openup/openup

#!/bin/sh
#
# Copyright (c) 2013 M:tier Ltd.
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
#
# Author: Antoine Jacoutot <antoine@mtier.org>

# TODO
# check_vuxml(): add support for binpatches

### user defined variables
OPENUP_URL="https://stable.mtier.org/openup"
PKG_CERT_URL="https://stable.mtier.org/mtier.cert"
PKG_CERT_FPRINT="DE:29:0F:7F:B8:0E:36:5A:AF:A9:BF:E0:4E:08:C2:0F:2D:50:16:97"
PKG_PATH_MAIN="http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)"
PKG_PATH_UPDATE="https://stable.mtier.org/updates/$(uname -r)/$(arch -s)"
VUXML_URL="https://stable.mtier.org/vuxml/$(uname -r | tr -d '.').xml"
### end of user defined variables

########################################################################
### DO NOT MODIFY ANYTHING BELOW THIS LINE!!!                        ###
########################################################################

_OPENUP_VERSION=4
_OPENUP_MINREL=53

usage() {
	echo
	echo "Usage: ${0##*/} [-SUn]|[-c]" >&2
	echo
	echo "Options:"
	echo "  -S    do not check for package signatures"
	echo "  -U    do not check for openup update"
	echo "  -n    dry-run mode, no modification is done"
	echo
	echo "  -c    check/cron mode, mutually exclusive with other options"
	exit 1
}

error() {
	echo "!!! ${@}"
	exit 1
}

if [ "$(id -u)" -ne 0 ]; then
	echo "need root privileges to run this script"
	usage
fi

# regex taken from fw_update(1)
set -A _REL -- $(sysctl -n kern.version | sed 's/^OpenBSD \([0-9]\.[0-9]\)\([^ ]*\).*/\1 \2/;q')
_REL_INT="$(echo ${_REL[0]} | tr -d '.')"

if [ "${_REL[1]}" == -!(stable) -o "${_REL_INT}" -lt "${_OPENUP_MINREL}" ]; then
	error "${_REL[0]}${_REL[1]} is not a supported release"
fi

# check that we have no installed binpatches from a previous release
_BPLIST=$(pkg_info -q | grep "^binpatch")
if [ -n "${_BPLIST}" ]; then
	_i=$(echo ${_BPLIST} | wc -w)
	_v=$(echo ${_BPLIST} | grep "^binpatch${_REL_INT}" | wc -w)
	if [ "${_i}" -ne "${_v}" ]; then
		error "Binpatch(es) from a previous release installed"
	fi
fi
unset _BPLIST

_MEESA=$(readlink -f $0)
_MEESA_ARGS="${@}"
_TMPDIR="${_TMPDIR:=/tmp}"
_TMPCERT=$(mktemp -p ${_TMPDIR} openup-pkg_cert.XXXXXX) || exit 1
_TMPSPLITCERT=$(mktemp -p ${_TMPDIR} openup-split_cert.XXXXXX) || exit 1
_TMPUPD=$(mktemp -p ${_TMPDIR} openup-update.XXXXXX) || exit 1
_TMPVUXML=$(mktemp -p ${_TMPDIR} openup-vuxml.XXXXXX) || exit 1

export _MEESA_ARGS
export PKG_PATH=${PKG_PATH_UPDATE}:${PKG_PATH_MAIN}

trap "rm -f ${_TMPDIR}/openup-*" 1 2 3 13 15

pr_bigarrow() {
	echo "===> ${@}${dryrun}"
}

pr_smallarrow() {
	echo "-> ${@}"
}

get_cert() {
	local _CMD

	[[ -r /etc/ssl/pkgca.pem ]] && \
		split -p '^-----BEGIN CERTIFICATE-----$' /etc/ssl/pkgca.pem ${_TMPSPLITCERT}

	for i in ${_TMPSPLITCERT}* ; do
		openssl x509 -noout -in $i -fingerprint 2>/dev/null | \
			grep -q "${PKG_CERT_FPRINT}" && return
	done

	pr_bigarrow "Downloading certificate"
	_CMD="ftp -Vo ${_TMPCERT} ${PKG_CERT_URL}"
	pr_smallarrow "${_CMD}"
	if [ -z "${dryrun}" ]; then
		eval ${_CMD} || exit 1
	fi

	pr_bigarrow "Installing certificate"
	_CMD="cat ${_TMPCERT} >>/etc/ssl/pkgca.pem"
	pr_smallarrow "${_CMD}"
	if [ -z "${dryrun}" ]; then
		eval ${_CMD} || exit 1
	fi
}

update_self() {
	local _CMD _N

	pr_bigarrow "Checking for openup update"
	_CMD="ftp -Vo ${_TMPUPD} ${OPENUP_URL}"
	pr_smallarrow "${_CMD}"
	if [ -z "${dryrun}" ]; then
		eval ${_CMD} || exit 1
	fi

	_N=$(grep -Eo '^_OPENUP_VERSION=.*' ${_TMPUPD} | awk -F '=' '{ print $2 }')
	if [ -n "${_N}" -o -n "${dryrun}" ]; then
		if [ "${_OPENUP_VERSION}" -lt "${_N}" -o -n "${dryrun}" ]; then
			pr_bigarrow "Updating openup to the latest release"
			_CMD="cat ${_TMPUPD} >${_MEESA}"
			pr_smallarrow "${_CMD}"
			if [ -z "${dryrun}" ]; then
				eval ${_CMD} || exit 1
				rtn=$?
			fi
			pr_bigarrow "openup has been updated, restarting"
			_CMD="${_MEESA} -U ${_MEESA_ARGS}"
			pr_smallarrow "${_CMD}"
			if [ -z "${dryrun}" ]; then
				export _RUN2=1 # needed for openup -c
				eval ${_CMD}
				exit $rtn
			fi
		fi
	fi
}

update_binpatches() {
	local _BP _CMD

	_BP=$(pkg_info -Q binpatch${_REL_INT}-$(arch -s) | sed 's/.[^-]*$//' | sort -u | tr '\n' ' ')

	if [ -n "$_BP" ]; then
		pr_bigarrow "Updating binpatch(es)"
		_CMD="pkg_add ${pkg_opt} ${_BP}"
		pr_smallarrow "${_CMD}"
		eval ${_CMD}
	fi
}

update_pkg() {
	local _CMD

	pr_bigarrow "Updating package(s)"
	_CMD="pkg_add -u ${pkg_opt}"
	pr_smallarrow "${_CMD}"
	eval ${_CMD}
}

# this only outputs the most recent vulnerability for each pkg
check_vuxml() {
	local _OUTDATED

	ftp -Vo ${_TMPVUXML} ${VUXML_URL} >/dev/null

	_OUTDATED=$(pkg_add -nuv -D nosig 2>/dev/null | \
		    grep '(installing)(pretending)' | \
		    sed -e 's,Adding ,,;s,(pretending),,;s,->.*,,' | \
		    perl -ne '/^(.*)-(\d[^-]*)[-]?(\w*)(.*)$/ && print "$1\n"')

	for p in ${_OUTDATED}
	do
		pr_bigarrow "${p} <"
		# XXX how do we print only the 1st matching range in awk?
		awk "/<name>${p}<\/name>/,/<\/vuln>/" ${_TMPVUXML} | \
			sed '/<\/vuln>/,$d' | \
			sed -n -e 's/.*<range><lt>\(.*\)<\/lt><\/range>.*/\1/p' \
				-e 's/.*<p>\(.*\)<\/p>.*/\1/p' | uniq | \
			while read l; do echo -n "${l} "; done
			echo "\n"
	done | fmt | sed '/^$/d'
}

while getopts 'SUcn' arg; do
	case ${arg} in
	S)	nosig=1; pkg_opt="${pkg_opt} -D nosig" ;;
	U)	noselfupdate=1 ;;
	c)	checkmode=1 ;;
	n)	dryrun=" (dry run)"; pkg_opt="${pkg_opt} -n -D nosig" ;;
	*)	usage ;;
	esac
done
[ $# = $(($OPTIND-1)) ] || usage

if [ -z "${checkmode}" ]; then
	[[ -z $noselfupdate ]] && update_self
	[[ -z $nosig ]] && get_cert
	update_binpatches
	update_pkg
else
	if [ "${nosig}" -o "${noselfupdate}" -o "${dryrun}" -a -z "${_RUN2}" ]; then
		usage
	fi
	[[ -z $noselfupdate ]] && update_self >/dev/null
	check_vuxml
fi

rm -f ${_TMPDIR}/openup-*