From dd9ee33cd5b227e197742d9a48954406cb55bddb Mon Sep 17 00:00:00 2001 From: cproudlock Date: Tue, 13 Oct 2026 16:58:55 -0400 Subject: [PATCH] Playbook: tools and Zscaler root CA the webapp Updates pages need sbsigntool, zip and curl, the Zscaler root CA in the system store (GitHub is TLS-intercepted on the corporate NIC; downloads.dell.com is not), and /var/lib/pxe-webapp/updates. --- playbook/certs/zscaler-root-ca.crt | 28 ++++++++++++ playbook/pxe_server_setup.yml | 68 +++++++++++++++++++++++++++++- scripts/download-packages.sh | 4 ++ 3 files changed, 98 insertions(+), 2 deletions(-) create mode 100755 playbook/certs/zscaler-root-ca.crt diff --git a/playbook/certs/zscaler-root-ca.crt b/playbook/certs/zscaler-root-ca.crt new file mode 100755 index 0000000..45e3a29 --- /dev/null +++ b/playbook/certs/zscaler-root-ca.crt @@ -0,0 +1,28 @@ +-----BEGIN CERTIFICATE----- +MIIE0zCCA7ugAwIBAgIJANu+mC2Jt3uTMA0GCSqGSIb3DQEBCwUAMIGhMQswCQYD +VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2Ux +FTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMMWnNjYWxlciBJbmMuMRgw +FgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG9w0BCQEWE3N1cHBvcnRA +enNjYWxlci5jb20wHhcNMTQxMjE5MDAyNzU1WhcNNDIwNTA2MDAyNzU1WjCBoTEL +MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExETAPBgNVBAcTCFNhbiBK +b3NlMRUwEwYDVQQKEwxac2NhbGVyIEluYy4xFTATBgNVBAsTDFpzY2FsZXIgSW5j +LjEYMBYGA1UEAxMPWnNjYWxlciBSb290IENBMSIwIAYJKoZIhvcNAQkBFhNzdXBw +b3J0QHpzY2FsZXIuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +qT7STSxZRTgEFFf6doHajSc1vk5jmzmM6BWuOo044EsaTc9eVEV/HjH/1DWzZtcr +fTj+ni205apMTlKBW3UYR+lyLHQ9FoZiDXYXK8poKSV5+Tm0Vls/5Kb8mkhVVqv7 +LgYEmvEY7HPY+i1nEGZCa46ZXCOohJ0mBEtB9JVlpDIO+nN0hUMAYYdZ1KZWCMNf +5J/aTZiShsorN2A38iSOhdd+mcRM4iNL3gsLu99XhKnRqKoHeH83lVdfu1XBeoQz +z5V6gA3kbRvhDwoIlTBeMa5l4yRdJAfdpkbFzqiwSgNdhbxTHnYYorDzKfr2rEFM +dsMU0DHdeAZf711+1CunuQIDAQABo4IBCjCCAQYwHQYDVR0OBBYEFLm33UrNww4M +hp1d3+wcBGnFTpjfMIHWBgNVHSMEgc4wgcuAFLm33UrNww4Mhp1d3+wcBGnFTpjf +oYGnpIGkMIGhMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8G +A1UEBxMIU2FuIEpvc2UxFTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMM +WnNjYWxlciBJbmMuMRgwFgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG +9w0BCQEWE3N1cHBvcnRAenNjYWxlci5jb22CCQDbvpgtibd7kzAMBgNVHRMEBTAD +AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAw0NdJh8w3NsJu4KHuVZUrmZgIohnTm0j+ +RTmYQ9IKA/pvxAcA6K1i/LO+Bt+tCX+C0yxqB8qzuo+4vAzoY5JEBhyhBhf1uK+P +/WVWFZN/+hTgpSbZgzUEnWQG2gOVd24msex+0Sr7hyr9vn6OueH+jj+vCMiAm5+u +kd7lLvJsBu3AO3jGWVLyPkS3i6Gf+rwAp1OsRrv3WnbkYcFf9xjuaf4z0hRCrLN2 +xFNjavxrHmsH8jPHVvgc1VD0Opja0l/BRVauTrUaoW6tE+wFG5rEcPGS80jjHK4S +pB5iDj2mUZH1T8lzYtuZy0ZPirxmtsk3135+CKNa2OCAhhFjE0xd +-----END CERTIFICATE----- diff --git a/playbook/pxe_server_setup.yml b/playbook/pxe_server_setup.yml index 6d56683..aff6ae8 100644 --- a/playbook/pxe_server_setup.yml +++ b/playbook/pxe_server_setup.yml @@ -18,6 +18,10 @@ - ansible - wimtools - conntrack + - sbsigntool # sbverify: iPXE update signature checks + - p7zip-full # 7z: Dell driver packs, catalog cabs, Blancco ISO + - zip # driver zips PESetup unpacks + - curl # Updates page downloads register: pkg_check failed_when: false changed_when: false @@ -34,6 +38,12 @@ samba_share: "/srv/samba/winpeapps" usb_mount: "/mnt/usb/playbook" # playbook location on USB usb_root: "/mnt/usb" # CIDATA partition root + # Zscaler Root CA: GE's Zscaler re-signs GitHub TLS, so the iPXE update + # check fails without it. Repo copy first, else the copy on the image share. + zscaler_ca_src: "{{ playbook_dir }}/certs/zscaler-root-ca.crt" + # _media/ links the base image's entries, so also look in the + # image roots (on a rebuild the _media views may not exist yet). + zscaler_ca_share_glob: "{{ samba_share }}/_media/*/Deploy/Applications/ZscalerCommercialCertificate-2048-SHA256.crt {{ samba_share }}/gea-*/Deploy/Applications/ZscalerCommercialCertificate-2048-SHA256.crt" image_types: - gea-standard - gea-engineer @@ -41,8 +51,9 @@ shopfloor_types: - gea-shopfloor # Image variants that share the generic Win10/Win11 unattend - # (gea-standard is now Win11, gea-engineer is Win10 — same unattend file - # drives both because the RunSynchronous entries are OS-version-agnostic). + # (gea-standard and gea-engineer both deploy Win11 Pro 24H2 now; the same + # unattend file drives both because the RunSynchronous entries are + # OS-version-agnostic). standard_types: - gea-standard - gea-engineer @@ -1067,6 +1078,59 @@ content: | @reboot root /bin/sleep 15 && /usr/bin/systemctl restart dnsmasq.service + # --- Updates pages (Dell drivers/BIOS, iPXE, Blancco) --- + # The webapp downloads from downloads.dell.com and GitHub through the + # corporate NIC and unpacks with 7z/zip; sbverify checks iPXE signatures. + - name: "Install tools the webapp Updates pages need (if missing)" + apt: + name: + - sbsigntool + - p7zip-full + - zip + - unzip + - curl + state: present + ignore_errors: yes + + - name: "Find the Zscaler Root CA (playbook copy, else the image share)" + shell: | + for f in "{{ zscaler_ca_src }}" {{ zscaler_ca_share_glob }}; do + if [ -f "$f" ] && grep -q "BEGIN CERTIFICATE" "$f"; then + echo "$f" + exit 0 + fi + done + register: zscaler_ca + changed_when: false + failed_when: false + + - name: "Install the Zscaler Root CA into the system trust store" + copy: + src: "{{ zscaler_ca.stdout_lines[0] }}" + dest: /usr/local/share/ca-certificates/zscaler-root-ca.crt + owner: root + group: root + mode: '0644' + when: zscaler_ca.stdout_lines | length > 0 + register: zscaler_ca_copy + + - name: "Rebuild the system CA bundle" + command: update-ca-certificates + when: zscaler_ca_copy is changed + + - name: "Warn when no Zscaler Root CA was found" + debug: + msg: "WARNING: no Zscaler Root CA at {{ zscaler_ca_src }} or {{ zscaler_ca_share_glob }}; GitHub (iPXE update check) will fail TLS until it is installed." + when: zscaler_ca.stdout_lines | length == 0 + + - name: "Create webapp Updates state directory" + file: + path: /var/lib/pxe-webapp/updates + state: directory + owner: root + group: root + mode: '0755' + # --- Web Management App (Flask) --- - name: "Create webapp directory" file: diff --git a/scripts/download-packages.sh b/scripts/download-packages.sh index d74807d..0004d81 100755 --- a/scripts/download-packages.sh +++ b/scripts/download-packages.sh @@ -67,6 +67,10 @@ PLAYBOOK_PACKAGES=( busybox-static zstd cpio + # Updates pages in the webapp (iPXE signature check, Dell pack zips, downloads) + sbsigntool + zip + curl ) # Packages installed during autoinstall late-commands (NetworkManager, WiFi, etc.)