feat(ca): artifact mirror live — pinned wazuh-agent debs on tsys-ca [#758]

dist/wazuh-agent/4.14.7-1/ (amd64+arm64+armhf) + SHA256SUMS, autoindex enabled, workstation hash-verified against published manifest. deploy-agent.sh now installs from the mirror (upstream fallback) and auto-detects arch. #335: kali-tsys enrolled+active (30 total agents). Detail: https://projects.knownelement.com/issues/758
2026-09-03 13:25:28 -05:00
parent e27e3a06b8
commit 1620351028
2 changed files with 53 additions and 3 deletions
@@ -0,0 +1,46 @@
+#!/bin/bash
+#
+# artifact-mirror.sh — pinned artifact mirror on the tsys-ca webroot [#758]
+#
+# Run ON tsys-ca as root (via tests/remote.sh vm-file):
+#   VM_IP=tsys-ca VM_USER=root bash tests/remote.sh vm-file ca/artifact-mirror.sh
+#
+# Publishes under http://tsys-ca.knel.net/ca/dist/:
+#   dist/wazuh-agent/<ver>/wazuh-agent_<ver>_<arch>.deb   (amd64, arm64, armhf)
+#   dist/wazuh-agent/<ver>/SHA256SUMS
+# and refreshes the top-level MANIFEST.sha256.
+#
+# Fleet rule: agents install from THIS mirror (DNS name), never from the
+# public internet — deploys stop depending on upstream availability and
+# get a stable, pinned, hash-verifiable source. Integrity = SHA256SUMS +
+# the root CA fingerprint recorded on Redmine #697.
+#
+set -euo pipefail
+
+WWW="${WWW:-/var/www/html/ca}"
+WZ_VER="${WZ_VER:-4.14.7-1}"
+UPSTREAM="https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent"
+DEST="$WWW/dist/wazuh-agent/$WZ_VER"
+
+mkdir -p "$DEST"
+cd "$DEST"
+
+for arch in amd64 arm64 armhf; do
+  f="wazuh-agent_${WZ_VER}_${arch}.deb"
+  if [ -s "$f" ]; then
+    echo "have $f"
+  else
+    echo "fetching $f"
+    curl -fSs --retry 2 --max-time 240 -o "$f" "$UPSTREAM/$f"
+  fi
+done
+
+# SHA256SUMS for this directory (regenerated every run — cheap)
+sha256sum -- *.deb > SHA256SUMS.tmp && mv SHA256SUMS.tmp SHA256SUMS
+cat SHA256SUMS
+
+# Top-level manifest rolls up the whole published tree
+cd "$WWW"
+find . -type f ! -name MANIFEST.sha256 -print0 | sort -z \
+  | xargs -0 sha256sum > MANIFEST.sha256.tmp && mv MANIFEST.sha256.tmp MANIFEST.sha256
+echo "top-level MANIFEST.sha256 refreshed ($(wc -l < MANIFEST.sha256) files)"