patch: assume that only src/ files are patchable

To this end sanitise the patch before storing it.  While
here, also add a few notes in the manual page.

patch/opnsense-patch.8

@@ -24,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd February 11, 2019
+.Dd February 25, 2019
 .Dt OPNSENSE-PATCH 8
 .Os
 .Sh NAME
@@ -61,6 +61,15 @@ results visible.
 Patches can also be reversed by reapplying them, but multiple
 patches must be given in reverse order to succeed.
 .Pp
+A preprocess run will remove repository meta data file changes
+and only keep file modifications inside the
+.Pa src
+directory.
+A postprocess run will retain file permissions which are stored
+inside a special format in
+.Xr git 1
+patches.
+.Pp
 The options are as follows:
 .Bl -tag -width ".Fl c Ar repo_default" -offset indent
 .It Fl a Ar account
@@ -78,6 +87,9 @@ and
 Download the requested patch, but do not apply it.
 .It Fl e
 Remove all patches stored in the cache directory.
+Note this will ignore the
+.Sq Fl r
+option and instead delete patches from all repositories immediately.
 .It Fl f
 Force a fetch of the patch to be applied even when it is
 already stored in the cache directory.

patch/opnsense-patch.sh

@@ -109,6 +109,11 @@ done
 
 shift $((${OPTIND} - 1))
 
+if [ ${PATCHLEVEL} -lt 2 ]; then
+	echo "Patch level must be >= 2." >&2
+	exit 1
+fi
+
 mkdir -p ${CACHEDIR}
 
 patch_load()
@@ -179,32 +184,59 @@ for ARG in ${@}; do
 
 	WANT="${REPOSITORY}-${ARG}"
 
-	fetch ${DO_INSECURE} -q -o "${CACHEDIR}/${WANT}" \
+	fetch ${DO_INSECURE} -q -o "${CACHEDIR}/~${WANT}" \
 	    "${SITE}/${ACCOUNT}/${REPOSITORY}/commit/${ARG}.patch"
 
-	if [ ! -s "${CACHEDIR}/${WANT}" ]; then
+	if [ ! -s "${CACHEDIR}/~${WANT}" ]; then
-		rm -f "${CACHEDIR}/${WANT}"
+		rm -f "${CACHEDIR}/~${WANT}"
 		echo "Failed to fetch: ${ARG}" >&2
 		exit 1
 	fi
 
+	DISCARD=
+
+	while IFS= read -r PATCHLINE; do
+		case "${PATCHLINE}" in
+		"diff --git a/"*" b/"*)
+			PATCHFILE="$(echo "${PATCHLINE}" | awk '{print $4 }')"
+			for INDEX in $(seq 2 ${PATCHLEVEL}); do
+				PATCHFILE=${PATCHFILE#*/}
+			done
+			if [ -n "${PATCHFILE##src/*}" ]; then
+				DISCARD=1
+			else
+				DISCARD=
+			fi
+			;;
+		esac
+
+		if [ -n "${DISCARD}" ]; then
+			continue
+		fi
+
+		echo "${PATCHLINE}" >> "${CACHEDIR}/${WANT}"
+	done < "${CACHEDIR}/~${WANT}"
+
 	echo "Fetched ${ARG} via ${SITE}/${ACCOUNT}/${REPOSITORY}"
 
 	ARGS="${ARGS} ${WANT}"
 done
 
+rm -f ${CACHEDIR}/~*
+
 if [ -n "${DO_DOWNLOAD}" ]; then
 	ARGS=
 fi
 
 for ARG in ${ARGS}; do
+	# XXX from here we could figure out if we will run in reverse...
 	if ! patch ${DO_FORWARD} -sCE -p ${PATCHLEVEL} -d "${PREFIX}" -i "${CACHEDIR}/${ARG}"; then
 		exit 1
 	fi
 
 	patch ${DO_FORWARD} -E -p ${PATCHLEVEL} -d "${PREFIX}" -i "${CACHEDIR}/${ARG}"
 
-	cat "${CACHEDIR}/${ARG}" | while read PATCHLINE; do
+	while IFS= read -r PATCHLINE; do
 		case "${PATCHLINE}" in
 		"diff --git a/"*" b/"*)
 			PATCHFILE="$(echo "${PATCHLINE}" | awk '{print $4 }')"
@@ -231,7 +263,7 @@ for ARG in ${ARGS}; do
 			fi
 			;;
 		esac
-	done
+	done < "${CACHEDIR}/${ARG}"
 done
 
 if [ -n "${ARGS}" ]; then