geenforce: HTTPS payload delivery (blob store + endpoint)

plugins/geenforce/models/__init__.py

@@ -10,6 +10,7 @@ from .manifest import (
     ManifestInUseCheckProcess,
     ManifestPublishedVersion,
     ManifestPayload,
+    ManifestBlob,
     ManifestEnforcementReport,
     ManifestEnforcementResult,
     PcTypeAlias,

plugins/geenforce/models/manifest.py

@@ -351,3 +351,21 @@ class PcTypeAlias(db.Model):
     __table_args__ = (
         db.UniqueConstraint('aliasgroup', 'aliasname', name='uq_alias_group_name'),
     )
+
+
+class ManifestBlob(db.Model):
+    """Content-addressed payload blob for http-delivered installers.
+
+    Bytes live on disk at <instance>/geenforce/payloads/<sha256> (deduped by
+    content, so a payload shared by many entries is stored once). Manifest
+    entries reference a blob by payloadsha256; the client fetches it from
+    GET /api/geenforce/payload/<sha256> over HTTPS and verifies the hash. This
+    is how big installers reach share-less (Intune/local-account) PCs.
+    """
+    __tablename__ = 'manifestblobs'
+
+    sha256 = db.Column(db.String(64), primary_key=True)
+    filename = db.Column(db.String(255), nullable=False)
+    contenttype = db.Column(db.String(128), nullable=True)
+    sizebytes = db.Column(db.BigInteger, nullable=False)
+    createdat = db.Column(db.DateTime, nullable=False)