add vex tarball downloader for IoP

Author: pfreyburg

src/roles/iop_core/tasks/main.yaml

@@ -52,6 +52,10 @@
   ansible.builtin.include_role:
     name: iop_cvemap_downloader
 
+- name: Deploy IOP VEX Downloader
+  ansible.builtin.include_role:
+    name: iop_vex_downloader
+
 - name: Deploy IOP VMAAS service
   ansible.builtin.include_role:
     name: iop_vmaas

src/roles/iop_vex_downloader/defaults/main.yaml

@@ -0,0 +1,6 @@
+---
+iop_vex_downloader_base_url: "https://security.access.redhat.com/data/csaf/v2/vex/"
+iop_vex_downloader_latest_filename: "archive_latest.txt"
+iop_vex_downloader_output_dir: "/var/www/html/pub/iop/data/csaf/v2/vex/"
+iop_vex_downloader_output_filename: "vex-latest.tar.zst"
+iop_vex_downloader_timer_interval: "7d"

src/roles/iop_vex_downloader/files/iop-vex-download.path

@@ -0,0 +1,9 @@
+[Unit]
+Description=Path unit for vex-latest.tar.zst manual file watcher
+
+[Path]
+PathChanged=/var/lib/foreman/vex-latest.tar.zst
+PathModified=/var/lib/foreman/vex-latest.tar.zst
+
+[Install]
+WantedBy=multi-user.target

src/roles/iop_vex_downloader/handlers/main.yaml

@@ -0,0 +1,10 @@
+---
+- name: Restart vex download timer
+  ansible.builtin.systemd:
+    name: iop-vex-download.timer
+    state: restarted
+
+- name: Restart vex download path
+  ansible.builtin.systemd:
+    name: iop-vex-download.path
+    state: restarted

src/roles/iop_vex_downloader/tasks/main.yaml

@@ -0,0 +1,61 @@
+---
+- name: Install vex download script
+  ansible.builtin.template:
+    src: iop-vex-downloader.sh.j2
+    dest: /usr/local/bin/iop-vex-downloader.sh
+    owner: root
+    group: root
+    mode: '0755'
+
+- name: Create vex download service unit
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/iop-vex-download.service
+    content: |
+      [Unit]
+      Description=Manages vex-latest.tar.zst for IoP Vulnerability
+      After=network-online.target iop-core-gateway.service
+      Wants=network-online.target iop-core-gateway.service
+
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/local/bin/iop-vex-downloader.sh \
+        '{{ iop_vex_downloader_base_url }}' \
+        '{{ iop_vex_downloader_latest_filename }}' \
+        '{{ iop_vex_downloader_output_dir }}' \
+        '{{ iop_vex_downloader_output_filename }}'
+      User=root
+      Group=root
+    mode: '0644'
+
+- name: Create vex download timer unit
+  ansible.builtin.template:
+    src: iop-vex-download.timer.j2
+    dest: /etc/systemd/system/iop-vex-download.timer
+    mode: '0644'
+  notify: Restart vex download timer
+
+- name: Create vex download path unit
+  ansible.builtin.copy:
+    src: iop-vex-download.path
+    dest: /etc/systemd/system/iop-vex-download.path
+    mode: '0644'
+  notify: Restart vex download path
+
+- name: Reload systemd daemon
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- name: Enable and start vex download timer
+  ansible.builtin.systemd:
+    name: iop-vex-download.timer
+    enabled: true
+    state: started
+
+- name: Enable and start vex download path watcher
+  ansible.builtin.systemd:
+    name: iop-vex-download.path
+    enabled: true
+    state: started

src/roles/iop_vex_downloader/templates/iop-vex-download.timer.j2

@@ -0,0 +1,9 @@
+[Unit]
+Description=Timer for vex-latest.tar.zst download
+
+[Timer]
+OnActiveSec=0
+OnUnitActiveSec={{ iop_vex_downloader_timer_interval }}
+
+[Install]
+WantedBy=timers.target

src/roles/iop_vex_downloader/templates/iop-vex-downloader.sh.j2

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+set -euo pipefail
+
+URL="${1:-}"
+FILENAME_LATEST="${2:-}"
+OUTPUT_DIR="${3:-}"
+OUTPUT_FILENAME="${4:-}"
+
+if [[ -z "$URL" || -z "$OUTPUT_DIR" || -z "$FILENAME_LATEST" || -z "$OUTPUT_FILENAME" ]]; then
+    echo "Usage: $0 URL FILENAME_LATEST OUTPUT_DIR OUTPUT_FILENAME" >&2
+    echo "Example: $0 https://security.access.redhat.com/data/csaf/v2/vex/ archive_latest.txt /root/download/ vex-latest.tar.zst" >&2
+    exit 1
+fi
+
+URL="${URL%/}/"
+OUTPUT_DIR="${OUTPUT_DIR%/}/"
+
+ARCHIVE_DOWNLOAD_NAME_CONTENT=$(curl -sf $URL$FILENAME_LATEST)
+
+if [ "$?" -ne 0 ]; then
+    echo "Error: The tarball's name wasn't downloaded" >&2
+    exit 1
+fi
+
+mkdir -p "$OUTPUT_DIR"
+
+curl -sf $URL$ARCHIVE_DOWNLOAD_NAME_CONTENT -o $OUTPUT_DIR$OUTPUT_FILENAME
+
+RET=$?
+
+if [ "$RET" -ne 0 ]; then
+    echo "Error: Downloading of tarball failed. Curl failed with code $RET" >&2
+    exit 2
+fi
+
+curl -sf $URL$ARCHIVE_DOWNLOAD_NAME_CONTENT".asc" -o $OUTPUT_DIR$OUTPUT_FILENAME".asc"
+
+RET=$?
+
+if [ "$RET" -ne 0 ]; then
+    echo "Error: Downloading of tarball's signature failed. Curl failed with code $RET" >&2
+    exit 3
+fi