From 1c895ed435d9c1b4cc223a7bc59c70abc01d87a9 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Thu, 5 Aug 2021 09:34:59 +0200
Subject: [PATCH] firmware: also check plugins for up to date core pkg #5136

---
 src/opnsense/scripts/firmware/sync.subr.sh | 24 +++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/src/opnsense/scripts/firmware/sync.subr.sh b/src/opnsense/scripts/firmware/sync.subr.sh
index 9c4472c0d..b9992cd48 100755
--- a/src/opnsense/scripts/firmware/sync.subr.sh
+++ b/src/opnsense/scripts/firmware/sync.subr.sh
@@ -25,12 +25,30 @@
 # POSSIBILITY OF SUCH DAMAGE.
 
 LOCKFILE=/tmp/pkg_upgrade.progress
+MUSTCHECK=yes
 
-PACKAGES=$(/usr/local/sbin/pluginctl -g system.firmware.plugins | /usr/bin/sed 's/,/ /g')
-for PACKAGE in ${PACKAGES}; do
+for PACKAGE in $(/usr/local/sbin/pluginctl -g system.firmware.plugins | \
+    /usr/bin/sed 's/,/ /g'); do
 	if ! pkg query %n ${PACKAGE} > /dev/null; then
+		if [ -n "${MUSTCHECK}" ] ; then
+			COREPKG=$(opnsense-version -n)
+			COREVER=$(opnsense-version -v)
+			REPOVER=$(pkg rquery %v ${COREPKG})
+
+			# plugins must pass a version check on up-to-date core package
+			if [ "$(pkg version -t ${COREVER} ${REPOVER})" = "<" ]; then
+				echo "Installation out of date. The update to ${COREPKG}-${REPOVER} is required." >> ${LOCKFILE} 2>&1
+				break
+			fi
+
+			MUSTCHECK=
+		fi
+
 		pkg install -y ${PACKAGE} >> ${LOCKFILE} 2>&1
 		/usr/local/opnsense/scripts/firmware/register.php install ${PACKAGE} >> ${LOCKFILE} 2>&1
 	fi
 done
-pkg autoremove -y >> ${LOCKFILE} 2>&1
+
+if [ -z "${MUSTCHECK}" ]; then
+	pkg autoremove -y >> ${LOCKFILE} 2>&1
+fi