1#!/bin/ksh 2# 3# $OpenBSD: sysupgrade.sh,v 1.42 2020/10/08 14:35:20 kn Exp $ 4# 5# Copyright (c) 1997-2015 Todd Miller, Theo de Raadt, Ken Westerback 6# Copyright (c) 2015 Robert Peichaer <rpe@openbsd.org> 7# Copyright (c) 2016, 2017 Antoine Jacoutot <ajacoutot@openbsd.org> 8# Copyright (c) 2019 Christian Weisgerber <naddy@openbsd.org> 9# Copyright (c) 2019 Florian Obser <florian@openbsd.org> 10# 11# Permission to use, copy, modify, and distribute this software for any 12# purpose with or without fee is hereby granted, provided that the above 13# copyright notice and this permission notice appear in all copies. 14# 15# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 16# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 17# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 18# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 19# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 20# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 21# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 22 23set -e 24umask 0022 25export PATH=/usr/bin:/bin:/usr/sbin:/sbin 26 27ARCH=$(uname -m) 28SETSDIR=/home/_sysupgrade 29 30err() 31{ 32 echo "${0##*/}: ${1}" 1>&2 33 return ${2:-1} 34} 35 36usage() 37{ 38 echo "usage: ${0##*/} [-fkn] [-r | -s] [installurl]" 1>&2 39 return 1 40} 41 42unpriv() 43{ 44 local _file _rc=0 _user=_syspatch 45 46 if [[ $1 == -f ]]; then 47 _file=$2 48 shift 2 49 fi 50 if [[ -n ${_file} ]]; then 51 >${_file} 52 chown "${_user}" "${_file}" 53 fi 54 (($# >= 1)) 55 56 eval su -s /bin/sh ${_user} -c "'$@'" || _rc=$? 57 58 [[ -n ${_file} ]] && chown root "${_file}" 59 60 return ${_rc} 61} 62 63# Remove all occurrences of first argument from list formed by the remaining 64# arguments. 65rmel() { 66 local _a=$1 _b _c 67 68 shift 69 for _b; do 70 [[ $_a != "$_b" ]] && _c="${_c:+$_c }$_b" 71 done 72 echo -n "$_c" 73} 74 75RELEASE=false 76SNAP=false 77FORCE=false 78KEEP=false 79REBOOT=true 80 81while getopts fknrs arg; do 82 case ${arg} in 83 f) FORCE=true;; 84 k) KEEP=true;; 85 n) REBOOT=false;; 86 r) RELEASE=true;; 87 s) SNAP=true;; 88 *) usage;; 89 esac 90done 91 92(($(id -u) != 0)) && err "need root privileges" 93 94if $RELEASE && $SNAP; then 95 usage 96fi 97 98set -A _KERNV -- $(sysctl -n kern.version | 99 sed 's/^OpenBSD \([1-9][0-9]*\.[0-9]\)\([^ ]*\).*/\1 \2/;q') 100 101shift $(( OPTIND -1 )) 102 103case $# in 1040) MIRROR=$(sed 's/#.*//;/^$/d' /etc/installurl) 2>/dev/null || 105 MIRROR=https://cdn.openbsd.org/pub/OpenBSD 106 ;; 1071) MIRROR=$1 108 ;; 109*) usage 110esac 111[[ $MIRROR == @(file|ftp|http|https)://* ]] || 112 ug_err "invalid installurl: $MIRROR" 113 114if ! $RELEASE && [[ ${#_KERNV[*]} == 2 ]]; then 115 SNAP=true 116fi 117 118if $RELEASE && [[ ${_KERNV[1]} == '-beta' ]]; then 119 NEXT_VERSION=${_KERNV[0]} 120else 121 NEXT_VERSION=$(echo ${_KERNV[0]} + 0.1 | bc) 122fi 123 124if $SNAP; then 125 URL=${MIRROR}/snapshots/${ARCH}/ 126else 127 URL=${MIRROR}/${NEXT_VERSION}/${ARCH}/ 128fi 129 130install -d -o 0 -g 0 -m 0755 ${SETSDIR} 131cd ${SETSDIR} 132 133echo "Fetching from ${URL}" 134unpriv -f SHA256.sig ftp -N sysupgrade -Vmo SHA256.sig ${URL}SHA256.sig 135 136_KEY=openbsd-${_KERNV[0]%.*}${_KERNV[0]#*.}-base.pub 137_NEXTKEY=openbsd-${NEXT_VERSION%.*}${NEXT_VERSION#*.}-base.pub 138 139read _LINE <SHA256.sig 140case ${_LINE} in 141*\ ${_KEY}) SIGNIFY_KEY=/etc/signify/${_KEY} ;; 142*\ ${_NEXTKEY}) SIGNIFY_KEY=/etc/signify/${_NEXTKEY} ;; 143*) err "invalid signing key" ;; 144esac 145 146[[ -f ${SIGNIFY_KEY} ]] || err "cannot find ${SIGNIFY_KEY}" 147 148unpriv -f SHA256 signify -Ve -p "${SIGNIFY_KEY}" -x SHA256.sig -m SHA256 149rm SHA256.sig 150 151if cmp -s /var/db/installed.SHA256 SHA256 && ! $FORCE; then 152 echo "Already on latest snapshot." 153 exit 0 154fi 155 156# INSTALL.*, bsd*, *.tgz 157SETS=$(sed -n -e 's/^SHA256 (\(.*\)) .*/\1/' \ 158 -e '/^INSTALL\./p;/^bsd/p;/\.tgz$/p' SHA256) 159 160OLD_FILES=$(ls) 161OLD_FILES=$(rmel SHA256 $OLD_FILES) 162DL=$SETS 163 164[[ -n ${OLD_FILES} ]] && echo Verifying old sets. 165for f in ${OLD_FILES}; do 166 if cksum -C SHA256 $f >/dev/null 2>&1; then 167 DL=$(rmel $f ${DL}) 168 OLD_FILES=$(rmel $f ${OLD_FILES}) 169 fi 170done 171 172[[ -n ${OLD_FILES} ]] && rm ${OLD_FILES} 173for f in ${DL}; do 174 unpriv -f $f ftp -N sysupgrade -Vmo ${f} ${URL}${f} 175done 176 177if [[ -n ${DL} ]]; then 178 echo Verifying sets. 179 unpriv cksum -qC SHA256 ${DL} 180fi 181 182cat <<__EOT >/auto_upgrade.conf 183Location of sets = disk 184Pathname to the sets = ${SETSDIR}/ 185Set name(s) = done 186Directory does not contain SHA256.sig. Continue without verification = yes 187__EOT 188 189if ! ${KEEP}; then 190 CLEAN=$(echo SHA256 ${SETS} | sed -e 's/ /,/g') 191 cat <<__EOT > /etc/rc.firsttime 192rm -f ${SETSDIR}/{${CLEAN}} 193__EOT 194fi 195 196echo Fetching updated firmware. 197fw_update || echo "Warning: firmware not updated." 198 199install -F -m 700 bsd.rd /bsd.upgrade 200logger -t sysupgrade -p kern.info "installed new /bsd.upgrade. Old kernel version: $(sysctl -n kern.version)" 201sync 202 203if ${REBOOT}; then 204 echo Upgrading. 205 exec reboot 206else 207 echo "Will upgrade on next reboot" 208fi 209