From 8b612c3c9763b98483f69a54e89778a291b0b33b Mon Sep 17 00:00:00 2001 From: Robert Nagy Date: Thu, 4 May 2017 21:10:22 +0200 Subject: [PATCH] add support for syspatch and switch to https --- openup | 67 ++++++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 53 insertions(+), 14 deletions(-) diff --git a/openup b/openup index fd8c880..0d36dfe 100755 --- a/openup +++ b/openup @@ -1,6 +1,6 @@ #!/bin/sh # -# Copyright (c) 2013 - 2016 M:tier Ltd. +# Copyright (c) 2013 - 2017 M:tier Ltd. # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above @@ -31,7 +31,10 @@ OPENUP_URL="https://stable.mtier.org/openup" PKG_PUBKEY_URL="https://stable.mtier.org/mtier-$(uname -r | tr -d '.')-pkg.pub" # PKG_PATH for currently running OpenBSD release -PKG_PATH_MAIN="http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)" +PKG_PATH_MAIN="https://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)" + +# ERRATA_PATH +ERRATA_PATH="https://ftp.fr.openbsd.org/pub/OpenBSD/patches/$(uname -r)/common" # PKG_PATH for the corresponding release stable service PKG_PATH_UPDATE="https://stable.mtier.org/updates/$(uname -r)/$(arch -s)" @@ -58,6 +61,7 @@ usage() { echo echo "Options:" echo " -K do not check for kernel binpatches (when running non GENERIC)" + echo " -N do not check for syspatches" echo " -S ignore binpatch/package signatures" echo " -c check/cron mode, report only (cannot be used with -S)" echo " -e echo the PKG_PATH that ${0##*/} would use" @@ -127,6 +131,11 @@ rm_old_bp() { done } +update_syspatches() { + pr "Installing/updating syspatches" + syspatch +} + update_binpatches() { local _BP _b _e @@ -166,6 +175,18 @@ update_pkg() { fi } +# this only outputs the missing syspatches on the system +check_syspatches() { + _SYSPATCHES=$(syspatch -c) + for _p in ${_SYSPATCHES}; do + ${FETCH} ${_TMPERRATA} ${ERRATA_PATH}/${_p}.patch.sig + [ -e ${_TMPERRATA} ] || continue + echo "--- ${_p} ---" + echo -n "Available errata: " + awk '/OpenBSD/{f=1;next} /Apply/{f=0;next} f' ${_TMPERRATA} | grep -ve '^$' + done +} + # this only outputs the most recent vulnerability for each matching pkg check_vuxml() { local _BP_MATCH _OUTDATED _PKG_MATCH _b _e _p @@ -173,26 +194,37 @@ check_vuxml() { ${FETCH} ${_TMPVUXML} ${VUXML_URL} || bye_bye perl -pi -e 's,\$ARCH,'"${_ARCH}"',g' ${_TMPVUXML} - - _BP_MATCH="$(grep binpatch ${_TMPVUXML} | sed -e 's,,,g;s,,,g;s,\$ARCH,'"${_ARCH}"',g' | sort -u)" - for _e in ${EXCLUDE_PKG}; do - set -A _BP_MATCH -- ${_BP_MATCH} - _BP_MATCH="$(for _b in ${_BP_MATCH[@]}; do echo ${_b} | grep -v "^${_e}$"; done)" - done + if [ "${_REL_INT}" -lt 61 ]; then + _BP_MATCH="$(grep binpatch ${_TMPVUXML} | sed -e 's,,,g;s,,,g;s,\$ARCH,'"${_ARCH}"',g' | sort -u)" + for _e in ${EXCLUDE_PKG}; do + set -A _BP_MATCH -- ${_BP_MATCH} + _BP_MATCH="$(for _b in ${_BP_MATCH[@]}; do echo ${_b} | grep -v "^${_e}$"; done)" + done + fi _PKG_MATCH=$(pkg_info -q | grep -v binpatch${_REL_INT}-${_ARCH}) + for _e in ${EXCLUDE_PKG}; do set -A _PKG_MATCH -- ${_PKG_MATCH} _PKG_MATCH="$(for _p in ${_PKG_MATCH[@]}; do echo ${_p} | grep -v "^${_e}-.*"; done)" done - # set to "quirks" if empty to prevent running pkg_add against an empty pkg list - _OUTDATED=$((pkg_add -Iqn -Dnosig -Dunsigned ${_BP_MATCH:=quirks}; pkg_add -Iqnuz -Dnosig -Dunsigned ${_PKG_MATCH:=quirks}) 2>&1 | \ + if [ "${_REL_INT}" -lt 61 ]; then + # set to "quirks" if empty to prevent running pkg_add against an empty pkg list + _OUTDATED=$((pkg_add -Iqn -Dnosig -Dunsigned ${_BP_MATCH:=quirks}; pkg_add -Iqnuz -Dnosig -Dunsigned ${_PKG_MATCH:=quirks}) 2>&1 | \ grep '^NOT CHECKING DIGITAL SIGNATURE FOR ' | \ sed -e 's,^NOT CHECKING DIGITAL SIGNATURE FOR ,,g' | \ grep -v '^quirks-' | \ perl -ne '/^(.*)-(\d[^-]*)[-]?(\w*)(.*)$/ && print "$1\n"' | \ sort -u) + else + # set to "quirks" if empty to prevent running pkg_add against an empty pkg list + _OUTDATED=$((pkg_add -Inuvz -Dnosig -Dunsigned ${_PKG_MATCH:=quirks}) 2>&1 | \ + grep '^Adding.*(pretending)' | sort -u | sed -e 's,Adding ,,;s,(pretending),,;s,->.*,,' | \ + grep -v '^quirks-' | \ + perl -ne '/^(.*)-(\d[^-]*)[-]?(\w*)(.*)$/ && print "$1\n"' | \ + sort -u) + fi for p in ${_OUTDATED} do @@ -235,7 +267,7 @@ fi set -A _REL -- $(sysctl -n kern.version | sed 's/^OpenBSD \([0-9]\.[0-9]\)\([^ ]*\).*/\1 \2/;q') _REL_INT="$(echo ${_REL[0]} | tr -d '.')" _OPENUP_MINREL=60 -_OPENUP_VERSION=25 +_OPENUP_VERSION=26 if [ -n "${_REL[1]}" -a "${_REL[1]}" != "-stable" ]; then _badrel=1; fi if [ "${_REL_INT}" -lt "${_OPENUP_MINREL}" ]; then _badrel=1; fi if [ -n "${_badrel}" ]; then @@ -243,9 +275,10 @@ if [ -n "${_badrel}" ]; then exit 1 fi -while getopts 'KSce' arg; do +while getopts 'KNSce' arg; do case ${arg} in K) if [ "${_REL_INT}" -lt 61 ]; then nokrn=1; fi ;; + N) nosyspatch=1 ;; S) nosig=1; pkgopt="${pkgopt} -Dnosig -Dunsigned" ;; c) checkrun=1 ;; e) showenv=1 ;; @@ -269,6 +302,7 @@ _TMP="${TMPDIR:=/tmp}" _TMPDIR=$(mktemp -dp ${_TMP} .openup-XXXXXXXXXX) || exit 1 _TMPKEY="${_TMPDIR}/key" _TMPVUXML="${_TMPDIR}/vuxml" +_TMPERRATA="${_TMPDIR}/errata" export PKG_PATH=${PKG_PATH_UPDATE_LTS}:${PKG_PATH_UPDATE}:${PKG_PATH_MAIN} @@ -289,12 +323,17 @@ fi check_openupd if [ "${checkrun}" ]; then + if [ "${_REL_INT}" -ge 61 -a -z "${nosyspatch}" ]; then + check_syspatches + fi check_vuxml else [ -z "${nosig}" ] && get_key - if [ "${_REL_INT}" -lt 61 ]; then - rm_old_bp + rm_old_bp + if [ "${_REL_INT}" -lt 61 -a -z "${nosyspatch}" ]; then update_binpatches + else + [ -z "${nosyspatch}" ] && update_syspatches fi update_pkg fi