Improve old escrow macOS method (#40583)

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))

orbit/changes/improve-tcl-script-escrow-old-method

@@ -0,0 +1 @@
+* Fixed old escrow method on macOS to use environment variables on the TCL script.

orbit/pkg/useraction/useraction_darwin.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
 	"os/exec"
 	"strings"
 	"text/template"
@@ -218,18 +219,20 @@ func rotateFileVaultKey(u, p string) error {
 		return errInvalidPassword
 	}
 
-	script := fmt.Sprintf(`
-		log_user 0
-		spawn fdesetup changerecovery -personal
-		expect "Enter the user name:"
-		send {%s}   
-		send \r
-		expect "Enter a password for '/', or the recovery key:"
-		send {%s}   
-		send \r
-		log_user 1
-		expect eof`, u, p)
-	out, err := exec.Command("expect", "-c", script).Output()
+	script := `
+        log_user 0
+        spawn fdesetup changerecovery -personal
+        expect "Enter the user name:"
+        send $env(FV_USER)
+        send \r
+        expect "Enter a password for '/', or the recovery key:"
+        send $env(FV_PASS)
+        send \r
+        log_user 1
+        expect eof`
+	cmd := exec.Command("expect", "-c", script)
+	cmd.Env = append(os.Environ(), "FV_USER="+u, "FV_PASS="+p)
+	out, err := cmd.Output()
 	if err != nil {
 		return fmt.Errorf("osascript failed: %w", err)
 	}

tools/tuf/test/README.md

@@ -73,6 +73,16 @@ GOARCH=arm64 \
 ./tools/tuf/test/main.sh
 ```
 
+To include Escrow Buddy, Nudge, or Swift Dialog on the TUF repository you can use the following variables:
+```sh
+[...]
+ESCROW_BUDDY=1 \
+NUDGE=1 \
+SWIFT_DIALOG=1 \
+[...]
+./tools/tuf/test/main.sh
+```
+
 # Test fleetd with expired signatures on a TUF repository
 
 To generate a TUF repository with shorter expiration time for roles you can set the following environment variables:

tools/tuf/test/create_repository.sh

@@ -40,8 +40,9 @@ SYSTEMS=${SYSTEMS:-macos linux linux-arm64 windows windows-arm64}
 
 echo "Generating components for $SYSTEMS"
 
-NUDGE_VERSION=stable
+NUDGE_VERSION=1.1.10.81462
 ESCROW_BUDDY_PKG_VERSION=1.0.0
+SWIFT_DIALOG_VERSION=2.5.6
 
 if [[ -z "$OSQUERY_VERSION" ]]; then
     OSQUERY_VERSION=5.21.0
@@ -183,37 +184,36 @@ for system in $SYSTEMS; do
             --target nudge.app.tar.gz \
             --platform macos \
             --name nudge \
-            --version $ORBIT_VERSION -t $ORBIT_MAJOR.$ORBIT_MINOR -t $ORBIT_MAJOR -t stable
+            --version $NUDGE_VERSION -t stable
         rm nudge.app.tar.gz
     fi
 
     # Add swiftDialog on macos (if enabled).
     if [[ $system == "macos" && -n "$SWIFT_DIALOG" ]]; then
-        curl https://updates.fleetdm.com/targets/swiftDialog/macos/stable/swiftDialog.app.tar.gz --output swiftDialog.app.tar.gz
+        curl https://updates.fleetdm.com/targets/swiftDialog/macos/$SWIFT_DIALOG_VERSION/swiftDialog.app.tar.gz --output swiftDialog.app.tar.gz
 
         ./build/fleetctl updates add \
             --path $TUF_PATH \
             --target swiftDialog.app.tar.gz \
             --platform macos \
             --name swiftDialog \
-            --version $ORBIT_VERSION -t $ORBIT_MAJOR.$ORBIT_MINOR -t $ORBIT_MAJOR -t stable
+            --version $SWIFT_DIALOG_VERSION -t stable
         rm swiftDialog.app.tar.gz
     fi
 
     # Add Escrow Buddy on macos (if enabled).
     if [[ $system == "macos" && -n "$ESCROW_BUDDY" ]]; then
-	make escrow-buddy-pkg version=$ESCROW_BUDDY_PKG_VERSION out-path=.
+        make escrow-buddy-pkg version=$ESCROW_BUDDY_PKG_VERSION out-path=.
 
         ./build/fleetctl updates add \
             --path $TUF_PATH \
             --target escrowBuddy.pkg \
             --platform macos \
             --name escrowBuddy \
-            --version $ORBIT_VERSION -t $ORBIT_MAJOR.$ORBIT_MINOR -t $ORBIT_MAJOR -t stable
+            --version $ESCROW_BUDDY_PKG_VERSION -t stable
         rm escrowBuddy.pkg
     fi
 
-
     # Add Fleet Desktop application on windows (if enabled).
     if [[ $system == "windows" && -n "$FLEET_DESKTOP" ]]; then
         FLEET_DESKTOP_VERSION=$ORBIT_VERSION \

tools/tuf/test/main.sh

@@ -6,7 +6,6 @@ export FLEET_ROOT_PASSPHRASE=p4ssphr4s3
 export FLEET_TARGETS_PASSPHRASE=p4ssphr4s3
 export FLEET_SNAPSHOT_PASSPHRASE=p4ssphr4s3
 export FLEET_TIMESTAMP_PASSPHRASE=p4ssphr4s3
-export NUDGE=1
 
 if [ -z "$TUF_PATH" ]; then
   TUF_PATH=test_tuf