From fd42134a0fb205f5f105eb98b7ba86bd2f0042b3 Mon Sep 17 00:00:00 2001 From: Adam Baali <45665341+AdamBaali@users.noreply.github.com> Date: Mon, 1 Jun 2026 22:10:33 +0200 Subject: [PATCH] YellowKey: drop wrapper (#46432) Removes docs/solutions/windows/scripts/install-yellowkey-extension.ps1 (thin wrapper that fetched Allen's upstream installer) and updates the policy's run_script.path to install-windows-yellowkey-extension.ps1, the canonical filename in allenhouchins/fleet-extensions. Users drop Allen's installer (with its canonical name) into their GitOps scripts directory; the policy references it directly. **Related issue:** #46360 ## Summary by CodeRabbit * **Documentation** * Updated Windows YellowKey osquery Fleet policy documentation with revised script references and remediation instructions for hosts that fail to load the extension. * **Chores** * Removed obsolete installation script; installation procedures have been consolidated for improved clarity and maintainability. Co-authored-by: Claude --- .../windows-yellowkey-extension.policies.yml | 6 +- .../scripts/install-yellowkey-extension.ps1 | 57 ------------------- 2 files changed, 3 insertions(+), 60 deletions(-) delete mode 100644 docs/solutions/windows/scripts/install-yellowkey-extension.ps1 diff --git a/docs/solutions/windows/policies/windows-yellowkey-extension.policies.yml b/docs/solutions/windows/policies/windows-yellowkey-extension.policies.yml index aa4d9904c4..1e5488a801 100644 --- a/docs/solutions/windows/policies/windows-yellowkey-extension.policies.yml +++ b/docs/solutions/windows/policies/windows-yellowkey-extension.policies.yml @@ -14,13 +14,13 @@ extension is absent, which Fleet shows as neither passing nor failing and would not trigger the installer. - Failing hosts run install-yellowkey-extension.ps1. Fleet caps + Failing hosts run install-windows-yellowkey-extension.ps1. Fleet caps run_script retries at 3 per failure; a host that still fails has likely lost egress to the release URL or could not restart orbit. resolution: | - install-yellowkey-extension.ps1 downloads, registers, and loads the + install-windows-yellowkey-extension.ps1 downloads, registers, and loads the extension. If a host stays failing, check the script output in Fleet > Hosts > Activity and confirm the host can reach the release URL. platform: windows run_script: - path: ../scripts/install-yellowkey-extension.ps1 + path: ../scripts/install-windows-yellowkey-extension.ps1 diff --git a/docs/solutions/windows/scripts/install-yellowkey-extension.ps1 b/docs/solutions/windows/scripts/install-yellowkey-extension.ps1 deleted file mode 100644 index 4a54832a3f..0000000000 --- a/docs/solutions/windows/scripts/install-yellowkey-extension.ps1 +++ /dev/null @@ -1,57 +0,0 @@ -<# -.SYNOPSIS - Installs and loads the windows_yellowkey osquery extension on this host. - -.DESCRIPTION - Fleet run_script remediation for the windows-yellowkey-extension - policy. Wrapper that fetches the canonical installer from - allenhouchins/fleet-extensions and executes it. The full install - logic (download, PE-header check, service stop, kill lingering - child, hardened ACLs, loader write, service restart) lives in - that upstream script; this wrapper exists only because Fleet's - GitOps run_script needs a file on disk to upload. - - Update workflow: none. Allen's CI republishes the binary on every - push to main, and the upstream installer always pulls from - releases/latest/download, so this file never needs editing. - -.OUTPUTS - Whatever the upstream installer writes to stdout. - -.NOTES - Exit codes are pass-through from the upstream installer: - 0 = Installed; service back to Running - 3 = Fleet osquery service not present - 4 = Filesystem operation failed - 5 = Service did not return to Running - 6 = Download failed or asset is not a valid PE32+ executable - 8 = Unsupported architecture - Additional codes from the wrapper itself: - 90 = Could not fetch the upstream installer -#> - -[CmdletBinding()] -param() - -$ErrorActionPreference = 'Stop' - -$UpstreamUrl = 'https://raw.githubusercontent.com/allenhouchins/fleet-extensions/main/windows_yellowkey/install-windows-yellowkey-extension.ps1' -$LocalPath = Join-Path $env:TEMP "install-windows-yellowkey-$([guid]::NewGuid()).ps1" - -Write-Output "=== windows_yellowkey installer (wrapper) ===" -Write-Output "Upstream: $UpstreamUrl" -Write-Output "" - -try { - try { - Invoke-WebRequest -Uri $UpstreamUrl -OutFile $LocalPath -UseBasicParsing -TimeoutSec 60 - } catch { - Write-Output "FAIL: could not fetch the upstream installer: $($_.Exception.Message)" - exit 90 - } - - & powershell.exe -ExecutionPolicy Bypass -NoProfile -File $LocalPath - exit $LASTEXITCODE -} finally { - Remove-Item -Path $LocalPath -Force -ErrorAction SilentlyContinue -}