#!/bin/bash
#
# artifact-mirror.sh — pinned artifact mirror on the tsys-ca webroot [#758]
#
# Run ON tsys-ca as root (via tests/remote.sh vm-file):
#   VM_IP=tsys-ca VM_USER=root bash tests/remote.sh vm-file ca/artifact-mirror.sh
#
# Publishes under http://tsys-ca.knel.net/ca/dist/:
#   dist/wazuh-agent/<ver>/wazuh-agent_<ver>_<arch>.deb   (amd64, arm64, armhf)
#   dist/wazuh-agent/<ver>/SHA256SUMS
# and refreshes the top-level MANIFEST.sha256.
#
# Fleet rule: agents install from THIS mirror (DNS name), never from the
# public internet — deploys stop depending on upstream availability and
# get a stable, pinned, hash-verifiable source. Integrity = SHA256SUMS +
# the root CA fingerprint recorded on Redmine #697.
#
set -euo pipefail

WWW="${WWW:-/var/www/html/ca}"
WZ_VER="${WZ_VER:-4.14.7-1}"
UPSTREAM="https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent"
DEST="$WWW/dist/wazuh-agent/$WZ_VER"

mkdir -p "$DEST"
cd "$DEST"

for arch in amd64 arm64 armhf; do
  f="wazuh-agent_${WZ_VER}_${arch}.deb"
  if [ -s "$f" ]; then
    echo "have $f"
  else
    echo "fetching $f"
    curl -fSs --retry 2 --max-time 240 -o "$f" "$UPSTREAM/$f"
  fi
done

# SHA256SUMS for this directory (regenerated every run — cheap)
sha256sum -- *.deb > SHA256SUMS.tmp && mv SHA256SUMS.tmp SHA256SUMS
cat SHA256SUMS

# Top-level manifest rolls up the whole published tree
cd "$WWW"
find . -type f ! -name MANIFEST.sha256 -print0 | sort -z \
  | xargs -0 sha256sum > MANIFEST.sha256.tmp && mv MANIFEST.sha256.tmp MANIFEST.sha256
echo "top-level MANIFEST.sha256 refreshed ($(wc -l < MANIFEST.sha256) files)"