add support for syspatch and switch to https

openup

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2013 - 2016 M:tier Ltd.
+# Copyright (c) 2013 - 2017 M:tier Ltd.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -31,7 +31,10 @@ OPENUP_URL="https://stable.mtier.org/openup"
 PKG_PUBKEY_URL="https://stable.mtier.org/mtier-$(uname -r | tr -d '.')-pkg.pub"
 
 # PKG_PATH for currently running OpenBSD release
-PKG_PATH_MAIN="http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)"
+PKG_PATH_MAIN="https://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)"
+
+# ERRATA_PATH
+ERRATA_PATH="https://ftp.fr.openbsd.org/pub/OpenBSD/patches/$(uname -r)/common"
 
 # PKG_PATH for the corresponding release stable service
 PKG_PATH_UPDATE="https://stable.mtier.org/updates/$(uname -r)/$(arch -s)"
@@ -58,6 +61,7 @@ usage() {
 	echo
 	echo "Options:"
 	echo "  -K    do not check for kernel binpatches (when running non GENERIC)"
+	echo "  -N    do not check for syspatches"
 	echo "  -S    ignore binpatch/package signatures"
 	echo "  -c    check/cron mode, report only (cannot be used with -S)"
 	echo "  -e    echo the PKG_PATH that ${0##*/} would use"
@@ -127,6 +131,11 @@ rm_old_bp() {
 	done
 }
 
+update_syspatches() {
+	pr "Installing/updating syspatches"
+	syspatch
+}
+
 update_binpatches() {
 	local _BP _b _e
 
@@ -166,6 +175,18 @@ update_pkg() {
 	fi
 }
 
+# this only outputs the missing syspatches on the system
+check_syspatches() {
+	_SYSPATCHES=$(syspatch -c)
+	for _p in ${_SYSPATCHES}; do
+		${FETCH} ${_TMPERRATA} ${ERRATA_PATH}/${_p}.patch.sig
+		[ -e ${_TMPERRATA} ] || continue
+		echo "--- ${_p} ---"
+		echo -n "Available errata: "
+		awk '/OpenBSD/{f=1;next} /Apply/{f=0;next} f' ${_TMPERRATA} | grep -ve '^$'
+	done
+}
+
 # this only outputs the most recent vulnerability for each matching pkg
 check_vuxml() {
 	local _BP_MATCH _OUTDATED _PKG_MATCH _b _e _p
@@ -173,19 +194,22 @@ check_vuxml() {
 	${FETCH} ${_TMPVUXML} ${VUXML_URL} || bye_bye
 	perl -pi -e 's,\$ARCH,'"${_ARCH}"',g' ${_TMPVUXML}
 
-
+	if [ "${_REL_INT}" -lt 61 ]; then
 		_BP_MATCH="$(grep binpatch ${_TMPVUXML} | sed -e 's,<name>,,g;s,</name>,,g;s,\$ARCH,'"${_ARCH}"',g' | sort -u)"
 		for _e in ${EXCLUDE_PKG}; do
 			set -A _BP_MATCH -- ${_BP_MATCH}
 			_BP_MATCH="$(for _b in ${_BP_MATCH[@]}; do echo ${_b} | grep -v "^${_e}$"; done)"
 		done
+	fi
 
 	_PKG_MATCH=$(pkg_info -q | grep -v binpatch${_REL_INT}-${_ARCH})
+
 	for _e in ${EXCLUDE_PKG}; do
 		set -A _PKG_MATCH -- ${_PKG_MATCH}
 		_PKG_MATCH="$(for _p in ${_PKG_MATCH[@]}; do echo ${_p} | grep -v "^${_e}-.*"; done)"
 	done
 
+	if [ "${_REL_INT}" -lt 61 ]; then
 		# set to "quirks" if empty to prevent running pkg_add against an empty pkg list
 		_OUTDATED=$((pkg_add -Iqn -Dnosig -Dunsigned ${_BP_MATCH:=quirks}; pkg_add -Iqnuz -Dnosig -Dunsigned ${_PKG_MATCH:=quirks}) 2>&1 | \
 		    grep '^NOT CHECKING DIGITAL SIGNATURE FOR ' | \
@@ -193,6 +217,14 @@ check_vuxml() {
 		    grep -v '^quirks-' | \
 		    perl -ne '/^(.*)-(\d[^-]*)[-]?(\w*)(.*)$/ && print "$1\n"' | \
 		    sort -u)
+	else
+		# set to "quirks" if empty to prevent running pkg_add against an empty pkg list
+		_OUTDATED=$((pkg_add -Inuvz -Dnosig -Dunsigned ${_PKG_MATCH:=quirks}) 2>&1 | \
+		    grep '^Adding.*(pretending)' | sort -u | sed -e 's,Adding ,,;s,(pretending),,;s,->.*,,' | \
+		    grep -v '^quirks-' | \
+		    perl -ne '/^(.*)-(\d[^-]*)[-]?(\w*)(.*)$/ && print "$1\n"' | \
+		    sort -u)
+	fi
 
 	for p in ${_OUTDATED}
 	do
@@ -235,7 +267,7 @@ fi
 set -A _REL -- $(sysctl -n kern.version | sed 's/^OpenBSD \([0-9]\.[0-9]\)\([^ ]*\).*/\1 \2/;q')
 _REL_INT="$(echo ${_REL[0]} | tr -d '.')"
 _OPENUP_MINREL=60
-_OPENUP_VERSION=25
+_OPENUP_VERSION=26
 if [ -n "${_REL[1]}" -a "${_REL[1]}" != "-stable" ]; then _badrel=1; fi
 if [ "${_REL_INT}" -lt "${_OPENUP_MINREL}" ]; then _badrel=1; fi
 if [ -n "${_badrel}" ]; then
@@ -243,9 +275,10 @@ if [ -n "${_badrel}" ]; then
 	exit 1
 fi
 
-while getopts 'KSce' arg; do
+while getopts 'KNSce' arg; do
 	case ${arg} in
 	K)	if [ "${_REL_INT}" -lt 61 ]; then nokrn=1; fi ;;
+	N)	nosyspatch=1 ;;
 	S)	nosig=1; pkgopt="${pkgopt} -Dnosig -Dunsigned" ;;
 	c)	checkrun=1 ;;
 	e)	showenv=1 ;;
@@ -269,6 +302,7 @@ _TMP="${TMPDIR:=/tmp}"
 _TMPDIR=$(mktemp -dp ${_TMP} .openup-XXXXXXXXXX) || exit 1
 _TMPKEY="${_TMPDIR}/key"
 _TMPVUXML="${_TMPDIR}/vuxml"
+_TMPERRATA="${_TMPDIR}/errata"
 
 export PKG_PATH=${PKG_PATH_UPDATE_LTS}:${PKG_PATH_UPDATE}:${PKG_PATH_MAIN}
 
@@ -289,12 +323,17 @@ fi
 check_openupd
 
 if [ "${checkrun}" ]; then
+	if [ "${_REL_INT}" -ge 61 -a -z "${nosyspatch}" ]; then
+		check_syspatches
+	fi
 	check_vuxml
 else
 	[ -z "${nosig}" ] && get_key
-	if [ "${_REL_INT}" -lt 61 ]; then
 	rm_old_bp
+	if [ "${_REL_INT}" -lt 61 -a -z "${nosyspatch}" ]; then
 		update_binpatches
+	else
+		[ -z "${nosyspatch}" ] && update_syspatches
 	fi
 	update_pkg
 fi