Dynamic Content Download Policy Action

The first time the client runs the ‘add nohash prefetch item’, the file is cached all through the relay chain. On the next attempt, the Relays and Root Server will refer to that previous download rather than downloading a new copy of the file. Replacing it in the Uploads folder won’t change that state.

There are some serious implications (both technical and security) around dynamic downloads. (As an aside, ‘dynamic downloads’ are any of those with a relevance substitution. In your client action, the ‘add nohash prefetch item’ is not a dynamic download, while ‘add prefetch item {line 1 of …}’ is dynamic)

With the static download, the root server and Relay can perform the ‘add nohash prefetch’ statement independently of the client. ‘manifest.txt’ ends up saved as /downloads/actionid/0 on the Root and Relay, when the client actually makes the download request it’s looking for ‘downloads/[actionid]/0’ from the Relay. The Relay, having previously cached the file, won’t go check for an update to it. Neither would the Root.

For the Dynamic Download, the client sends a DownloadRequest message to the Relay, that contains the URL, size, sha1, and sha256 of the file - the client doesn’t just ask for ‘downloads/[actionid]/1’, instead it sends the Relay an instruction to go download a file with these specifics in it. What makes the download Dynamic is that the Client tells the Relay what to go collect.

So, the approach you’re taking is very close but it’s going to take a couple of more steps, I think.

One method would be for your clients to perform a ‘download now’ to get the manifest.txt file and then parse it to generate the ‘add prefetch item’ command. That’s fairly simple, but the disadvantage is that every client has to open a direct download to the root server, which could be a performance impact (and, for security reasons I usually block clients from talking directly to the root server anyway).

The other method, which I think is preferable, is to set up a scheduled task, run one one machine (maybe on the root server itself?), to collect the file from https://server/app/file.zip, generate the manifest.txt file from that, and then attach the manifest.txt as a Site File on a Custom Site on the root server, with the ‘Send to Clients’ option.

You can get some description of posting to a Site File at https://developer.bigfix.com/rest-api/api/site.html
Your script will need to authenticate to the root server using an operator account.

From the client, instead of downloading the manifest file itself, you’d use the copy of the manifest that’s already been gathered as a Site File; do something like

add prefetch item {line 1 of file "manifest.txt" of client folders of sites whose (name of it = "My-Custom-Site-Name")}

3 Likes