From 33bb7886b63c80a0ee6983e1de493efefd1b7ae5 Mon Sep 17 00:00:00 2001 From: Lucas Manuel Rodriguez Date: Wed, 1 Jun 2022 13:54:16 -0300 Subject: [PATCH] Add automation for orbit shell (with TUF) (#5856) * fix old root dir in orbit * add changes * Add automation for orbit shell (with TUF) * Fix workflow syntax * Add logging to latest fleetctl preview action * Add changes to fix workflow * Use macOS host for TUF server and package generation * Remove copy/paste if clause * Fix orbit logs on macOS, Ubuntu * Simplify TUF and generation of packages * Set enroll secret instead of getting it * Increase timeouts * Add step id * Fixes to the upload/download of artifacts * Rearrange steps to not lose the downloads * Fix copy/paste * Add fleetctl login step * Add missing config set * Fix quotes on Windows * Increase timeout * Fix job termination * Disable FLEET_DESKTOP for now * Checkout repository on macOS * Fix logs path * Enable fleet desktop * Use cancel, nitpick Co-authored-by: Michal Nicpon --- .github/workflows/fleet-and-orbit.yml | 272 +++++++++++++----- .github/workflows/fleetctl-preview-latest.yml | 18 ++ .github/workflows/integration.yml | 3 +- changes/issue-5734-fix-orbit-shell-root | 1 + orbit/cmd/orbit/orbit.go | 13 +- orbit/cmd/orbit/shell.go | 49 +++- orbit/pkg/osquery/osquery.go | 61 +++- tools/tuf/test/README.md | 1 + tools/tuf/test/create_repository.sh | 58 ++-- 9 files changed, 341 insertions(+), 135 deletions(-) create mode 100644 changes/issue-5734-fix-orbit-shell-root diff --git a/.github/workflows/fleet-and-orbit.yml b/.github/workflows/fleet-and-orbit.yml index ccec140356..d912a4adea 100644 --- a/.github/workflows/fleet-and-orbit.yml +++ b/.github/workflows/fleet-and-orbit.yml @@ -1,6 +1,6 @@ -name: Test Orbit & Fleet +name: Test Fleetctl Package, Orbit & Fleet -# This workflow tests orbit code changes (compiles and runs orbit from source). +# This workflow tests orbit code changes (compiles orbit from source). # It uses a fleet instance also built and executed from source. # # It tests that orbit osquery agents enroll successfully to Fleet. @@ -27,6 +27,7 @@ jobs: subdomain: ${{ steps.gen.outputs.subdomain }} domain: ${{ steps.gen.outputs.domain }} address: ${{ steps.gen.outputs.address }} + enroll_secret: ${{ steps.gen.outputs.enroll_secret }} steps: - id: gen run: | @@ -34,8 +35,11 @@ jobs: echo "::set-output name=subdomain::fleet-test-$UUID" echo "::set-output name=domain::fleet-test-$UUID.fleetuem.com" echo "::set-output name=address::https://fleet-test-$UUID.fleetuem.com" + ENROLL=$(uuidgen) + echo "::set-output name=enroll_secret::$ENROLL" run-server: + timeout-minutes: 60 strategy: matrix: go-version: ['^1.17.0'] @@ -81,7 +85,6 @@ jobs: run: make fleet fleetctl - name: Run Fleet server - timeout-minutes: 10 env: FLEET_OSQUERY_HOST_IDENTIFIER: instance # use instance identifier to allow for duplicate UUIDs FLEET_SERVER_ADDRESS: 0.0.0.0:1337 @@ -103,7 +106,7 @@ jobs: echo -n "Waiting for hosts to enroll: " cat hostcount | xargs echo -n echo " / $EXPECTED" - sleep 10 + sleep 30 done ./build/fleetctl get hosts echo "Success! $EXPECTED hosts enrolled." @@ -120,14 +123,17 @@ jobs: path: | fleet_log - get-enroll-secret: + + # Sets the enroll secret of the Fleet server. + # + # This job also makes sure the Fleet server is up and running. + set-enroll-secret: + timeout-minutes: 60 strategy: matrix: go-version: ['^1.17.0'] runs-on: ubuntu-latest needs: gen - outputs: - enroll_secret: ${{ steps.enroll.outputs.enroll_secret }} steps: - name: Install Go @@ -142,30 +148,41 @@ jobs: run: make fleetctl - id: enroll - name: Fetch enroll secret - timeout-minutes: 10 + name: Set enroll secret run: | ./build/fleetctl config set --address ${{ needs.gen.outputs.address }} until ./build/fleetctl login --email admin@example.com --password preview1337# do - echo "Retrying in 10s..." - sleep 10 + echo "Retrying in 30s..." + sleep 30 done - SECRET_JSON=$(./build/fleetctl get enroll_secret --json --debug) - echo $SECRET_JSON - SECRET=$(echo $SECRET_JSON | jq -r '.spec.secrets[0].secret') - echo "::set-output name=enroll_secret::$SECRET" - - orbit-macos-and-ubuntu: - timeout-minutes: 15 + echo '--- + apiVersion: v1 + kind: enroll_secret + spec: + secrets: + - secret: ${{ needs.gen.outputs.enroll_secret }} + ' > secrets.yml + ./build/fleetctl apply -f secrets.yml + + + # TODO(lucas): Currently, to simplify the workflow we do all in one job: + # 1. Generate TUF repository (compile Orbit from source). + # 2. Run TUF server on localhost. + # 3. Generate packages using localhost TUF server. + # + # When installing the generated packages, Orbit will log "update errors" + # because the TUF URL is set to http://localhost:8081. + # + # TODO(lucas): Test the generated RPM package on a CentOS docker image. + run-tuf-and-gen-pkgs: + timeout-minutes: 60 strategy: matrix: - # TODO(lucas): Add edge channel for osqueryd. - osqueryd-channel: ['stable'] go-version: ['^1.17.0'] - os: ['macos-latest', 'ubuntu-latest'] - runs-on: ${{ matrix.os }} - needs: [gen, get-enroll-secret] + # We can only generate all (PKG, MSI, DEB, RPM) packages from a macOS host. + runs-on: macos-latest + needs: gen steps: - name: Install Go @@ -176,84 +193,193 @@ jobs: - name: Checkout Code uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 - - name: Build and Run Orbit + # Docker needs to be installed manually on macOS. + # From https://github.com/docker/for-mac/issues/2359#issuecomment-943131345 + - name: Install Docker run: | - sudo hostname ${{ matrix.os }}-orbit-dev-osqueryd-${{ matrix.osqueryd-channel }} - echo "Hostname: $(hostname -s)" - mkdir /tmp/orbit - cp ./orbit/pkg/packaging/certs.pem /tmp/orbit - mkdir orbit_logs - go run github.com/fleetdm/fleet/v4/orbit/cmd/orbit \ - --debug \ - --dev-mode \ - --disable-updates \ - --root-dir /tmp/orbit \ - --fleet-url ${{ needs.gen.outputs.address }} \ - --enroll-secret ${{ needs.get-enroll-secret.outputs.enroll_secret }} \ - --osqueryd-channel ${{ matrix.osqueryd-channel }} \ - -- --verbose 1>./orbit_logs/stdout.log 2>./orbit_logs/stderr.log & - # TODO(lucas): Improve checking of "enrolled". - # This waits until the server goes down. + brew install --cask docker + sudo /Applications/Docker.app/Contents/MacOS/Docker --unattended --install-privileged-components + open -a /Applications/Docker.app --args --unattended --accept-license + echo "Waiting for Docker to start up..." + while ! /Applications/Docker.app/Contents/Resources/bin/docker info &>/dev/null; do sleep 1; done + echo "Docker is ready." + + - name: Build Repository and run TUF server + env: + SYSTEMS: "macos windows linux" + PKG_FLEET_URL: ${{ needs.gen.outputs.address }} + PKG_TUF_URL: http://localhost:8081 + DEB_FLEET_URL: ${{ needs.gen.outputs.address }} + DEB_TUF_URL: http://localhost:8081 + RPM_FLEET_URL: ${{ needs.gen.outputs.address }} + RPM_TUF_URL: http://localhost:8081 + MSI_FLEET_URL: ${{ needs.gen.outputs.address }} + MSI_TUF_URL: http://localhost:8081 + ENROLL_SECRET: ${{ needs.gen.outputs.enroll_secret }} + GENERATE_PKG: 1 + GENERATE_DEB: 1 + GENERATE_RPM: 1 + GENERATE_MSI: 1 + FLEET_DESKTOP: 1 + run: | + ./tools/tuf/test/main.sh + + - name: Upload PKG installer + uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2 + with: + name: fleet-osquery.pkg + path: | + fleet-osquery.pkg + + - name: Upload DEB installer + uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2 + with: + name: fleet-osquery_42.0.0_amd64.deb + path: | + fleet-osquery_42.0.0_amd64.deb + + - name: Upload MSI installer + uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2 + with: + name: fleet-osquery.msi + path: | + fleet-osquery.msi + + + orbit-macos: + timeout-minutes: 60 + runs-on: macos-latest + needs: [gen, run-tuf-and-gen-pkgs] + steps: + + - name: Checkout Code + uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + + - name: Download pkg + id: download + uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2 + with: + name: fleet-osquery.pkg + + - name: Install pkg + run: | + sudo hostname orbit-macos + sudo installer -pkg ${{ steps.download.outputs.download-path }}/fleet-osquery.pkg -target / + + - name: Wait enroll + run: | + # Wait until fleet server goes down. while curl --fail ${{ needs.gen.outputs.address }}; do echo "Retrying in 10s..." sleep 10 done + - name: Run orbit shell + run: + sudo orbit shell -- --json "select * from osquery_info;" | jq -e 'if (.[0]) then true else false end' + + - name: Collect orbit logs + if: always() + run: | + mkdir orbit-logs + sudo cp /var/log/orbit/* orbit-logs/ + - name: Upload orbit logs if: always() uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2 with: - name: orbit-${{ matrix.os }}-logs-${{ matrix.osqueryd-channel }} + name: orbit-logs path: | - orbit_logs + orbit-logs + + - name: Uninstall pkg + run: | + ./orbit/tools/cleanup/cleanup_macos.sh + + + orbit-ubuntu: + timeout-minutes: 60 + runs-on: ubuntu-latest + needs: [gen, run-tuf-and-gen-pkgs] + steps: + + - name: Download deb + id: download + uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2 + with: + name: fleet-osquery_42.0.0_amd64.deb + + - name: Install deb + run: | + sudo hostname orbit-ubuntu + sudo dpkg --install ${{ steps.download.outputs.download-path }}/fleet-osquery_42.0.0_amd64.deb + + - name: Wait enroll + run: | + # Wait until fleet server goes down. + while curl --fail ${{ needs.gen.outputs.address }}; + do + echo "Retrying in 10s..." + sleep 10 + done + + - name: Run orbit shell + run: + sudo orbit shell -- --json "select * from osquery_info;" | jq -e 'if (.[0]) then true else false end' + + - name: Collect orbit logs + if: always() + run: | + mkdir orbit-logs + sudo journalctl -u orbit.service > orbit-logs/orbit_service.log + + - name: Upload orbit logs + if: always() + uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2 + with: + name: orbit-logs + path: | + orbit-logs + + - name: Uninstall deb + run: | + sudo apt remove fleet-osquery -y + orbit-windows: - timeout-minutes: 15 - strategy: - matrix: - # TODO(lucas): Add edge channel for osqueryd. - osqueryd-channel: ['stable'] - go-version: ['^1.17.8'] - needs: [gen, get-enroll-secret] + timeout-minutes: 60 + needs: [run-tuf-and-gen-pkgs] runs-on: windows-latest steps: - - name: Install Go - uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # v2 + - name: Download msi + id: download + uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2 with: - go-version: ${{ matrix.go-version }} + name: fleet-osquery.msi - - name: Checkout Code - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + - name: Install msi + run: | + msiexec /i ${{ steps.download.outputs.download-path }}\fleet-osquery.msi /quiet /passive /lv log.txt - - name: Build and Run Orbit + - name: Wait enroll shell: bash run: | - mkdir "/C/Program Files/Orbit" - cp ./orbit/pkg/packaging/certs.pem "/C/Program Files/Orbit" - mkdir orbit_logs - go run github.com/fleetdm/fleet/v4/orbit/cmd/orbit \ - --debug \ - --dev-mode \ - --disable-updates \ - --root-dir "/C/Program Files/Orbit" \ - --fleet-url ${{ needs.gen.outputs.address }} \ - --enroll-secret ${{ needs.get-enroll-secret.outputs.enroll_secret }} \ - --osqueryd-channel ${{ matrix.osqueryd-channel }} \ - -- --verbose 1>./orbit_logs/stdout.log 2>./orbit_logs/stderr.log & - # TODO(lucas): Improve checking of "enrolled". - # This waits until the server goes down. while curl --fail ${{ needs.gen.outputs.address }}; do echo "Retrying in 10s..." sleep 10 done - - name: Upload orbit logs + - name: Run orbit shell + shell: cmd + run: | + "C:\Program Files\Orbit\bin\orbit\orbit.exe" shell -- --json "select * from osquery_info;" | jq -e "if (.[0]) then true else false end" + + - name: Upload Orbit logs if: always() uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2 with: - name: orbit-windows-logs-${{ matrix.osqueryd-channel }} - path: | - orbit_logs \ No newline at end of file + name: orbit-logs-windows + path: C:\Windows\system32\config\systemprofile\AppData\Local\FleetDM\Orbit\Logs\orbit-osquery.log diff --git a/.github/workflows/fleetctl-preview-latest.yml b/.github/workflows/fleetctl-preview-latest.yml index 8778df491f..0a2edb8d93 100644 --- a/.github/workflows/fleetctl-preview-latest.yml +++ b/.github/workflows/fleetctl-preview-latest.yml @@ -57,9 +57,27 @@ jobs: run: make fleetctl - name: Run fleetctl preview + shell: bash run: | ./build/fleetctl preview --std-query-lib-file-path $(pwd)/docs/01-Using-Fleet/standard-query-library/standard-query-library.yml sleep 10 ./build/fleetctl get hosts | tee hosts.txt [ $( cat hosts.txt | grep online | wc -l) -eq 8 ] + + - name: Get fleet logs + run: | + FLEET_LICENSE_KEY=foo docker compose -f ~/.fleet/preview/docker-compose.yml logs fleet01 fleet02 > fleet-logs.txt + # Copying logs, otherwise the upload-artifact action uploads the logs in a hidden folder (.fleet) + cp ~/.fleet/preview/orbit.log orbit.log + cp -r ~/.fleet/preview/logs osquery_result_status_logs shell: bash + + - name: Upload logs + if: always() + uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2 + with: + name: ${{ matrix.os }}-log + path: | + fleet-logs.txt + orbit.log + osquery_result_status_logs \ No newline at end of file diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index 2ed27eab68..14ba5d5b14 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -318,5 +318,4 @@ jobs: uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2 with: name: orbit-windows-${{ matrix.orbit-channel }}-${{ matrix.osqueryd-channel }}-logs - path: | - C:\Windows\system32\config\systemprofile\AppData\Local\FleetDM\Orbit\Logs\orbit-osquery.log \ No newline at end of file + path: C:\Windows\system32\config\systemprofile\AppData\Local\FleetDM\Orbit\Logs\orbit-osquery.log diff --git a/changes/issue-5734-fix-orbit-shell-root b/changes/issue-5734-fix-orbit-shell-root new file mode 100644 index 0000000000..73530d3b56 --- /dev/null +++ b/changes/issue-5734-fix-orbit-shell-root @@ -0,0 +1 @@ +* Fixed an issue with detecting root directory when using `orbit shell`. diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go index 8f49fab4cf..40fdbea532 100644 --- a/orbit/cmd/orbit/orbit.go +++ b/orbit/cmd/orbit/orbit.go @@ -36,7 +36,6 @@ import ( ) func main() { - app := cli.NewApp() app.Name = "Orbit osquery" app.Usage = "A powered-up, (near) drop-in replacement for osquery" @@ -483,10 +482,7 @@ func main() { } g.Add(r.Execute, r.Interrupt) - ext := table.NewRunner(r.ExtensionSocketPath(), table.WithExtension(orbitInfoExtension{ - deviceAuthToken: deviceAuthToken, - })) - g.Add(ext.Execute, ext.Interrupt) + registerExtensionRunner(&g, r.ExtensionSocketPath(), deviceAuthToken) if c.Bool("fleet-desktop") { desktopRunner := newDesktopRunner(desktopPath, fleetURL, deviceAuthToken, c.Bool("insecure")) @@ -510,6 +506,13 @@ func main() { } } +func registerExtensionRunner(g *run.Group, extSockPath, deviceAuthToken string) { + ext := table.NewRunner(extSockPath, table.WithExtension(orbitInfoExtension{ + deviceAuthToken: deviceAuthToken, + })) + g.Add(ext.Execute, ext.Interrupt) +} + type desktopRunner struct { desktopPath string fleetURL string diff --git a/orbit/cmd/orbit/shell.go b/orbit/cmd/orbit/shell.go index 5b3b868ffc..0d69c452a6 100644 --- a/orbit/cmd/orbit/shell.go +++ b/orbit/cmd/orbit/shell.go @@ -5,11 +5,10 @@ import ( "fmt" "os" "path/filepath" - "runtime" + "strings" "github.com/fleetdm/fleet/v4/orbit/pkg/constant" "github.com/fleetdm/fleet/v4/orbit/pkg/osquery" - "github.com/fleetdm/fleet/v4/orbit/pkg/table" "github.com/fleetdm/fleet/v4/orbit/pkg/update" "github.com/fleetdm/fleet/v4/orbit/pkg/update/filestore" "github.com/fleetdm/fleet/v4/pkg/secure" @@ -37,6 +36,7 @@ var shellCommand = &cli.Command{ }, }, Action: func(c *cli.Context) error { + zerolog.SetGlobalLevel(zerolog.InfoLevel) if c.Bool("debug") { zerolog.SetGlobalLevel(zerolog.DebugLevel) } @@ -76,23 +76,42 @@ var shellCommand = &cli.Command{ var g run.Group - // Create an osquery runner with the provided options - r, _ := osquery.NewRunner( - osquerydPath, + opts := []osquery.Option{ osquery.WithShell(), osquery.WithDataPath(filepath.Join(c.String("root-dir"), "shell")), - // Handle additional args after -- - osquery.WithFlags(c.Args().Slice()), - ) - g.Add(r.Execute, r.Interrupt) - - if runtime.GOOS != "windows" { - // We are disabling extensions for Windows until #3679 is fixed. - ext := table.NewRunner(r.ExtensionSocketPath()) - g.Add(ext.Execute, ext.Interrupt) } - // Install a signal handler + // Detect if the additional arguments have a positional argument. + // + // osqueryi/osqueryd has the following usage: + // Usage: osqueryi [OPTION]... [SQL STATEMENT] + additionalArgs := c.Args().Slice() + singleQueryArg := false + if len(additionalArgs) > 0 { + if !strings.HasPrefix(additionalArgs[len(additionalArgs)-1], "--") { + singleQueryArg = true + opts = append(opts, osquery.SingleQuery()) + } + } + + // Handle additional args after -- + opts = append(opts, osquery.WithFlags(additionalArgs)) + + r, err := osquery.NewRunner(osquerydPath, opts...) + if err != nil { + return fmt.Errorf("create osquery runner: %w", err) + } + g.Add(r.Execute, r.Interrupt) + + if !singleQueryArg { + // We currently start the extension runner when !singleQueryArg + // because otherwise osquery exits and leaves too quickly, + // leaving the extension runner waiting for the socket. + // NOTE(lucas): `--extensions_require` doesn't seem to work with + // thrift extensions? + registerExtensionRunner(&g, r.ExtensionSocketPath(), "") + } + ctx, cancel := context.WithCancel(context.Background()) defer cancel() g.Add(run.SignalHandler(ctx, os.Interrupt, os.Kill)) diff --git a/orbit/pkg/osquery/osquery.go b/orbit/pkg/osquery/osquery.go index 2c51df894f..9ea465da87 100644 --- a/orbit/pkg/osquery/osquery.go +++ b/orbit/pkg/osquery/osquery.go @@ -10,6 +10,7 @@ import ( "os/exec" "path/filepath" "runtime" + "sync" "time" "github.com/fleetdm/fleet/v4/orbit/pkg/constant" @@ -26,10 +27,12 @@ const ( // Runner is a specialized runner for osquery. It is designed with Execute and // Interrupt functions to be compatible with oklog/run. type Runner struct { - proc *process.Process - cmd *exec.Cmd - dataPath string - cancel func() + proc *process.Process + cmd *exec.Cmd + dataPath string + cancelMu sync.Mutex + cancel func() + singleQuery bool } type Option func(*Runner) error @@ -81,6 +84,14 @@ func WithEnv(env []string) Option { } } +// SingleQuery configures the osqueryd invocation to run a SQL statement and exit. +func SingleQuery() Option { + return func(r *Runner) error { + r.singleQuery = true + return nil + } +} + // WithShell adds the -S flag to run an osqueryi shell. func WithShell() func(*Runner) error { return func(r *Runner) error { @@ -143,15 +154,23 @@ func WithLogPath(path string) Option { func (r *Runner) Execute() error { log.Info().Str("cmd", r.cmd.String()).Msg("start osqueryd") - ctx, cancel := context.WithCancel(context.Background()) - r.cancel = cancel + if r.singleQuery { + // When running in "SQL STATEMENT" mode, start osqueryd + // and wait for it to exit. + if err := r.cmd.Run(); err != nil { + return fmt.Errorf("start osqueryd shell: %w", err) + } + } else { + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + r.setCancel(cancel) - if err := r.proc.Start(); err != nil { - return fmt.Errorf("start osqueryd: %w", err) - } - - if err := r.proc.WaitOrKill(ctx, 10*time.Second); err != nil { - return fmt.Errorf("osqueryd exited with error: %w", err) + if err := r.proc.Start(); err != nil { + return fmt.Errorf("start osqueryd: %w", err) + } + if err := r.proc.WaitOrKill(ctx, 10*time.Second); err != nil { + return fmt.Errorf("osqueryd exited with error: %w", err) + } } return nil @@ -160,7 +179,9 @@ func (r *Runner) Execute() error { // Runner interrupts the running osquery process. func (r *Runner) Interrupt(err error) { log.Debug().Err(err).Msg("interrupt osquery") - r.cancel() + if cancel := r.getCancel(); cancel != nil { + cancel() + } } func (r *Runner) ExtensionSocketPath() string { @@ -170,3 +191,17 @@ func (r *Runner) ExtensionSocketPath() string { return filepath.Join(r.dataPath, extensionSocketName) } + +func (r *Runner) setCancel(c func()) { + r.cancelMu.Lock() + defer r.cancelMu.Unlock() + + r.cancel = c +} + +func (r *Runner) getCancel() func() { + r.cancelMu.Lock() + defer r.cancelMu.Unlock() + + return r.cancel +} diff --git a/tools/tuf/test/README.md b/tools/tuf/test/README.md index 08d5b8bca8..1ff3571899 100644 --- a/tools/tuf/test/README.md +++ b/tools/tuf/test/README.md @@ -8,6 +8,7 @@ Scripts in this directory aim to ease the testing of Orbit and the [TUF](https:/ The `main.sh` creates and runs the TUF repository and optionally generate the installers (GENERATE_PKGS): ```sh +SYSTEMS="macos windows linux" \ PKG_FLEET_URL=https://127.0.0.1:8080 \ PKG_TUF_URL=http://127.0.0.1:8081 \ DEB_FLEET_URL=https://172.16.132.1:8080 \ diff --git a/tools/tuf/test/create_repository.sh b/tools/tuf/test/create_repository.sh index 3050969a3b..b69d025b39 100755 --- a/tools/tuf/test/create_repository.sh +++ b/tools/tuf/test/create_repository.sh @@ -6,11 +6,12 @@ set -e # All targets are created with version 42. # Input: -# $TUF_PATH: directory path for the test TUF repository. +# TUF_PATH: directory path for the test TUF repository. # FLEET_ROOT_PASSPHRASE: Root role passphrase. # FLEET_TARGETS_PASSPHRASE: Targets role passphrase. # FLEET_SNAPSHOT_PASSPHRASE: Snapshot role passphrase. # FLEET_TIMESTAMP_PASSPHRASE: Timestamp role passphrase. +# SYSTEMS: Space separated list of systems to support in the TUF repository. Default value is: "macos windows linux" if [[ -z "$TUF_PATH" ]]; then echo "Must set the TUF_PATH environment variable." @@ -22,28 +23,42 @@ if [[ -d "$TUF_PATH" ]]; then fi OSQUERY_MACOS_APP_BUNDLE_VERSION=5.2.3 +SYSTEMS=${SYSTEMS:-macos linux windows} mkdir -p $TUF_PATH/tmp ./build/fleetctl updates init --path $TUF_PATH -for system in macos linux windows; do +for system in $SYSTEMS; do - # Use latest stable version of osqueryd from our TUF server. - osqueryd="osqueryd" - if [[ $system == "windows" ]]; then - osqueryd="$osqueryd.exe" + if [[ $system == "macos" ]]; then + # Generate and add osqueryd .app bundle for macos-app. + osqueryd_path=$TUF_PATH/tmp/osqueryd.app.tar.gz + make osqueryd-app-tar-gz version=$OSQUERY_MACOS_APP_BUNDLE_VERSION out-path=$(dirname $osqueryd_path) + ./build/fleetctl updates add \ + --path $TUF_PATH \ + --target $osqueryd_path \ + --platform macos-app \ + --name osqueryd \ + --version 42.0.0 -t 42.0 -t 42 -t stable + rm $osqueryd_path + else + # Use latest stable version of osqueryd from our TUF server. + osqueryd="osqueryd" + if [[ $system == "windows" ]]; then + osqueryd="$osqueryd.exe" + fi + osqueryd_path="$TUF_PATH/tmp/$osqueryd" + curl https://tuf.fleetctl.com/targets/osqueryd/$system/stable/$osqueryd --output $osqueryd_path + + ./build/fleetctl updates add \ + --path $TUF_PATH \ + --target $osqueryd_path \ + --platform $system \ + --name osqueryd \ + --version 42.0.0 -t 42.0 -t 42 -t stable + rm $osqueryd_path fi - osqueryd_path="$TUF_PATH/tmp/$osqueryd" - curl https://tuf.fleetctl.com/targets/osqueryd/$system/stable/$osqueryd --output $osqueryd_path - - ./build/fleetctl updates add \ - --path $TUF_PATH \ - --target $osqueryd_path \ - --platform $system \ - --name osqueryd \ - --version 42.0.0 -t 42.0 -t 42 -t stable - rm $osqueryd_path goose_value="$system" if [[ $system == "macos" ]]; then @@ -110,14 +125,3 @@ for system in macos linux windows; do rm desktop.tar.gz fi done - -# Generate and add osqueryd .app bundle for macos-app. -osqueryd_path=$TUF_PATH/tmp/osqueryd.app.tar.gz -make osqueryd-app-tar-gz version=$OSQUERY_MACOS_APP_BUNDLE_VERSION out-path=$(dirname $osqueryd_path) -./build/fleetctl updates add \ - --path $TUF_PATH \ - --target $osqueryd_path \ - --platform macos-app \ - --name osqueryd \ - --version 42.0.0 -t 42.0 -t 42 -t stable -rm $osqueryd_path \ No newline at end of file