Playbook: tools and Zscaler root CA the webapp Updates pages need

sbsigntool, zip and curl, the Zscaler root CA in the system store (GitHub is
TLS-intercepted on the corporate NIC; downloads.dell.com is not), and
/var/lib/pxe-webapp/updates.

playbook/certs/zscaler-root-ca.crt

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIE0zCCA7ugAwIBAgIJANu+mC2Jt3uTMA0GCSqGSIb3DQEBCwUAMIGhMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2Ux
+FTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMMWnNjYWxlciBJbmMuMRgw
+FgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG9w0BCQEWE3N1cHBvcnRA
+enNjYWxlci5jb20wHhcNMTQxMjE5MDAyNzU1WhcNNDIwNTA2MDAyNzU1WjCBoTEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExETAPBgNVBAcTCFNhbiBK
+b3NlMRUwEwYDVQQKEwxac2NhbGVyIEluYy4xFTATBgNVBAsTDFpzY2FsZXIgSW5j
+LjEYMBYGA1UEAxMPWnNjYWxlciBSb290IENBMSIwIAYJKoZIhvcNAQkBFhNzdXBw
+b3J0QHpzY2FsZXIuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+qT7STSxZRTgEFFf6doHajSc1vk5jmzmM6BWuOo044EsaTc9eVEV/HjH/1DWzZtcr
+fTj+ni205apMTlKBW3UYR+lyLHQ9FoZiDXYXK8poKSV5+Tm0Vls/5Kb8mkhVVqv7
+LgYEmvEY7HPY+i1nEGZCa46ZXCOohJ0mBEtB9JVlpDIO+nN0hUMAYYdZ1KZWCMNf
+5J/aTZiShsorN2A38iSOhdd+mcRM4iNL3gsLu99XhKnRqKoHeH83lVdfu1XBeoQz
+z5V6gA3kbRvhDwoIlTBeMa5l4yRdJAfdpkbFzqiwSgNdhbxTHnYYorDzKfr2rEFM
+dsMU0DHdeAZf711+1CunuQIDAQABo4IBCjCCAQYwHQYDVR0OBBYEFLm33UrNww4M
+hp1d3+wcBGnFTpjfMIHWBgNVHSMEgc4wgcuAFLm33UrNww4Mhp1d3+wcBGnFTpjf
+oYGnpIGkMIGhMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8G
+A1UEBxMIU2FuIEpvc2UxFTATBgNVBAoTDFpzY2FsZXIgSW5jLjEVMBMGA1UECxMM
+WnNjYWxlciBJbmMuMRgwFgYDVQQDEw9ac2NhbGVyIFJvb3QgQ0ExIjAgBgkqhkiG
+9w0BCQEWE3N1cHBvcnRAenNjYWxlci5jb22CCQDbvpgtibd7kzAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAw0NdJh8w3NsJu4KHuVZUrmZgIohnTm0j+
+RTmYQ9IKA/pvxAcA6K1i/LO+Bt+tCX+C0yxqB8qzuo+4vAzoY5JEBhyhBhf1uK+P
+/WVWFZN/+hTgpSbZgzUEnWQG2gOVd24msex+0Sr7hyr9vn6OueH+jj+vCMiAm5+u
+kd7lLvJsBu3AO3jGWVLyPkS3i6Gf+rwAp1OsRrv3WnbkYcFf9xjuaf4z0hRCrLN2
+xFNjavxrHmsH8jPHVvgc1VD0Opja0l/BRVauTrUaoW6tE+wFG5rEcPGS80jjHK4S
+pB5iDj2mUZH1T8lzYtuZy0ZPirxmtsk3135+CKNa2OCAhhFjE0xd
+-----END CERTIFICATE-----

playbook/pxe_server_setup.yml

@@ -18,6 +18,10 @@
         - ansible
         - wimtools
         - conntrack
+        - sbsigntool    # sbverify: iPXE update signature checks
+        - p7zip-full    # 7z: Dell driver packs, catalog cabs, Blancco ISO
+        - zip           # driver zips PESetup unpacks
+        - curl          # Updates page downloads
       register: pkg_check
       failed_when: false
       changed_when: false
@@ -34,6 +38,12 @@
     samba_share: "/srv/samba/winpeapps"
     usb_mount: "/mnt/usb/playbook"     # playbook location on USB
     usb_root: "/mnt/usb"               # CIDATA partition root
+    # Zscaler Root CA: GE's Zscaler re-signs GitHub TLS, so the iPXE update
+    # check fails without it. Repo copy first, else the copy on the image share.
+    zscaler_ca_src: "{{ playbook_dir }}/certs/zscaler-root-ca.crt"
+    # _media/<pctype> links the base image's entries, so also look in the
+    # image roots (on a rebuild the _media views may not exist yet).
+    zscaler_ca_share_glob: "{{ samba_share }}/_media/*/Deploy/Applications/ZscalerCommercialCertificate-2048-SHA256.crt {{ samba_share }}/gea-*/Deploy/Applications/ZscalerCommercialCertificate-2048-SHA256.crt"
     image_types:
       - gea-standard
       - gea-engineer
@@ -41,8 +51,9 @@
     shopfloor_types:
       - gea-shopfloor
     # Image variants that share the generic Win10/Win11 unattend
-    # (gea-standard is now Win11, gea-engineer is Win10 — same unattend file
-    # drives both because the RunSynchronous entries are OS-version-agnostic).
+    # (gea-standard and gea-engineer both deploy Win11 Pro 24H2 now; the same
+    # unattend file drives both because the RunSynchronous entries are
+    # OS-version-agnostic).
     standard_types:
       - gea-standard
       - gea-engineer
@@ -1067,6 +1078,59 @@
         content: |
           @reboot root /bin/sleep 15 && /usr/bin/systemctl restart dnsmasq.service
 
+    # --- Updates pages (Dell drivers/BIOS, iPXE, Blancco) ---
+    # The webapp downloads from downloads.dell.com and GitHub through the
+    # corporate NIC and unpacks with 7z/zip; sbverify checks iPXE signatures.
+    - name: "Install tools the webapp Updates pages need (if missing)"
+      apt:
+        name:
+          - sbsigntool
+          - p7zip-full
+          - zip
+          - unzip
+          - curl
+        state: present
+      ignore_errors: yes
+
+    - name: "Find the Zscaler Root CA (playbook copy, else the image share)"
+      shell: |
+        for f in "{{ zscaler_ca_src }}" {{ zscaler_ca_share_glob }}; do
+          if [ -f "$f" ] && grep -q "BEGIN CERTIFICATE" "$f"; then
+            echo "$f"
+            exit 0
+          fi
+        done
+      register: zscaler_ca
+      changed_when: false
+      failed_when: false
+
+    - name: "Install the Zscaler Root CA into the system trust store"
+      copy:
+        src: "{{ zscaler_ca.stdout_lines[0] }}"
+        dest: /usr/local/share/ca-certificates/zscaler-root-ca.crt
+        owner: root
+        group: root
+        mode: '0644'
+      when: zscaler_ca.stdout_lines | length > 0
+      register: zscaler_ca_copy
+
+    - name: "Rebuild the system CA bundle"
+      command: update-ca-certificates
+      when: zscaler_ca_copy is changed
+
+    - name: "Warn when no Zscaler Root CA was found"
+      debug:
+        msg: "WARNING: no Zscaler Root CA at {{ zscaler_ca_src }} or {{ zscaler_ca_share_glob }}; GitHub (iPXE update check) will fail TLS until it is installed."
+      when: zscaler_ca.stdout_lines | length == 0
+
+    - name: "Create webapp Updates state directory"
+      file:
+        path: /var/lib/pxe-webapp/updates
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+
     # --- Web Management App (Flask) ---
     - name: "Create webapp directory"
       file:

scripts/download-packages.sh

@@ -67,6 +67,10 @@ PLAYBOOK_PACKAGES=(
     busybox-static
     zstd
     cpio
+    # Updates pages in the webapp (iPXE signature check, Dell pack zips, downloads)
+    sbsigntool
+    zip
+    curl
 )
 
 # Packages installed during autoinstall late-commands (NetworkManager, WiFi, etc.)