Bugfix: ignore nested .app files in .pkg metadata extraction (#40851)

changes/38356-fix-pkg-metadata-extraction

@@ -0,0 +1,2 @@
+- Fixed the metadata extraction for `.pkg` macOS installers, which was introduced in `4.77.0` and could prevent updating some installers that were added in a previous Fleet version.
+    * **NOTE**: the fix may cause some installers that were added in Fleet `4.77.0` and later to fail to update with the message "The selected package is for different software". In this case, you will have to delete and re-add the installer. This will not only make it possible to update it successfully later, it will also create it with the correct metadata (name, version, bundle identifier).

pkg/file/xar.go

@@ -639,7 +639,10 @@ func isValidAppFilePath(input string) (string, bool) {
 		return file, true
 	}
 
-	if strings.HasSuffix(file, ".app") {
+	// ignore nested .app files, we want to make sure the .app file is
+	// in the Applications directory and not nested somewhere else
+	// See https://github.com/fleetdm/fleet/issues/38356#issuecomment-3935530961
+	if strings.HasSuffix(file, ".app") && !strings.Contains(dir, ".app/") {
 		if strings.HasPrefix(dir, "Applications/") && strings.HasSuffix(dir, "/") {
 			return file, true
 		}

pkg/file/xar_test.go

@@ -340,6 +340,8 @@ func TestIsValidAppFilePath(t *testing.T) {
 		{"Applications/Foo with spaces.app", true},
 		{"Applications/foo", false},
 		{"foo", true},
+		{"Applications/foo.app/bar.app", false},
+		{"Applications/foo.app/Helpers/bar.app", false},
 	}
 
 	for _, test := range tests {