fleet/tools/tuf/test/gen_pkgs.sh

#!/bin/bash

set -ex

# This script generates fleet-osquery packages for all supported platforms
# using the specified TUF server.

# Input:
# Values for generating a package for a macOS host:
# PKG_FLEET_URL: Fleet server URL.
# PKG_TUF_URL: URL of the TUF server.
#
# Values for generating a package for an Ubuntu host:
# DEB_FLEET_URL: Fleet server URL.
# DEB_TUF_URL: URL of the TUF server.
#
# Values for generating a package for a CentOS host:
# RPM_FLEET_URL: Fleet server URL.
# RPM_TUF_URL: URL of the TUF server.
#
# Values for generating a package for a Windows host:
# MSI_FLEET_URL: Fleet server URL.
# MSI_TUF_URL: URL of the TUF server.
#
# Values for generating a package for a Arch Linux host:
# PKG_TAR_ZST_FLEET_URL: Fleet server URL.
# PKG_TAR_ZST_TUF_URL: URL of the TUF server.
#
# ENROLL_SECRET: Fleet server enroll secret.
# ROOT_KEYS: TUF repository root keys.
# FLEET_DESKTOP: Whether to build with Fleet Desktop support.
# INSECURE: Whether to use the --insecure flag.
# FLEET_MANAGED_HOST_IDENTITY_CERTIFICATE: Whether to use TPM-backed key for HTTP signing (Linux only).
# USE_UPDATE_SERVER_CERTIFICATE: Whether to use a custom certificate bundle.
# FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST: Alternative host:port to use for the Fleet Desktop browser URLs.
# DEBUG: Whether or not to build the package with --debug.

ENABLE_SCRIPTS="1"
if [[ -n $DISABLE_SCRIPTS ]]; then
    ENABLE_SCRIPTS=""
fi

using_localhost() {
    local url=$1
    if [[ "$url" = "https://localhost:"* || "$url" = "https://127.0.0.1:"* || "$url" = "https://host.docker.internal:"* ]]; then
        return 0 # true (exit code 0)
    else
        return 1 # false (exit code 1)
    fi
}

if [ -n "$GENERATE_PKG" ]; then
    echo "Generating pkg..."
    if using_localhost "$PKG_FLEET_URL" ; then
        GENERATE_PKG_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE=1
    fi
    ./build/fleetctl package \
        --type=pkg \
        ${FLEET_DESKTOP:+--fleet-desktop} \
        --fleet-url=$PKG_FLEET_URL \
        --enroll-secret=$ENROLL_SECRET \
        ${GENERATE_PKG_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
        ${INSECURE:+--insecure} \
        ${DEBUG:+--debug} \
        --update-roots="$ROOT_KEYS" \
        --update-interval=10s \
        --disable-open-folder \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
        --update-url=$PKG_TUF_URL \
        ${ENABLE_SCRIPTS:+--enable-scripts} \
        --disable-keystore
fi

if [ -n "$GENERATE_DEB" ]; then
    echo "Generating deb (amd64)..."
    if using_localhost "$DEB_FLEET_URL" ; then
        GENERATE_DEB_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE=1
    fi
    ./build/fleetctl package \
        --type=deb \
        --arch=amd64 \
        ${FLEET_DESKTOP:+--fleet-desktop} \
        --fleet-url=$DEB_FLEET_URL \
        --enroll-secret=$ENROLL_SECRET \
        ${GENERATE_DEB_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
        ${INSECURE:+--insecure} \
        ${DEBUG:+--debug} \
        --update-roots="$ROOT_KEYS" \
        --update-interval=10s \
        --disable-open-folder \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
        ${ENABLE_SCRIPTS:+--enable-scripts} \
        ${FLEET_MANAGED_HOST_IDENTITY_CERTIFICATE:+--fleet-managed-host-identity-certificate} \
        --update-url=$DEB_TUF_URL
fi

if [ -n "$GENERATE_DEB_ARM64" ]; then
    echo "Generating deb (arm64)..."
    if using_localhost "$DEB_FLEET_URL" ; then
        GENERATE_DEB_ARM64_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE=1
    fi
    ./build/fleetctl package \
        --type=deb \
        --arch=arm64 \
        ${FLEET_DESKTOP:+--fleet-desktop} \
        --fleet-url=$DEB_FLEET_URL \
        --enroll-secret=$ENROLL_SECRET \
        ${GENERATE_DEB_ARM64_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
        ${INSECURE:+--insecure} \
        ${DEBUG:+--debug} \
        --update-roots="$ROOT_KEYS" \
        --update-interval=10s \
        --disable-open-folder \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
        ${ENABLE_SCRIPTS:+--enable-scripts} \
        ${FLEET_MANAGED_HOST_IDENTITY_CERTIFICATE:+--fleet-managed-host-identity-certificate} \
        --update-url=$DEB_TUF_URL
fi

if [ -n "$GENERATE_RPM" ]; then
    echo "Generating rpm (amd64)..."
    if using_localhost "$RPM_FLEET_URL" ; then
        GENERATE_RPM_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE=1
    fi
    ./build/fleetctl package \
        --type=rpm \
        --arch=amd64 \
        ${FLEET_DESKTOP:+--fleet-desktop} \
        --fleet-url=$RPM_FLEET_URL \
        --enroll-secret=$ENROLL_SECRET \
        ${GENERATE_RPM_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
        ${INSECURE:+--insecure} \
        ${DEBUG:+--debug} \
        --update-roots="$ROOT_KEYS" \
        --update-interval=10s \
        --disable-open-folder \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
        ${ENABLE_SCRIPTS:+--enable-scripts} \
        ${FLEET_MANAGED_HOST_IDENTITY_CERTIFICATE:+--fleet-managed-host-identity-certificate} \
        --update-url=$RPM_TUF_URL
fi

if [ -n "$GENERATE_RPM_ARM64" ]; then
    echo "Generating rpm (arm64)..."
    if using_localhost "$RPM_FLEET_URL" ; then
        GENERATE_RPM_ARM64_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE=1
    fi
    ./build/fleetctl package \
        --type=rpm \
        --arch=arm64 \
        ${FLEET_DESKTOP:+--fleet-desktop} \
        --fleet-url=$RPM_FLEET_URL \
        --enroll-secret=$ENROLL_SECRET \
        ${GENERATE_RPM_ARM64_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
        ${INSECURE:+--insecure} \
        ${DEBUG:+--debug} \
        --update-roots="$ROOT_KEYS" \
        --update-interval=10s \
        --disable-open-folder \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
        ${ENABLE_SCRIPTS:+--enable-scripts} \
        ${FLEET_MANAGED_HOST_IDENTITY_CERTIFICATE:+--fleet-managed-host-identity-certificate} \
        --update-url=$RPM_TUF_URL
fi

if [ -n "$GENERATE_PKG_TAR_ZST" ]; then
    echo "Generating pkg.tar.zst (amd64)..."
    if using_localhost "$PKG_TAR_ZST_FLEET_URL" ; then
        GENERATE_PKG_TAR_ZST_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE=1
    fi
    ./build/fleetctl package \
        --type=pkg.tar.zst \
        --arch=amd64 \
        ${FLEET_DESKTOP:+--fleet-desktop} \
        --fleet-url=$PKG_TAR_ZST_FLEET_URL \
        --enroll-secret=$ENROLL_SECRET \
        ${GENERATE_PKG_TAR_ZST_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
        ${INSECURE:+--insecure} \
        ${DEBUG:+--debug} \
        --update-roots="$ROOT_KEYS" \
        --update-interval=10s \
        --disable-open-folder \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
        ${ENABLE_SCRIPTS:+--enable-scripts} \
        ${FLEET_MANAGED_HOST_IDENTITY_CERTIFICATE:+--fleet-managed-host-identity-certificate} \
        --update-url=$PKG_TAR_ZST_TUF_URL
fi

if [ -n "$GENERATE_PKG_TAR_ZST_ARM64" ]; then
    echo "Generating pkg.tar.zst (arm64)..."
    if using_localhost "$PKG_TAR_ZST_FLEET_URL" ; then
       GENERATE_PKG_TAR_ZST_ARM64_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE=1
    fi
    ./build/fleetctl package \
        --type=pkg.tar.zst \
        --arch=arm64 \
        ${FLEET_DESKTOP:+--fleet-desktop} \
        --fleet-url=$PKG_TAR_ZST_FLEET_URL \
        --enroll-secret=$ENROLL_SECRET \
        ${GENERATE_PKG_TAR_ZST_ARM64_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
        ${INSECURE:+--insecure} \
        ${DEBUG:+--debug} \
        --update-roots="$ROOT_KEYS" \
        --update-interval=10s \
        --disable-open-folder \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
        ${ENABLE_SCRIPTS:+--enable-scripts} \
        ${FLEET_MANAGED_HOST_IDENTITY_CERTIFICATE:+--fleet-managed-host-identity-certificate} \
        --update-url=$PKG_TAR_ZST_TUF_URL
fi

if [ -n "$GENERATE_MSI" ]; then
    echo "Generating msi..."
    if using_localhost "$MSI_FLEET_URL" ; then
        GENERATE_MSI_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE=1
    fi
    ./build/fleetctl package \
        --type=msi \
        ${FLEET_DESKTOP:+--fleet-desktop} \
        --fleet-url=$MSI_FLEET_URL \
        --enroll-secret=$ENROLL_SECRET \
        ${GENERATE_MSI_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
        ${INSECURE:+--insecure} \
        ${DEBUG:+--debug} \
        --update-roots="$ROOT_KEYS" \
        --update-interval=10s \
        --disable-open-folder \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
        ${ENABLE_SCRIPTS:+--enable-scripts} \
        --update-url=$MSI_TUF_URL
fi

if [ -n "$GENERATE_MSI_ARM64" ]; then
    echo "Generating msi (arm64)..."
    if using_localhost "$MSI_FLEET_URL" ; then
        GENERATE_MSI_ARM64_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE=1
    fi
    ./build/fleetctl package \
        --type=msi \
        --arch=arm64 \
        ${FLEET_DESKTOP:+--fleet-desktop} \
        --fleet-url=$MSI_FLEET_URL \
        --enroll-secret=$ENROLL_SECRET \
        ${GENERATE_MSI_ARM64_USE_LOCALHOST_FLEET_SERVER_CERTIFICATE:+--fleet-certificate=./tools/osquery/fleet.crt} \
        ${USE_UPDATE_SERVER_CERTIFICATE:+--update-tls-certificate=./tools/osquery/fleet.crt} \
        ${INSECURE:+--insecure} \
        ${DEBUG:+--debug} \
        --update-roots="$ROOT_KEYS" \
        --update-interval=10s \
        --disable-open-folder \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_FLEET_CLIENT_CERTIFICATE:+--fleet-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
        ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
        ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
        ${ENABLE_SCRIPTS:+--enable-scripts} \
        --update-url=$MSI_TUF_URL
fi

echo "Packages generated."

if [[ $OSTYPE == 'darwin'* && -n "$INSTALL_PKG" ]]; then
    sudo installer -pkg fleet-osquery.pkg -target /
fi