===================================================================
RCS file: /cvs/openbsd/fw_update/fw_install.sh,v
retrieving revision 1.143
retrieving revision 1.144
diff -u -r1.143 -r1.144
--- openbsd/fw_update/fw_install.sh	2022/01/07 01:47:24	1.143
+++ openbsd/fw_update/fw_install.sh	2022/01/07 02:16:31	1.144
@@ -1,5 +1,5 @@
 #!/bin/ksh
-#	$OpenBSD: fw_install.sh,v 1.143 2022/01/07 01:47:24 afresh1 Exp $
+#	$OpenBSD: fw_install.sh,v 1.144 2022/01/07 02:16:31 afresh1 Exp $
 #
 # Copyright (c) 2021 Andrew Hewus Fresh <afresh1@openbsd.org>
 #
@@ -37,7 +37,7 @@
 DRYRUN=false
 VERBOSE=0
 DELETE=false
-DOWNLOAD=
+DOWNLOAD=true
 INSTALL=true
 LOCALSRC=
 
@@ -122,7 +122,21 @@
 	fi
 }
 
+fetch_cfile() {
+	if "$DOWNLOAD"; then
+		set +o noclobber # we want to get the latest CFILE
+		fetch "$CFILE" || return 1
+		set -o noclobber
+		! signify -qVep "$FWPUB_KEY" -x "$CFILE" -m "$CFILE" &&
+		    echo "Signature check of SHA256.sig failed" >&2 && return 1
+	elif [ ! -e "$CFILE" ]; then
+		echo "${0##*/}: $CFILE: No such file or directory" >&2
+		return 2
+	fi
+}
+
 verify() {
+	[ -e "$CFILE" ] || fetch_cfile
 	# On the installer we don't get sha256 -C, so fake it.
 	if ! fgrep -qx "SHA256 (${1##*/}) = $( /bin/sha256 -qb "$1" )" "$CFILE"; then
 		echo "Checksum test for ${1##*/} failed." >&2
@@ -152,6 +166,7 @@
 
 firmware_filename() {
 	local _f
+	[ -e "$CFILE" ] || fetch_cfile
 	_f="$( sed -n "s/.*(\($1-firmware-.*\.tgz\)).*/\1/p" "$CFILE" | sed '$!d' )"
 	! [ "$_f" ] && echo "Unable to find firmware for $1" >&2 && return 1
 	echo "$_f"
@@ -322,9 +337,19 @@
 
 # "Download only" means local dir and don't install
 if [ "$OPT_F" ]; then
-	DOWNLOAD=true
 	INSTALL=false
 	LOCALSRC="${LOCALSRC:-.}"
+
+	# Always check for latest CFILE and so latest firmware
+	if [ -e "$LOCALSRC/$CFILE" ]; then
+		mv "$LOCALSRC/$CFILE" "$LOCALSRC/$CFILE-OLD"
+		if fetch_cfile; then
+			rm -f "$LOCALSRC/$CFILE-OLD"
+		else
+			mv "$LOCALSRC/$CFILE-OLD" "$LOCALSRC/$CFILE"
+			echo "Using existing $CFILE" >&2
+		fi
+	fi
 elif [ "$LOCALSRC" ]; then
 	DOWNLOAD=false
 fi
@@ -388,6 +413,8 @@
     REMOVE_LOCALSRC=true
 fi
 
+CFILE="$LOCALSRC/$CFILE"
+
 if [ "${devices[*]:-}" ]; then
 	"$ALL" && usage 22
 else
@@ -398,37 +425,6 @@
 fi
 
 [ "${devices[*]:-}" ] || exit
-
-# Only need the CFILE to verify what has been downloaded
-# or to convert a device to a filename.
-NEED_CFILE="${DOWNLOAD:-false}"
-if ! "$NEED_CFILE"; then
-	for f in "${devices[@]}"; do
-		if [ "$( firmware_devicename "$f" )" = "$f" ]; then
-			NEED_CFILE=true
-			break
-		fi
-	done
-fi
-
-# Only need to download if we already decided we did,
-# or the same decision as if we NEED_CFILE.
-DOWNLOAD="${DOWNLOAD:-$NEED_CFILE}"
-
-if "$NEED_CFILE"; then
-	CFILE="$LOCALSRC/$CFILE"
-
-	if "$DOWNLOAD"; then
-		set +o noclobber # we want to get the latest CFILE
-		fetch "$CFILE"
-		set -o noclobber
-		! signify -qVep "$FWPUB_KEY" -x "$CFILE" -m "$CFILE" &&
-		    echo "Signature check of SHA256.sig failed" >&2 && exit 1
-	elif [ ! -e "$CFILE" ]; then
-		echo "${0##*/}: $CFILE: No such file or directory" >&2
-		exit 2
-	fi
-fi
 
 added=''
 updated=''