mrcharles
1620351028
dist/wazuh-agent/4.14.7-1/ (amd64+arm64+armhf) + SHA256SUMS, autoindex enabled, workstation hash-verified against published manifest. deploy-agent.sh now installs from the mirror (upstream fallback) and auto-detects arch. #335: kali-tsys enrolled+active (30 total agents). Detail: https://projects.knownelement.com/issues/758
47 lines
1.6 KiB
Bash
47 lines
1.6 KiB
Bash
#!/bin/bash
|
|
#
|
|
# artifact-mirror.sh — pinned artifact mirror on the tsys-ca webroot [#758]
|
|
#
|
|
# Run ON tsys-ca as root (via tests/remote.sh vm-file):
|
|
# VM_IP=tsys-ca VM_USER=root bash tests/remote.sh vm-file ca/artifact-mirror.sh
|
|
#
|
|
# Publishes under http://tsys-ca.knel.net/ca/dist/:
|
|
# dist/wazuh-agent/<ver>/wazuh-agent_<ver>_<arch>.deb (amd64, arm64, armhf)
|
|
# dist/wazuh-agent/<ver>/SHA256SUMS
|
|
# and refreshes the top-level MANIFEST.sha256.
|
|
#
|
|
# Fleet rule: agents install from THIS mirror (DNS name), never from the
|
|
# public internet — deploys stop depending on upstream availability and
|
|
# get a stable, pinned, hash-verifiable source. Integrity = SHA256SUMS +
|
|
# the root CA fingerprint recorded on Redmine #697.
|
|
#
|
|
set -euo pipefail
|
|
|
|
WWW="${WWW:-/var/www/html/ca}"
|
|
WZ_VER="${WZ_VER:-4.14.7-1}"
|
|
UPSTREAM="https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent"
|
|
DEST="$WWW/dist/wazuh-agent/$WZ_VER"
|
|
|
|
mkdir -p "$DEST"
|
|
cd "$DEST"
|
|
|
|
for arch in amd64 arm64 armhf; do
|
|
f="wazuh-agent_${WZ_VER}_${arch}.deb"
|
|
if [ -s "$f" ]; then
|
|
echo "have $f"
|
|
else
|
|
echo "fetching $f"
|
|
curl -fSs --retry 2 --max-time 240 -o "$f" "$UPSTREAM/$f"
|
|
fi
|
|
done
|
|
|
|
# SHA256SUMS for this directory (regenerated every run — cheap)
|
|
sha256sum -- *.deb > SHA256SUMS.tmp && mv SHA256SUMS.tmp SHA256SUMS
|
|
cat SHA256SUMS
|
|
|
|
# Top-level manifest rolls up the whole published tree
|
|
cd "$WWW"
|
|
find . -type f ! -name MANIFEST.sha256 -print0 | sort -z \
|
|
| xargs -0 sha256sum > MANIFEST.sha256.tmp && mv MANIFEST.sha256.tmp MANIFEST.sha256
|
|
echo "top-level MANIFEST.sha256 refreshed ($(wc -l < MANIFEST.sha256) files)"
|