feat(ca): artifact mirror live — pinned wazuh-agent debs on tsys-ca [#758]

dist/wazuh-agent/4.14.7-1/ (amd64+arm64+armhf) + SHA256SUMS, autoindex
enabled, workstation hash-verified against published manifest.
deploy-agent.sh now installs from the mirror (upstream fallback) and
auto-detects arch. #335: kali-tsys enrolled+active (30 total agents).

Detail: https://projects.knownelement.com/issues/758

ca/artifact-mirror.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+#
+# artifact-mirror.sh — pinned artifact mirror on the tsys-ca webroot [#758]
+#
+# Run ON tsys-ca as root (via tests/remote.sh vm-file):
+#   VM_IP=tsys-ca VM_USER=root bash tests/remote.sh vm-file ca/artifact-mirror.sh
+#
+# Publishes under http://tsys-ca.knel.net/ca/dist/:
+#   dist/wazuh-agent/<ver>/wazuh-agent_<ver>_<arch>.deb   (amd64, arm64, armhf)
+#   dist/wazuh-agent/<ver>/SHA256SUMS
+# and refreshes the top-level MANIFEST.sha256.
+#
+# Fleet rule: agents install from THIS mirror (DNS name), never from the
+# public internet — deploys stop depending on upstream availability and
+# get a stable, pinned, hash-verifiable source. Integrity = SHA256SUMS +
+# the root CA fingerprint recorded on Redmine #697.
+#
+set -euo pipefail
+
+WWW="${WWW:-/var/www/html/ca}"
+WZ_VER="${WZ_VER:-4.14.7-1}"
+UPSTREAM="https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent"
+DEST="$WWW/dist/wazuh-agent/$WZ_VER"
+
+mkdir -p "$DEST"
+cd "$DEST"
+
+for arch in amd64 arm64 armhf; do
+  f="wazuh-agent_${WZ_VER}_${arch}.deb"
+  if [ -s "$f" ]; then
+    echo "have $f"
+  else
+    echo "fetching $f"
+    curl -fSs --retry 2 --max-time 240 -o "$f" "$UPSTREAM/$f"
+  fi
+done
+
+# SHA256SUMS for this directory (regenerated every run — cheap)
+sha256sum -- *.deb > SHA256SUMS.tmp && mv SHA256SUMS.tmp SHA256SUMS
+cat SHA256SUMS
+
+# Top-level manifest rolls up the whole published tree
+cd "$WWW"
+find . -type f ! -name MANIFEST.sha256 -print0 | sort -z \
+  | xargs -0 sha256sum > MANIFEST.sha256.tmp && mv MANIFEST.sha256.tmp MANIFEST.sha256
+echo "top-level MANIFEST.sha256 refreshed ($(wc -l < MANIFEST.sha256) files)"

siem/deploy-agent.sh

@@ -8,11 +8,15 @@ set -euo pipefail
 
 MGR="tsys-wazuh.knel.net"
 VER="4.14.7-1"
+ARCH="$(dpkg --print-architecture)"
+# Pinned mirror on tsys-ca [#758]; upstream fallback if the mirror is down
+MIRROR="http://tsys-ca.knel.net/ca/dist/wazuh-agent/${VER}/wazuh-agent_${VER}_${ARCH}.deb"
+UPSTREAM="https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_${VER}_${ARCH}.deb"
 
 if ! dpkg -s wazuh-agent >/dev/null 2>&1; then
-  echo "installing wazuh-agent $VER (manager: $MGR)"
-  curl -sSf --max-time 120 -o /tmp/wazuh-agent.deb \
-    "https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_${VER}_amd64.deb"
+  echo "installing wazuh-agent $VER ($ARCH; manager: $MGR)"
+  curl -sSf --max-time 120 -o /tmp/wazuh-agent.deb "$MIRROR" \
+    || curl -sSf --max-time 120 -o /tmp/wazuh-agent.deb "$UPSTREAM"
   WAZUH_MANAGER="$MGR" WAZUH_REGISTRATION_SERVER="$MGR" \
     DEBIAN_FRONTEND=noninteractive dpkg -i /tmp/wazuh-agent.deb
   rm -f /tmp/wazuh-agent.deb