ston1th/openup
1
0
Fork 0
forked from mirrors/openup
Code Releases Activity

Drop support for old /etc/ssl package certificates. Starting with 5.5, only signify is used.

Browse source
This commit is contained in:
Antoine Jacoutot 2014-09-11 18:36:19 +02:00
commit 76effd5e72
1 changed files with 3 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

34
openup
View file

@ -29,11 +29,7 @@ _REL_INT="$(echo ${_REL[0]} | tr -d '.')"
######################################################################## ########################################################################
# URL to the latest openup version # URL to the latest openup version
OPENUP_URL="https://stable.mtier.org/openup" OPENUP_URL="https://stable.mtier.org/openup"
# URL to the certificate that was used to sign the packages (OpenBSD =< 5.4) # signify(1) public key
PKG_CERT_URL="https://stable.mtier.org/mtier.cert"
# fingerprint of the certificate that was used to sign the packages (OpenBSD =< 5.4)
PKG_CERT_FPRINT="DE:29:0F:7F:B8:0E:36:5A:AF:A9:BF:E0:4E:08:C2:0F:2D:50:16:97"
# signify(1) public key (OpenBSD >= 5.5)
PKG_PUBKEY_URL="https://stable.mtier.org/mtier-${_REL_INT}-pkg.pub" PKG_PUBKEY_URL="https://stable.mtier.org/mtier-${_REL_INT}-pkg.pub"
# PKG_PATH for currently running OpenBSD release # PKG_PATH for currently running OpenBSD release
PKG_PATH_MAIN="http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)" PKG_PATH_MAIN="http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)"
@ -95,7 +91,6 @@ _ARCH=$(arch -s)
_TMP="${TMPDIR:=/tmp}" _TMP="${TMPDIR:=/tmp}"
_TMPDIR=$(mktemp -dp ${_TMP} .openup-XXXXXXXXXX) || exit 1 _TMPDIR=$(mktemp -dp ${_TMP} .openup-XXXXXXXXXX) || exit 1
_TMPKEY="${_TMPDIR}/key" _TMPKEY="${_TMPDIR}/key"
_TMPSPLITCERT="${_TMPDIR}/cert"
_TMPVUXML="${_TMPDIR}/vuxml" _TMPVUXML="${_TMPDIR}/vuxml"
_PID="/var/run/${0##*/}.pid" _PID="/var/run/${0##*/}.pid"
@ -114,24 +109,7 @@ pr() {
fi fi
} }
get_cert() { get_key() {
if [ -r /etc/ssl/pkgca.pem ]; then
split -p '^-----BEGIN CERTIFICATE-----$' /etc/ssl/pkgca.pem ${_TMPSPLITCERT}
fi
for i in ${_TMPSPLITCERT}* ; do
openssl x509 -noout -in $i -fingerprint 2>/dev/null | \
grep -q "${PKG_CERT_FPRINT}" && return
done
pr "Downloading certificate"
ftp -Vo ${_TMPKEY} ${PKG_CERT_URL} || bye_bye
pr "Installing certificate"
_cat ${_TMPKEY} >>/etc/ssl/pkgca.pem || bye_bye
}
get_pubkey() {
[ -r /etc/signify/mtier-${_REL_INT}-pkg.pub ] && return [ -r /etc/signify/mtier-${_REL_INT}-pkg.pub ] && return
pr "Downloading public key" pr "Downloading public key"
@ -307,13 +285,7 @@ fi
if [ "${checkmode}" ]; then if [ "${checkmode}" ]; then
check_vuxml check_vuxml
else else
if [ -z "${nosig}" ]; then [ -z "${nosig}" ] && get_key
if [ "${_REL_INT}" -lt 55 ]; then
get_cert
else
get_pubkey
fi
fi
rm_old_bp rm_old_bp
update_binpatches update_binpatches
update_pkg update_pkg