Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity

Add automated Safari policy update and remediation (#35890)

Browse Source 
This pull request introduces automation for keeping the Fleet macOS
Safari update policy current, along with a new script for updating
Safari on endpoints. The main changes include a new GitHub Actions
workflow step to run an automated script that checks for the latest
Safari versions, updates the policy YAML if needed, and creates a pull
request with the changes. Additionally, a new endpoint script is added
to perform Safari updates via `softwareupdate`.

**Automation for Safari Policy Updates:**

* Added `.github/scripts/dogfood-policy-updater-latest-safari.sh`, a
script that fetches the latest Safari versions from the SOFA feed,
compares them to the versions in `update-safari.yml`, updates the YAML
if necessary, and automatically creates a pull request with reviewers
assigned.
* Updated `.github/workflows/dogfood-automated-policy-updates.yml` to
add a step that runs the new Safari version update script as part of the
workflow, using the required automation secrets.

**Policy and Endpoint Script Enhancements:**

* Added a new policy to
`it-and-security/lib/macos/policies/update-safari.yml` that checks if
the installed Safari version matches the latest for macOS 15 (Safari
18.6) and macOS 26 (Safari 26.1).
* Introduced `it-and-security/lib/macos/scripts/update-safari.sh`, a
script for endpoints that runs `softwareupdate` with the `--safari-only`
flag, logging the outcome and requiring root privileges.
This commit is contained in:
Allen Houchins
2026-01-08 11:00:31 -06:00
committed by GitHub
parent 35d9f42599
commit cc6b995e22
4 changed files with 319 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/scripts/dogfood-policy-updater-latest-safari.sh
Executable
+218
View File
@@ -0,0 +1,218 @@
#!/bin/bash
# Variables
REPO_OWNER="fleetdm"
REPO_NAME="fleet"
FILE_PATH="it-and-security/lib/macos/policies/update-safari.yml"
BRANCH="main"
# Ensure required environment variables are set
if [ -z "$DOGFOOD_AUTOMATION_TOKEN" ] || [ -z "$DOGFOOD_AUTOMATION_USER_NAME" ] || [ -z "$DOGFOOD_AUTOMATION_USER_EMAIL" ]; then
echo "Error: Missing required environment variables."
exit 1
fi
# GitHub API URL
FILE_URL="https://api.github.com/repos/$REPO_OWNER/$REPO_NAME/contents/$FILE_PATH?ref=$BRANCH"
# Fetch the file contents from GitHub
response=$(curl -s -H "Authorization: token $DOGFOOD_AUTOMATION_TOKEN" -H "Accept: application/vnd.github.v3.raw" "$FILE_URL")
if [ -z "$response" ] || [[ "$response" == *"Not Found"* ]]; then
echo "Error: Failed to fetch file or file does not exist in the repository."
exit 1
fi
# Extract the query section (may be multi-line)
query_section=$(echo "$response" | sed -n '/^query:/,/^[^ ]/p' | head -n -1)
if [ -z "$query_section" ]; then
echo "Error: Could not find the query section in the file."
exit 1
fi
# Extract Safari 18 and Safari 26 version numbers from the query
# Safari 18 is for macOS 15.x, Safari 26 is for macOS 26.x
policy_safari_18_version=$(echo "$query_section" | grep -A 5 "version >= '15.0'" | grep "version_compare" | grep -oE "'[0-9]+\.[0-9]+(\.[0-9]+)?'" | sed "s/'//g" | head -n 1)
policy_safari_26_version=$(echo "$query_section" | grep -A 5 "version >= '26.0'" | grep "version_compare" | grep -oE "'[0-9]+\.[0-9]+(\.[0-9]+)?'" | sed "s/'//g" | head -n 1)
if [ -z "$policy_safari_18_version" ] || [ -z "$policy_safari_26_version" ]; then
echo "Error: Failed to extract Safari version numbers from policy."
echo "Safari 18 version found: $policy_safari_18_version"
echo "Safari 26 version found: $policy_safari_26_version"
exit 1
fi
echo "Policy Safari 18 version: $policy_safari_18_version"
echo "Policy Safari 26 version: $policy_safari_26_version"
# Fetch the latest Safari version from SOFA feed
echo "Fetching latest Safari version from SOFA feed..."
safari_feed_response=$(curl -s "https://sofafeed.macadmins.io/v2/safari_data_feed.json" 2>/dev/null)
if [ -z "$safari_feed_response" ] || [[ "$safari_feed_response" == *"404"* ]] || [[ "$safari_feed_response" == *"Not Found"* ]]; then
echo "Error: Failed to fetch Safari feed from SOFA."
exit 1
fi
# Parse Safari feed - get latest versions for Safari 18 (macOS 15) and Safari 26 (macOS 26)
# The feed structure has AppVersions array, each with a Latest.ProductVersion
safari_18_version=$(echo "$safari_feed_response" | jq -r '.AppVersions[] | select(.AppVersion == "Safari 18") | .Latest.ProductVersion' 2>/dev/null | head -n 1)
safari_26_version=$(echo "$safari_feed_response" | jq -r '.AppVersions[] | select(.AppVersion == "Safari 26") | .Latest.ProductVersion' 2>/dev/null | head -n 1)
if [ -z "$safari_18_version" ] || [ "$safari_18_version" == "null" ]; then
echo "Error: Failed to parse Safari 18 version from SOFA feed."
exit 1
fi
if [ -z "$safari_26_version" ] || [ "$safari_26_version" == "null" ]; then
echo "Error: Failed to parse Safari 26 version from SOFA feed."
exit 1
fi
# Clean up version strings (remove any extra whitespace or characters)
safari_18_version=$(echo "$safari_18_version" | xargs)
safari_26_version=$(echo "$safari_26_version" | xargs)
echo "Safari 18 (macOS 15) latest version: $safari_18_version"
echo "Safari 26 (macOS 26) latest version: $safari_26_version"
# Check if updates are needed
update_needed=false
if [ "$policy_safari_18_version" != "$safari_18_version" ]; then
echo "Safari 18 version update needed: $policy_safari_18_version -> $safari_18_version"
update_needed=true
fi
if [ "$policy_safari_26_version" != "$safari_26_version" ]; then
echo "Safari 26 version update needed: $policy_safari_26_version -> $safari_26_version"
update_needed=true
fi
# Update the file if needed
if [ "$update_needed" = true ]; then
echo "Updating policy query with new Safari versions..."
# Prepare the new query section with updated versions
new_query_section="query: |
SELECT 1 WHERE
NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.Safari')
OR (
EXISTS (SELECT 1 FROM os_version WHERE version LIKE '26.%')
AND EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.Safari' AND version_compare(bundle_short_version, '$safari_26_version') >= 0)
)
OR (
EXISTS (SELECT 1 FROM os_version WHERE version LIKE '15.%')
AND EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.Safari' AND version_compare(bundle_short_version, '$safari_18_version') >= 0)
);"
# Replace the query section in the response
# Use a more robust approach: find the query section and replace it
updated_response=$(echo "$response" | awk -v new_query="$new_query_section" '
BEGIN {
in_query = 0
query_started = 0
}
/^query:/ {
query_started = 1
in_query = 1
print new_query
next
}
query_started && /^[a-zA-Z-]/ && !/^ / && !/^query:/ {
in_query = 0
query_started = 0
}
!in_query {
print
}
')
if [ -z "$updated_response" ]; then
echo "Error: Failed to update the query line."
exit 1
fi
# Create a temporary file for the update
temp_file=$(mktemp)
echo "$updated_response" > "$temp_file"
# Configure Git
git config --global user.name "$DOGFOOD_AUTOMATION_USER_NAME"
git config --global user.email "$DOGFOOD_AUTOMATION_USER_EMAIL"
# Clone the repository and create a new branch
git clone "https://$DOGFOOD_AUTOMATION_TOKEN@github.com/$REPO_OWNER/$REPO_NAME.git" repo || {
echo "Error: Failed to clone repository."
exit 1
}
cd repo || exit
# Generate branch name with timestamp right before use
NEW_BRANCH="update-safari-version-$(date +%s)"
git checkout -b "$NEW_BRANCH"
cp "$temp_file" "$FILE_PATH"
git add "$FILE_PATH"
commit_message="Update Safari versions: Safari 18 (macOS 15) to $safari_18_version, Safari 26 (macOS 26) to $safari_26_version"
if [ "$policy_safari_18_version" != "$safari_18_version" ]; then
commit_message="$commit_message
- Updated Safari 18 version from $policy_safari_18_version to $safari_18_version"
fi
if [ "$policy_safari_26_version" != "$safari_26_version" ]; then
commit_message="$commit_message
- Updated Safari 26 version from $policy_safari_26_version to $safari_26_version"
fi
git commit -m "$commit_message"
git push origin "$NEW_BRANCH"
# Create a pull request
pr_title="Update Safari versions: Safari 18 to $safari_18_version, Safari 26 to $safari_26_version"
pr_data=$(jq -n --arg title "$pr_title" \
--arg head "$NEW_BRANCH" \
--arg base "$BRANCH" \
'{title: $title, head: $head, base: $base}')
pr_response=$(curl -s -H "Authorization: token $DOGFOOD_AUTOMATION_TOKEN" \
-H "Accept: application/vnd.github.v3+json" \
-X POST \
-d "$pr_data" \
"https://api.github.com/repos/$REPO_OWNER/$REPO_NAME/pulls")
if [[ "$pr_response" == *"Validation Failed"* ]]; then
echo "Error: Failed to create a pull request. Response: $pr_response"
exit 1
fi
echo "Pull request created successfully."
# Extract the pull request number from the response
pr_number=$(echo "$pr_response" | jq -r '.number')
if [ -z "$pr_number" ] || [ "$pr_number" == "null" ]; then
echo "Error: Failed to retrieve pull request number."
exit 1
fi
echo "Adding reviewers to PR #$pr_number..."
# Prepare the reviewers data payload
reviewers_data=$(jq -n \
--arg r1 "harrisonravazzolo" \
--arg r2 "tux234" \
'{reviewers: [$r1, $r2]}')
# Request reviewers for the pull request
review_response=$(curl -s -X POST \
-H "Authorization: token $DOGFOOD_AUTOMATION_TOKEN" \
-H "Accept: application/vnd.github.v3+json" \
-d "$reviewers_data" \
"https://api.github.com/repos/$REPO_OWNER/$REPO_NAME/pulls/$pr_number/requested_reviewers")
if echo "$review_response" | grep -q "errors"; then
echo "Error: Failed to add reviewers. Response: $review_response"
exit 1
fi
echo "Reviewers added successfully."
else
echo "No updates needed; Safari versions are current."
fi
.github/workflows/dogfood-automated-policy-updates.yml
+50 -5
View File
@@ -90,8 +90,32 @@ jobs:
DOGFOOD_AUTOMATION_USER_NAME: ${{ secrets.DOGFOOD_AUTOMATION_USER_NAME }}
DOGFOOD_AUTOMATION_USER_EMAIL: ${{ secrets.DOGFOOD_AUTOMATION_USER_EMAIL }}
- name: Run Safari version update script
id: update-safari
run: |
chmod +x ./.github/scripts/dogfood-policy-updater-latest-safari.sh
./.github/scripts/dogfood-policy-updater-latest-safari.sh
if [ $? -eq 0 ]; then
# Check if there are any changes
if git diff --quiet; then
echo "changed=false" >> $GITHUB_OUTPUT
echo "No changes detected for Safari policy"
else
echo "changed=true" >> $GITHUB_OUTPUT
echo "Changes detected for Safari policy"
git diff
fi
else
echo "changed=false" >> $GITHUB_OUTPUT
exit 0
fi
env:
DOGFOOD_AUTOMATION_TOKEN: ${{ secrets.DOGFOOD_AUTOMATION_TOKEN }}
DOGFOOD_AUTOMATION_USER_NAME: ${{ secrets.DOGFOOD_AUTOMATION_USER_NAME }}
DOGFOOD_AUTOMATION_USER_EMAIL: ${{ secrets.DOGFOOD_AUTOMATION_USER_EMAIL }}
- name: Search for Existing PRs
if: steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true'
if: steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true' || steps.update-safari.outputs.changed == 'true'
id: search_pr
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
with:
@@ -105,7 +129,11 @@ jobs:
const matchingPRs = pullRequests.filter(pr =>
(pr.title.includes('Update macOS policy versions') ||
pr.title.includes('Update 1Password macOS policy version') ||
pr.title.includes('Update Safari policy version') ||
pr.title.includes('Update macOS and 1Password policy versions') ||
pr.title.includes('Update macOS and Safari policy versions') ||
pr.title.includes('Update 1Password and Safari policy versions') ||
pr.title.includes('Update macOS, 1Password, and Safari policy versions') ||
pr.title.includes('Update latest macOS versions') ||
pr.title.includes('Update latest macOS version')) &&
pr.user.login === 'github-actions[bot]'
@@ -113,22 +141,39 @@ jobs:
return matchingPRs.map(pr => pr.number);
- name: Determine update type and generate branch name
if: steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true'
if: steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true' || steps.update-safari.outputs.changed == 'true'
id: update-info
run: |
BRANCH_DATE=$(date +'%y%m%d%H%M')
MACOS_CHANGED="${{ steps.update-macos.outputs.changed }}"
ONEPASSWORD_CHANGED="${{ steps.update-1password.outputs.changed }}"
SAFARI_CHANGED="${{ steps.update-safari.outputs.changed }}"
# Determine what changed and create appropriate branch name and title
if [ "$MACOS_CHANGED" == "true" ] && [ "$ONEPASSWORD_CHANGED" == "true" ]; then
if [ "$MACOS_CHANGED" == "true" ] && [ "$ONEPASSWORD_CHANGED" == "true" ] && [ "$SAFARI_CHANGED" == "true" ]; then
BRANCH_NAME="update-macos-1password-safari-policy-versions-$BRANCH_DATE"
PR_TITLE="Update macOS, 1Password, and Safari policy versions"
PR_BODY="This PR automatically updates macOS version policies, 1Password macOS version policy, and Safari version policy for dogfood."
elif [ "$MACOS_CHANGED" == "true" ] && [ "$ONEPASSWORD_CHANGED" == "true" ]; then
BRANCH_NAME="update-macos-and-1password-policy-versions-$BRANCH_DATE"
PR_TITLE="Update macOS and 1Password policy versions"
PR_BODY="This PR automatically updates both macOS version policies and 1Password macOS version policy for dogfood."
elif [ "$MACOS_CHANGED" == "true" ] && [ "$SAFARI_CHANGED" == "true" ]; then
BRANCH_NAME="update-macos-and-safari-policy-versions-$BRANCH_DATE"
PR_TITLE="Update macOS and Safari policy versions"
PR_BODY="This PR automatically updates both macOS version policies and Safari version policy for dogfood."
elif [ "$ONEPASSWORD_CHANGED" == "true" ] && [ "$SAFARI_CHANGED" == "true" ]; then
BRANCH_NAME="update-1password-and-safari-policy-versions-$BRANCH_DATE"
PR_TITLE="Update 1Password and Safari policy versions"
PR_BODY="This PR automatically updates both 1Password macOS version policy and Safari version policy for dogfood."
elif [ "$ONEPASSWORD_CHANGED" == "true" ]; then
BRANCH_NAME="update-1password-policy-version-$BRANCH_DATE"
PR_TITLE="Update 1Password macOS policy version"
PR_BODY="This PR automatically updates the 1Password macOS version policy for dogfood."
elif [ "$SAFARI_CHANGED" == "true" ]; then
BRANCH_NAME="update-safari-policy-version-$BRANCH_DATE"
PR_TITLE="Update Safari policy version"
PR_BODY="This PR automatically updates the Safari version policy for dogfood."
else
BRANCH_NAME="update-macos-policy-versions-$BRANCH_DATE"
PR_TITLE="Update macOS policy versions"
@@ -142,7 +187,7 @@ jobs:
echo "PR title: $PR_TITLE"
- name: Create Pull Request
if: steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true'
if: steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true' || steps.update-safari.outputs.changed == 'true'
id: create-pr
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e #v7.0.8
with:
@@ -161,7 +206,7 @@ jobs:
assignees: allenhouchins
- name: Close Existing PRs
if: (steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true') && steps.search_pr.outputs.result != '[]'
if: (steps.update-macos.outputs.changed == 'true' || steps.update-1password.outputs.changed == 'true' || steps.update-safari.outputs.changed == 'true') && steps.search_pr.outputs.result != '[]'
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
with:
script: |
it-and-security/lib/macos/policies/update-safari.yml
+18
View File
@@ -0,0 +1,18 @@
- name: macOS - Safari up to date
query: |
SELECT 1 WHERE
NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.Safari')
OR (
EXISTS (SELECT 1 FROM os_version WHERE version LIKE '26.%')
AND EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.Safari' AND version_compare(bundle_short_version, '26.1') >= 0)
)
OR (
EXISTS (SELECT 1 FROM os_version WHERE version LIKE '15.%')
AND EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.Safari' AND version_compare(bundle_short_version, '18.6') >= 0)
);
critical: false
description: The host may have an outdated version of Safari, potentially risking security vulnerabilities or compatibility issues.
resolution: Update Safari by running the Safari update package from self-service, or manually run Software Update ( > System Settings > Software Update).
platform: darwin
calendar_events_enabled: false
it-and-security/lib/macos/scripts/update-safari.sh
Executable
+33
View File
@@ -0,0 +1,33 @@
#!/bin/bash
# Safari Update Script
# This script runs softwareupdate to install Safari updates only
set -e
# Log file location
LOG_FILE="/var/log/safari_update.log"
# Function to log messages
log() {
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}
# Check if running as root
if [ "$EUID" -ne 0 ]; then
log "Error: This script must be run as root (use sudo)"
exit 1
fi
log "Starting Safari update process..."
# Run softwareupdate to install Safari updates only
# The --safari-only flag ensures only Safari updates are installed
if /usr/sbin/softwareupdate -i --safari-only; then
log "Safari update completed successfully"
exit 0
else
log "Error: Safari update failed or no Safari updates available"
exit 1
fi