forked from mirrors/openup
Remove the auto-update feature, one less knob!
The rational is that if the openup URL ever gets compromised, then we are restarting a script which we do not control anymore... and that can lead to obvious catastrophic failures... Now openup will *always* check if there is an update and if one is available, it will output the command needed to update (but will not run it itself) then exit.
This commit is contained in:
Antoine Jacoutot
parent
fd116b23dd
commit
81d5d62ff7
1 changed files with 24 additions and 37 deletions
61
openup
61
openup
|
|
@ -29,7 +29,7 @@ VUXML_URL="https://stable.mtier.org/vuxml/$(uname -r | tr -d '.').xml"
|
|||
### DO NOT MODIFY ANYTHING BELOW THIS LINE!!! ###
|
||||
########################################################################
|
||||
|
||||
_OPENUP_VERSION=5
|
||||
_OPENUP_VERSION=4
|
||||
_OPENUP_MINREL=53
|
||||
|
||||
usage() {
|
||||
|
|
@ -38,20 +38,18 @@ usage() {
|
|||
echo
|
||||
echo "Options:"
|
||||
echo " -S do not check for package signatures"
|
||||
echo " -U do not check for openup update"
|
||||
echo " -n dry-run mode, no modification is done"
|
||||
echo
|
||||
echo " -c check/cron mode, mutually exclusive with other options"
|
||||
exit 1
|
||||
}
|
||||
|
||||
error() {
|
||||
pr_error() {
|
||||
echo "!!! ${@}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "need root privileges to run this script"
|
||||
pr_error "need root privileges to run this script"
|
||||
usage
|
||||
fi
|
||||
|
||||
|
|
@ -60,7 +58,8 @@ set -A _REL -- $(sysctl -n kern.version | sed 's/^OpenBSD \([0-9]\.[0-9]\)\([^ ]
|
|||
_REL_INT="$(echo ${_REL[0]} | tr -d '.')"
|
||||
|
||||
if [ "${_REL[1]}" == -!(stable) -o "${_REL_INT}" -lt "${_OPENUP_MINREL}" ]; then
|
||||
error "${_REL[0]}${_REL[1]} is not a supported release"
|
||||
pr_error "${_REL[0]}${_REL[1]} is not a supported release"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# check that we have no installed binpatches from a previous release
|
||||
|
|
@ -69,30 +68,31 @@ if [ -n "${_BPLIST}" ]; then
|
|||
_i=$(echo ${_BPLIST} | wc -w)
|
||||
_v=$(echo ${_BPLIST} | grep "^binpatch${_REL_INT}" | wc -w)
|
||||
if [ "${_i}" -ne "${_v}" ]; then
|
||||
error "Binpatch(es) from a previous release installed"
|
||||
pr_error "Binpatch(es) from a previous release installed"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
unset _BPLIST
|
||||
|
||||
_MEESA=$(readlink -f $0)
|
||||
_MEESA_ARGS="${@}"
|
||||
_TMPDIR="${TMPDIR:=/tmp}"
|
||||
_TMPCERT=$(mktemp -p ${_TMPDIR} openup-pkg_cert.XXXXXX) || exit 1
|
||||
_TMPSPLITCERT=$(mktemp -p ${_TMPDIR} openup-split_cert.XXXXXX) || exit 1
|
||||
_TMPUPD=$(mktemp -p ${_TMPDIR} openup-update.XXXXXX) || exit 1
|
||||
_TMPVUXML=$(mktemp -p ${_TMPDIR} openup-vuxml.XXXXXX) || exit 1
|
||||
|
||||
export _MEESA_ARGS
|
||||
export PKG_PATH=${PKG_PATH_UPDATE}:${PKG_PATH_MAIN}
|
||||
|
||||
trap "rm -f ${_TMPDIR}/openup-*" 1 2 3 13 15
|
||||
|
||||
pr_bigarrow() {
|
||||
echo "===> ${@}${dryrun}"
|
||||
if [ -z "${checkmode}" ]; then
|
||||
echo "===> ${@}${dryrun}"
|
||||
fi
|
||||
}
|
||||
|
||||
pr_smallarrow() {
|
||||
echo "-> ${@}"
|
||||
if [ -z "${checkmode}" ]; then
|
||||
echo "-> ${@}"
|
||||
fi
|
||||
}
|
||||
|
||||
get_cert() {
|
||||
|
|
@ -122,34 +122,22 @@ get_cert() {
|
|||
fi
|
||||
}
|
||||
|
||||
update_self() {
|
||||
check_openupd() {
|
||||
local _CMD _N
|
||||
|
||||
pr_bigarrow "Checking for openup update"
|
||||
_CMD="ftp -Vo ${_TMPUPD} ${OPENUP_URL}"
|
||||
_CMD="ftp -Vo - ${OPENUP_URL} | awk -F '=' '/^_OPENUP_VERSION/ { print \$2 }'"
|
||||
pr_smallarrow "${_CMD}"
|
||||
if [ -z "${dryrun}" ]; then
|
||||
eval ${_CMD} || exit 1
|
||||
_N=$(eval ${_CMD}) || exit 1
|
||||
fi
|
||||
|
||||
_N=$(grep -Eo '^_OPENUP_VERSION=.*' ${_TMPUPD} | awk -F '=' '{ print $2 }')
|
||||
if [ -n "${_N}" -o -n "${dryrun}" ]; then
|
||||
if [ "${_OPENUP_VERSION}" -lt "${_N}" -o -n "${dryrun}" ]; then
|
||||
pr_bigarrow "Updating openup to the latest release"
|
||||
_CMD="cat ${_TMPUPD} >${_MEESA}"
|
||||
pr_smallarrow "${_CMD}"
|
||||
if [ -z "${dryrun}" ]; then
|
||||
eval ${_CMD} || exit 1
|
||||
rtn=$?
|
||||
fi
|
||||
pr_bigarrow "openup has been updated, restarting"
|
||||
_CMD="${_MEESA} -U ${_MEESA_ARGS}"
|
||||
pr_smallarrow "${_CMD}"
|
||||
if [ -z "${dryrun}" ]; then
|
||||
export _RUN2=1 # needed for openup -c
|
||||
eval ${_CMD}
|
||||
exit $rtn
|
||||
fi
|
||||
if [ "${_OPENUP_VERSION}" -lt "${_N}" -o -z "${dryrun}" ]; then
|
||||
pr_error "New openup release (version ${_N}) is available; please update with:"
|
||||
pr_error "ftp -Vo $(readlink -f $0) ${OPENUP_URL}"
|
||||
pr_error "Exiting"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
|
@ -212,7 +200,6 @@ check_vuxml() {
|
|||
while getopts 'SUcn' arg; do
|
||||
case ${arg} in
|
||||
S) nosig=1; pkg_opt="${pkg_opt} -D nosig" ;;
|
||||
U) noselfupdate=1 ;;
|
||||
c) checkmode=1 ;;
|
||||
n) dryrun=" (dry run)"; pkg_opt="${pkg_opt} -n -D nosig" ;;
|
||||
*) usage ;;
|
||||
|
|
@ -220,16 +207,16 @@ while getopts 'SUcn' arg; do
|
|||
done
|
||||
[ $# = $(($OPTIND-1)) ] || usage
|
||||
|
||||
check_openupd
|
||||
|
||||
if [ -z "${checkmode}" ]; then
|
||||
if [ -z "${noselfupdate}" ]; then update_self; fi
|
||||
if [ -z "${nosig}" ]; then get_cert; fi
|
||||
update_binpatches
|
||||
update_pkg
|
||||
else
|
||||
if [ "${nosig}" -o "${noselfupdate}" -o "${dryrun}" -a -z "${_RUN2}" ]; then
|
||||
if [ "${nosig}" -o "${dryrun}" ]; then
|
||||
usage
|
||||
fi
|
||||
if [ -z "${noselfupdate}" ]; then update_self >/dev/null; fi
|
||||
check_vuxml
|
||||
fi
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue