi
-
-	for i in ${_TMPSPLITCERT}* ; do
-		openssl x509 -noout -in $i -fingerprint 2>/dev/null | \
-			grep -q "${PKG_CERT_FPRINT}" && return
-	done
-
-	pr "Downloading certificate"
-	ftp -Vo ${_TMPKEY} ${PKG_CERT_URL} || bye_bye
-
-	pr "Installing certificate"
-	_cat ${_TMPKEY} >>/etc/ssl/pkgca.pem || bye_bye
-}
-
-get_pubkey() {
+get_key() {
 	[ -r /etc/signify/mtier-${_REL_INT}-pkg.pub ] && return
 
 	pr "Downloading public key"
@@ -307,13 +285,7 @@ fi
 if [ "${checkmode}" ]; then
 	check_vuxml
 else
-	if [ -z "${nosig}" ]; then
-		if [ "${_REL_INT}" -lt 55 ]; then
-			get_cert
-		else
-			get_pubkey
-		fi
-	fi
+	[ -z "${nosig}" ] && get_key
 	rm_old_bp
 	update_binpatches
 	update_pkg