=================================================================== RCS file: /cvs/openbsd/fw_update/fw_install.sh,v retrieving revision 1.127 retrieving revision 1.146 diff -u -r1.127 -r1.146 --- openbsd/fw_update/fw_install.sh 2021/12/25 02:38:33 1.127 +++ openbsd/fw_update/fw_install.sh 2022/01/07 04:22:29 1.146 @@ -1,5 +1,5 @@ #!/bin/ksh -# $OpenBSD: fw_install.sh,v 1.127 2021/12/25 02:38:33 afresh1 Exp $ +# $OpenBSD: fw_install.sh,v 1.146 2022/01/07 04:22:29 afresh1 Exp $ # # Copyright (c) 2021 Andrew Hewus Fresh # @@ -34,17 +34,20 @@ FWURL=http://firmware.openbsd.org/firmware/${HTTP_FWDIR} FWPUB_KEY=${DESTDIR}/etc/signify/openbsd-${VERSION}-fw.pub -VERBOSE=false +DRYRUN=false +VERBOSE=0 DELETE=false DOWNLOAD=true INSTALL=true LOCALSRC= unset FTPPID +unset FWPKGTMP REMOVE_LOCALSRC=false cleanup() { set +o errexit # ignore errors from killing ftp - [ "${FTPPID:-}" ] && kill -TERM -"$FTPPID" #2>/dev/null + [ "${FTPPID:-}" ] && kill -TERM -"$FTPPID" 2>/dev/null + [ "${FWPKGTMP:-}" ] && rm -rf "$FWPKGTMP" "$REMOVE_LOCALSRC" && rm -rf "$LOCALSRC" } trap cleanup EXIT @@ -72,14 +75,17 @@ # we have su(1) and doas(1) is unlikely to be configured. set -o monitor # make sure ftp gets its own process group ( - flags=-VM - "$VERBOSE" && flags=-vm + _flags=-vm + case "$VERBOSE" in + 0|1) _flags=-VM ;; + 2) _flags=-Vm ;; + esac if [ -x /usr/bin/su ]; then exec /usr/bin/su -s /bin/ksh "$_user" -c \ - "/usr/bin/ftp -N '${0##/}' -D 'Get/Verify' $flags -o- '$_src'" > "$_dst" + "/usr/bin/ftp -N '${0##/}' -D 'Get/Verify' $_flags -o- '$_src'" > "$_dst" else exec /usr/bin/doas -u "$_user" \ - /usr/bin/ftp -N "${0##/}" -D 'Get/Verify' $flags -o- "$_src" > "$_dst" + /usr/bin/ftp -N "${0##/}" -D 'Get/Verify' $_flags -o- "$_src" > "$_dst" fi ) & FTPPID=$! set +o monitor @@ -94,7 +100,7 @@ SECONDS=0 sleep 1 else - kill -INT -"$FTPPID" + kill -INT -"$FTPPID" 2>/dev/null _error=" (timed out)" fi else @@ -114,14 +120,34 @@ echo "Cannot fetch $_src$_error" >&2 return 1 fi + + return 0 } +fetch_cfile() { + if "$DOWNLOAD"; then + set +o noclobber # we want to get the latest CFILE + fetch "$CFILE" || return 1 + set -o noclobber + ! signify -qVep "$FWPUB_KEY" -x "$CFILE" -m "$CFILE" && + echo "Signature check of SHA256.sig failed" >&2 && return 1 + elif [ ! -e "$CFILE" ]; then + echo "${0##*/}: $CFILE: No such file or directory" >&2 + return 2 + fi + + return 0 +} + verify() { + [ -e "$CFILE" ] || fetch_cfile || return 1 # On the installer we don't get sha256 -C, so fake it. if ! fgrep -qx "SHA256 (${1##*/}) = $( /bin/sha256 -qb "$1" )" "$CFILE"; then echo "Checksum test for ${1##*/} failed." >&2 return 1 fi + + return 0 } firmware_in_dmesg() { @@ -129,8 +155,7 @@ # When we're not in the installer, the dmesg.boot can # contain multiple boots, so only look in the last one - _dmesgtail="$( echo ; sed -n 'H;/^OpenBSD/h;${g;p;}' /var/run/dmesg.boot | - grep -e "^[a-z][a-z]*[0-9]" -e " not configured " )" + _dmesgtail="$( echo ; sed -n 'H;/^OpenBSD/h;${g;p;}' /var/run/dmesg.boot )" grep -v '^[[:space:]]*#' "$FWPATTERNS" | while read -r _d _m; do @@ -147,6 +172,7 @@ firmware_filename() { local _f + [ -e "$CFILE" ] || fetch_cfile || return 1 _f="$( sed -n "s/.*(\($1-firmware-.*\.tgz\)).*/\1/p" "$CFILE" | sed '$!d' )" ! [ "$_f" ] && echo "Unable to find firmware for $1" >&2 && return 1 echo "$_f" @@ -181,37 +207,42 @@ set -sA _devices -- $( firmware_in_dmesg for _d in $( installed_firmware '*' '-firmware-' '*' ); do - echo "$( firmware_devicename "$_d" )" + firmware_devicename "$_d" done ) [ "${_devices[*]:-}" ] || return 0 for _d in "${_devices[@]}"; do - [[ $_last = $_d ]] && continue - echo $_d + [ "$_last" = "$_d" ] && continue + echo "$_d" _last="$_d" done } add_firmware () { - local _f="${1##*/}" _pkgname - local _tmpdir="$( tmpdir "${DESTDIR}/var/db/pkg/.firmware" )" - local flags=-VM - "$VERBOSE" && flags=-vm - ftp -N "${0##/}" -D "Install" "$flags" -o- "file:${1}" | - tar -s ",^\+,${_tmpdir}/+," \ + local _f="${1##*/}" _m="${2:-Install}" _pkgname + FWPKGTMP="$( tmpdir "${DESTDIR}/var/db/pkg/.firmware" )" + local _flags=-vm + case "$VERBOSE" in + 0|1) _flags=-VM ;; + 2|3) _flags=-Vm ;; + esac + + ftp -N "${0##/}" -D "$_m" "$_flags" -o- "file:${1}" | + tar -s ",^\+,${FWPKGTMP}/+," \ -s ",^firmware,${DESTDIR}/etc/firmware," \ -C / -zxphf - "+*" "firmware/*" - _pkgname="$( sed -n '/^@name /{s///p;q;}' "${_tmpdir}/+CONTENTS" )" + _pkgname="$( sed -n '/^@name /{s///p;q;}' "${FWPKGTMP}/+CONTENTS" )" if [ ! "$_pkgname" ]; then echo "Failed to extract name from $1, partial install" 2>&1 - rm -rf "$_tmpdir" + rm -rf "$FWPKGTMP" + unset FWPKGTMP return 1 fi # TODO: Should we mark these so real fw_update can -Drepair? - ed -s "${_tmpdir}/+CONTENTS" <&2 - usage 2 - ;; - ?) - echo "${0##*/}: unknown option -- -$OPTARG" >&2 - usage 2 - ;; - esac + case "$name" in + a) ALL=true ;; + d) DELETE=true ;; + F) OPT_F=true ;; + n) DRYRUN=true ;; + p) LOCALSRC="$OPTARG" ;; + v) VERBOSE=$(( VERBOSE + 1 )) ;; + :) + echo "${0##*/}: option requires an argument -- -$OPTARG" >&2 + usage 2 + ;; + ?) + echo "${0##*/}: unknown option -- -$OPTARG" >&2 + usage 2 + ;; + esac done shift $((OPTIND - 1)) @@ -305,9 +342,22 @@ fi # "Download only" means local dir and don't install -if [ "$OPT_D" ]; then +if [ "$OPT_F" ]; then INSTALL=false LOCALSRC="${LOCALSRC:-.}" + + # Always check for latest CFILE and so latest firmware + if [ -e "$LOCALSRC/$CFILE" ]; then + mv "$LOCALSRC/$CFILE" "$LOCALSRC/$CFILE-OLD" + if fetch_cfile; then + rm -f "$LOCALSRC/$CFILE-OLD" + else + mv "$LOCALSRC/$CFILE-OLD" "$LOCALSRC/$CFILE" + echo "Using existing $CFILE" >&2 + fi + fi +elif [ "$LOCALSRC" ]; then + DOWNLOAD=false fi if [ -x /usr/bin/id ] && [ "$(/usr/bin/id -u)" != 0 ]; then @@ -318,8 +368,11 @@ set -sA devices -- "$@" if "$DELETE"; then - [ "$OPT_D" ] && usage 22 + [ "$OPT_F" ] && usage 22 + # Show the "Uninstalling" message when just deleting not upgrading + [ "$VERBOSE" -gt 0 ] && VERBOSE=3 + set -A installed if [ "${devices[*]:-}" ]; then "$ALL" && usage 22 @@ -346,20 +399,24 @@ deleted='' if [ "${installed:-}" ]; then for fw in "${installed[@]}"; do - delete_firmware "$fw" || continue + if "$DRYRUN"; then + [ "$VERBOSE" -gt 0 ] && echo "Delete $fw" + else + delete_firmware "$fw" || continue + fi deleted="$deleted,$( firmware_devicename "$fw" )" done fi - deleted="${deleted:+${deleted#,}}" + deleted="${deleted#,}" echo "${0:##*/}: deleted ${deleted:-none}"; exit fi if [ ! "$LOCALSRC" ]; then - LOCALSRC="$( tmpdir "${DESTDIR}/tmp/${0##*/}" )" - REMOVE_LOCALSRC=true + LOCALSRC="$( tmpdir "${DESTDIR}/tmp/${0##*/}" )" + REMOVE_LOCALSRC=true fi CFILE="$LOCALSRC/$CFILE" @@ -367,32 +424,21 @@ if [ "${devices[*]:-}" ]; then "$ALL" && usage 22 else - "$VERBOSE" && echo -n "Detecting firmware ..." + [ "$VERBOSE" -gt 1 ] && echo -n "Detect firmware ..." set -sA devices -- $( detect_firmware ) - "$VERBOSE" && + [ "$VERBOSE" -gt 1 ] && { [ "${devices[*]:-}" ] && echo " found." || echo " done." ; } fi [ "${devices[*]:-}" ] || exit -if "$DOWNLOAD"; then - set +o noclobber # we want to get the latest CFILE - fetch "$CFILE" - set -o noclobber - ! signify -qVep "$FWPUB_KEY" -x "$CFILE" -m "$CFILE" && - echo "Signature check of SHA256.sig failed" >&2 && exit 1 -elif [ ! -e "$CFILE" ]; then - # TODO: We shouldn't need a CFILE if all arguments are files. - echo "${0##*/}: $CFILE: No such file or directory" >&2 - exit 2 -fi - added='' updated='' kept='' for f in "${devices[@]}"; do d="$( firmware_devicename "$f" )" + verify_existing="$DOWNLOAD" if [ "$f" = "$d" ]; then f=$( firmware_filename "$d" || true ) [ "$f" ] || continue @@ -400,6 +446,10 @@ elif ! "$INSTALL" && ! grep -Fq "($f)" "$CFILE" ; then echo "Cannot download local file $f" >&2 exit 2 + else + # If someone specified a filename on the command-line + # we don't want to verify it. + verify_existing=false fi set -A installed -- $( installed_firmware '' "$d-firmware-" '*' ) @@ -407,7 +457,7 @@ if "$INSTALL" && [ "${installed[*]:-}" ]; then for i in "${installed[@]}"; do if [ "${f##*/}" = "$i.tgz" ]; then - "$VERBOSE" && echo "$i already installed" + [ "$VERBOSE" -gt 2 ] && echo "Keep $i" kept="$kept,$d" continue 2 fi @@ -416,15 +466,28 @@ if [ -e "$f" ]; then if "$DOWNLOAD"; then - "$VERBOSE" && echo "Verify existing ${f##*/}" - verify "$f" || continue - "$INSTALL" || kept="$kept,$d" + if "$verify_existing" && ! "$DRYRUN"; then + [ "$VERBOSE" -gt 1 ] && ! "$INSTALL" && + echo "Keep/Verify ${f##*/}" + verify "$f" || continue + else + [ "$VERBOSE" -gt 1 ] && ! "$INSTALL" && + echo "Keep ${f##*/}" + fi + "$INSTALL" || kept="$kept,$d" # else assume it was verified when downloaded fi elif "$DOWNLOAD"; then - fetch "$f" || continue - verify "$f" || continue - "$INSTALL" || added="$added,$d" + if "$DRYRUN"; then + [ "$VERBOSE" -gt 0 ] && echo "Get/Verify ${f##*/}" + else + [ "$VERBOSE" -eq 1 ] && echo -n "Get/Verify ${f##*/} ..." + fetch "$f" && + verify "$f" || + { [ "$VERBOSE" -eq 1 ] && echo " failed."; continue; } + [ "$VERBOSE" -eq 1 ] && ! "$INSTALL" && echo " done." + fi + "$INSTALL" || added="$added,$d" elif "$INSTALL"; then echo "Cannot install ${f##*/}, not found" >&2 continue @@ -432,19 +495,35 @@ "$INSTALL" || continue - removed=false + update='' if [ "${installed[*]:-}" ]; then for i in "${installed[@]}"; do - delete_firmware "$i" - removed=true + "$DRYRUN" || delete_firmware "$i" + update="Update" done fi - add_firmware "$f" + "$DRYRUN" || add_firmware "$f" "$update" - if "$removed"; then + f="${f##*/}" + f="${f%.tgz}" + if [ "$update" ]; then + if [ "$VERBOSE" -eq 1 ] && "$DOWNLOAD" && ! "$DRYRUN"; then + echo " updated." + elif [ "$VERBOSE" -eq 1 ]; then + echo "Update $f" + elif [ "$VERBOSE" -gt 0 ] && "$DRYRUN"; then + echo "Update $f" + fi updated="$updated,$d" else + if [ "$VERBOSE" -eq 1 ] && "$DOWNLOAD" && ! "$DRYRUN"; then + echo " installed." + elif [ "$VERBOSE" -eq 1 ]; then + echo "Install $f" + elif [ "$VERBOSE" -gt 0 ] && "$DRYRUN"; then + echo "Install $f" + fi added="$added,$d" fi done