 @@ -1,41 +1,47 @@
 #! /bin/sh
-# $NetBSD: sort-packages,v 1.13 2010/03/21 10:52:29 wiz Exp $
+# $NetBSD: sort-packages,v 1.14 2010/03/21 15:31:41 wiz Exp $
 # This program scans all binary packages in the current directory and
-# creates two lists of files in OUTDIR:
+# creates three lists of files in OUTDIR:
+#
 # restricted_packages
 #	contains all packages that must not be published on the FTP
 #	server, for whatever reason
+#
 # vulnerable_packages
 #	contains all packages that are not restricted, but vulnerable
+#
 # regular_packages
 #	contains all the other ("good") packages.
+#
 set -eu
 : ${OUTDIR="/tmp"}
 : ${PKG_SUFX=".tgz"}
 : ${AUDIT_PACKAGES="audit-packages"}
 : ${PKG_ADMIN="pkg_admin"}
 : ${PKG_INFO="pkg_info"}
 regular_packages="${OUTDIR}/regular_packages"
 restricted_packages="${OUTDIR}/restricted_packages"
 vulnerable_packages="${OUTDIR}/vulnerable_packages"
 newline="
+"
 : > "${regular_packages}"
 : > "${restricted_packages}"
 : > "${vulnerable_packages}"
 for pkg in *${PKG_SUFX}; do
 	build_info=`${PKG_INFO} -B "${pkg}"`
 	# Note: this code needs to be that complicated because licensing
 	# issues are critical to pkgsrc, and we really don't want
 	# anything unexpected to happen here. The worst case would be
 	# that some file is sorted wrongly because some change in the
 	# output of pkg_info which had not been foreseen. Therefore it
 	# is better to check as strictly as possible to make those
 	# changes immediately visible.
 	no_bin_on_ftp="unknown"
 @@ -48,33 +54,45 @@ for pkg in *${PKG_SUFX}; do
 		;;
 	esac
 	restricted="unknown"
 	case "${newline}${build_info}${newline}" in
 	*"${newline}RESTRICTED=${newline}"*)
 		restricted="no"
 		;;
 	*"${newline}RESTRICTED="*)
 		restricted="yes"
 		;;
 	esac
-	if [ "${restricted}" != "unknown" ] && [ "${no_bin_on_ftp}" != "unknown" ]; then
+	if [ "${restricted}" = "no" ] && [ "${no_bin_on_ftp}" = "no" ]; then
 		# Check whether the package is vulnerable or not.
 		pkg_prefix="${pkg%%-*}"
 		category="regular"
 		_INFO_VER=`${PKG_INFO} -V`;
 		vuln=`${AUDIT_PACKAGES} ${AUDIT_PACKAGES_FLAGS} -p "${pkg}"`
 		if [ -n "${vuln}" ]; then
 			category="vulnerable"
 		fi
 	elif [ "${restricted}" != "unknown" ] && [ "${no_bin_on_ftp}" != "unknown" ]; then
 		category="restricted"
 	else
 		category="unknown"
 	fi
 	: echo "upload> ${pkg} is ${category}."
 	case "${category}" in
 	"regular")
 		echo "${pkg}" >> "${regular_packages}"
 		;;
 	"vulnerable")
 		echo "${pkg}" >> "${vulnerable_packages}"
 		;;
 	"restricted")
 		echo "${pkg}" >> "${restricted_packages}"
 		;;
 	*)
 		echo "sort-packages> WARNING: Could not sort ${pkg} into a category." 1>&2
 		;;
 	esac
 done

 @@ -1,15 +1,15 @@
 #!/bin/sh
-# $NetBSD: upload,v 1.46 2010/03/21 10:52:29 wiz Exp $
+# $NetBSD: upload,v 1.47 2010/03/21 15:31:42 wiz Exp $
+#
 # Upload non-restricted binary pkgs to ftp server
+#
 AWK=${AWK:-/usr/bin/awk}
 PKG_ADMIN="pkg_admin"
 PKG_INFO="pkg_info"
 set -eu
+#
 # Find out where we are
 @@ -208,68 +208,85 @@ fi
+#
 # Some temp files
+#
 umask 022
 TMPDIR="${TMPDIR:-/tmp}"
 TMP="${TMPDIR}"/pkg_upload.$$
 (umask 077 && mkdir "${TMP}") \
 || {
         echo "upload> ERROR: cannot create temporary directory \"${TMP}\"." 1>&2
         exit 1
+}
 vulnerable_packages="$TMP/vulnerable_packages"
 restricted_packages="$TMP/restricted_packages"
 old_packages="$TMP/old_packages"
 good_packages="$TMP/regular_packages"
 all_good_packages="$TMP/all_regular_packages"
 upload_general="$TMP"/upload_general
 upload_vulnerable="$TMP"/upload_vulnerable
 # May be different than $USR_PKGSRC:
 echo "upload> Running ${BMAKE} to get the pkgsrc variables"
 pkgsrcdir=`cd pkgtools/lintpkgsrc ; ${BMAKE} show-var VARNAME=_PKGSRCDIR`
 packages=`cd pkgtools/lintpkgsrc ; ${BMAKE} show-var VARNAME=PACKAGES`
 distdir=`cd pkgtools/lintpkgsrc ; ${BMAKE} show-var VARNAME=DISTDIR`
 gzip_cmd=`cd pkgtools/lintpkgsrc; ${BMAKE} show-var VARNAME=GZIP_CMD USE_TOOLS=gzip`
 pkg_info=`cd pkgtools/lintpkgsrc && ${BMAKE} show-var VARNAME=PKG_INFO`
 shell=`cd pkgtools/lintpkgsrc && ${BMAKE} show-var VARNAME=TOOLS_PLATFORM.sh`
 # Pull in some pkgs needed
 for pkg in ${REQUIRED_PACKAGES}; do
 	install_required $pkg
 done
 echo "upload> Making sure vulnerability-list is up-to-date:"
 if [ -z "$UPDATE_VULNERABILITY_LIST" -o "$UPDATE_VULNERABILITY_LIST" = "yes" ]
 then
 	_PKGVULNDIR=`audit-packages ${AUDIT_PACKAGES_FLAGS} -Q PKGVULNDIR`
 	download-vulnerability-list ${DOWNLOAD_VULNERABILITY_LIST_FLAGS}
 	if [ "x${_PKGVULNDIR}" != "x${distdir}" ]; then
 		cp ${_PKGVULNDIR}/pkg-vulnerabilities ${distdir}
 	fi
 	echo "        done."
 else
 	echo "        (skipped)"
 fi
 case $LINTPKGSRC_CACHE in
 yes|YES)
 	lintpkgsrc_cache="-I `cd pkgtools/lintpkgsrc ; ${BMAKE} show-var VARNAME=LINTPKGSRC_DB`"
 	;;
 *)
 	lintpkgsrc_cache=''
 	;;
 esac
 echo "upload> Checking for out of date packages:"
 # -p  =  report old versions of packages
 lintpkgsrc $lintpkgsrc_cache -K $packages -P $pkgsrcdir -p > "${old_packages}.tmp"
 sed 's@'$packages'/@@' < "${old_packages}.tmp" > "$old_packages"
 RSFLAGS="-vap --progress $RSYNC_OPTS"
 failed=no
 cd $packages
-echo "upload> Checking for restricted packages"
+echo "upload> Checking for restricted and vulnerable packages"
-(cd All && env PKG_INFO="${pkg_info}" OUTDIR="${TMP}" \
+(cd All && env PKG_INFO="${pkg_info}" OUTDIR="${TMP}" PKGVULNDIR="${distdir}" \
                AUDIT_PACKAGES_FLAGS="${AUDIT_PACKAGES_FLAGS}" \
 	       DOWNLOAD_VULNERABILITY_LIST_FLAGS="${DOWNLOAD_VULNERABILITY_LIST_FLAGS}" \
 	       ${shell} "${pkgsrcdir}/mk/bulk/sort-packages")
 # Add the name of the package file, including all its symlinks to the
 # list of files to be uploaded.
 while read package; do
 	ls -1 */"$package"
 done < "$good_packages" > "$all_good_packages"
 if [ "${MKSUMS}" = "yes" -o "${MKSUMS}" = "YES" ]; then
 	echo "upload> Calculating checksum files..."
 	SUMFILES="BSDSUM CKSUM MD5 SHA1 SYSVSUM"
 @@ -281,27 +298,27 @@ if [ "${MKSUMS}" = "yes" -o "${MKSUMS}"
 		for i in ${SUMFILES}; do
 			echo > $i
 			echo "This file is signed with ${SIGN_AS}'s PGP key." >> $i
 			echo >> $i
 		done
 	fi
 	install_required "pkgtools/digest"
 	[ -z "${BSDSUM}" ] && BSDSUM="echo"
 	[ -z "${CKSUM}" ] && CKSUM="echo"
 	[ -z "${SYSVSUM}" ] && SYSVSUM="echo"
-	for pkg in `cat "${good_packages}"`; do
+	for pkg in `cat "${good_packages}" "${vulnerable_packages}"`; do
 		pkg="All/$pkg"
 		${BSDSUM}	"$pkg" >> BSDSUM
 		${CKSUM}	"$pkg" >> CKSUM
 		${MD5}		"$pkg" >> MD5
 		${SHA1}		"$pkg" >> SHA1
 		${SYSVSUM}	"$pkg" >> SYSVSUM
 	done
 	[ "${BSDSUM}" = "echo" ] && rm BSDSUM
 	[ "${CKSUM}" = "echo" ] && rm CKSUM
 	[ "${SYSVSUM}" = "echo" ] && rm SYSVSUM
 	if [ "${SIGN_AS-}" != "" ]; then
 @@ -323,34 +340,54 @@ if [ "${MKSUMMARY-}" = "yes" -o "${MKSUM
 		&& ls -t | grep '\.t[gb]z$' | while read n; do pkg_info -X "$n"; done) \
 		| ${gzip_cmd} > "${packages}"/All/pkg_summary.gz
 fi
 cat <<EOF > "$upload_general"
 #! /bin/sh
 set -e
 cd "$packages"
 rsync $RSFLAGS --files-from="${all_good_packages}" --exclude-from="${old_packages}" . "$RSYNC_DST/"
 EOF
 chmod +x "$upload_general"
 if [ "$do_upload" = "yes" ]; then
-	echo "upload> Uploading packages"
+	echo "upload> Uploading non-vulnerable packages"
 	${shell} "$upload_general" \
 	|| {
 		echo "upload> ERROR: rsync failed.  To retry later, you can run $upload_general" 1>&2
 		failed=yes
+	}
 else
-	echo "upload> Skipping upload of packages."
+	echo "upload> Skipping upload of non-vulnerable packages."
 	echo "        Run \"$upload_general\" to upload them later."
 fi
 cat <<EOF > "$upload_vulnerable"
 #! /bin/sh
 set -e
 cd "$packages/All"
 rsync $RSFLAGS --files-from="${vulnerable_packages}" --exclude-from="${old_packages}" . "$RSYNC_DST/All/"
 EOF
 chmod +x "$upload_vulnerable"
 if [ "$do_upload" = "yes" ]; then
 	echo "upload> Uploading vulnerable packages"
 	${shell} "$upload_vulnerable" \
 	|| {
 		echo "upload> ERROR: rsync failed.  To retry later, you can run $upload_vulnerable" 1>&2
 		failed=yes
+	}
 else
 	echo "upload> Skipping upload of vulnerable packages."
 	echo "        Run \"$upload_vulnerable\" to upload them later."
 fi
 # clean up temp files
 if [ "$failed,$debug,$do_upload" = "no,no,yes" ]; then
 	rm -fr "$TMP"
 else
 	echo "upload> Preserving temporary directory ${TMP}"
 fi
 if [ "$failed" = "yes" ]; then
 	exit 1
 fi