From 3f0111964ffd93eb94bc07b1fb16de254fe71b5d Mon Sep 17 00:00:00 2001 From: Zach Wasserman Date: Fri, 5 May 2023 07:02:28 -0700 Subject: [PATCH] Add macos_rsr table from macadmins extension (#11537) # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md) - [ ] Documented any permissions changes - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features. - [ ] Added/updated tests - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). --------- Co-authored-by: Roberto Dip Co-authored-by: Lucas Rodriguez --- go.mod | 2 +- go.sum | 2 + orbit/pkg/table/extension_darwin.go | 2 + schema/osquery_fleet_schema.json | 387 +++++++++++++++------------- schema/tables/macos_rsr.yml | 23 ++ 5 files changed, 240 insertions(+), 176 deletions(-) create mode 100644 schema/tables/macos_rsr.yml diff --git a/go.mod b/go.mod index f7da836ba8..4b1f12712d 100644 --- a/go.mod +++ b/go.mod @@ -56,7 +56,7 @@ require ( github.com/kevinburke/go-bindata v3.24.0+incompatible github.com/kolide/kit v0.0.0-20191023141830-6312ecc11c23 github.com/kolide/launcher v0.11.25-0.20220321235155-c3e9480037d2 - github.com/macadmins/osquery-extension v0.0.7 + github.com/macadmins/osquery-extension v0.0.14 github.com/mattermost/xml-roundtrip-validator v0.0.0-20201213122252-bcd7e1b9601e github.com/mattn/go-sqlite3 v1.14.13 github.com/micromdm/micromdm v1.9.0 diff --git a/go.sum b/go.sum index ed6e83d11f..a4eca7c822 100644 --- a/go.sum +++ b/go.sum @@ -901,6 +901,8 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I= github.com/macadmins/osquery-extension v0.0.7 h1:iEo2eajSbG51pdXg+QH3kM5ZWhidWBBZ/YiNDEXU1lE= github.com/macadmins/osquery-extension v0.0.7/go.mod h1:7/zR5oT8BSw8ejmx17EJlvif1d6iGFXRhOoKgLNP12g= +github.com/macadmins/osquery-extension v0.0.14 h1:GhTdqp5fEfD9AsIng1r9jIsYpmahelXwxVVd8by5NEk= +github.com/macadmins/osquery-extension v0.0.14/go.mod h1:Alx7on10YHX4wE8vFbj7BLwnniDPs+lsJtgB0k0OM7w= github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= github.com/magiconair/properties v1.8.4/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60= diff --git a/orbit/pkg/table/extension_darwin.go b/orbit/pkg/table/extension_darwin.go index 5f1ccb1eed..b3856391a0 100644 --- a/orbit/pkg/table/extension_darwin.go +++ b/orbit/pkg/table/extension_darwin.go @@ -18,6 +18,7 @@ import ( "github.com/fleetdm/fleet/v4/orbit/pkg/table/user_login_settings" "github.com/macadmins/osquery-extension/tables/filevaultusers" "github.com/macadmins/osquery-extension/tables/macos_profiles" + "github.com/macadmins/osquery-extension/tables/macosrsr" "github.com/macadmins/osquery-extension/tables/mdm" "github.com/macadmins/osquery-extension/tables/munki" "github.com/macadmins/osquery-extension/tables/unifiedlog" @@ -50,6 +51,7 @@ func PlatformTables() []osquery.OsqueryPlugin { table.NewPlugin("mdm", mdm.MDMInfoColumns(), mdm.MDMInfoGenerate), table.NewPlugin("munki_info", munki.MunkiInfoColumns(), munki.MunkiInfoGenerate), table.NewPlugin("munki_installs", munki.MunkiInstallsColumns(), munki.MunkiInstallsGenerate), + table.NewPlugin("macos_rsr", macosrsr.MacOSRsrColumns(), macosrsr.MacOSRsrGenerate), // osquery version 5.5.0 and up ships a unified_log table in core // we are renaming the one from the macadmins extension to avoid collision table.NewPlugin("macadmins_unified_log", unifiedlog.UnifiedLogColumns(), unifiedlog.UnifiedLogGenerate), diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index d2aa9f0a34..8901546e5c 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -26993,6 +26993,73 @@ ], "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yum_sources.yml" }, + { + "name": "apfs_physical_stores", + "platforms": [ + "darwin" + ], + "description": "Information about APFS physical stores from the `diskutil apfs list -plist` command.", + "columns": [ + { + "name": "container_uuid", + "type": "text", + "required": false, + "description": "The UUID of the APFS Contianer" + }, + { + "name": "container_designated_physical_store", + "type": "text", + "required": false, + "description": "The disk displayed as the backing store of the container. There may be multiple,\nuse `apfs_physical_stores` to see all actual physical stores\n" + }, + { + "name": "container_reference", + "type": "text", + "required": false, + "description": "The current reference for the APFS container, e.g. \"disk3\"" + }, + { + "name": "container_fusion", + "type": "text", + "required": false, + "description": "Whether this container is on a \"fusion drive\" (i.e. SSHD)" + }, + { + "name": "container_capacity_ceiling", + "type": "bigint", + "required": false, + "description": "The total amount of space in the container" + }, + { + "name": "container_capacity_free", + "type": "bigint", + "required": false, + "description": "The amount of remaining free space in the container" + }, + { + "name": "uuid", + "type": "text", + "required": false, + "description": "The UUID of the physical store" + }, + { + "name": "identifier", + "type": "text", + "required": false, + "description": "The current identifier of the physical store (e.g. disk1s2)" + }, + { + "name": "size", + "type": "bigint", + "required": false, + "description": "The size of the physical store in byptes" + } + ], + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "evented": false, + "url": "https://fleetdm.com/tables/apfs_physical_stores", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_physical_stores.yml" + }, { "name": "apfs_volumes", "platforms": [ @@ -27108,73 +27175,6 @@ "url": "https://fleetdm.com/tables/apfs_volumes", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_volumes.yml" }, - { - "name": "apfs_physical_stores", - "platforms": [ - "darwin" - ], - "description": "Information about APFS physical stores from the `diskutil apfs list -plist` command.", - "columns": [ - { - "name": "container_uuid", - "type": "text", - "required": false, - "description": "The UUID of the APFS Contianer" - }, - { - "name": "container_designated_physical_store", - "type": "text", - "required": false, - "description": "The disk displayed as the backing store of the container. There may be multiple,\nuse `apfs_physical_stores` to see all actual physical stores\n" - }, - { - "name": "container_reference", - "type": "text", - "required": false, - "description": "The current reference for the APFS container, e.g. \"disk3\"" - }, - { - "name": "container_fusion", - "type": "text", - "required": false, - "description": "Whether this container is on a \"fusion drive\" (i.e. SSHD)" - }, - { - "name": "container_capacity_ceiling", - "type": "bigint", - "required": false, - "description": "The total amount of space in the container" - }, - { - "name": "container_capacity_free", - "type": "bigint", - "required": false, - "description": "The amount of remaining free space in the container" - }, - { - "name": "uuid", - "type": "text", - "required": false, - "description": "The UUID of the physical store" - }, - { - "name": "identifier", - "type": "text", - "required": false, - "description": "The current identifier of the physical store (e.g. disk1s2)" - }, - { - "name": "size", - "type": "bigint", - "required": false, - "description": "The size of the physical store in byptes" - } - ], - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", - "evented": false, - "url": "https://fleetdm.com/tables/apfs_physical_stores", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_physical_stores.yml" - }, { "name": "authdb", "platforms": [ @@ -27576,32 +27576,6 @@ "url": "https://fleetdm.com/tables/dscl", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dscl.yml" }, - { - "name": "filevault_users", - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", - "description": "Information on the users able to unlock the current boot volume if protected with FileVault.", - "platforms": [ - "darwin" - ], - "evented": false, - "examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```", - "columns": [ - { - "name": "username", - "description": "Username of the FileVault user.", - "required": false, - "type": "text" - }, - { - "name": "uuid", - "description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).", - "required": false, - "type": "text" - } - ], - "url": "https://fleetdm.com/tables/filevault_users", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml" - }, { "name": "file_lines", "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", @@ -27630,6 +27604,57 @@ "url": "https://fleetdm.com/tables/file_lines", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file_lines.yml" }, + { + "name": "filevault_users", + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Information on the users able to unlock the current boot volume if protected with FileVault.", + "platforms": [ + "darwin" + ], + "evented": false, + "examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```", + "columns": [ + { + "name": "username", + "description": "Username of the FileVault user.", + "required": false, + "type": "text" + }, + { + "name": "uuid", + "description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/filevault_users", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml" + }, + { + "name": "firmware_eficheck_integrity_check", + "platforms": [ + "darwin" + ], + "description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).", + "columns": [ + { + "name": "chip", + "type": "text", + "required": false, + "description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n" + }, + { + "name": "output", + "type": "text", + "required": false, + "description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n" + } + ], + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "evented": false, + "url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml" + }, { "name": "google_chrome_profiles", "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", @@ -27670,31 +27695,6 @@ "url": "https://fleetdm.com/tables/google_chrome_profiles", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/google_chrome_profiles.yml" }, - { - "name": "firmware_eficheck_integrity_check", - "platforms": [ - "darwin" - ], - "description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).", - "columns": [ - { - "name": "chip", - "type": "text", - "required": false, - "description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n" - }, - { - "name": "output", - "type": "text", - "required": false, - "description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n" - } - ], - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", - "evented": false, - "url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml" - }, { "name": "icloud_private_relay", "platforms": [ @@ -27892,6 +27892,43 @@ "url": "https://fleetdm.com/tables/macos_profiles", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_profiles.yml" }, + { + "name": "macos_rsr", + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Returns information about installed Rapid Security Responses (RSRs).", + "platforms": [ + "darwin" + ], + "evented": false, + "columns": [ + { + "name": "full_macos_version", + "description": "Full macOS version string (including the RSR suffix)", + "required": false, + "type": "text" + }, + { + "name": "macos_version", + "description": "The macOS version string (excluding the RSR suffix)", + "required": false, + "type": "text" + }, + { + "name": "rsr_supported", + "description": "Whether this macOS version supports RSRs (>= 13). Possible values are 'true' or 'false'.", + "required": false, + "type": "text" + }, + { + "name": "rsr_version", + "description": "RSR version string suffix (with parenthesis included)", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/macos_rsr", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_rsr.yml" + }, { "name": "mdm", "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).

Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited present`, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not.", @@ -28027,6 +28064,44 @@ "url": "https://fleetdm.com/tables/mdm_bridge", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml" }, + { + "name": "munki_installs", + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).", + "description": "Software packages and other items [Munki](https://github.com/munki/munki) is managing.", + "platforms": [ + "darwin" + ], + "evented": false, + "examples": "See the version of software that has been deployed by Munki.\n```\nSELECT name, installed_version FROM munki_installs WHERE installed='true';\n```", + "columns": [ + { + "name": "end_time", + "description": "The end time of the last Munki run.", + "required": false, + "type": "text" + }, + { + "name": "installed", + "description": "Shows if Munki installed an item (true) or if it is simply available but not installed (false).", + "required": false, + "type": "text" + }, + { + "name": "installed_version", + "description": "The version number of installed items.", + "required": false, + "type": "text" + }, + { + "name": "name", + "description": "The name of items managed by Munki.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/munki_installs", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_installs.yml" + }, { "name": "munki_info", "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).", @@ -28095,44 +28170,6 @@ "url": "https://fleetdm.com/tables/munki_info", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_info.yml" }, - { - "name": "munki_installs", - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).", - "description": "Software packages and other items [Munki](https://github.com/munki/munki) is managing.", - "platforms": [ - "darwin" - ], - "evented": false, - "examples": "See the version of software that has been deployed by Munki.\n```\nSELECT name, installed_version FROM munki_installs WHERE installed='true';\n```", - "columns": [ - { - "name": "end_time", - "description": "The end time of the last Munki run.", - "required": false, - "type": "text" - }, - { - "name": "installed", - "description": "Shows if Munki installed an item (true) or if it is simply available but not installed (false).", - "required": false, - "type": "text" - }, - { - "name": "installed_version", - "description": "The version number of installed items.", - "required": false, - "type": "text" - }, - { - "name": "name", - "description": "The name of items managed by Munki.", - "required": false, - "type": "text" - } - ], - "url": "https://fleetdm.com/tables/munki_installs", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_installs.yml" - }, { "name": "orbit_info", "platforms": [ @@ -28541,6 +28578,25 @@ "url": "https://fleetdm.com/tables/pwd_policy", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pwd_policy.yml" }, + { + "name": "software_update", + "platforms": [ + "darwin" + ], + "description": "Information about available Apple software updates.", + "columns": [ + { + "name": "software_update_required", + "type": "integer", + "required": false, + "description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n" + } + ], + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "evented": false, + "url": "https://fleetdm.com/tables/software_update", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml" + }, { "name": "sntp_request", "platforms": [ @@ -28593,25 +28649,6 @@ "url": "https://fleetdm.com/tables/sudo_info", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sudo_info.yml" }, - { - "name": "software_update", - "platforms": [ - "darwin" - ], - "description": "Information about available Apple software updates.", - "columns": [ - { - "name": "software_update_required", - "type": "integer", - "required": false, - "description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n" - } - ], - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", - "evented": false, - "url": "https://fleetdm.com/tables/software_update", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml" - }, { "name": "user_login_settings", "platforms": [ diff --git a/schema/tables/macos_rsr.yml b/schema/tables/macos_rsr.yml new file mode 100644 index 0000000000..3bbe177f62 --- /dev/null +++ b/schema/tables/macos_rsr.yml @@ -0,0 +1,23 @@ +name: macos_rsr +notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer). +description: Returns information about installed Rapid Security Responses (RSRs). +platforms: + - darwin +evented: false +columns: + - name: full_macos_version + description: Full macOS version string (including the RSR suffix) + required: false + type: text + - name: macos_version + description: The macOS version string (excluding the RSR suffix) + required: false + type: text + - name: rsr_supported + description: Whether this macOS version supports RSRs (>= 13). Possible values are 'true' or 'false'. + required: false + type: text + - name: rsr_version + description: RSR version string suffix (with parenthesis included) + required: false + type: text \ No newline at end of file