xref: /openbsd-src/usr.sbin/sysupgrade/sysupgrade.sh (revision 99fd087599a8791921855f21bd7e36130f39aadc) 
1#!/bin/ksh
2#
3# $OpenBSD: sysupgrade.sh,v 1.37 2020/01/26 22:08:36 benno Exp $
4#
5# Copyright (c) 1997-2015 Todd Miller, Theo de Raadt, Ken Westerback
6# Copyright (c) 2015 Robert Peichaer <rpe@openbsd.org>
7# Copyright (c) 2016, 2017 Antoine Jacoutot <ajacoutot@openbsd.org>
8# Copyright (c) 2019 Christian Weisgerber <naddy@openbsd.org>
9# Copyright (c) 2019 Florian Obser <florian@openbsd.org>
10#
11# Permission to use, copy, modify, and distribute this software for any
12# purpose with or without fee is hereby granted, provided that the above
13# copyright notice and this permission notice appear in all copies.
14#
15# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
16# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
17# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
18# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22
23set -e
24umask 0022
25export PATH=/usr/bin:/bin:/usr/sbin:/sbin
26
27ARCH=$(uname -m)
28SETSDIR=/home/_sysupgrade
29
30ug_err()
31{
32	echo "${1}" 1>&2 && return ${2:-1}
33}
34
35usage()
36{
37	ug_err "usage: ${0##*/} [-fkn] [-r | -s] [installurl]"
38}
39
40unpriv()
41{
42	local _file _rc=0 _user=_syspatch
43
44	if [[ $1 == -f ]]; then
45		_file=$2
46		shift 2
47	fi
48 	if [[ -n ${_file} ]]; then
49		>${_file}
50		chown "${_user}" "${_file}"
51	fi
52	(($# >= 1))
53
54	# XXX ksh(1) bug; send error code to the caller instead of failing hard
55	set +e
56	eval su -s /bin/sh ${_user} -c "'$@'" || _rc=$?
57	set -e
58
59	[[ -n ${_file} ]] && chown root "${_file}"
60
61	return ${_rc}
62}
63
64# Remove all occurrences of first argument from list formed by the remaining
65# arguments.
66rmel() {
67	local _a=$1 _b _c
68
69	shift
70	for _b; do
71		[[ $_a != "$_b" ]] && _c="${_c:+$_c }$_b"
72	done
73	echo -n "$_c"
74}
75
76RELEASE=false
77SNAP=false
78FORCE=false
79KEEP=false
80REBOOT=true
81
82while getopts fknrs arg; do
83	case ${arg} in
84	f)	FORCE=true;;
85	k)	KEEP=true;;
86	n)	REBOOT=false;;
87	r)	RELEASE=true;;
88	s)	SNAP=true;;
89	*)	usage;;
90	esac
91done
92
93(($(id -u) != 0)) && ug_err "${0##*/}: need root privileges"
94
95if $RELEASE && $SNAP; then
96	usage
97fi
98
99set -A _KERNV -- $(sysctl -n kern.version |
100	sed 's/^OpenBSD \([1-9][0-9]*\.[0-9]\)\([^ ]*\).*/\1 \2/;q')
101
102shift $(( OPTIND -1 ))
103
104case $# in
1050)	MIRROR=$(sed 's/#.*//;/^$/d' /etc/installurl) 2>/dev/null ||
106		MIRROR=https://cdn.openbsd.org/pub/OpenBSD
107	;;
1081)	MIRROR=$1
109	;;
110*)	usage
111esac
112
113if ! $RELEASE && [[ ${#_KERNV[*]} == 2 ]]; then
114	SNAP=true
115fi
116
117if $RELEASE && [[ ${_KERNV[1]} == '-beta' ]]; then
118	NEXT_VERSION=${_KERNV[0]}
119else
120	NEXT_VERSION=$(echo ${_KERNV[0]} + 0.1 | bc)
121fi
122
123if $SNAP; then
124	URL=${MIRROR}/snapshots/${ARCH}/
125else
126	URL=${MIRROR}/${NEXT_VERSION}/${ARCH}/
127fi
128
129install -d -o 0 -g 0 -m 0755 ${SETSDIR}
130cd ${SETSDIR}
131
132echo "Fetching from ${URL}"
133unpriv -f SHA256.sig ftp -N sysupgrade -Vmo SHA256.sig ${URL}SHA256.sig
134
135_KEY=openbsd-${_KERNV[0]%.*}${_KERNV[0]#*.}-base.pub
136_NEXTKEY=openbsd-${NEXT_VERSION%.*}${NEXT_VERSION#*.}-base.pub
137
138read _LINE <SHA256.sig
139case ${_LINE} in
140*\ ${_KEY})	SIGNIFY_KEY=/etc/signify/${_KEY} ;;
141*\ ${_NEXTKEY})	SIGNIFY_KEY=/etc/signify/${_NEXTKEY} ;;
142*)		ug_err "invalid signing key" ;;
143esac
144
145[[ -f ${SIGNIFY_KEY} ]] || ug_err "cannot find ${SIGNIFY_KEY}"
146
147unpriv -f SHA256 signify -Ve -p "${SIGNIFY_KEY}" -x SHA256.sig -m SHA256
148rm SHA256.sig
149
150if cmp -s /var/db/installed.SHA256 SHA256 && ! $FORCE; then
151	echo "Already on latest snapshot."
152	exit 0
153fi
154
155# INSTALL.*, bsd*, *.tgz
156SETS=$(sed -n -e 's/^SHA256 (\(.*\)) .*/\1/' \
157    -e '/^INSTALL\./p;/^bsd/p;/\.tgz$/p' SHA256)
158
159OLD_FILES=$(ls)
160OLD_FILES=$(rmel SHA256 $OLD_FILES)
161DL=$SETS
162
163[[ -n ${OLD_FILES} ]] && echo Verifying old sets.
164for f in ${OLD_FILES}; do
165	if cksum -C SHA256 $f >/dev/null 2>&1; then
166		DL=$(rmel $f ${DL})
167		OLD_FILES=$(rmel $f ${OLD_FILES})
168	fi
169done
170
171[[ -n ${OLD_FILES} ]] && rm ${OLD_FILES}
172for f in ${DL}; do
173	unpriv -f $f ftp -N sysupgrade -Vmo ${f} ${URL}${f}
174done
175
176if [[ -n ${DL} ]]; then
177	echo Verifying sets.
178	unpriv cksum -qC SHA256 ${DL}
179fi
180
181${KEEP} && > keep
182
183cat <<__EOT >/auto_upgrade.conf
184Location of sets = disk
185Pathname to the sets = /home/_sysupgrade/
186Set name(s) = done
187Directory does not contain SHA256.sig. Continue without verification = yes
188__EOT
189
190if ! ${KEEP}; then
191	CLEAN=$(echo SHA256 ${SETS} | sed -e 's/ /,/g')
192	cat <<__EOT > /etc/rc.firsttime
193rm -f /home/_sysupgrade/{${CLEAN}}
194__EOT
195fi
196
197echo Fetching updated firmware.
198fw_update || echo "Warning: firmware not updated."
199
200install -F -m 700 bsd.rd /bsd.upgrade
201logger -t sysupgrade -p kern.info "installed new /bsd.upgrade. Old kernel version: $(sysctl -n kern.version)"
202sync
203
204if ${REBOOT}; then
205	echo Upgrading.
206	exec reboot
207else
208	echo "Will upgrade on next reboot"
209fi
210