blancco: CMMC evidence pack, ServiceNow tick list, cloud-upload status

Automates the Blancco parts of the onsite-support CMMC playbook:

- ENT-056/158 evidence pack: /reports/evidence?month=YYYY-MM returns
  ENT-056_<Site>_<YYYY-MM>.zip (summary.csv, README, each report's XML
  and PDF). pxe-blancco-evidence.timer saves last month's pack to the
  reports share's evidence/ folder on the 1st (Persistent).
- ENT-045/159 ServiceNow tick list: /reports/servicenow lists recent
  reports as "Wiped" or "Blancco Wipe failed" with a pre-written
  destruction note, copy buttons and Done (CSRF-protected).
- Cloud upload: blancco-progress.py posts each report's upload result
  ("Sending report document id" -> "Report sent to MC") to
  /reports/cloud-status (CSRF-exempt like /imaging/status); the Reports
  page and the CSVs show it, so a wipe missing from BMP is visible.
- CSV gains failure_reason (exception messages, failed steps, error
  counts), business_location and cloud_upload.
- Preferences: business_location "West Jefferson" (config.BLANCCO_SITE)
  and pdf+xml reports; the report copier now copies the PDF too, named
  after its XML. .part and hidden files are not listed as reports.

State (cloud confirmations, ServiceNow ticks) is a JSON file at
/var/lib/pxe-webapp/blancco-state.json, off the report share.

playbook/blancco-init.sh

@@ -291,33 +291,39 @@ cat > /run/newroot/usr/local/sbin/blancco-report-sync << 'XEOF'
 #!/bin/bash
 # Copy Blancco reports to the SMB report share.
 #
-# In process=auto Albus saves each report to /reports/<document_id>.xml and
-# uploads it to the cloud, but never writes the share: auto_backup is
-# forced off outside workflow/manual mode. Albus has the share mounted at
-# /mnt/share already, so copy each finished report there, named the way a
-# manual Save names it (UTC YYYYMMDD_HHMMSS_report.xml).
+# In process=auto Albus saves each report to /reports/<document_id>.xml
+# (and .pdf when pdf+xml is selected) and uploads it to the cloud, but never
+# writes the share: auto_backup is forced off outside workflow/manual mode.
+# Albus has the share mounted at /mnt/share already, so copy each finished
+# file there, named the way a manual Save names it (UTC
+# YYYYMMDD_HHMMSS_report.<ext>, the time taken from the XML so the PDF of
+# the same report gets the same name).
 # Usage: blancco-report-sync [--once]
 DONE=/var/lib/blancco-report-sync
 mkdir -p "$DONE"
 while :; do
-    for f in /reports/*.xml; do
+    for f in /reports/*.xml /reports/*.pdf; do
         [ -s "$f" ] || continue
-        id=$(basename "$f" .xml)
-        [ -e "$DONE/$id" ] && continue
+        base=$(basename "$f")
+        [ -e "$DONE/$base" ] && continue
         # Leave files Albus may still be writing.
         [ $(( $(date +%s) - $(stat -c %Y "$f") )) -ge 5 ] || continue
         mountpoint -q /mnt/share || continue
-        name="$(date -u -r "$f" +%Y%m%d_%H%M%S)_report.xml"
+        id=${base%.*}
+        ext=${base##*.}
+        ref="/reports/$id.xml"
+        [ -f "$ref" ] || ref="$f"
+        name="$(date -u -r "$ref" +%Y%m%d_%H%M%S)_report.$ext"
         if cp "$f" "/mnt/share/$name.part" && mv -f "/mnt/share/$name.part" "/mnt/share/$name"; then
-            touch "$DONE/$id"
-            echo "copied $id to $name"
-            serial=$(tr -d '"\\' < /sys/class/dmi/id/product_serial 2>/dev/null)
+            touch "$DONE/$base"
+            echo "copied $base to $name"
+            serial=$(tr -d '"\\' 2>/dev/null < /sys/class/dmi/id/product_serial)
             [ -n "$serial" ] && curl -s -m 5 -o /dev/null -H 'Content-Type: application/json' \
                 -d "{\"serial\":\"$serial\",\"log_lines\":[\"Report copied to share: $name\"]}" \
                 http://172.16.9.1:9009/imaging/status || true
         else
             rm -f "/mnt/share/$name.part"
-            echo "copy of $id failed, will retry"
+            echo "copy of $base failed, will retry"
         fi
     done
     [ "$1" = "--once" ] && exit 0