mirror of
https://github.com/fleetdm/fleet
synced 2026-05-21 16:08:47 +00:00
4a09cd1ce8
#19126 Validate base-fleetd daily Workflow run: https://github.com/fleetdm/fleet/actions/runs/9781375393
110 lines
4.1 KiB
YAML
110 lines
4.1 KiB
YAML
name: Verify fleetd-base files at https://download.fleetdm.com
|
|
|
|
on:
|
|
workflow_dispatch: # Manual
|
|
inputs:
|
|
base-url:
|
|
description: 'The base URL to download the files from'
|
|
required: false
|
|
default: 'https://download.fleetdm.com'
|
|
type: string
|
|
workflow_call:
|
|
inputs:
|
|
base-url:
|
|
description: 'The base URL to download the files from'
|
|
required: false
|
|
default: 'https://download.fleetdm.com'
|
|
type: string
|
|
schedule:
|
|
- cron: '0 5 * * *' # Nightly 5AM UTC, not at the same time as release-fleetd-base workflow
|
|
|
|
# This workflow is called by release-fleetd-base workflow, so it does not have its own concurrency group.
|
|
|
|
defaults:
|
|
run:
|
|
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
|
shell: bash
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify-checksums:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
BASE_URL: ${{ github.event.inputs.base-url || 'https://download.fleetdm.com' }}
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Verify checksums
|
|
run: |
|
|
curl -O ${{ env.BASE_URL }}/stable/meta.json
|
|
curl -O ${{ env.BASE_URL }}/stable/fleetd-base.msi
|
|
fleetd_base_msi_sha256=$(shasum -a 256 fleetd-base.msi | cut -d ' ' -f 1)
|
|
if [ "$(jq --raw-output '.fleetd_base_msi_sha256' meta.json)" != "$fleetd_base_msi_sha256" ]; then
|
|
echo "Checksum mismatch for fleetd-base.msi"
|
|
exit 1
|
|
else
|
|
echo "Checksum matches for fleetd-base.msi"
|
|
fi
|
|
curl -O ${{ env.BASE_URL }}/stable/fleetd-base.pkg
|
|
fleetd_base_pkg_sha256=$(shasum -a 256 fleetd-base.pkg | cut -d ' ' -f 1)
|
|
if [ "$(jq --raw-output '.fleetd_base_pkg_sha256' meta.json)" != "$fleetd_base_pkg_sha256" ]; then
|
|
echo "Checksum mismatch for fleetd-base.pkg"
|
|
exit 1
|
|
else
|
|
echo "Checksum matches for fleetd-base.pkg"
|
|
fi
|
|
: # Check the files at the permalinks
|
|
curl -o fleetd-base-permalink.msi "$(jq --raw-output '.fleetd_base_msi_url' meta.json)"
|
|
diff fleetd-base.msi fleetd-base-permalink.msi
|
|
curl -o fleetd-base-permalink.pkg "$(jq --raw-output '.fleetd_base_pkg_url' meta.json)"
|
|
diff fleetd-base.pkg fleetd-base-permalink.pkg
|
|
|
|
verify-fleetd-base-msi:
|
|
runs-on: windows-latest
|
|
env:
|
|
BASE_URL: ${{ github.event.inputs.base-url || 'https://download.fleetdm.com' }}
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Download fleetd-base.msi
|
|
shell: powershell
|
|
run: |
|
|
Invoke-WebRequest "${{ env.BASE_URL }}/stable/fleetd-base.msi" -OutFile "fleetd-base.msi"
|
|
if (! $?) { exit 1 }
|
|
Get-ChildItem
|
|
|
|
- name: Install fleetd-base.msi
|
|
shell: powershell
|
|
run: |
|
|
Start-Process msiexec "/i fleetd-base.msi /qn FLEET_URL='https://fleet.example.com' FLEET_SECRET='insecure'" -Wait
|
|
if (! $?) { exit 1 }
|
|
Start-Sleep -Seconds 5
|
|
cd "C:\Windows\System32\config\systemprofile\AppData\Local\FleetDM\Orbit\Logs"
|
|
Get-ChildItem
|
|
if (!(Test-Path "C:\Windows\System32\config\systemprofile\AppData\Local\FleetDM\Orbit\Logs\orbit-osquery.log" -PathType Leaf)) { exit 1 }
|
|
|
|
verify-fleetd-base-pkg:
|
|
runs-on: macos-latest
|
|
env:
|
|
BASE_URL: ${{ github.event.inputs.base-url || 'https://download.fleetdm.com' }}
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Download fleetd-base.pkg
|
|
run: |
|
|
curl -O ${{ env.BASE_URL }}/stable/fleetd-base.pkg
|
|
|
|
- name: Install fleetd-base.pkg
|
|
run: |
|
|
sudo installer -pkg fleetd-base.pkg -target /
|