From 19fbd34cb715d5838503d04e70d3e61d959d361a Mon Sep 17 00:00:00 2001 From: Lucas Manuel Rodriguez Date: Thu, 26 Feb 2026 14:53:31 -0300 Subject: [PATCH] Improve old escrow macOS method (#40583) - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) --- .../improve-tcl-script-escrow-old-method | 1 + orbit/pkg/useraction/useraction_darwin.go | 27 ++++++++++--------- tools/tuf/test/README.md | 10 +++++++ tools/tuf/test/create_repository.sh | 14 +++++----- tools/tuf/test/main.sh | 1 - 5 files changed, 33 insertions(+), 20 deletions(-) create mode 100644 orbit/changes/improve-tcl-script-escrow-old-method diff --git a/orbit/changes/improve-tcl-script-escrow-old-method b/orbit/changes/improve-tcl-script-escrow-old-method new file mode 100644 index 0000000000..ee5c2dc9c8 --- /dev/null +++ b/orbit/changes/improve-tcl-script-escrow-old-method @@ -0,0 +1 @@ +* Fixed old escrow method on macOS to use environment variables on the TCL script. diff --git a/orbit/pkg/useraction/useraction_darwin.go b/orbit/pkg/useraction/useraction_darwin.go index a334fdf568..2fe367825d 100644 --- a/orbit/pkg/useraction/useraction_darwin.go +++ b/orbit/pkg/useraction/useraction_darwin.go @@ -7,6 +7,7 @@ import ( "encoding/json" "errors" "fmt" + "os" "os/exec" "strings" "text/template" @@ -218,18 +219,20 @@ func rotateFileVaultKey(u, p string) error { return errInvalidPassword } - script := fmt.Sprintf(` - log_user 0 - spawn fdesetup changerecovery -personal - expect "Enter the user name:" - send {%s} - send \r - expect "Enter a password for '/', or the recovery key:" - send {%s} - send \r - log_user 1 - expect eof`, u, p) - out, err := exec.Command("expect", "-c", script).Output() + script := ` + log_user 0 + spawn fdesetup changerecovery -personal + expect "Enter the user name:" + send $env(FV_USER) + send \r + expect "Enter a password for '/', or the recovery key:" + send $env(FV_PASS) + send \r + log_user 1 + expect eof` + cmd := exec.Command("expect", "-c", script) + cmd.Env = append(os.Environ(), "FV_USER="+u, "FV_PASS="+p) + out, err := cmd.Output() if err != nil { return fmt.Errorf("osascript failed: %w", err) } diff --git a/tools/tuf/test/README.md b/tools/tuf/test/README.md index d822be440e..77ae7df459 100644 --- a/tools/tuf/test/README.md +++ b/tools/tuf/test/README.md @@ -73,6 +73,16 @@ GOARCH=arm64 \ ./tools/tuf/test/main.sh ``` +To include Escrow Buddy, Nudge, or Swift Dialog on the TUF repository you can use the following variables: +```sh +[...] +ESCROW_BUDDY=1 \ +NUDGE=1 \ +SWIFT_DIALOG=1 \ +[...] +./tools/tuf/test/main.sh +``` + # Test fleetd with expired signatures on a TUF repository To generate a TUF repository with shorter expiration time for roles you can set the following environment variables: diff --git a/tools/tuf/test/create_repository.sh b/tools/tuf/test/create_repository.sh index 0c73151cd7..63578014bc 100755 --- a/tools/tuf/test/create_repository.sh +++ b/tools/tuf/test/create_repository.sh @@ -40,8 +40,9 @@ SYSTEMS=${SYSTEMS:-macos linux linux-arm64 windows windows-arm64} echo "Generating components for $SYSTEMS" -NUDGE_VERSION=stable +NUDGE_VERSION=1.1.10.81462 ESCROW_BUDDY_PKG_VERSION=1.0.0 +SWIFT_DIALOG_VERSION=2.5.6 if [[ -z "$OSQUERY_VERSION" ]]; then OSQUERY_VERSION=5.21.0 @@ -183,37 +184,36 @@ for system in $SYSTEMS; do --target nudge.app.tar.gz \ --platform macos \ --name nudge \ - --version $ORBIT_VERSION -t $ORBIT_MAJOR.$ORBIT_MINOR -t $ORBIT_MAJOR -t stable + --version $NUDGE_VERSION -t stable rm nudge.app.tar.gz fi # Add swiftDialog on macos (if enabled). if [[ $system == "macos" && -n "$SWIFT_DIALOG" ]]; then - curl https://updates.fleetdm.com/targets/swiftDialog/macos/stable/swiftDialog.app.tar.gz --output swiftDialog.app.tar.gz + curl https://updates.fleetdm.com/targets/swiftDialog/macos/$SWIFT_DIALOG_VERSION/swiftDialog.app.tar.gz --output swiftDialog.app.tar.gz ./build/fleetctl updates add \ --path $TUF_PATH \ --target swiftDialog.app.tar.gz \ --platform macos \ --name swiftDialog \ - --version $ORBIT_VERSION -t $ORBIT_MAJOR.$ORBIT_MINOR -t $ORBIT_MAJOR -t stable + --version $SWIFT_DIALOG_VERSION -t stable rm swiftDialog.app.tar.gz fi # Add Escrow Buddy on macos (if enabled). if [[ $system == "macos" && -n "$ESCROW_BUDDY" ]]; then - make escrow-buddy-pkg version=$ESCROW_BUDDY_PKG_VERSION out-path=. + make escrow-buddy-pkg version=$ESCROW_BUDDY_PKG_VERSION out-path=. ./build/fleetctl updates add \ --path $TUF_PATH \ --target escrowBuddy.pkg \ --platform macos \ --name escrowBuddy \ - --version $ORBIT_VERSION -t $ORBIT_MAJOR.$ORBIT_MINOR -t $ORBIT_MAJOR -t stable + --version $ESCROW_BUDDY_PKG_VERSION -t stable rm escrowBuddy.pkg fi - # Add Fleet Desktop application on windows (if enabled). if [[ $system == "windows" && -n "$FLEET_DESKTOP" ]]; then FLEET_DESKTOP_VERSION=$ORBIT_VERSION \ diff --git a/tools/tuf/test/main.sh b/tools/tuf/test/main.sh index 43ec35f21d..6364e33cc9 100755 --- a/tools/tuf/test/main.sh +++ b/tools/tuf/test/main.sh @@ -6,7 +6,6 @@ export FLEET_ROOT_PASSPHRASE=p4ssphr4s3 export FLEET_TARGETS_PASSPHRASE=p4ssphr4s3 export FLEET_SNAPSHOT_PASSPHRASE=p4ssphr4s3 export FLEET_TIMESTAMP_PASSPHRASE=p4ssphr4s3 -export NUDGE=1 if [ -z "$TUF_PATH" ]; then TUF_PATH=test_tuf