Fleetctl to package .app bundles for osquery (and changes for orbit to support them) (#4393)

* WIP

* WIP2

* Fix orbit and fleetctl tests

* Amend macos-app default

* Add some fixes

* Use fleetctl updates roots command

* Add more fixes to Updater

* Fixes to app publishing and downloading

* Add more changes to support fleetctl cross generation

* Amend comment

* Add pkg generation to ease testing

* Make more fixes

* Add changes entry

* Add legacy targets (until our TUF system exposes the new app)

* Fix fleetctl preview

* Fix bool flag

* Fix orbit logic for disabled-updates and dev-mode

* Fix TestPreview

* Remove constant and fix zip-slip attack (codeql)

* Return unknown error

* Fix updater's checkExec

* Add support for executable signing in init_tuf.sh

* Try only signing orbit

* Fix init_tuf.sh targets, macos-app only for osqueryd

* Specify GOARCH to support M1s

* Add workflow to generate osqueryd.app.tar.gz

* Use 5.2.2 on init_tuf.sh

* Add unit test for tar.gz target

* Use artifacts instead of releases

* Remove copy paste residue

* Trigger workflow on PR

* Fixes to ease handling of artifact

* Fix, do not use target name as dir

* Remove workaround

.github/workflows/fleet-and-orbit.yml

@@ -183,6 +183,7 @@ jobs:
         go run github.com/fleetdm/fleet/v4/orbit/cmd/orbit \
           --debug \
           --dev-mode \
+          --dev-darwin-legacy-targets \
           --disable-updates \
           --root-dir /tmp/orbit \
           --fleet-url ${{ needs.gen.outputs.address }} \

.github/workflows/generate-osqueryd-app-tar-gz.yml

@@ -0,0 +1,34 @@
+name: Generate osqueryd.app.tar.gz for Orbit
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      # The workflow can be triggered by modifying OSQUERY_VERSION env.
+      - '.github/workflows/generate-osqueryd-app-tar-gz.yml'
+  pull_request:
+    paths:
+      # The workflow can be triggered by modifying OSQUERY_VERSION env.
+      - '.github/workflows/generate-osqueryd-app-tar-gz.yml'
+  workflow_dispatch:
+
+env:
+  OSQUERY_VERSION: 5.2.2
+
+jobs:
+  generate:
+    runs-on: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Generate osqueryd.app.tar.gz
+        run: |
+          make osqueryd-app-tar-gz out-path=. version=$OSQUERY_VERSION
+
+      - name: Upload osqueryd.app.tar.gz
+        uses: actions/upload-artifact@v2
+        with:
+          name: osqueryd.app.tar.gz
+          path: osqueryd.app.tar.gz