Use pkgutil approach to be more effective at uninstalling (#22618)

#22571

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [X] Added/updated tests
- [X] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [X] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [X] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [X] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [X] Manual QA for all new/changed functionality

pkg/file/scripts/uninstall_pkg.sh

@@ -1,18 +1,22 @@
 #!/bin/sh
 
-package_app_name="$PACKAGE_ID"
+# Fleet extracts and saves package IDs.
+pkg_ids=$PACKAGE_ID
 
-# Make sure PACKAGE_ID is not empty.
-if [[ -z "$package_app_name" ]]; then
-  echo "Empty PACKAGE_ID variable."
-  exit 1
-fi
-
-# Make sure the PACKAGE_ID doesn't have "../" or is "."
-if [[ "$package_app_name" == *".."* || "$package_app_name" == "." ]]; then
-  echo "Invalid PACKAGE_ID value."
-  exit 1
-fi
-
-echo "Removing \"/Applications/$package_app_name\"..."
-rm -rf "/Applications/$package_app_name"
+# For each package id, get all .app folders associated with the package and remove them.
+for pkg_id in "${pkg_ids[@]}"
+do
+  # Get volume and location of the package.
+  volume=$(pkgutil --pkg-info "$pkg_id" | grep -i "volume" | awk '{if (NF>1) print $NF}')
+  location=$(pkgutil --pkg-info "$pkg_id" | grep -i "location" | awk '{if (NF>1) print $NF}')
+  # Check if this package id corresponds to a valid/installed package
+  if [[ ! -z "$volume" ]]; then
+    # Remove individual directories that end with ".app" belonging to the package.
+    # Only process directories that end with ".app" to prevent Fleet from removing top level directories.
+    pkgutil --only-dirs --files "$pkg_id" | grep "\.app$" | sed -e 's@^@'"$volume""$location"'/@' | tr '\n' '\0' | xargs -n 1 -0 rm -rf
+    # Remove receipts
+    pkgutil --forget "$pkg_id"
+  else
+    echo "WARNING: volume is empty for package ID $pkg_id"
+  fi
+done

pkg/file/testdata/scripts/uninstall_pkg.sh.golden

@@ -1,18 +1,22 @@
 #!/bin/sh
 
-package_app_name="$PACKAGE_ID"
+# Fleet extracts and saves package IDs.
+pkg_ids=$PACKAGE_ID
 
-# Make sure PACKAGE_ID is not empty.
-if [[ -z "$package_app_name" ]]; then
-  echo "Empty PACKAGE_ID variable."
-  exit 1
-fi
-
-# Make sure the PACKAGE_ID doesn't have "../" or is "."
-if [[ "$package_app_name" == *".."* || "$package_app_name" == "." ]]; then
-  echo "Invalid PACKAGE_ID value."
-  exit 1
-fi
-
-echo "Removing \"/Applications/$package_app_name\"..."
-rm -rf "/Applications/$package_app_name"
+# For each package id, get all .app folders associated with the package and remove them.
+for pkg_id in "${pkg_ids[@]}"
+do
+  # Get volume and location of the package.
+  volume=$(pkgutil --pkg-info "$pkg_id" | grep -i "volume" | awk '{if (NF>1) print $NF}')
+  location=$(pkgutil --pkg-info "$pkg_id" | grep -i "location" | awk '{if (NF>1) print $NF}')
+  # Check if this package id corresponds to a valid/installed package
+  if [[ ! -z "$volume" ]]; then
+    # Remove individual directories that end with ".app" belonging to the package.
+    # Only process directories that end with ".app" to prevent Fleet from removing top level directories.
+    pkgutil --only-dirs --files "$pkg_id" | grep "\.app$" | sed -e 's@^@'"$volume""$location"'/@' | tr '\n' '\0' | xargs -n 1 -0 rm -rf
+    # Remove receipts
+    pkgutil --forget "$pkg_id"
+  else
+    echo "WARNING: volume is empty for package ID $pkg_id"
+  fi
+done