Package osquery certificate bundle with orbit (#3033)

- Include the osquery certs.pem with Orbit installers.
- Use the certs.pem if available and no other certificate specified.

orbit/cmd/orbit/orbit.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"context"
-	"crypto/x509"
 	"fmt"
 	"io/fs"
 	"io/ioutil"
@@ -324,12 +323,15 @@ func main() {
 					osquery.WithFlags([]string{"--tls_server_certs", certPath}),
 				)
 			} else {
-				// Check and log if there are any errors with TLS connection.
-				pool, err := x509.SystemCertPool()
-				if err != nil {
-					log.Info().Err(err).Msg("Failed to retrieve system cert pool. Cannot validate Fleet server connection.")
-				} else if err := certificate.ValidateConnection(pool, fleetURL); err != nil {
-					log.Info().Err(err).Msg("Failed to connect to Fleet server. Osquery connection may fail. Provide certificate with --fleet-certificate.")
+				certPath := filepath.Join(opt.RootDirectory, "certs.pem")
+				if exists, err := file.Exists(certPath); err == nil && exists {
+					_, err = certificate.LoadPEM(certPath)
+					if err != nil {
+						return errors.Wrap(err, "load certs.pem")
+					}
+					options = append(options, osquery.WithFlags([]string{"--tls_server_certs", certPath}))
+				} else {
+					log.Info().Msg("No cert chain available. Relying on system store.")
 				}
 			}
 		}

orbit/pkg/packaging/linux_shared.go

@@ -63,6 +63,10 @@ func buildNFPM(opt Options, pkger nfpm.Packager) (string, error) {
 		return "", errors.Wrap(err, "write flagfile")
 	}
 
+	if err := writeOsqueryCertPEM(opt, orbitRoot); err != nil {
+		return "", errors.Wrap(err, "write certs.pem")
+	}
+
 	postInstallPath := filepath.Join(tmpDir, "postinstall.sh")
 	if err := writePostInstall(opt, postInstallPath); err != nil {
 		return "", errors.Wrap(err, "write postinstall script")

orbit/pkg/packaging/macos.go

@@ -71,6 +71,10 @@ func BuildPkg(opt Options) (string, error) {
 	if err := writeOsqueryFlagfile(opt, orbitRoot); err != nil {
 		return "", errors.Wrap(err, "write flagfile")
 	}
+	if err := writeOsqueryCertPEM(opt, orbitRoot); err != nil {
+		return "", errors.Wrap(err, "write certs.pem")
+	}
+
 	if opt.StartService {
 		if err := writeLaunchd(opt, filesystemRoot); err != nil {
 			return "", errors.Wrap(err, "write launchd")

orbit/pkg/packaging/packaging.go

@@ -2,6 +2,7 @@
 package packaging
 
 import (
+	_ "embed"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -128,3 +129,18 @@ func writeOsqueryFlagfile(opt Options, orbitRoot string) error {
 
 	return nil
 }
+
+// Embed the certs file that osquery uses so that we can drop it into our installation packages.
+// This file copied from https://raw.githubusercontent.com/osquery/osquery/master/tools/deployment/certs.pem
+//go:embed certs.pem
+var osqueryCerts []byte
+
+func writeOsqueryCertPEM(opt Options, orbitRoot string) error {
+	dstPath := filepath.Join(orbitRoot, "certs.pem")
+
+	if err := ioutil.WriteFile(dstPath, osqueryCerts, 0644); err != nil {
+		return errors.Wrap(err, "write file")
+	}
+
+	return nil
+}

orbit/pkg/packaging/windows.go

@@ -61,6 +61,10 @@ func BuildMSI(opt Options) (string, error) {
 		return "", errors.Wrap(err, "write flagfile")
 	}
 
+	if err := writeOsqueryCertPEM(opt, orbitRoot); err != nil {
+		return "", errors.Wrap(err, "write certs.pem")
+	}
+
 	if opt.FleetCertificate != "" {
 		if err := writeCertificate(opt, orbitRoot); err != nil {
 			return "", errors.Wrap(err, "write fleet certificate")