sysupgrade: add -R #.# to try to use a specific release version rather

than the immediate +0.1. print an https://ftp.openbsd.org/... URL where
the new signify pubkey can be found if not present.

no guarantees: we only test +0.1, but jumping further does work quite
often (and if tight on disk, can work better than multiple steps) -
this avoids editing the script if you're going to do it anyway.

"Only upgrades from one version to the next are tested. Skipping
versions may work. Downgrading is unlikely to work."

discussed with deraadt chris florian, ok deraadt

diff --git a/usr.sbin/sysupgrade/sysupgrade.8 b/usr.sbin/sysupgrade/sysupgrade.8
index 3f03b7c..6f5cb36 100644 (file)
--- a/usr.sbin/sysupgrade/sysupgrade.8
+++ b/usr.sbin/sysupgrade/sysupgrade.8
@@ -1,4 +1,4 @@
-.\"    $OpenBSD: sysupgrade.8,v 1.15 2024/09/24 07:33:35 florian Exp $
+.\"    $OpenBSD: sysupgrade.8,v 1.16 2024/09/25 13:55:23 sthen Exp $
 .\"
 .\" Copyright (c) 2019 Florian Obser <florian@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: September 24 2024 $
+.Dd $Mdocdate: September 25 2024 $
 .Dt SYSUPGRADE 8
 .Os
 .Sh NAME
@@ -24,12 +24,13 @@
 .Nm
 .Op Fl fkns
 .Op Fl b Ar base-directory
+.Op Fl R Ar version
 .Op Ar installurl
 .Sh DESCRIPTION
 .Nm
 is a utility to upgrade
 .Ox
-to the next release or a new snapshot if available.
+to a new release or snapshot if available.
 .Pp
 .Nm
 downloads the necessary files to
@@ -65,6 +66,11 @@ By default they will be deleted after the upgrade.
 Fetch and verify the files and create
 .Pa /bsd.upgrade
 but do not reboot.
+.It Fl R Op version
+Upgrade to a specific release version.
+Only upgrades from one version to the next are tested.
+Skipping versions may work.
+Downgrading is unlikely to work.
 .It Fl s
 Upgrade to a snapshot.
 The default is to upgrade to the next release.

diff --git a/usr.sbin/sysupgrade/sysupgrade.sh b/usr.sbin/sysupgrade/sysupgrade.sh
index 71aa321..6dfd412 100644 (file)
--- a/usr.sbin/sysupgrade/sysupgrade.sh
+++ b/usr.sbin/sysupgrade/sysupgrade.sh
@@ -1,6 +1,6 @@
 #!/bin/ksh
 #
-# $OpenBSD: sysupgrade.sh,v 1.53 2024/09/24 07:33:35 florian Exp $
+# $OpenBSD: sysupgrade.sh,v 1.54 2024/09/25 13:55:23 sthen Exp $
 #
 # Copyright (c) 1997-2015 Todd Miller, Theo de Raadt, Ken Westerback
 # Copyright (c) 2015 Robert Peichaer <rpe@openbsd.org>
@@ -35,7 +35,7 @@ err()
 
 usage()
 {
-       echo "usage: ${0##*/} [-fkns] [-b base-directory] [installurl]" 1>&2
+       echo "usage: ${0##*/} [-fkns] [-b base-directory] [-R version] [installurl]" 1>&2
        return 1
 }
 
@@ -74,17 +74,25 @@ rmel() {
 
 SNAP=false
 FORCE=false
+FORCE_VERSION=false
 KEEP=false
 REBOOT=true
 WHAT='release'
 
-while getopts b:fknrs arg; do
+VERSION=$(uname -r)
+NEXT_VERSION=$(echo ${VERSION} + 0.1 | bc)
+
+while getopts b:fknrR:s arg; do
        case ${arg} in
        b)      SETSDIR=${OPTARG}/_sysupgrade;;
        f)      FORCE=true;;
        k)      KEEP=true;;
        n)      REBOOT=false;;
        r)      ;;
+       R)      FORCE_VERSION=true
+               [[ ${OPTARG} == @([0-9]|[0-9][0-9]).[0-9] ]] ||
+                   err "invalid version: ${OPTARG}"
+               NEXT_VERSION=${OPTARG};;
        s)      SNAP=true;;
        *)      usage;;
        esac
@@ -104,33 +112,39 @@ case $# in
 esac
 [[ $MIRROR == @(file|ftp|http|https)://* ]] ||
        err "invalid installurl: $MIRROR"
+$FORCE_VERSION && $SNAP &&
+       err "incompatible options: -s -R $NEXT_VERSION"
+$FORCE && ! $SNAP &&
+       err "incompatible options: -f without -s"
 
 if $SNAP; then
        WHAT='snapshot'
-fi
-
-VERSION=$(uname -r)
-NEXT_VERSION=$(echo ${VERSION} + 0.1 | bc)
-
-if $SNAP; then
        URL=${MIRROR}/snapshots/${ARCH}/
 else
        URL=${MIRROR}/${NEXT_VERSION}/${ARCH}/
-       ALT_URL=${MIRROR}/${VERSION}/${ARCH}/
+       $FORCE_VERSION || ALT_URL=${MIRROR}/${VERSION}/${ARCH}/
 fi
 
 install -d -o 0 -g 0 -m 0755 ${SETSDIR}
 cd ${SETSDIR}
 
 echo "Fetching from ${URL}"
-if ! $SNAP; then
-       if ! unpriv -f SHA256.sig ftp -N sysupgrade -Vmo SHA256.sig ${URL}SHA256.sig; then
+if ! unpriv -f SHA256.sig ftp -N sysupgrade -Vmo SHA256.sig ${URL}SHA256.sig; then
+       if [[ -n ${ALT_URL} ]]; then
                echo "Fetching from ${ALT_URL}"
                unpriv -f SHA256.sig ftp -N sysupgrade -Vmo SHA256.sig ${ALT_URL}SHA256.sig
                URL=${ALT_URL}
+               NEXT_VERSION=${VERSION}
+       else
+               exit 1
        fi
-else
-       unpriv -f SHA256.sig ftp -N sysupgrade -Vmo SHA256.sig ${URL}SHA256.sig
+fi
+
+SHORT_VERSION=${NEXT_VERSION%.*}${NEXT_VERSION#*.}
+if ! [[ -r /etc/signify/openbsd-${SHORT_VERSION}-base.pub ]]; then
+       echo "${0##*/}: signify key not found; download into /etc/signify from" 1>&2
+       echo "https://ftp.openbsd.org/pub/OpenBSD/signify/openbsd-${SHORT_VERSION}-base.pub" 1>&2
+       exit 1
 fi
 
 unpriv -f SHA256 signify -Ve -x SHA256.sig -m SHA256