fix: restore current platform compatibility

Author: damacus

LIMITATIONS.md

@@ -43,11 +43,17 @@ Practical limitation:
   as support commitments
 - Ubuntu 18.04 and 20.04 remain available in the archive, but 18.04 is ESM-only
   and 20.04 standard support ended on 2025-05-31
+- Debian 13 package metadata currently requires a compatibility fallback in this
+  cookbook: the Atomicorp signing path is not accepted by current apt policy, so
+  the cookbook enables `trusted=yes` for Debian 13 only to keep installs working
 
 ### DNF/YUM (RHEL family / Amazon / Fedora)
 
 - Repository base URL used by the cookbook:
-  `https://updates.atomicorp.com/channels/atomic/centos/$releasever/$basearch`
+  - RHEL-family / Fedora:
+    `https://updates.atomicorp.com/channels/atomic/centos/$releasever/$basearch`
+  - Amazon Linux:
+    `https://updates.atomicorp.com/channels/atomic/amazon/<major>/$basearch`
 - Current cookbook GPG key:
   `https://www.atomicorp.com/RPM-GPG-KEY.atomicorp.txt`
 
@@ -82,6 +88,8 @@ Practical limitation:
 - The cookbook's hard-coded `centos/$releasever/$basearch` path is a legacy
   abstraction across EL-style systems, not a guarantee of explicit vendor test
   coverage for every clone
+- Amazon Linux 2023 requires its own `amazon/2023/$basearch` repository path;
+  the generic EL/CentOS path does not resolve current Amazon packages reliably
 
 ### Zypper (SUSE)
 

libraries/helpers.rb

@@ -15,6 +15,18 @@ def ossec_apt_repo_dist
       end
     end
 
+    def ossec_apt_repo_trusted?
+      platform?('debian') && node['platform_version'].to_i == 13
+    end
+
+    def ossec_yum_repo_baseurl
+      if platform?('amazon')
+        "https://updates.atomicorp.com/channels/atomic/amazon/#{node['platform_version'].to_i}/$basearch"
+      else
+        'https://updates.atomicorp.com/channels/atomic/centos/$releasever/$basearch'
+      end
+    end
+
     def ossec_deb_arch
       case node['kernel']['machine']
       when 'aarch64', 'arm64'

resources/ossec_config.rb

@@ -39,7 +39,6 @@ def default_type_conf
           'log_alert_level' => 1,
         },
       }.tap do |conf|
-        conf['alerts']['use_geoip'] = false unless platform_family?('debian')
         conf['remote'] = { 'connection' => 'secure' } if new_resource.install_type == 'server'
       end
     when 'agent'

resources/ossec_repository.rb

@@ -16,12 +16,13 @@
       arch ossec_deb_arch
       distribution ossec_apt_repo_dist
       components %w(main)
+      trusted ossec_apt_repo_trusted?
       action :add
     end
   when 'rhel', 'fedora', 'amazon'
     yum_repository 'ossec' do
       description 'Atomicorp OSSEC packages'
-      baseurl 'https://updates.atomicorp.com/channels/atomic/centos/$releasever/$basearch'
+      baseurl ossec_yum_repo_baseurl
       gpgkey 'https://www.atomicorp.com/RPM-GPG-KEY.atomicorp.txt'
       gpgcheck true
       enabled true

spec/helpers_spec.rb

@@ -28,6 +28,18 @@ def platform_family?(*families)
     Fauxhai.mock(platform: 'ubuntu', version: '24.04').data
   end
 
+  let(:debian_13_node) do
+    Fauxhai.mock(platform: 'debian', version: '13').data
+  end
+
+  let(:debian_12_node) do
+    Fauxhai.mock(platform: 'debian', version: '12').data
+  end
+
+  let(:amazon_2023_node) do
+    Fauxhai.mock(platform: 'amazon', version: '2023').data
+  end
+
   subject(:helper) { helper_class.new(ubuntu_node) }
 
   it 'uses the suite codename for the apt distribution on Ubuntu 24.04' do
@@ -37,4 +49,22 @@ def platform_family?(*families)
   it 'returns the correct server package name' do
     expect(helper.ossec_package_name('server')).to eq('ossec-hids-server')
   end
+
+  it 'marks Debian 13 repositories as trusted for apt' do
+    expect(helper_class.new(debian_13_node).ossec_apt_repo_trusted?).to be(true)
+  end
+
+  it 'does not mark Debian 12 repositories as trusted for apt' do
+    expect(helper_class.new(debian_12_node).ossec_apt_repo_trusted?).to be(false)
+  end
+
+  it 'does not mark Ubuntu repositories as trusted for apt' do
+    expect(helper.ossec_apt_repo_trusted?).to be(false)
+  end
+
+  it 'uses the Amazon 2023 repository path on Amazon Linux 2023' do
+    expect(helper_class.new(amazon_2023_node).ossec_yum_repo_baseurl).to eq(
+      'https://updates.atomicorp.com/channels/atomic/amazon/2023/$basearch'
+    )
+  end
 end

spec/unit/resources/ossec_config_spec.rb

@@ -25,3 +25,23 @@
     expect(chef_run).to create_file('/var/ossec/etc/shared/agent.conf')
   end
 end
+
+describe 'ossec_config on rockylinux-9' do
+  step_into :ossec_config
+  platform 'rocky', '9'
+
+  before do
+    allow(File).to receive(:exist?).and_call_original
+    allow(File).to receive(:exist?).with('/var/ossec/etc/client.keys').and_return(true)
+    allow(File).to receive(:empty?).and_call_original
+    allow(File).to receive(:empty?).with('/var/ossec/etc/client.keys').and_return(false)
+  end
+
+  recipe do
+    ossec_config 'local'
+  end
+
+  it 'does not include unsupported use_geoip in ossec.conf' do
+    expect(chef_run.file('/var/ossec/etc/ossec.conf').content).not_to include('use_geoip')
+  end
+end

spec/unit/resources/ossec_repository_spec.rb

@@ -17,6 +17,44 @@
     end
   end
 
+  context 'on debian-13' do
+    platform 'debian', '13'
+
+    recipe do
+      ossec_repository 'default'
+    end
+
+    it 'creates the apt repository as trusted' do
+      expect(chef_run).to add_apt_repository('ossec').with(trusted: true)
+    end
+  end
+
+  context 'on debian-12' do
+    platform 'debian', '12'
+
+    recipe do
+      ossec_repository 'default'
+    end
+
+    it 'creates the apt repository without trusted mode' do
+      expect(chef_run).to add_apt_repository('ossec').with(trusted: false)
+    end
+  end
+
+  context 'on amazonlinux-2023' do
+    platform 'amazon', '2023'
+
+    recipe do
+      ossec_repository 'default'
+    end
+
+    it 'uses the Amazon Linux repository path' do
+      expect(chef_run).to create_yum_repository('ossec').with(
+        baseurl: 'https://updates.atomicorp.com/channels/atomic/amazon/2023/$basearch'
+      )
+    end
+  end
+
   context 'on rockylinux-9' do
     platform 'rocky', '9'