From fc5536732bcbaf8817a344a45222a73fc7b570c6 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Wed, 1 Nov 2023 14:59:28 +0100
Subject: [PATCH] firmware: record packages state for update reboot check for
 #6940

This way we can see if something changed and reboot if "always
reboot" is required.  We do the first hash unconditionally because
it's fast and maybe we can use this for other purposes as well.
---
 src/opnsense/scripts/firmware/update.sh | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/opnsense/scripts/firmware/update.sh b/src/opnsense/scripts/firmware/update.sh
index 3c747ae29..bff139c27 100755
--- a/src/opnsense/scripts/firmware/update.sh
+++ b/src/opnsense/scripts/firmware/update.sh
@@ -50,8 +50,9 @@ if [ "${SUFFIX}" = "-" ]; then
 	SUFFIX=
 fi
 
-# read reboot flag
+# read reboot flag and record current package name and version state
 ALWAYS_REBOOT=$(/usr/local/sbin/pluginctl -g system.firmware.reboot)
+PKGS_HASH=$(pkg query %n-%v 2> /dev/null | sha256)
 
 # upgrade all packages if possible
 (opnsense-update ${DO_FORCE} -pt "opnsense${SUFFIX}" 2>&1) | ${TEE} ${LOCKFILE}
@@ -76,9 +77,11 @@ if opnsense-update ${DO_FORCE} -bk -c > ${PIPEFILE} 2>&1; then
 fi
 
 if [ -n "${ALWAYS_REBOOT}" ]; then
-	echo '***REBOOT***' >> ${LOCKFILE}
-	sleep 5
-	/usr/local/etc/rc.reboot
+	if [ "${PKGS_HASH}" != "$(pkg query %n-%v 2> /dev/null | sha256)" ]; then
+		echo '***REBOOT***' >> ${LOCKFILE}
+		sleep 5
+		/usr/local/etc/rc.reboot
+	fi
 fi
 
 echo '***DONE***' >> ${LOCKFILE}