Harden release downloads for TLS failures

scripts/install-ocsentinel-ninja-once.ps1

@@ -7,7 +7,39 @@ param(
 
 $ErrorActionPreference = "Stop"
 $ProgressPreference = "SilentlyContinue"
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+function Initialize-OCSentinelTls {
+    $protocols = [Net.SecurityProtocolType]::Tls12
+    if ([Enum]::GetNames([Net.SecurityProtocolType]) -contains "Tls13") {
+        $protocols = $protocols -bor [Net.SecurityProtocolType]::Tls13
+    }
+
+    [Net.ServicePointManager]::SecurityProtocol = $protocols
+    [Net.ServicePointManager]::Expect100Continue = $false
+}
+
+function Get-OCSentinelManifest {
+    param([Parameter(Mandatory)][string]$Uri)
+
+    $parameters = @{ Method = "Get"; Uri = $Uri; TimeoutSec = 60 }
+    if ((Get-Command Invoke-RestMethod).Parameters.ContainsKey("UseBasicParsing")) {
+        $parameters.UseBasicParsing = $true
+    }
+
+    for ($attempt = 1; $attempt -le 3; $attempt++) {
+        try {
+            return Invoke-RestMethod @parameters
+        }
+        catch {
+            if ($attempt -eq 3) {
+                throw "Could not retrieve the OCSentinel release manifest after 3 attempts. Verify that the device can reach gitea.officecom.cloud with TLS 1.2 or newer. Last error: $($_.Exception.Message)"
+            }
+            Start-Sleep -Seconds (3 * $attempt)
+        }
+    }
+}
+
+Initialize-OCSentinelTls
 
 function Get-NinjaValue {
     param([Parameter(Mandatory)][string]$Name)
@@ -26,7 +58,7 @@ if ([string]::IsNullOrWhiteSpace($WebhookUrl) -or [string]::IsNullOrWhiteSpace($
     throw "WebhookUrl and SecretValue must be set as NinjaOne script variables."
 }
 
-$manifest = Invoke-RestMethod -Method Get -Uri $ManifestUrl -TimeoutSec 60
+$manifest = Get-OCSentinelManifest -Uri $ManifestUrl
 if ([string]::IsNullOrWhiteSpace($manifest.artifactUrl) -or [string]::IsNullOrWhiteSpace($manifest.sha256)) {
     throw "The release manifest is incomplete."
 }