chore: initial import from KNEL/PFVCluster@041d311 [#769]

Split per O&M lane work order. Full history: KNEL/PFVCluster. https://projects.knownelement.com/issues/769#note-4152
2026-09-03 21:30:47 -05:00
commit 2eca50490d
20 changed files with 1189 additions and 0 deletions
@@ -0,0 +1,46 @@
+#!/bin/bash
+#
+# artifact-mirror.sh — pinned artifact mirror on the tsys-ca webroot [#758]
+#
+# Run ON tsys-ca as root (via tests/remote.sh vm-file):
+#   VM_IP=tsys-ca VM_USER=root bash tests/remote.sh vm-file ca/artifact-mirror.sh
+#
+# Publishes under http://tsys-ca.knel.net/ca/dist/:
+#   dist/wazuh-agent/<ver>/wazuh-agent_<ver>_<arch>.deb   (amd64, arm64, armhf)
+#   dist/wazuh-agent/<ver>/SHA256SUMS
+# and refreshes the top-level MANIFEST.sha256.
+#
+# Fleet rule: agents install from THIS mirror (DNS name), never from the
+# public internet — deploys stop depending on upstream availability and
+# get a stable, pinned, hash-verifiable source. Integrity = SHA256SUMS +
+# the root CA fingerprint recorded on Redmine #697.
+#
+set -euo pipefail
+
+WWW="${WWW:-/var/www/html/ca}"
+WZ_VER="${WZ_VER:-4.14.7-1}"
+UPSTREAM="https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent"
+DEST="$WWW/dist/wazuh-agent/$WZ_VER"
+
+mkdir -p "$DEST"
+cd "$DEST"
+
+for arch in amd64 arm64 armhf; do
+  f="wazuh-agent_${WZ_VER}_${arch}.deb"
+  if [ -s "$f" ]; then
+    echo "have $f"
+  else
+    echo "fetching $f"
+    curl -fSs --retry 2 --max-time 240 -o "$f" "$UPSTREAM/$f"
+  fi
+done
+
+# SHA256SUMS for this directory (regenerated every run — cheap)
+sha256sum -- *.deb > SHA256SUMS.tmp && mv SHA256SUMS.tmp SHA256SUMS
+cat SHA256SUMS
+
+# Top-level manifest rolls up the whole published tree
+cd "$WWW"
+find . -type f ! -name MANIFEST.sha256 -print0 | sort -z \
+  | xargs -0 sha256sum > MANIFEST.sha256.tmp && mv MANIFEST.sha256.tmp MANIFEST.sha256
+echo "top-level MANIFEST.sha256 refreshed ($(wc -l < MANIFEST.sha256) files)"