===================================================================
RCS file: /cvs/openbsd/update_openbsd/update_openbsd,v
retrieving revision 1.20
retrieving revision 1.121
diff -u -r1.20 -r1.121
--- openbsd/update_openbsd/update_openbsd	2009/04/25 01:14:12	1.20
+++ openbsd/update_openbsd/update_openbsd	2019/03/02 01:02:02	1.121
@@ -1,9 +1,24 @@
 #!/bin/sh
-# $RedRiver: update_openbsd,v 1.19 2009/03/14 01:09:23 andrew Exp $
+# $AFresh1: update_openbsd,v 1.120 2019/03/02 00:34:34 andrew Exp $
+#
+# Copyright (c) 2012 Andrew Fresh <andrew@afresh1.com>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 
 installed_sets() {
     local misc=/usr/share/doc/README
-    local man=/usr/share/man/cat1/intro.0
+    local man=/usr/share/man/man1/intro.1
     local comp=/usr/bin/cc
     local game=/usr/games/
     local xbase=/usr/X11R6/
@@ -12,10 +27,12 @@
     local xserv=/usr/X11R6/bin/X
     local xshare=/usr/X11R6/bin/startx
 
+    local _nv=`echo $NEW_VER | sed -e 's/\.//'`
     local _c _d _e
     echo -n base
-    echo -n ' etc'
+    [ $_nv -lt 57 ] && echo -n ' etc'
     for _d in misc man comp game xbase xetc xfont xserv xshare; do
+        [ $_d = xetc -a $_nv -ge 57 ] && continue
         eval _e=\$${_d}
         _c=`ls $_e 2> /dev/null | wc -l`
         #echo $_c $_d $_e
@@ -24,12 +41,21 @@
         fi
     done
 
-    sendmail -d0.1 root < /dev/null | grep -q SASL
-    if [ $? == 0 ]; then 
+    sendmail -d0.1 --badoption </dev/null 2>/dev/null | grep -q SASL
+    if [ $? == 0 ]; then
         echo -n ' sendmail-smtp_auth'
     fi
 }
 
+kernel_file_version() {
+    echo exit | config -e $1 | grep -A1 ^OpenBSD
+    #what $1 | sed -ne 's/[[:blank:]]\{1,\}//p'
+}
+
+kernel_is_multiprocessor() {
+    printf "find cpu*\nexit\n" | config -e $1 2>/dev/null | grep -q "cpu\* at "
+}
+
 version_in() {
         local _proto=${FTP%%://*}
         local _file
@@ -38,19 +64,15 @@
             local _list=`echo "ls base*.tgz" | ${FTP_CMD} ${FTP}/`
             _file=`echo ${_list} | awk '/base[0-9][0-9].tgz/ { print $9 }'`
 
-        elif [ X"http" == X"${_proto}" ]; then
-            local _list=`${FTP_CMD} -V -o - ${FTP}/`
-            _file=`echo ${_list} | awk '/[^x]base[0-9][0-9]*\.tgz/ { 
-                    sub("^.*base","base");
-                    sub("\.tgz.*",".tgz"); 
-                    print $0;
-                }'`
+        elif [ X"http" == X"${_proto}" -o X"https" == X"${_proto}" ]; then
+            _file=`${FTP_CMD} -V -o - ${FTP}/index.txt |
+		sed -ne 's/.*\(base[0-9][0-9].tgz\).*/\1/p'`
 
         elif [ X"scp" == X"${_proto}" ]; then
             echo SCP is not yet supported >&2
             return 2
 
-        else 
+        else
             echo Unsupported FTP ${FTP} >&2
             return 2
 
@@ -61,6 +83,58 @@
         echo $_v
 }
 
+set_boot_device() {
+	BOOT_DEVICE=$( df -lnP /bsd | sed -ne 's! .*/$!!p' )
+
+	root_disk=$( echo $BOOT_DEVICE |
+	    sed -e 's,/dev/\([a-z]*[0-9]\)[a-z].*,\1,' )
+	msdos_partition=$(
+	    fdisk $root_disk | grep -q '^*.*FAT32' \
+	    && \
+	    disklabel $root_disk | sed -ne 's/:.*MSDOS//p' | tr -d ' '
+	)
+
+	[ "$msdos_partition" ] &&
+	    BOOT_DEVICE="/dev/$root_disk$msdos_partition"
+}
+
+boot_device_mounted=""
+mount_boot_device() {
+    [ "$boot_device_mounted" ] && return
+    [ "$BOOT_DEVICE" ] || return
+
+    local boot_mount=$( mount |
+	    sed -ne "s!^$BOOT_DEVICE on \([^ ]*\).*!\1!p" )
+
+    if [ ! "$boot_mount" ]; then
+        mount $BOOT_DEVICE /mnt
+        boot_device_mounted=1
+    fi
+}
+
+umount_boot_device() {
+    [ "$boot_device_mounted" ] && umount $BOOT_DEVICE
+    boot_device_mounted=""
+}
+
+find_boot_kernel() {
+    local _k=$( ( \
+        echo bsd; \
+        [ -e boot.conf ] && sed -E '/^ *(set +image|boot) +/!d ; \
+            s///; s/^.*://; s/ .*$//' boot.conf \
+    ) | tail -1 )
+    _k=$( follow_symlink $_k )
+
+    local _d=$( dirname $_k )
+    [ "$_d" = "." ] && _d=$PWD
+
+    if [ $_d = . -o $_d = $PWD ]; then
+        basename $_k
+    else
+        echo $_k
+    fi
+}
+
 set_version() {
     CUR_VER=`uname -r`
     NEW_VER=`dc -e "$CUR_VER 0.1 + p"`
@@ -69,7 +143,7 @@
 
     local _cv=`echo $CUR_VER | sed -e 's/\.//'`
     local _nv=`echo $NEW_VER | sed -e 's/\.//'`
-    local _v
+    local _v _d _pkr
 
     if [ X"No" != X"$FORCE_DIR" -a -d $FORCE_DIR ]; then
         _dir=$FORCE_DIR
@@ -96,10 +170,13 @@
     fi
 
     if [ X"" != X"${MIRROR}" -a X"" == X"${_v}" ]; then
-        if [ X"No" == X"${FORCE_DIR}" ]; then
-            _dir=${NEW_VER}
-        else
+        if [ X"No" != X"${FORCE_DIR}" ]; then
             _dir=${FORCE_DIR}
+        elif sysctl kern.version | grep -q -e '-current ' -e '-beta '; then
+            _dir=snapshots
+            FORCE_DIR=snapshots
+        else
+            _dir=${NEW_VER}
         fi
         FTP=${MIRROR}/${_dir}/`machine`
 
@@ -120,7 +197,7 @@
 
         if [ X"" == X"${_v}" ]; then
             echo No sets in [${FTP}] >&2
-            return 2 
+            return 2
         elif [ X"${_cv}" == X"${_v}" ]; then
             NEW_VER=$CUR_VER
         elif [ X"${_nv}" == X"${_v}" ]; then
@@ -137,7 +214,11 @@
     fi
 
     if [ X"" == X"${_v}" ]; then
-        echo ERROR: Unable to determine file version! >&2
+        if [ X"" == X"${MIRROR}" ]; then
+            echo ERROR: No sets, and no MIRROR, unable to continue. >&2
+        else
+            echo ERROR: Unable to determine FILE_VER, check your MIRROR. >&2
+        fi
         return 1
     fi
 
@@ -149,10 +230,72 @@
     if [ X"" != X"${MIRROR}" ]; then
         FTP=${MIRROR}/${_dir}/`machine`
     fi
+
+    KERNEL_ROOT=""
+    [ -z "$BOOT_DEVICE" ] && set_boot_device
+
+    mount_boot_device
+
+    # _pkr == possible_kernel_roots
+    _pkr=/
+    [ "$BOOT_DEVICE" ] && _pkr="/mnt/ $_pkr"
+
+    for _d in $_pkr; do
+	KERNEL_ROOT=$( df -lnP ${_d}bsd 2>/dev/null | sed -ne 's!/dev/.* !!p' )
+	[ "$KERNEL_ROOT" ] && break
+    done
+
+    if ! [ "$KERNEL_ROOT" ]; then
+        echo "Unable to find KERNEL_ROOT, tried $_pkr" >&2
+        exit 2
+    fi
+
+    cd $KERNEL_ROOT
+    BOOTED_KERNEL=$( find_boot_kernel )
+    BOOT_KERNEL_VERSION=$( kernel_file_version $BOOTED_KERNEL )
+
+    if [ $(sysctl -n hw.ncpufound) -gt 1 ] || kernel_is_multiprocessor $BOOTED_KERNEL; then
+        BOOT_KERNEL=bsd.mp
+    else
+        BOOT_KERNEL=$BOOTED_KERNEL
+    fi
+
+    BOOTED_KERNEL_VERSION=`sysctl -n kern.version`
+    NEW_KERNEL_VERSION=""
+
+    # We want to default to what we had
+    INSTALL_KERNELS="$BOOT_KERNEL"
+    # if the boot kernel was our specially named bsd.sp, we install from bsd
+    if [ X"$INSTALL_KERNELS" == X"bsd.sp" ]; then
+        INSTALL_KERNELS="bsd"
+    fi
+
+    # We want to update all kernels that exist
+    # either in the $KERNEL_ROOT or in /
+    for b in bsd bsd.mp; do
+        [ -e $b -o -e /$b ] || continue
+        if [ X"${INSTALL_KERNELS% *}" != X"$b" ]; then
+            INSTALL_KERNELS="$INSTALL_KERNELS $b"
+        fi
+    done
+
+    cd $OLDPWD
+
+    EFI_BOOT=""
+    if [ -d "/mnt/efi/boot" ]; then
+        _d=$( cd "/mnt/efi/boot" && ls -1 *.{efi,EFI} 2>/dev/null )
+        # assume an MSDOS filesystem and so case insensitive
+        [ "$_d" ] && EFI_BOOT=$( echo $_d | tr a-z A-Z )
+    fi
+
+    umount_boot_device
+
+    BOOT_KERNELS=$INSTALL_KERNELS
+    INSTALL_KERNELS="$INSTALL_KERNELS bsd.rd"
 }
 
 get_sets() {
-    echo '### GETTING SETS ###'
+    echo '==> GETTING SETS'
     if [ X"" == X"$FTP" ]; then
         echo ERROR: No FTP site set! >&2
         return 1
@@ -163,37 +306,62 @@
 
     local _v=$FILE_VER
 
-    for _b in `echo /bsd* bsd bsd.mp bsd.rd | sort -u`; do
-        if [ -e /${_b} -a ! -e ./${_b} ]; then
-            echo $FTP_CMD ${FTP}/${_b}
+    if [ "$EFI_BOOT" ]; then
+        _b="$EFI_BOOT"
+        if [ ! -e ./${_b} ]; then
+            echo "===> $FTP_CMD ${FTP}/${_b}"
             $FTP_CMD ${FTP}/${_b}
+        else
+            echo "===> Have ${_b}"
         fi
+    fi
+
+    for _b in $INSTALL_KERNELS; do
+        if [ ! -e ./${_b} ]; then
+            echo "===> $FTP_CMD ${FTP}/${_b}"
+            $FTP_CMD ${FTP}/${_b}
+        else
+            echo "===> Have ${_b}"
+        fi
+        kernel_file_version "${_b}"
     done
 
     for _s in $INSTALLED_SETS; do
+        [ "$_v" -ge "57" -a "$_s" != "${_s%etc}" ] && continue
         local _file=${_s}${_v}.tgz
         if [ ${_s} == sendmail-smtp_auth ]; then
             _file=${_s}.gz
         fi
 
         if [ ! -e ./${_file} ]; then
-            echo $FTP_CMD ${FTP}/${_file}
+            echo "===> $FTP_CMD ${FTP}/${_file}"
             $FTP_CMD ${FTP}/${_file}
         fi
     done
 
     local _type
+    local _ftp
     for _type in $CHECKSUM_TYPES; do
-        if [ ! -e $_type ]; then
-            echo $FTP_CMD ${FTP}/$_type
-            $FTP_CMD ${FTP}/$_type
-        fi
+        [ -e $_type ] && break
+        _ftp=`echo "$FTP" | sed -e 's,://[^/]*/,://ftp.openbsd.org/,'`
+        echo "===> $FTP_CMD ${_ftp}/$_type"
+        $FTP_CMD ${_ftp}/$_type
     done
 }
 
+follow_symlink () {
+    local _file=$1
+    # This could go circular, but I dunno how to fix that.
+    if [ -h $_file ]; then
+        follow_symlink $( readlink -f $_file )
+    else
+        echo $_file
+    fi
+}
+
 check_sum () {
     local _type=$1
-    echo "### CHECKING $_type SUMS ###"
+    echo "==> CHECKING $_type SUMS"
     cd $RELEASEDIR
 
     if [ ! -e $_type ]; then
@@ -201,9 +369,28 @@
         return 1
     fi
 
-    ls bsd* *gz | sed -e 's/\(.*\)/(\1)/' > index 
-    grep -f index $_type | sum -c 
+    local _nv=`echo $NEW_VER | sed -e 's/\.//'`
+    local _signify=`which signify 2>/dev/null`
+    local _keyfile=/etc/signify/openbsd-${_nv}-base.pub
+    local _b _s
 
+    (
+        for _b in $INSTALL_KERNELS; do echo "($_b)"        ; done
+        for _s in $INSTALLED_SETS;  do echo "($_s$_nv.tgz)"; done
+    ) > index
+
+
+    if [ -n "$_signify" -a "$_type" != "${_type%.sig}" ]; then
+        echo "===> Checking signature";
+        if [ ! -e $_keyfile ]; then
+            echo "key [$_keyfile] does not exist, cannot check $_type" >&2
+            return 2
+        fi
+        signify -V -e -p $_keyfile -x $_type -m - | grep -f index | sha256 -c -
+    else
+       grep -f index $_type | sha256 -c
+    fi
+
     if [ $? -ne 0 ]; then
         echo ERROR: $_type does not match! >&2
         return 1
@@ -211,25 +398,34 @@
 }
 
 check_sets() {
-    echo '### CHECKING SETS ###'
+    echo '==> CHECKING SETS'
     cd $RELEASEDIR
 
     local _missing_sets
     local _v=$FILE_VER
 
-    for _b in `echo /bsd* bsd bsd.mp bsd.rd | sort -u`; do
-	_b=${_b#/}
-        local _n=$_b
-        if [ X"bsd.sp" == X"${_n}" ]; then
-            _n=bsd
-        fi
-        if [ -e /${_b} -a ! -e ./${_n} ]; then
-            echo ${_n} does not exist
+    mount_boot_device
+    for _n in $INSTALL_KERNELS; do
+        local _o=$_n
+        [ X"bsd" == X"${_o}" -a -e ${KERNEL_ROOT}bsd.sp ] && _o=bsd.sp
+        if [ -e ${KERNEL_ROOT}${_o} -a ! -e ./${_n} ]; then
+            echo ${_o} does not exist on $BOOT_DEVICE
             _missing_sets=1
         fi
+
+        if [ X"${BOOT_KERNEL}" == X"${_o}" -a -e ./${_n} ]; then
+            NEW_KERNEL_VERSION=`kernel_file_version ./${_n}`
+        fi
     done
+    umount_boot_device
 
+    if [ X"$NEW_KERNEL_VERSION" == X"" ]; then
+        echo Missing replacement for boot kernel $BOOT_KERNEL >&2
+        _missing_sets=1
+    fi
+
     for _s in $INSTALLED_SETS; do
+        [ "$_v" -ge "57" -a "$_s" != "${_s%etc}" ] && continue
         local _file=${_s}${_v}.tgz
         if [ ${_s} == sendmail-smtp_auth ]; then
             _file=${_s}.gz
@@ -241,104 +437,119 @@
     done
 
     if [ X"" == X"${_missing_sets}" ]; then
-        echo All OK
+        echo 'All OK'
     fi
 
     local _type
     for _type in $CHECKSUM_TYPES; do
+	[ -n "$NO_SIGNIFY" -a "$_type" != "${_type%.sig}" ] && continue
         if [ -e $_type ]; then
-            check_sum $_type
+            check_sum $_type && break
+            [ -z "$IGNORE_CHECKSUM_ERROR" ] && exit 1
         fi
     done
+
+    return 0
 }
 
 
-install_kernel() {
-    echo '### INSTALLING KERNEL ###'
-    if [ X"$USER" != X"root" -a X"$SUDO" == X"" ]; then
-        echo ${0##*/} must be run as root or SUDO must be set! >&2
-        exit 1
-    fi
+install_kernels() {
+    local _d="$1"
+    local boot_mount
+    local mount_is_msdos
 
-    if [ X"" == X"$RELEASEDIR" ]; then
-        echo ERROR: no source for new kernels! >&2
-        exit 1
+    if [ "$_d" ]; then
+      _d=$( readlink -nf "$_d" )
     else
-        cd $RELEASEDIR
-    fi
+        mount_boot_device
 
-    if [ ! -e bsd ]; then
-        echo ERROR: new bsd kernel does not exist! >&2
-        exit 1
-    fi
+	if [ "$KERNEL_ROOT" != "/" ]; then
+		local _ik="$INSTALL_KERNELS"
+		INSTALL_KERNELS="$BOOT_KERNEL bsd.rd"
 
-    if [ -e /bsd.mp -a ! -e bsd.mp ]; then
-        echo ERROR: new bsd.mp kernel does not exist! >&2
-        exit 1
-    fi
+		install_kernels $KERNEL_ROOT
 
-    if [ ! -e bsd.rd ]; then
-        echo ERROR: new bsd.rd kernel does not exist! >&2
-        exit 1
-    fi
+		INSTALL_KERNELS="$_ik"
+	fi
 
-    local _v=$FILE_VER
-    if [ -e base${_v}.tgz ]; then
-        echo Extracting new firmware and ifconfig from base${_v}.tgz
-        $SUDO tar -C $DESTDIR -xzphf base${_v}.tgz \
-		./etc/firmware ./sbin/ifconfig
+        umount_boot_device
+
+        install_kernels /
+        return
     fi
 
-    $SUDO rm -f /obsd
-    $SUDO ln /bsd /obsd
-    if [ $? -ne 0 ]; then
-        echo "Error copying old kernel!"
+    echo "==> INSTALLING KERNEL to $_d"
+
+    if [ X"" == X"$RELEASEDIR" ]; then
+        echo ERROR: no source for new kernels! >&2
         exit 1
     fi
 
-    for _b in bsd*; do
-        $SUDO rm -f /nbsd
+    [ $_d != / ] && _d=${_d%/}/
+    [ $_d != / ] && mount | grep -q " on ${_d%/} .* msdos" && mount_is_msdos=1
 
-        if [ X"${_b}" == X"bsd" ]; then
-            echo Copying bsd to /bsd.sp
-            $SUDO cp bsd /nbsd && $SUDO mv /nbsd /bsd.sp
-            if [ $? -ne 0 ]; then
-                echo ERROR: Could not copy new SP kernel! >&2
-                exit 1
-            fi
-        else
-            if [ -e /$_b ]; then
-                echo Copying $_b to /
-                $SUDO cp ${_b} /nbsd && $SUDO mv /nbsd /${_b}
-                if [ $? -ne 0 ]; then
-                    echo ERROR: Could not copy new $_b kernel! >&2
-                    exit 1
-                fi
-            fi
-        fi
-    done
+    if [ "$EFI_BOOT" -a -d /mnt/efi/boot ]; then
+       echo "Copying $EFI_BOOT to /mnt/efi/boot/"
+       ( cd /mnt/efi/boot \
+         && cp "$RELEASEDIR/$EFI_BOOT" "n$EFI_BOOT" \
+         && mv "n$EFI_BOOT" "$EFI_BOOT"
+       )
+    fi
 
-    if [ ! -h /bsd ]; then
-        if [ -e /bsd.mp ]; then
-            echo linking /bsd.mp to /bsd
-            $SUDO ln -sf /bsd.mp /bsd
+    if [ X"$BOOT_KERNEL_VERSION" != X"$NEW_KERNEL_VERSION" ]; then
+        echo "===> Backing up ${_d}$BOOTED_KERNEL to ${_d}obsd"
+        if [ $mount_is_msdos ]; then
+            cp ${_d}$BOOTED_KERNEL ${_d}obsd
         else
-            echo linking /bsd.sp to /bsd
-            $SUDO ln -sf /bsd.sp /bsd
+            ln -f ${_d}$BOOTED_KERNEL ${_d}obsd
         fi
         if [ $? -ne 0 ]; then
-            echo ERROR: Could not symlink new kernel! >&2
+            echo "Error copying old kernel!" >&2
             exit 1
         fi
     fi
+
+    cd $RELEASEDIR
+
+    for _b in $INSTALL_KERNELS; do
+        rm -f ${_d}nbsd
+        local _bd=$_b
+        [ X"${_b}" == X"bsd" ] && _bd="bsd.sp"
+
+        local _is_boot=""
+        [ X"$BOOT_KERNEL" == X"${_d}${_bd}" ] && _is_boot="# boot kernel"
+
+        echo "Copying $_b to ${_d}$_bd $_is_boot"
+        cp ${_b} ${_d}nbsd && mv ${_d}nbsd ${_d}${_bd}
+        if [ $? -ne 0 ]; then
+            echo ERROR: Could not copy new $_bd kernel! >&2
+            exit 1
+        fi
+    done
+
+    cd $OLDPWD
+
+    if [ ! -h ${_d}bsd ]; then
+        cd ${_d}
+        for _b in $BOOT_KERNELS; do
+            [ X"$_b" == X"bsd" ] && _b="bsd.sp"
+            if [ -e $_b ]; then
+                if [ "$mount_is_msdos" ]; then
+                    echo "===> Moving $_b ${_d}bsd (MSDOS)"
+                    mv -f ${_b} bsd
+                else
+                    echo "===> symlinking $_b to ${_d}bsd"
+                    ln -sf $_b bsd
+                fi
+                break
+            fi
+        done
+        cd $OLDPWD
+    fi
 }
 
 install_sets() {
-    echo '### INSTALLING SETS ###'
-    if [ X"$USER" != X"root" -a X"$SUDO" == X"" ]; then
-        echo ${0##*/} must be run as root or SUDO must be set! >&2
-        exit 1
-    fi
+    echo '==> INSTALLING SETS'
 
     if [ X"" == X"$RELEASEDIR" ]; then
         echo ERROR: no source for sets! >&2
@@ -349,92 +560,87 @@
 
     local _v=$FILE_VER
 
-    for _f in *${_v}.tgz; do
+    local _sets=`ls *${_v}.tgz | grep -v ^base `
+    for _f in ${_sets} base${_v}.tgz; do
         _path=$DESTDIR
         if [ X"etc${_v}.tgz"  == X"$_f" \
             -o X"xetc${_v}.tgz" == X"$_f" ]; then
-            if [ X"" != X"$SYSMERGE" ]; then
-                continue
-            fi
+            [ X"" != X"$SYSMERGE" ] && continue
             _path=/var/tmp/temproot
         fi
 
-        echo Extracting $_f to $_path
-        $SUDO mkdir -p $_path
-        $SUDO tar -C $_path -xzphf ${RELEASEDIR}/${_f}
+        echo "Extracting $_f to $_path"
+        mkdir -p $_path
+        tar -C $_path -xzphf ${RELEASEDIR}/${_f}
         if [ $? -ne 0 ]; then
             echo ERROR: Could not extract ${_f}! >&2
             exit 1
         fi
     done
 
-    echo Extracted all sets.
+    echo '===> Extracted all sets.'
+}
 
+install_sendmail_smtp_auth() {
     if [ -e ${RELEASEDIR}/sendmail-smtp_auth.gz ]; then
         gzcat ${RELEASEDIR}/sendmail-smtp_auth.gz > \
             ${RELEASEDIR}/sendmail-smtp_auth
     fi
     if [ -e ${RELEASEDIR}/sendmail-smtp_auth ]; then
+        if ! pkg_info -qe 'cyrus-sasl-*'; then
+            pkg_add -i cyrus-sasl
+        fi
+
         install -o root -g smmsp -m 2555 \
             ${RELEASEDIR}/sendmail-smtp_auth \
-            /usr/local/libexec/sendmail/sendmail
+            /usr/libexec/sendmail/sendmail
 
-        echo Installed sendmail with smtp_auth
+        echo '===> Installed sendmail with smtp_auth'
     fi
 }
 
 update_etc() {
-    echo '### UPDATING ETC ###'
+    echo '==> UPDATING ETC'
     if [ ! -e $SYSMERGE ]; then
-        SYSMERGE=
+        echo "ERROR: Can't find sysmerge!" >&2
+        exit 1;
     fi
 
-    if [ X"" == X"$SYSMERGE" ]; then
-        if [ -e /var/tmp/temproot ]; then
-            MERGEMASTER=`which mergemaster`
+    local _v=$FILE_VER
+    local _args=""
 
-            if [ $? != 0 ]; then
-                $SUDO pkg_add -i mergemaster
-
-                MERGEMASTER=`which mergemaster`
-                if [ $? != 0 ]; then
-                    echo ERROR: mergemaster not installed! >&2
-                    exit 1
-                fi
-            fi
-
-            echo '### RUNNING MERGEMASTER ###'
-            $SUDO $MERGEMASTER -irv
-        else 
-            echo "ERROR: no source for etc!" >&2
-            exit 1
-        fi
-    else
+    if [ ! -e /var/sysmerge/etc.tgz ]; then
         if [ X"" == X"$RELEASEDIR" ]; then
             echo "ERROR: no source for etc!" >&2
             exit 1
-        else
-            cd $RELEASEDIR
         fi
 
-        local _v=$FILE_VER
+        cd $RELEASEDIR
+
         if [ -e etc${_v}.tgz ]; then
-            _args="$_args -s etc${_v}.tgz"
+            _args="$_args -s ${RELEASEDIR}/etc${_v}.tgz"
         fi
         if [ -e xetc${_v}.tgz ]; then
-            _args="$_args -x xetc${_v}.tgz"
+            _args="$_args -x ${RELEASEDIR}/xetc${_v}.tgz"
         fi
-        if [ X"" == X"$_args" ]; then 
+        if [ X"" == X"$_args" ]; then
             echo ERROR: No upgrade sets found! >&2
-        else
-            echo '### RUNNING SYSMERGE ###'
-            _args="-a $_args"
-            $SUDO $SYSMERGE $_args
+            exit 1
         fi
     fi
+
+    echo '==> RUNNING SYSMERGE'
+    $SYSMERGE $_args
+
+    cd $OLDPWD
 }
 
 
+if [ $(id -u) != 0 ]; then
+    echo 'ERROR: need root privileges to run this script' >&2
+    exit 1
+fi
+
 if [ -e /etc/update_openbsd.conf ]; then
     . /etc/update_openbsd.conf
 fi
@@ -443,37 +649,62 @@
     . ${HOME}/.update_openbsdrc
 fi
 
-#MIRROR=${MIRROR:=ftp://ftp.openbsd.org/pub/OpenBSD}
+MIRROR=${MIRROR:=http://cdn.openbsd.org/pub/OpenBSD}
 FTP_CMD=${FTP_CMD:=ftp -V}
-PKG_PATH=${PKG_PATH:=/usr/ports/packages/`machine`/all/:${MIRROR}/`uname -r`/packages/`machine`/}
 
 DESTDIR=${DESTDIR:=/}
 SYSMERGE=${SYSMERGE:=/usr/sbin/sysmerge}
 FORCE_DIR=${FORCE_DIR:=No}
 
+export PKG_PATH TRUSTED_PKG_PATH
+
+set_version
+
+TRUSTED_PKG_PATH=${TRUSTED_PKG_PATH:=/usr/ports/packages/`machine -a`/all}
+if [ "$FORCE_DIR" = "No" ]; then
+	PKG_PATH=${PKG_PATH:=${MIRROR}/$NEW_VER/packages/`machine -a`}
+else
+	PKG_PATH=${PKG_PATH:=${MIRROR}/$FORCE_DIR/packages/`machine -a`}
+fi
+
 INSTALLED_SETS=${INSTALLED_SETS:=`installed_sets`}
 
-CHECKSUM_TYPES=${CHECKSUM_TYPE:=SHA256 MD5}
+CHECKSUM_TYPES=${CHECKSUM_TYPES:=SHA256.sig SHA256}
 
-set_version
 local _error=$?
 
 echo
 echo "-= update_openbsd - helper script to update OpenBSD =-"
 echo "------------------------------------------------------"
 echo
-echo "          SUDO: $SUDO"
-echo "      SYSMERGE: $SYSMERGE"
-echo "        MIRROR: $MIRROR"
-echo "    RELEASEDIR: $RELEASEDIR"
-echo "       DESTDIR: $DESTDIR"
-echo "INSTALLED_SETS: $INSTALLED_SETS"
+echo "        SYSMERGE: $SYSMERGE"
+echo "          MIRROR: $FTP"
+echo "        PKG_PATH: $PKG_PATH"
+echo "TRUSTED_PKG_PATH: $TRUSTED_PKG_PATH"
+echo "      RELEASEDIR: $RELEASEDIR"
+echo "         DESTDIR: $DESTDIR"
+echo "     BOOT_DEVICE: $BOOT_DEVICE"
+[ "$EFI_BOOT" ] && echo "        EFI_BOOT: $EFI_BOOT"
+echo "     BOOT_KERNEL: $BOOT_KERNEL"
+echo " INSTALL_KERNELS: $INSTALL_KERNELS"
+echo "  INSTALLED_SETS: $INSTALLED_SETS"
 echo
-echo "       CUR_VER: $CUR_VER"
-echo "       NEW_VER: $NEW_VER"
-#echo "      FILE_VER: $FILE_VER"
+echo "         CUR_VER: $CUR_VER"
+echo "         NEW_VER: $NEW_VER"
+#echo "        FILE_VER: $FILE_VER"
 echo
 
+mount_boot_device
+l=$KERNEL_ROOT
+[ "$l" = / ] || l="$BOOT_DEVICE:"
+for k in $INSTALL_KERNELS; do
+    if [ -e $KERNEL_ROOT$k ]; then
+        echo "Existing $l$k"
+        kernel_file_version $KERNEL_ROOT$k
+    fi
+done
+umount_boot_device
+
 if [ ${_error} -ne 0 ]; then
 	exit ${_error}
 fi
@@ -484,24 +715,91 @@
 
 check_sets || exit
 
-if [ X"" != X"$SUDO" ]; then
-    echo Please enter your sudo password if prompted.
-    echo You may be asked for it again later in the process.
-    $SUDO -v
+echo "===> Last booted:\n$BOOTED_KERNEL_VERSION"
+if [ X"$BOOT_KERNEL_VERSION" != X"$BOOTED_KERNEL_VERSION" \
+  -a X"$BOOT_KERNEL_VERSION" != X"$NEW_KERNEL_VERSION" ]; then
+    echo "Next boot $BOOTED_KERNEL (unless replaced):\n$BOOT_KERNEL_VERSION"
 fi
+if [ -n "$NEW_KERNEL_VERSION" ]; then
+    echo "===> New $BOOT_KERNEL:\n$NEW_KERNEL_VERSION";
+else
+    echo "\n!!! WARNING: Will not replace boot kernel $BOOT_KERNEL! !!!\n" >&2
+    echo "ctrl+C to cancel, enter to continue anyway" >&2
+    local _temp
+    read _temp
+    NEW_KERNEL_VERSION=$BOOT_KERNEL_VERSION
+fi
 
-install_kernel
+if [ X"$NEW_KERNEL_VERSION" != X"$BOOTED_KERNEL_VERSION" ]; then
+    echo >&2
+    echo "!!!  You are upgrading the OpenBSD kernel.        !!!" >&2
+    echo "!!!  You will be given the opportunity to reboot  !!!" >&2
+    echo "!!!  at the end of the proces but it is safer to  !!!" >&2
+    echo "!!!  have a separate root shell open.             !!!" >&2
+    echo "!!!  It is needed in order to run /sbin/oreboot.  !!!" >&2
+    echo "!!!  doas MAY NOT WORK after sets are extracted.  !!!" >&2
+    echo >&2
+    echo "enter to continue, ctrl+C to cancel" >&2
+    local _temp
+    read _temp
 
-if [ $CUR_VER == $NEW_VER ]; then
-    install_sets
+    if [ ! -e /sbin/oreboot ]; then
+        cp /sbin/reboot /sbin/oreboot
+        if [ $? -ne 0 ]; then
+            echo "Error copying old reboot command!" >&2
+            exit 1
+        fi
+        echo "/sbin/reboot copied to /sbin/oreboot"
+    fi
+fi
+
+install_kernels
+install_sets
+
+if [ X"$NEW_KERNEL_VERSION" == X"$BOOTED_KERNEL_VERSION" ]; then
+    install_sendmail_smtp_auth
+
+    if [ -e /sbin/oreboot ]; then
+        echo Removing /sbin/oreboot
+        rm -f /sbin/oreboot
+    fi
+
+    echo "===> Relinking to create unique kernel..."
+    sha256 -h /var/db/kernel.SHA256 /bsd
+    /usr/libexec/reorder_kernel
+
     update_etc
 
-    echo '### UPDATING PACKAGES ###'
-    $SUDO pkg_add -ui -F update -F updatedepends
+    OPENUP=$( which openup 2>/dev/null )
+    if [ -n "$OPENUP" ]; then
+        echo "==> UPDATING WITH $OPENUP"
+        $OPENUP
+    else
+        echo '==> UPDATING PACKAGES'
+        pkg_add -u
+    fi
 
+    echo '==> UPDATING FIRMWARE'
+    fw_update
+
 else
-    echo Instructions for updating to the new version available from 
-    echo "  http://www.openbsd.org/faq/upgrade${_v}.html"
+    [ -e /etc/rc.sysmerge ] && grep -q $SYSMERGE /etc/rc.sysmerge ||
+        echo "$SYSMERGE -b" >>/etc/rc.sysmerge &&
+        echo "==> RUNNING $SYSMERGE -b ON REBOOT"
+
+    echo Instructions for updating to the new version available from
+    if [ X"snapshots" == X"$FORCE_DIR" ]; then
+        echo "  http://www.openbsd.org/faq/current.html"
+    else
+        echo "  http://www.openbsd.org/faq/upgrade${FILE_VER}.html"
+    fi
 fi
 
-echo New kernel installed.  Please reboot!
+echo Update complete. enter to reboot, ctrl+C to cancel
+read _temp
+if [ -e /sbin/oreboot ]; then
+    echo using /sbin/oreboot
+    /sbin/oreboot
+else
+    /sbin/reboot
+fi