From 9f2a80f818b13380f9ef6a512262b9b8ef28056f Mon Sep 17 00:00:00 2001
Message-Id: <9f2a80f818b13380f9ef6a512262b9b8ef28056f.1391582441.git.hahn@univention.de>
From: Philipp Hahn <hahn@univention.de>
Date: Tue, 4 Feb 2014 17:02:01 +0100
Subject: [PATCH] Bug #33189: Updater: Fix evaluation of univentionUpdateActive
Organization: Univention GmbH, Bremen, Germany

Only evaluate the --updateto argument when univentionUpdateActive is
TRUE.

Only write the message id the updater is run.

Move the evaluation of the policy before the check for updates, so
univention-maintenance get really disabled when neither on-start nor
on-shutdown are set. There's still the separate Cron-job configurable
through UCRV update/check/{cron,boot}/{enable,debug,entry}, which does
the correct thing by calling univention-updater-check.
---
 .../conffiles/etc/cron.d/univention-updater-check  |  21 +-
 .../univention-updater/debian/ucslint.overrides    |   1 +
 .../univention-updater.univention-maintenance.init | 348 +++++++++++----------
 .../univention-policy-maintenance                  | 200 ++++++++----
 4 files changed, 327 insertions(+), 243 deletions(-)

diff --git a/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/conffiles/etc/cron.d/univention-updater-check b/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/conffiles/etc/cron.d/univention-updater-check
index 8e6c516..5303f73 100644
--- a/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/conffiles/etc/cron.d/univention-updater-check
+++ b/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/conffiles/etc/cron.d/univention-updater-check
@@ -3,19 +3,12 @@
 PATH=/usr/sbin:/usr/bin:/sbin:/bin
 
 @!@
-disabled = ''
-debug = ''
-if not configRegistry.is_true('update/check/cron/enabled', False):
-        disabled = '# '
-if not configRegistry.get('update/check/cron/debug','no').lower() in ('yes','true','enabled','1','2','3','4'):
-        debug = '2> /dev/null > /dev/null'
-print '%s%s   root   [ -x /usr/share/univention-updater/univention-updater-check ] && /usr/sbin/jitter 600 /usr/share/univention-updater/univention-updater-check %s' % (disabled, configRegistry.get('update/check/cron/entry', '5 * * * *'), debug)
+def check_update(key, cron):
+	BIN = "/usr/share/univention-updater/univention-updater-check"
+	disabled = '# ' if not configRegistry.is_true('update/check/%s/enabled' % key, False) else ''
+	debug = ' 2>/dev/null >/dev/null' if configRegistry.get('update/check/%s/debug' % key, 'no').lower() not in ('yes','true','enabled','1','2','3','4') else ''
+	print '%(disabled)s%(cron)s   root   [ -x %(BIN)s ] && /usr/sbin/jitter 600 %(BIN)s%(debug)s' % locals()
 
-disabled = ''
-debug = ''
-if not configRegistry.is_true('update/check/boot/enabled', False):
-        disabled = '# '
-if not configRegistry.get('update/check/boot/debug','no').lower() in ('yes','true','enabled','1','2','3','4'):
-        debug = '2> /dev/null > /dev/null'
-print '%s@reboot   root   [ -x /usr/share/univention-updater/univention-updater-check ] && /usr/sbin/jitter 30 /usr/share/univention-updater/univention-updater-check %s' % (disabled, debug)
+check_update("cron", configRegistry.get('update/check/cron/entry', '5 * * * *'))
+check_update("boot", "@reboot")
 @!@
diff --git a/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/debian/ucslint.overrides b/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/debian/ucslint.overrides
index 5196568..64b89e2 100644
--- a/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/debian/ucslint.overrides
+++ b/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/debian/ucslint.overrides
@@ -2,3 +2,4 @@
 0010-2:tests/test_mirror.py
 0010-2:tests/mockups.py
 0011-14: debian/univention-updater.univention-maintenance.init
+0004-12: conffiles/etc/cron.d/univention-updater-check
diff --git a/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/debian/univention-updater.univention-maintenance.init b/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/debian/univention-updater.univention-maintenance.init
index 70b5d10..22f00ae 100644
--- a/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/debian/univention-updater.univention-maintenance.init
+++ b/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/debian/univention-updater.univention-maintenance.init
@@ -33,6 +33,127 @@
 . /lib/lsb/init-functions
 LOG="/var/log/univention/updater.log"
 
+issue_warning () {
+	local ttyname="$1" warning_message=
+	warning_message+="\n\r"
+	warning_message+="${color[1]}"
+	if echo $update_warning_lang | egrep -qi '^de$|^ger'; then
+		warning_message+="!!!!!!!!!! Achtung\n\r"
+		warning_message+="!!!!!!!!!! die Aktualisierung des Systems kann je nach\n\r"
+		warning_message+="!!!!!!!!!! Umfang der Pakete eine lange Zeit in Anspruch\n\r"
+		warning_message+="!!!!!!!!!! nehmen.\n\r"
+		warning_message+="!!!!!!!!!!\n\r"
+		case "$(/sbin/runlevel)" in
+		*2)
+			warning_message+="!!!!!!!!!! Das System setzt den Startvorgang nach\n\r"
+			warning_message+="!!!!!!!!!! der Aktualisierung fort.\n\r"
+			;;
+		*0)
+			warning_message+="!!!!!!!!!! Schalten Sie das System erst aus, wenn die\n\r"
+			warning_message+="!!!!!!!!!! Ausgabe \"System halted!\" erscheint.\n\r"
+			warning_message+="!!!!!!!!!! Die meisten Systeme schalten sich\n\r"
+			warning_message+="!!!!!!!!!! selbstständig aus.\n\r"
+			;;
+		*6)
+			warning_message+="!!!!!!!!!! Das System wird nach der Aktualisierung\n\r"
+			warning_message+="!!!!!!!!!! automatisch neu gestartet.\n\r"
+			;;
+		esac
+	else
+		warning_message+="!!!!!!!!!! Warning\n\r"
+		warning_message+="!!!!!!!!!! The update process might take a\n\r"
+		warning_message+="!!!!!!!!!! considerable amount of time depending on the\n\r"
+		warning_message+="!!!!!!!!!! number and size of installed packages.\n\r"
+		warning_message+="!!!!!!!!!!\n\r"
+		warning_message+="!!!!!!!!!! Do not switch off the system before\n\r"
+		warning_message+="!!!!!!!!!! update is completely finished.\n\r"
+		case "$(/sbin/runlevel)" in
+		*2)
+			warning_message+="!!!!!!!!!! System boot will continue after\n\r"
+			warning_message+="!!!!!!!!!! update is finished.\n\r"
+			;;
+		*0)
+			warning_message+="!!!!!!!!!! System can be safely switched off when\n\r"
+			warning_message+="!!!!!!!!!! \"System halted!\" is displayed.\n\r"
+			warning_message+="!!!!!!!!!! Most modern systems switch off\n\r"
+			warning_message+="!!!!!!!!!! automatically.\n\r"
+			;;
+		*6)
+			warning_message+="!!!!!!!!!! System will reboot automatically\n\r"
+			warning_message+="!!!!!!!!!! after update finished.\n\r"
+			;;
+		esac
+	fi
+	warning_message+="${color[0]}"
+	warning_message+="\n\r"
+
+	echo -e "$down" > "$ttyname"
+	echo -e "$warning_message" > "$ttyname"
+}
+
+run_silent_update () {
+	dmesg -n 1
+	trap "dmesg -n 8" EXIT
+	run_update "$@"
+}
+
+run_update () {
+	eval "$(univention-config-registry shell)"
+	reset_reboot
+	setup_colour
+	check_reachability || return 1
+	check_policy "$@" || return 1
+	check_for_updates || return 1
+	run_update_with_warning
+}
+
+reset_reboot () {
+	if [ -n "$update_reboot_required" ]; then
+		univention-config-registry unset update/reboot/required >/dev/null 2>&1
+	fi
+}
+
+setup_colour () {
+	color=("" "" "")
+	if echo "$update_warning_coloured" | egrep -i 'yes|true' >/dev/null 2>&1; then
+		color=("\033[0m" "\033[31;1m" "\033[32;1m")
+	fi
+	down="\033[5B"
+	clear="\033[2J"
+}
+
+check_reachability () {
+	log_action_begin_msg "Checking network for Univention maintenance"
+	check_reachability_ldap &&
+		check_reachability_repository
+	log_action_end_msg $?
+}
+check_reachability_ldap () {
+	log_action_cont_msg "ldap[$ldap_server_name]"
+	ldap_server_port=${ldap_server_port:-7389}
+	if ! netcat -q0 -w4 "$ldap_server_name" $ldap_server_port </dev/null >/dev/null 2>&1
+	then
+		return 1
+	fi
+}
+check_reachability_repository () {
+	local repository_server
+	if [ -n "$proxy_http" ]
+	then
+		repository_server="${proxy_http#http://}"
+		repository_server="${repository_server%:*}" # strip port
+		repository_server="${repository_server##*@}" # strip login information
+		log_action_cont_msg "proxy[${repository_server}]"
+	else
+		repository_server="$repository_online_server"
+		log_action_cont_msg "repository[$repository_server]"
+	fi
+	if ! ping -c 1 "$repository_server" >/dev/null 2>&1
+	then
+		return 1
+	fi
+}
+
 check_policy () {
 	eval "$(univention_policy_result -D "$ldap_hostdn" -y /etc/machine.secret -s "$ldap_hostdn")"
 	case "$1" in
@@ -43,181 +164,84 @@ check_policy () {
 	esac
 }
 
-case "$1" in
-	start|restart|stop)
-
-		log_action_begin_msg "Checking network for Univention maintenance"
-
-		dmesg -n 1
-		eval "$(univention-config-registry shell)"
+check_for_updates () {
+	local upd_local upd_net actualise
+	if [ "$local_repository" = "yes" -o "$local_repository" = "true" ]; then
+		mode="local"
+		/usr/share/univention-updater/univention-updater local --silent --check >/dev/null 2>&1
+		upd_local=$?
+	else
+		mode="net"
+		upd_local=0
+	fi
+	/usr/share/univention-updater/univention-updater net --silent --check >/dev/null 2>&1
+	upd_net=$?
+	/usr/share/univention-updater/univention-actualise --dist-upgrade --silent --check >/dev/null 2>&1
+	actualise=$?
+
+	if [ "${upd_local}${upd_net}${actualise}" = 000 ]; then
+		echo -e "${color[2]}Nothing to do for Univention Updater.${color[0]}"
+		exit 0
+	fi
+}
 
-		# clean up updater settings
-		if [ -n "$update_reboot_required" ]; then
-			univention-config-registry unset update/reboot/required >/dev/null 2>&1
+run_update_with_warning () {
+	local LOCKFILE="/var/lock/univention-maintenance_$RANDOM" tty
+
+	if echo "$update_warning" | egrep -i 'yes|true' >/dev/null 2>&1; then
+		if [ -n "$update_warning_tty" ]; then
+			touch "$LOCKFILE"
+			while [ -f "$LOCKFILE" ]; do
+				for tty in $update_warning_tty
+				do
+					if [ -c "$tty" ]; then
+						issue_warning "$tty"
+					fi
+				done
+				sleep 2
+			done &
+			sleep 4
 		fi
 
-		log_action_cont_msg "ldap[$ldap_server_name]"
-		ldap_server_port=${ldap_server_port:-7389}
-		if ! netcat -q0 -w4 "$ldap_server_name" $ldap_server_port </dev/null >/dev/null 2>&1
-		then
-			log_action_end_msg 1
-			exit 1
-		fi
-		if [ -n "$proxy_http" ]
-		then
-			repository_server="${proxy_http#http://}"
-			repository_server="${repository_server%:*}" # strip port
-			repository_server="${repository_server##*@}" # strip login information
-			log_action_cont_msg "proxy[${repository_server}]"
-		else
-			repository_server="$repository_online_server"
-			log_action_cont_msg "repository[$repository_server]"
+		if [ -c "$SSH_TTY" ]; then
+			issue_warning "$SSH_TTY"
 		fi
-		if ! ping -c 1 "$repository_server" >/dev/null 2>&1
-		then
-			log_action_end_msg 1
-			exit 1
-		fi
-		log_action_end_msg 0
+	else
+		echo -e "${color[1]}Univention Updater is updating the system.${color[0]}"
+	fi
 
-		check_policy "$1" || exit 0
+	call_updater_scripts
 
-		colourstart=""
-		colourend=""
-		if echo $update_warning_coloured | egrep -i 'yes|true' >/dev/null 2>&1; then
-			colourstart="\033[31;1m"
-			colourend="\033[0m"
-		fi
-		down="\033[5B"
-		clear="\033[2J"
-
-
-		function issue_warning () {
-			ttyname="$1"
-			warning_message=""
-			warning_message="$warning_message\n\r"
-			warning_message="$warning_message$colourstart"
-			if echo $update_warning_lang | egrep -i '^de$|^ger' > /dev/null 2>&1; then
-				warning_message="$warning_message!!!!!!!!!! Achtung\n\r"
-				warning_message="$warning_message!!!!!!!!!! die Aktualisierung des Systems kann je nach\n\r"
-				warning_message="$warning_message!!!!!!!!!! Umfang der Pakete eine lange Zeit in Anspruch\n\r"
-				warning_message="$warning_message!!!!!!!!!! nehmen.\n\r"
-				warning_message="$warning_message!!!!!!!!!!\n\r"
-				if /sbin/runlevel | grep '2$' > /dev/null 2>&1; then
-					warning_message="$warning_message!!!!!!!!!! Das System setzt den Startvorgang nach\n\r"
-					warning_message="$warning_message!!!!!!!!!! der Aktualisierung fort.\n\r"
-				elif /sbin/runlevel | grep '0$'> /dev/null 2>&1; then
-					warning_message="$warning_message!!!!!!!!!! Schalten Sie das System erst aus, wenn die\n\r"
-					warning_message="$warning_message!!!!!!!!!! Ausgabe \"System halted!\" erscheint.\n\r"
-					warning_message="$warning_message!!!!!!!!!! Die meisten Systeme schalten sich\n\r"
-					warning_message="$warning_message!!!!!!!!!! selbstständig aus.\n\r"
-				elif /sbin/runlevel | grep '6$'> /dev/null 2>&1; then
-					warning_message="$warning_message!!!!!!!!!! Das System wird nach der Aktualisierung\n\r"
-					warning_message="$warning_message!!!!!!!!!! automatisch neu gestartet.\n\r"
-				fi
-			else
-				warning_message="$warning_message!!!!!!!!!! Warning\n\r"
-				warning_message="$warning_message!!!!!!!!!! The update process might take a\n\r"
-				warning_message="$warning_message!!!!!!!!!! considerable amount of time depending on the\n\r"
-				warning_message="$warning_message!!!!!!!!!! number and size of installed packages.\n\r"
-				warning_message="$warning_message!!!!!!!!!!\n\r"
-				warning_message="$warning_message!!!!!!!!!! Do not switch off the system before\n\r"
-				warning_message="$warning_message!!!!!!!!!! update is completely finished.\n\r"
-				if /sbin/runlevel | grep '2$' > /dev/null 2>&1; then
-					warning_message="$warning_message!!!!!!!!!! System boot will continue after\n\r"
-					warning_message="$warning_message!!!!!!!!!! update is finished.\n\r"
-				elif /sbin/runlevel | grep '0$'> /dev/null 2>&1; then
-					warning_message="$warning_message!!!!!!!!!! System can be safely switched off when\n\r"
-					warning_message="$warning_message!!!!!!!!!! \"System halted!\" is displayed.\n\r"
-					warning_message="$warning_message!!!!!!!!!! Most modern systems switch off\n\r"
-					warning_message="$warning_message!!!!!!!!!! automatically.\n\r"
-				elif /sbin/runlevel | grep '6$'> /dev/null 2>&1; then
-					warning_message="$warning_message!!!!!!!!!! System will reboot automatically\n\r"
-					warning_message="$warning_message!!!!!!!!!! after update finished.\n\r"
-
-				fi
-			fi
-			warning_message="$warning_message$colourend"
-			warning_message="$warning_message\n\r"
-
-			echo -e "$down" > "$ttyname"
-			echo -e "$warning_message" > "$ttyname"
-		}
-
-		if [ "$local_repository" = "yes" -o "$local_repository" = "true" ]; then
-			mode="local"
-			/usr/share/univention-updater/univention-updater local --silent --check >/dev/null 2>&1
-			upd_local=$?
-		else
-			mode="net"
-			upd_local=0
-		fi
-		/usr/share/univention-updater/univention-updater net --silent --check >/dev/null 2>&1
-		upd_net=$?
-		/usr/share/univention-updater/univention-actualise --dist-upgrade --silent --check >/dev/null 2>&1
-		actualise=$?
-
-		if [ "$upd_local$upd_net$actualise" = 000 ]; then
-			if echo $update_warning_coloured | egrep -i 'yes|true' >/dev/null 2>&1; then
-				echo -e "\033[32;1mNothing to do for Univention Updater.\033[0m"
-			else
-				echo "Nothing to do for Univention Updater."
-			fi
-			exit 0
-		fi
+	if [ -f "$LOCKFILE" ]; then
+		rm "$LOCKFILE"
+	fi
+}
 
-		LOCKFILE="/var/lock/univention-maintenance_$RANDOM"
-
-		if echo $update_warning | egrep -i 'yes|true' >/dev/null 2>&1; then
-			if [ -n "$update_warning_tty" ]; then
-				touch "$LOCKFILE"
-				while [ -f "$LOCKFILE" ]; do
-					for tty in $update_warning_tty
-					do
-						if [ -c "$tty" ]; then
-							issue_warning "$tty"
-						fi
-					done
-					sleep 2
-				done &
-				sleep 4
-			fi
-
-			if [ -c "$SSH_TTY" ]; then
-				issue_warning "$SSH_TTY"
-			fi
+call_updater_scripts () {
+	if [ "$univentionUpdateActivate" = "TRUE" ]
+	then
+		if [ -n "$univentionUpdateVersion" ]
+		then
+			log_action_msg "Starting Univention Updater [$univentionUpdateVersion]"
+			/usr/share/univention-updater/univention-updater "$mode" --noninteractive --updateto "$univentionUpdateVersion" >>"$LOG" 2>&1
 		else
-			if echo $update_warning_coloured | egrep -qi 'yes|true'; then
-				echo -e "\033[31;1m""Univention Updater is updating the system.\033[0m"
-			else
-				echo "Univention Updater is updating the system."
-			fi
+			log_action_msg "Starting Univention Updater"
+			/usr/share/univention-updater/univention-updater "$mode" --noninteractive >>"$LOG" 2>&1
 		fi
+		log_action_cont_msg " Univention Actualise"
+	else:
+		log_action_msg "Starting Univention Actualise"
+	fi
 
-				if [ "$univentionUpdateActivate" = "TRUE" ]
-				then
-					if [ -n "$univentionUpdateVersion" ]
-					then
-						log_action_msg "Starting Univention Updater [$univentionUpdateVersion]"
-						/usr/share/univention-updater/univention-updater "$mode" --noninteracive --updateto "$univentionUpdateVersion" >>"$LOG" 2>&1
-					else
-						log_action_msg "Starting Univention Updater"
-						/usr/share/univention-updater/univention-updater "$mode" --noninteracive >>"$LOG" 2>&1
-					fi
-					log_action_cont_msg " Univention Actualise"
-				else
-					log_action_msg "Starting Univention Actualise"
-				fi
-
-				/usr/share/univention-updater/univention-actualise --dist-upgrade --silent >>"$LOG" 2>&1
+	/usr/share/univention-updater/univention-actualise --dist-upgrade --silent >>"$LOG" 2>&1
 
-		if [ -f "$LOCKFILE" ]; then
-			rm "$LOCKFILE"
-		fi
+	log_action_end_msg 0
+}
 
-		log_action_end_msg 0
-		dmesg -n 8
 
+case "$1" in
+	start|restart|stop)
+		run_silent_update "$@"
 		;;
 	*)
 		echo "Usage: /etc/init.d/univention-maintenance {start|stop|restart}"
diff --git a/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/univention-directory-policy/univention-policy-maintenance b/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/univention-directory-policy/univention-policy-maintenance
index b1c6c91..aea0724 100755
--- a/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/univention-directory-policy/univention-policy-maintenance
+++ b/branches/ucs-3.2/ucs-3.2-0/base/univention-updater/univention-directory-policy/univention-policy-maintenance
@@ -31,71 +31,137 @@
 # /usr/share/common-licenses/AGPL-3; if not, see
 # <http://www.gnu.org/licenses/>.
 
-import os, string, sys
+import os
+import sys
 import subprocess
-import univention.config_registry
-
-# Name of the cron.d file
-CRON_D='/etc/cron.d/univention-maintenance'
-
-def write_cron_job(configRegistry, cron, updateto, reboot, try_release_update):
-	file=open(CRON_D, 'w')
-	file.write('# cron job for update\n')
-	file.write('PATH=/sbin:/usr/sbin:/usr/bin:/bin\n')
-	if cron != '* * * * * ':
-		file.write('%s root ' % cron)
-		if configRegistry.is_true( 'local/repository' ):
-			target='local'
-		else:
-			target='net'
-		if updateto:
-			updateto='--updateto=%s' % updateto
-		if reboot:
-			reboot='--reboot=%s' % reboot
-		file.write('/usr/sbin/jitter 600 ')
-		if try_release_update:
-			file.write('/usr/share/univention-updater/univention-updater %s %s %s --silent --noninteractive; ' % (target, updateto, reboot))
-		file.write('/usr/share/univention-updater/univention-actualise --dist-upgrade --silent\n')
-	file.close()
-
-
-configRegistry = univention.config_registry.ConfigRegistry()
-configRegistry.load()
-
-if os.path.exists(CRON_D):
-	os.unlink(CRON_D)
-
-ldap_hostdn = configRegistry.get('ldap/hostdn')
-if ldap_hostdn:
-
-	p1 = subprocess.Popen(['univention_policy_result', '-D', ldap_hostdn, '-y', '/etc/machine.secret', '-s', ldap_hostdn], stdout=subprocess.PIPE)
-
-	updateto=''
-	cron_active=''
-	reboot=''
-	cron=None
-	try_release_update = False
-
-	for line in p1.stdout:
-		line=line.strip(' ').strip('\n')
-		key, value = line.split('=', 1)
-		if line.startswith('univentionCronActive='):
-			cron_active=line.replace('univentionCronActive=', '').replace('"','')
-		elif line.startswith('univentionCron='):
-			cron=line.replace('univentionCron=', '').replace('"','')
-		elif line.startswith('univentionUpdateVersion='):
-			updateto=line.replace('univentionUpdateVersion=', '').replace('"','')
-		elif line.startswith('univentionInstallationReboot='):
-			reboot=line.replace('univentionInstallationReboot=', '').replace('"','')
-		elif 'univentionUpdateActive' == key:
-			try_release_update = value == "TRUE"
-
-	if p1.wait() != 0:
-		print 'failed to execute univention_policy_result'
-		sys.exit(p1.returncode)
-
-	if cron_active and cron_active == '1':
-		if cron:
-			write_cron_job(configRegistry, cron, updateto, reboot, try_release_update)
-
-sys.exit(0)
+from univention.config_registry import ConfigRegistry
+
+
+class UpdaterPolicy(dict):
+	@property
+	def cron_active(self):
+		return self.get("univentionCronActive") == "1"
+
+	@property
+	def cron(self):
+		return self.get("univentionCron")
+
+	@property
+	def release_version(self):
+		return self.get("univentionUpdateVersion")
+
+	@property
+	def relese_active(self):
+		return self.get("univentionUpdateActivate") == "TRUE"
+
+	@property
+	def reboot(self):
+		return self.get("univentionInstallationReboot")
+
+	def fetch(self, ldap_hostdn):
+		cmd = (
+			'univention_policy_result',
+			'-D', ldap_hostdn,
+			'-y', '/etc/machine.secret',
+			'-s', ldap_hostdn,
+		)
+		proc = subprocess.Popen(cmd, stdout=subprocess.PIPE)
+		for line in proc.stdout:
+			line = line.strip()
+			key, value = line.split('=', 1)
+			self[key] = value[1:-1] if value[0] == value[-1] == '"' else value
+		if proc.wait() != 0:
+			print >> sys.stderr, 'failed to execute univention_policy_result'
+			sys.exit(proc.returncode)
+
+
+class UniventionUpdaterPolicy(object):
+	CRON_D = '/etc/cron.d/univention-maintenance'
+
+	def __init__(self):
+		self.ucr = ConfigRegistry()
+		self.ucr.load()
+		self.ldap_hostdn = self.ucr.get('ldap/hostdn')
+		self.policy = UpdaterPolicy()
+
+	def main(self):
+		self.remove_previous_cron()
+		if self.ldap_hostdn:
+			self.process_host()
+		sys.exit(0)
+
+	def remove_previous_cron(self):
+		if os.path.exists(self.CRON_D):
+			os.unlink(self.CRON_D)
+
+	def process_host(self):
+		self.fetch_policy()
+
+		if not self.policy.cron_active:
+			return
+		if not self.valid_cron():
+			return
+
+		self.write_cron_job()
+
+	def fetch_policy(self):
+		self.policy.fetch(self.ldap_hostdn)
+
+	def valid_cron(self):
+		if not self.policy.cron:
+			return False
+		if self.policy.cron == '* * * * * ':
+			return False
+		return True
+
+	def append_to(self, args, prefix, key):
+		value = self.policy[key]
+		if value:
+			args.append(prefix)
+			args.append(value)
+
+	def write_cron_job(self):
+		with open(self.CRON_D, 'w') as cron_file:
+			cron_file.write('# cron job for update\n')
+			cron_file.write('PATH=/sbin:/usr/sbin:/usr/bin:/bin\n')
+			cron_file.write('%s root %s\n' % (self.policy.cron, self.command()))
+
+	def command(self):
+		cmd = self.jitter_command()
+		if self.policy.relese_active:
+			cmd.extend(self.update_command())
+			cmd.append(";")
+		cmd.extend(self.actualise_command())
+		return " ".join(cmd)
+
+	def jitter_command(self):
+		cmd = [
+			"/usr/sbin/jitter",
+			"600",
+		]
+		return cmd
+
+	def update_command(self):
+		cmd = [
+			'/usr/share/univention-updater/univention-updater',
+			'--noninteractive',
+			'--silent',
+		]
+		if self.policy.release_version:
+			cmd.extend(("--updateto", self.policy.release_version))
+		if self.policy.reboot:
+			cmd.extend(("--reboot", self.policy.reboot))
+		cmd.append('local' if self.ucr.is_true('local/repository') else 'net')
+		return cmd
+
+	def actualise_command(self):
+		cmd = [
+			"/usr/share/univention-updater/univention-actualise",
+			"--dist-upgrade",
+			"--silent",
+		]
+		return cmd
+
+
+if __name__ == '__main__':
+	UniventionUpdaterPolicy().main()
-- 
1.8.5.3