imgbot
517
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Juan Fernandez
|
9cb3a5e206 |
Check trusted location before from_webstore in chromiumSideloaded
Resolves #50706 chromiumSideloaded returned true as soon as from_webstore was 0, never reaching the trusted-location check. First-party browser components are installed by the browser itself and so always report from_webstore:false, which made the location exemption unreachable and flagged components like Edge Copilot Bridge as sideloaded_unverified. Check location for Internal/Component first. The existing collector fixture asserted the buggy behaviour and is updated to a genuinely sideloaded location, with a first-party component case added. |
||
|
Victor Lyuboslavsky
|
49bf85c54d |
Windows managed local account: design feedback on the Users tab and error tooltip (#50675)
Fixes from @melpike's feedback. Keep the Windows tab visible when Windows MDM is off rather than hiding it, and disable Create hidden admin with a tooltip pointing at Windows MDM, matching how the macOS tab already behaves. - Extracted `TurnOnMdmTooltipWrapper` to reduce code duplication Reword the password-policy error fleetd reports so it reads as sentences. The whole string is generated by Fleet, not by Windows, and it is now shown to admins verbatim in the Show managed account tooltip. Left-align that tooltip. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43488 # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Windows account setup remains visible when Windows MDM is unavailable. * Added guidance for enabling Apple or Windows MDM when required. * Managed-account error tooltips now show detailed failure information when available. * **Bug Fixes** * Prevented unavailable managed-account options from being selected. * Improved Windows account error messages and password-policy wording. * Improved visual feedback for disabled actions in dropdown menus. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
05bc7be89e |
Add Windows managed local admin account support to fleetd (#50088)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48723 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows (did not do macOS, but should be the same as Linux) - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for Fleet-managed local administrator accounts on Windows. * When enabled, creates or updates a hidden `_fleetadmin` account, securely generates a password, and escrows it to Fleet. * Reports provisioning errors and supports safe retries without blocking other configuration updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
a442d7af3a |
Python script-only packages: follow-on QA fixes (#50143)
**Related issues:** Resolves #50068, Resolves #50106, Resolves #50107, Resolves #50108, Resolves #50110, Resolves #50114 Follow-on fixes from QA of #41470 (Python script-only packages): - Software-installer validation errors are action-neutral, so the Add and Edit flows each show the correct single verb, and the unsupported-file error names a content/format mismatch instead of blaming the extension (#50068, #50107). - `.py` packages accept `setup_experience_platform` (`darwin`/`linux`), matching `.sh` (#50106). - A failed-to-run install script (exit code `-1`) now renders a diagnostic instead of empty output, and orbit surfaces the underlying execve error (#50108). - The install-rejection message for `.sh`/`.py` packages says "macOS and Linux hosts" instead of "linux" (#50110). - Orbit writes each script's temp file with an extension matching its shebang (`.py`/`.sh`/`.ps1`), so tracebacks reference the right file type (#50114). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes. - [x] Verified compatibility with the latest released version of Fleet (orbit-only change; the server↔agent `SoftwareInstallDetails` contract is unchanged). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved installer validation and rejection messaging for unsupported/invalid package contents (including correcting “add” vs “edit” wording and avoiding duplicated phrasing). * Added clearer diagnostics when install scripts fail to start (including empty output cases). * Corrected handling of script-only packages so Python scripts use the proper script type/extension, reducing misleading tracebacks. * Updated platform availability messaging so `.sh`/`.py` packages display macOS+Linux support. * **New Features** * Python script-only packages can now specify macOS and Linux setup experience platforms. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
07d4423c84 |
Add homebrew_outdated table to fleetd
Fixes #47692 New macOS-only extension table returning outdated Homebrew packages (formulae and casks) with installed and latest-available versions, for querying out-of-date packages and driving patching policies. Runs `brew outdated`/`brew info` as the console user; auto-update left on so current_version stays accurate. |
||
|
Lucas Manuel Rodriguez
|
1f2ca668f8 |
Fix flaky test TestCheckExecRealBinary (#50057)
Fixes flaky test found in nightly run: https://github.com/fleetdm/fleet/actions/runs/30330273165. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Improved execution checks to tolerate transient busy-file errors during retries. * Strengthened validation for both healthy and corrupted binaries, ensuring tests report the intended result. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
bf3e1bab99 |
Add Apple marketing names to backend, frontend, and an osquery table (#46482)
**Related issue:** Resolves https://github.com/fleetdm/fleet/issues/46818 and https://github.com/fleetdm/fleet/issues/48524. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Host lists and Host details now show human‑readable Apple hardware marketing names (macOS, iOS, iPadOS) where available (e.g., "MacBook Pro (16‑inch, 2021)"), replacing raw model identifiers. * Hardware model displays fall back to the original model identifier for non‑Apple or unmapped devices. * **Bug Fixes / CSV** * Exported host CSVs now align with the UI by using the marketing name for Apple devices when available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Jordan Montgomery
|
89f67544b4 |
Add support for fleet vars in scripts(controls scripts, software scripts/script-only packages and setup experience scripts) (#49781)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49511 and #46837 as a whole # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for Fleet built-in variables in host scripts, software installer scripts, setup-experience scripts, and maintained-app installer scripts. * Variables are resolved per host at execution time; saved content remains unexpanded. * **Bug Fixes** * Requests now validate Fleet variables up-front, with clear script-specific error messages for unsupported variables. * Added improved messaging when variable resolution fails during execution. * Enforced Fleet Premium licensing for script/installer flows that use Fleet variables. * **Documentation** * Documented supported variables and Premium requirements, including usage examples. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
a7eb747faf |
Flag to bypass end user auth (#49683)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46644 Demo video: https://www.youtube.com/watch?v=svCaA-820yc Docs: https://github.com/fleetdm/fleet/pull/49713/changes # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - Did not verify macOS. - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added `--bypass-end-user-auth` to `fleetctl package` and Orbit. * Generated Linux and Windows installers can skip the end-user authentication prompt during enrollment. * Added `ORBIT_BYPASS_END_USER_AUTH` for environment-based configuration. * End-user authentication remains enabled when a supported EUA token is provided. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
github-actions[bot]andlucasmrod
|
363a56a2dc |
Update Orbit CA certs [automated] (#49479)
Automated change from [GitHub action](https://github.com/fleetdm/fleet/actions/workflows/update-certs.yml). Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com> |
||
|
Dante Catalfamo
|
eae56802f9 |
Fix duplicate FDE TPM keyslots not getting caught correctly (#49459)
**Related issue:** Resolves #44428 Unreleased bug from #48452 caught during testing <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved handling of resource-conflict responses when wording varies, including singular and plural message formats. * Prevented authentication failures and unrelated bad requests from being incorrectly classified as conflicts. * **Tests** * Added coverage for HTTP conflict responses, recognized conflict types, message variations, and non-conflict errors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
e87dd023f7 |
Fix update ca certs CI check (#49476)
Fixing broken CI check after some updates on curl's mk bundle script: https://github.com/fleetdm/fleet/actions/runs/29560837606/job/87822721779 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the certificate bundle header comment with clearer configuration wording. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
0fe0e0038b |
Add ai_tools fleetd table (#49243)
**Related issue:** Resolves #47619 |
||
|
Lucas Manuel Rodriguez
|
cf19294ad9 | Fix update-certs CI check (failing for a while) (#49159) | ||
|
Lucas Manuel Rodriguez
|
9aa4a3375b |
Remove the wmic.exe dependency in mdm_bridge table (#49296)
Resolves #34311. It's not urgent because: - Orbit uses a fallback mechanism to fetch the device UUID (using SMBIOS): https://github.com/fleetdm/fleet/blob/d3092bbc640ebd8e92c13476f0ca8772b98d425e/orbit/pkg/platform/platform_windows.go#L354-L359 - Only used by the `mdm_bridge` table implementation. Which is only used by CIS policies (not for critical MDM functionality). - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually Tested on both a Windows 11 VM with 25H2 and real Windows 11 device with 23H2. The extracted UUID matches the UUID reported by osquery. ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [X] Verified that fleetd runs on macOS, Linux and Windows - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Updated Windows device identification to obtain the system UUID using COM-based WMI querying instead of relying on the deprecated WMIC utility. - Removed the WMIC dependency from the MDM bridge table implementation. - Improved cross-platform UUID handling by removing unused non-Windows UUID placeholder logic and related constants. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
ada55da5bd |
Drop Docker fleetdm/bomutils dependency in fleetctl when generating pkg fleetd installers (#48915)
Resolves #48448. These should help with reviewing the XAR and BOM implementations: - https://claude.ai/code/artifact/60a78c1d-2fc9-45da-9471-1517fe77adb4. - https://claude.ai/code/artifact/1c759a32-02f7-4a41-8611-04d7358367d7. The darwin only tests (bom_darwin_test.go) have been executed on my workstation. Goal is to make sure to run the tests on macOS Github runners in https://github.com/fleetdm/fleet/issues/33371. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * macOS package builds now use an internal, built-in implementation instead of external packaging tools. * `.pkg` installer creation no longer depends on Docker for macOS packaging. * **Bug Fixes** * Improved packaging reliability by reducing platform-specific build steps. * Packaging test coverage was streamlined to better match the supported build environment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
github-actions[bot]andlucasmrod
|
11df098d7c |
Update Orbit CA certs [automated] (#49160)
Resolves: https://github.com/fleetdm/fleet/issues/49161. Automated change from [GitHub action](https://github.com/fleetdm/fleet/actions/workflows/update-certs.yml). Claude summary: ``` ➕ Added (1) - e-Szigno TLS Root CA 2023 — new Hungarian (Microsec) root Mozilla admitted to the store. ➖ Removed (24) These match Mozilla's root-store retirements/distrusts over the Jan–Jul 2026 window. Grouped by the reason they went away: ┌────────────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ │ Theme │ Roots removed │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Trustwave exiting the CA business │ Trustwave Global CA, Trustwave Global ECC P256, Trustwave Global ECC P384, SecureTrust CA, Secure Global CA │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Entrust distrust (incl. Entrust-owned AffirmTrust) │ Entrust Root CA – G2, Entrust Root CA – EC1, AffirmTrust Commercial, AffirmTrust Networking, AffirmTrust Premium, AffirmTrust Premium ECC │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Legacy DigiCert / QuoVadis roots retired (superseded by G2/G3) │ DigiCert Assured ID Root CA, DigiCert Global Root CA, DigiCert High Assurance EV Root CA, QuoVadis Root CA 2, QuoVadis Root CA 3 │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Distrusted for compliance │ GLOBALTRUST 2020 │ ├────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Other retirements │ COMODO Certification Authority, SwissSign Gold CA – G2, TeliaSonera Root CA v1, Certigna, certSIGN ROOT CA, FIRMAPROFESIONAL CA ROOT‑A WEB, GTS Root R2 │ └────────────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘ ``` Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguez
|
21c024313a |
Upgrade nfpm package in fleetctl (#48961)
Resolves #48954. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually Tested a package generated with new `fleetctl` on Fedora 43, Ubuntu 25.04, and Omarchy. ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary of changes * **Bug Fixes** * Improved Linux RPM packaging consistency, including more reliable output filename normalization and correct platform metadata. * Ensured RPM metadata extraction stays aligned with the updated packaging flow. * **Tests** * Added coverage for RPM filename normalization edge cases. * Updated a CPE rule validation test expectation to match the new error-string format. * **Chores** * Upgraded packaging tooling and refreshed Go dependencies. * **Security** * Removed a previously ignored CVE entry from vulnerability scan ignore settings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
374aa7e612 |
LUKS key escrow validate against any keyslot (#48815)
**Related issue:** Resolves #46227 |
||
|
Lucas Manuel Rodriguez
|
4449830add |
Fix lint for linux only code (#48962)
- [X] QA'd all new/changed functionality manually
Fixes:
```
make lint-go
[...]
orbit/pkg/luks/snapd_client.go:21:7: const snapdSocketPath is unused (unused)
const snapdSocketPath = "/run/snapd.socket"
^
orbit/pkg/luks/snapd_client.go:46:6: func newSnapdClient is unused (unused)
func newSnapdClient() *snapdClient {
^
orbit/pkg/luks/snapd_fde.go:62:6: func newSnapdSocketFDE is unused (unused)
func newSnapdSocketFDE() *snapdSocketFDE {
^
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Linux-specific handling for recovery-key and snapd
interactions.
* Added fallback behavior when an existing keyslot causes a conflict, so
recovery-key setup can still complete successfully.
* Better surfaces error messages from failed snapd requests.
* **Tests**
* Added Linux-only tests covering synchronous and asynchronous snapd
request flows.
* Added coverage for recovery-key creation, polling, fallback
replacement, and error responses.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Dante Catalfamo
|
4351f4cee5 |
escrow snapd TPM-backed FDE recovery keys from orbit (#48452)
**Related issue:** Resolves #44428 |
||
|
Victor Lyuboslavsky
|
3aff550422 |
Fixed a bug where fleetd could not start on-demand Windows MDM session (#48765)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48760 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop Note: changes are Windows only; only verified/tested these items for Linux and Windows - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where some Windows MDM enrollment sessions could stay queued or fail to start on certain devices. * Improved detection of active Windows MDM enrollment, helping commands run more reliably when enrollment is already present. * **Tests** * Added coverage for Windows enrollment detection to prevent regressions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
3e4cf63d31 |
Fix polling of /proc/stat on Linux by caching (#48750)
Resolves #46461. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. --- Verification command (checks how many times /proc/stat is read): ``` sudo bpftrace -e ' tracepoint:syscalls:sys_enter_openat /str(args->filename) == "/proc/stat" || str(args->filename) == "/proc/uptime"/ { @[comm, str(args->filename)] = count(); } interval:s:60 { exit(); }' ``` 1.57.0 outputs: ``` @[orbit, /proc/stat]: 1084 ``` fleetd built with changes in this PR (and I had to trigger a restart, otherwise it's 0): ``` @[orbit, /proc/stat]: 3 [...] @[fleet-desktop, /proc/stat]: 6 ``` ## Testing - [X] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [X] Verified that fleetd runs on macOS, Linux and Windows - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved process listing performance on Linux by reducing repeated system boot-time reads. * Prevented unnecessary refreshes during frequent process checks, helping watchdog-style polling run more efficiently. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
a2940ecd31 |
Revert "Initial pass on TPM-backed disk encryption support (#46457)" (#48101)
This reverts commit
|
||
|
rahultoppurandLucas Manuel Rodriguez
|
06bc81106e |
Add socket_path to containerd tables (#47987)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48006. Adds a new field `socket_path` in both `containerd_containers` and `containerd_mounts`. We keep the previous default when no `socket_path` is requested in the filter; otherwise, we honor the value passed from the incoming query. Test case: Ran a `make fleetd-tables-linux`, started some containers, then used osquery: <img width="2494" height="1408" alt="Screenshot from 2026-06-22 12-48-43" src="https://github.com/user-attachments/assets/ed65d16c-8aa8-4fc7-890e-4f200752e6e2" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added an optional `socket_path` column to `containerd_containers` and `containerd_mounts`. * Containerd queries can now target a specific socket path, and results report the socket path used (defaulting to `/run/containerd/containerd.sock` when not provided). * **Documentation** * Updated Fleet and table schemas with the new `socket_path` column and example queries (including common k3s socket paths). * **Tests** * Added Linux-only coverage to verify default vs explicitly provided `socket_path` behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucarodriguez@gmail.com> |
||
|
|
1f6f218b1d |
Handle missing macOS bundle executable in executable_hashes table (#47532)
**Related issue:** Resolves #45327 - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes * Fixed macOS detail query failures when application bundles declare executable paths that don't exist on the system. Previously, missing executables would cause queries to fail entirely. The system now handles these gracefully by setting the SHA256 field to an empty value, improving reliability of system queries. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Juan Fernandez
|
d109d3954b |
Fix fleetd keychain error logs during first ABM enrollment
Resolves #41338 A fleetd-base.pkg built with `fleetctl package --use-system-configuration` shipped an empty /opt/orbit/secret.txt. During ABM enrollment, before the configuration profile was available, orbit read that empty file as an empty enroll secret, producing confusing logs. |
||
|
Lucas Manuel Rodriguez
|
443d82dd15 |
Add self-heal mechanism in case of corruption in osquery or Fleet Desktop executables (#47818)
Resolves #47552 Currently, a corruption in the download process is caught by our TUF updater and will re-download. So the main scenario we are covering here is a corruption in the extraction process of the .tar.gz components. I'm simulating this by modifying the executables in the hosts and restarting (now with these changes it self-heals). - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Orbit now self-heals corrupt component binaries by detecting executables that fail to run, removing the broken artifacts, re-downloading, and re-verifying before continuing (including the osqueryd and Fleet Desktop components). * **Bug Fixes** * Prevents endless crash loops caused by truncated or otherwise invalid on-disk binaries. * **Tests** * Added coverage for exec verification and target cleanup/re-download, including corruption, healthy binaries, and cross-platform behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
2cb8509c21 |
Add daemon_reachable column to santa_status table (#47751)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46059 Added `daemon_reachable` and `error` columns to the `santa_status` fleetd table so the table reports a row when the Santa daemon is unreachable instead of silently returning zero rows. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Reproduced the issue: <img width="1476" height="255" alt="Screenshot 2026-06-17 at 11 12 55 AM" src="https://github.com/user-attachments/assets/bf7f20c2-9e77-499d-9962-0996f5c57cb1" /> <img width="1644" height="632" alt="Screenshot 2026-06-17 at 11 14 34 AM" src="https://github.com/user-attachments/assets/57c790b6-ccf2-4446-90a4-164cdcbacadd" /> Pushed a new orbit version with the fix to the TUF server: <img width="689" height="58" alt="Screenshot 2026-06-17 at 11 34 25 AM" src="https://github.com/user-attachments/assets/77b70d51-856f-4957-869e-1458540154dd" /> Ran the query again: we now return one row instead of no rows, and `daemon_reachable = 0` is returned. Rest of the values are null. <img width="2542" height="545" alt="Screenshot 2026-06-17 at 11 36 37 AM" src="https://github.com/user-attachments/assets/6d71167e-9711-4284-9142-48629edbd9be" /> Approved the system extension and granted full disk access: <img width="791" height="664" alt="Screenshot 2026-06-17 at 11 38 39 AM" src="https://github.com/user-attachments/assets/3f4f91b0-d20a-4afc-93f9-347efe823beb" /> <img width="733" height="643" alt="Screenshot 2026-06-17 at 11 39 20 AM" src="https://github.com/user-attachments/assets/596d3fb8-7b0e-4532-94d6-f5c28802f343" />\ Verified the state changed from `[activated waiting for user]` to `[activated enabled]` and `santactl status` did not return errors: <img width="1429" height="708" alt="Screenshot 2026-06-17 at 11 40 02 AM" src="https://github.com/user-attachments/assets/f9402808-0755-478c-9c95-78aa2e5c65f4" /> Ran queries again and verified `daemon_reachable = 1` <img width="2525" height="548" alt="Screenshot 2026-06-17 at 11 41 33 AM" src="https://github.com/user-attachments/assets/bf65ec55-c719-48e1-9a29-4b38aa52a882" /> <img width="1656" height="528" alt="Screenshot 2026-06-17 at 11 42 34 AM" src="https://github.com/user-attachments/assets/42b51b5b-9123-4919-beeb-b847a0a99668" /> ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added `daemon_reachable` to Santa status monitoring to clearly indicate reachability (`1` reachable, `0` unreachable). * Added an `error` column to expose the `santactl status` error when the daemon is not reachable. * **Bug Fixes** * Updated Santa status behavior so daemon communication failures now return exactly one row with `daemon_reachable = 0` (and `error` populated) instead of returning no rows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
0ac698145b |
Reap sudo child processes in execuser on Linux to prevent zombies (#47664)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41796 Root cause: run() in orbit/pkg/execuser/execuser_linux.go called cmd.Start() but never cmd.Wait(). On Linux a child that exits stays a zombie until the parent reaps it, so every sudo … fleet-desktop invocation leaked a zombie. When Fleet Desktop fails to start, orbit respawns it in a loop (desktopRunner.Execute), so the zombies pile up. Fix: reap the child in a background goroutine after Start(). run() still returns immediately (orbit monitors the desktop process separately), so behavior is unchanged otherwise. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually #### Reproduction steps 1. Start TUF server and create .deb package ```sh SYSTEMS="linux-arm64" \ DEB_FLEET_URL=https://nicolasulmete.xyz \ # personal ngrok tunnel serving Fleet DEB_TUF_URL=http://nicotuf.ngrok.io \ # personal ngrok tunnel serving TUF GENERATE_DEB_ARM64=1 \ ENROLL_SECRET=<enroll-secret> \ FLEET_DESKTOP=1 \ TUF_PATH=$FLEET_REPO_DIR/test_tuf \ ./tools/tuf/test/main.sh ``` 2. Install .deb on a Ubuntu 25.10 ARM64 VM. 3. Push a failing fleet-desktop stub to trigger the respawn loop that produces zombie processes: ```sh export TUF_PATH=$FLEET_REPO_DIR/test_tuf export FLEET_TARGETS_PASSPHRASE=p4ssphr4s3 FLEET_SNAPSHOT_PASSPHRASE=p4ssphr4s3 FLEET_TIMESTAMP_PASSPHRASE=p4ssphr4s3 source ./tools/tuf/test/load_orbit_version_vars.sh STUB=$(mktemp -d) mkdir -p "$STUB/fleet-desktop" printf '#!/bin/sh\n[ "$1" = "--help" ] && exit 0\nexit 1\n' > "$STUB/fleet-desktop/fleet-desktop" chmod +x "$STUB/fleet-desktop/fleet-desktop" tar czf "$STUB/desktop.tar.gz" -C "$STUB" fleet-desktop ./build/fleetctl updates add --path "$TUF_PATH" --target "$STUB/desktop.tar.gz" --platform linux-arm64 --name desktop --version "$ORBIT_VERSION" -t "$ORBIT_MAJOR.$ORBIT_MINOR" -t "$ORBIT_MAJOR" -t stable rm -rf "$STUB" ``` 4. Watch zombie processes on the VM: ```sh watch -n5 'ORB=$(pgrep -x orbit); \ echo "zombie sudo children: $(ps -eo ppid,stat,comm | awk -v o="$ORB" "\$1==o && \$2 ~ /Z/ && \$3==\"sudo\"" | wc -l)"; \ echo "total sudo lines: $(ps aux | grep -c "[s]udo")"' ``` https://github.com/user-attachments/assets/dfa4d766-3c8e-4eb0-9104-7219c421538f #### Test fix 1. Switch to this branch, rebuild and push the new orbit binary (note that we still have the stub fleet-desktop that always exits). ```sh make build export TUF_PATH=$FLEET_REPO_DIR/test_tuf bash $FLEET_REPO_DIR/push-orbit-arm64.sh ``` Contents of `push-orbit-arm64.sh` is: ```sh #!/bin/bash set -e source ./tools/tuf/test/load_orbit_version_vars.sh GOOS=linux GOARCH=arm64 go build \ -o orbit-linux-arm64 \ -ldflags="-s -w -X github.com/fleetdm/fleet/v4/orbit/pkg/build.Version=$ORBIT_VERSION -X github.com/fleetdm/fleet/v4/orbit/pkg/build.Commit=$ORBIT_COMMIT" \ ./orbit/cmd/orbit ./tools/tuf/test/push_target.sh linux-arm64 orbit orbit-linux-arm64 "$ORBIT_VERSION" ``` 2. Verify on the VM that the update is detected and applied. Also, run step 4's cmd from the reproduction steps and see the zombies being 0, even though fleet-desktop is still continuously exiting. https://github.com/user-attachments/assets/d0f96d85-5e94-4878-b413-67031add3c1e ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue on Linux where repeated Fleet Desktop startup failures could result in thousands of orphaned processes accumulating in the background, degrading system performance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
eacca4e906 |
Linux disk encryption key escrow: Improve confirmation modal (#47097)
- @noahtalerman: For the following quick win: - #46528 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Clarified the success message shown after disk encryption key escrow: instructs users to close the window, go to the "My Device" page, and use "Refetch" to clear the yellow notification banner. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Noah Talerman <noahtal@umich.edu> |
||
|
Lucas Manuel Rodriguez
|
4991b3c685 |
Fix fleetd with pre-packaged osquery flags (#47305)
Resolves #47285. Final behavior (matches pre-1.56): ``` ┌────────────────────┬─────────────────────────┬───────────────────────────────────────┐ │ command_line_flags │ wire config.Flags │ Orbit action │ ├────────────────────┼─────────────────────────┼───────────────────────────────────────┤ │ Unset │ omitted (nil, len == 0) │ Preserve osquery.flags — return early │ ├────────────────────┼─────────────────────────┼───────────────────────────────────────┤ │ null │ null (len == 4) │ Clear (parses to empty map) │ ├────────────────────┼─────────────────────────┼───────────────────────────────────────┤ │ {} │ {} (len == 2) │ Clear (parses to empty map) │ ├────────────────────┼─────────────────────────┼───────────────────────────────────────┤ │ {"verbose": true} │ non-empty │ Write flags │ └────────────────────┴─────────────────────────┴───────────────────────────────────────┘ ``` - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Preserve existing pre-packaged or user-provided osquery flagfiles when the server omits flag configuration (no unintended clears or restarts). * Treat an explicit empty flag payload (including JSON empty document or JSON "null") as an instruction to clear flagfiles and queue a restart. * **Tests** * Expanded coverage to validate the preserve-vs-clear behavior for unset, empty, and "null" flag payloads. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
19ba1ed787 | Initial pass on TPM-backed disk encryption support (#46457) | ||
|
Jordan MontgomeryandCopilot Autofix powered by AI
|
19d7dec0ed |
Fix orbit debug flag behavior (#46814)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46816 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed unexpected restarts when starting Orbit with `--debug` or `ORBIT_DEBUG=1` environment variable while the server was not sending debug flags. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Victor Lyuboslavsky
|
e20cedc8a0 |
fleetd Windows MDM wake (push vs poll) (#46594)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46567 and Resolves #46737 Solution for the agressive polling: - no WNS (although we could add it later as another avenue for notifications) - fleetd advertises a sync capability, persisted as `mdm_windows_enrollments.fleetd_sync_capable` - The management session relaxes the DMClient poll (`poll_schedule_relaxed`) - When an MDM command is queued, `has_pending_commands` flips, the next orbit check-in returns `WindowsMDMSyncRequest`, and fleetd runs `deviceenroller` to deliver it immediately - older fleetd versions keep the 1-minute poll Docs: https://github.com/fleetdm/fleet/pull/46780 Changes to osquery_perf and any additional changes after loadtesting will be done in a separate PR. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * On-demand Windows MDM sync: servers can request immediate delivery of queued MDM commands to Windows clients; Orbit triggers client-side sync on Windows. * **Enhancements** * Orbit throttles per-device on-demand sync to avoid excessive runs. * Server reconciles and persists device poll schedule (fast vs relaxed) and exposes consolidated host MDM state (awaiting-configuration + has-pending-commands). * **Tests** * Added tests covering host config state, pending-command flows, poll-schedule toggling, and on-demand sync behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
4221903eb2 |
Add exponential backoff to Fleet Desktop server polling (#45623)
Closes #45624 Part 1 of #45553 -- see there for the full behavioral contract and Oracle. ## Changes - New `orbit/pkg/backoff` package: shared, stateful exponential backoff tracker with jitter, thread-safe, per-path isolation. This package will serve all agent components that need backoff (orbit API, fleetd paths, and potentially osquery TLS), but for now only Fleet Desktop uses it. We are introducing it incrementally to reduce risk. - Integrated into Fleet Desktop's `checkToken` retry loop -- the exact tight-retry path that caused the #44816 DB outage. The main ping/DesktopSummary loop does not need backoff (Ping is unauthenticated with no DB cost; DesktopSummary already runs at most every 5 min). - On error: interval doubles each failure (1s, 2s, 4s, 8s, ...) capped at 5 minutes - On success: resets immediately to normal polling interval - Each communication path tracks its own backoff independently ## Manual testing ### Automated tests (17 total, all pass with -race) \`\`\` go test ./orbit/pkg/backoff/ -v -race -count=1 # 17 tests, 0 failures make lint-go-incremental # 0 issues \`\`\` - 14 logic tests (exponential doubling, cap, jitter, reset, per-path isolation, concurrent access, overflow detection, garbage input flooring) - 3 real-time ticker tests (actual time.Ticker with wall-clock measurements) ### Local TUF end-to-end test (macOS) Set up local TUF server via \`tools/tuf/test/main.sh\` with \`SYSTEMS=macos FLEET_DESKTOP=1 GENERATE_PKG=1\`. This builds orbit and Desktop from this branch, generates \`fleet-osquery.pkg\` with local TUF root keys. Installed the package on macOS, enrolled to a local Fleet server. **Test: corrupt token to simulate #44816 expired-token scenario** Wrote invalid token to \`/opt/orbit/identifier\`, then watched Desktop and orbit logs. Desktop backoff (exponential doubling): \`\`\` 11:57:21 ERR get device URL, backing off next_retry=2.044s (1s * 2^1 + jitter) 11:57:29 ERR get device URL, backing off next_retry=4.061s (1s * 2^2 + jitter) 11:57:39 ERR get device URL, backing off next_retry=8.744s (1s * 2^3 + jitter) \`\`\` Orbit detects and rotates the token: \`\`\` 11:57:42 INF token TTL expired, rotating token \`\`\` Desktop recovers instantly: \`\`\` 11:57:48 DBG enabling tray items \`\`\` Previously Desktop would have retried every 5s indefinitely (#44816). With backoff, retry intervals double each failure and recovery is immediate on the first success. ### Build verification \`\`\` go build ./orbit/cmd/desktop/ # compiles clean go build ./orbit/cmd/orbit/ # compiles clean \`\`\` --- # Checklist for submitter - [x] Changes file added for user-visible changes in \`orbit/changes/\`. - [x] Input data is properly validated, no SQL changes, no JS changes. - [x] Timeouts are implemented and retries are limited to avoid infinite loops (backoff caps at 5 min). - [x] Added/updated automated tests (17 tests, all pass with \`-race\`). - [x] QA'd all new/changed functionality manually (local TUF e2e on macOS). ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that \`runtime.GOOS\` is used as needed to isolate changes (backoff is platform-agnostic). - [x] Verified that fleetd runs on macOS (local TUF install + e2e test). Linux/Windows need QA. - [ ] Verified auto-update works from the released version of component to the new version. |
||
|
Juan Fernandez
|
0922a8bdb9 |
Fix Fleet Desktop KDE detection on hybrid Linux installs
Fixes #45963 isKDE() previously matched loginctl's Desktop metadata field, which can falsely report KDE on hosts that have kde-plasma-desktop installed alongside another, detect the live plasmashell process owned by the logged-in GUI user instead. |
||
|
Nico
|
7290b27a56 |
Fix: My Device page not showing correct light/dark mode logo (#46063)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46034 ## Testing - [x] QA'd all new/changed functionality manually ### Before My Device page was showing the light mode logo even when in dark mode. <img width="1412" height="756" alt="Screenshot 2026-05-22 at 11 51 57 AM" src="https://github.com/user-attachments/assets/9f098d96-b9d1-4618-b6f4-e7ee49629506" /> <img width="1340" height="708" alt="Screenshot 2026-05-22 at 11 35 59 AM" src="https://github.com/user-attachments/assets/dfff3a53-e08b-4b7a-a3fc-97f33e0d691d" /> ### After My Device page correctly shows the logo for both modes Light: <img width="1434" height="725" alt="Screenshot 2026-05-22 at 11 48 51 AM" src="https://github.com/user-attachments/assets/4d5913c5-5264-40ac-bbdf-21c271637898" /> <img width="1337" height="451" alt="Screenshot 2026-05-22 at 11 48 55 AM" src="https://github.com/user-attachments/assets/1cd6193e-b910-46ea-8f89-0cd88ad07382" /> Dark (Fleet's default logo): <img width="1127" height="644" alt="Screenshot 2026-05-22 at 11 48 08 AM" src="https://github.com/user-attachments/assets/a55a0026-f301-4281-8419-83cc9a707bb7" /> <img width="1357" height="528" alt="Screenshot 2026-05-22 at 11 48 15 AM" src="https://github.com/user-attachments/assets/471a604a-9524-4d5a-8af4-cfe09d2430fc" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Organization logos now adapt to dark or light mode, showing the appropriate themed variant across the app. * **Bug Fixes / Improvements** * Device and host pages now pick the correct logo variant with sensible fallbacks so logos display consistently when theme-specific images are missing. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46063?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
1f496781a2 |
Rename and move testing_utils.go from schedule and orbit tests (#45609)
Resolves #45220 (one of many small PRs, we are close) ## Testing - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Refactored test infrastructure for scheduling components to use centralized test utilities. --- **Note:** This release contains no user-facing changes. All modifications are internal testing and code organization improvements. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45609) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katz
|
7d26e7e475 |
Add adobe_plugins osquery extension table (#45208)
Closes #45206 ## Summary - Adds a new `adobe_plugins` osquery extension table to fleetd (macOS + Windows) - Parses CEP (`CSXS/manifest.xml`) and UXP (`manifest.json`) manifests for rich metadata - Falls back to filesystem info for native plug-ins where no manifest exists - Supports a `scan_level` WHERE constraint: `standard` (default) or `deep` ## Table schema | Column | Type | Description | | --- | --- | --- | | `path` | TEXT | Full path to the plugin directory or file | | `name` | TEXT | Plugin display name (from manifest or directory name) | | `version` | TEXT | Plugin version (from manifest) | | `vendor` | TEXT | Plugin author/publisher (from manifest) | | `bundle_id` | TEXT | Plugin bundle identifier (from manifest) | | `host_application` | TEXT | Target app(s): Photoshop, Illustrator, Premiere Pro, etc. | | `extension_type` | TEXT | `CEP`, `UXP`, or `native` | | `user` | TEXT | Username for user-scoped installs; empty for system-wide | | `platform` | TEXT | `darwin` or `windows` | | `scan_level` | TEXT | WHERE constraint only — `standard` (default) or `deep` | ## How I tested it > **Note:** Manual testing was done by installing two real open-source CEP extensions (downloaded from GitHub) on a macOS host without a full Adobe CC installation. This validates the table logic, manifest parsing, and osquery integration end-to-end against real-world manifest formats. **QA should test against machines with full Adobe Creative Cloud installations** (Photoshop, Premiere, Illustrator, etc.) to verify the scan paths match what Adobe actually ships, and to exercise `scan_level = 'deep'` with real native plug-in directories. Expect a few more dev cycles after QA feedback. ### 1. Unit tests — 22 passing ``` $ go test ./orbit/pkg/table/adobe_plugins/... -v --- PASS: TestParseCEPPlugin/valid_manifest --- PASS: TestParseCEPPlugin/missing_manifest_falls_back_to_dir_name --- PASS: TestParseCEPPlugin/malformed_manifest_falls_back_to_dir_name --- PASS: TestParseUXPPlugin/valid_manifest --- PASS: TestParseUXPPlugin/missing_manifest_falls_back_to_dir_name --- PASS: TestParseUXPPlugin/manifest_with_id_but_no_name_uses_id --- PASS: TestParseNativePlugin/* (5 subtests) --- PASS: TestResolveHostApps/* (7 subtests) --- PASS: TestScanEntry/* (2 subtests) PASS ``` ### 2. Cross-platform compilation ``` $ go build ./orbit/pkg/table/adobe_plugins/... # macOS ✅ $ GOOS=windows go build ./orbit/pkg/table/adobe_plugins/... # Windows ✅ $ GOOS=linux go build ./orbit/pkg/table/adobe_plugins/... # Linux stub ✅ $ go build ./orbit/cmd/fleetd_tables/ # Full fleetd binary ✅ $ go vet ./orbit/pkg/table/adobe_plugins/... # Clean ✅ ``` ### 3. Manual end-to-end testing on macOS (osquery 5.23.0) #### Setup Built the fleetd extension binary, then installed two **real open-source CEP extensions** from GitHub into the user-scoped scan path (`~/Library/Application Support/Adobe/CEP/extensions/`): 1. **[adobe-discord-rpc](https://github.com/Kuredew/adobe-discord-rpc)** — a real CEP extension targeting 11 Adobe apps. Has no `<Author>` element (tests missing-vendor edge case). Complex manifest with many host app codes. 2. **[cep-template](https://github.com/khanyuinc/cep-template)** — a CEP starter template targeting After Effects only. Minimal manifest. ```bash # Build extension go build -o build/fleetd-tables-test ./orbit/cmd/fleetd_tables/ # Install real extensions CEP_DIR="$HOME/Library/Application Support/Adobe/CEP/extensions" mkdir -p "$CEP_DIR/adobe-discord-rpc/CSXS" # downloaded CSXS/manifest.xml from GitHub into the directory mkdir -p "$CEP_DIR/cep-template/CSXS" # downloaded CSXS/manifest.xml from GitHub into the directory ``` #### Running the query ```bash OSQUERYD="/opt/orbit/bin/osqueryd/macos-app/stable/osquery.app/Contents/MacOS/osqueryd" $OSQUERYD -S --allow_unsafe --extensions_timeout=10 \ --extensions_require=com.fleetdm.fleetd_tables.osquery_extension.v1 \ --extension build/fleetd-tables-test \ --json "SELECT * FROM adobe_plugins;" ``` #### Actual output (verbatim) ```json [ { "bundle_id": "com.kureichi.discordrpc", "extension_type": "CEP", "host_application": "After Effects, Photoshop, Premiere Pro, InCopy, Audition, Dreamweaver, Animate, InDesign, Illustrator, Prelude", "name": "adobe-discord-rpc", "path": "/Users/sharonkatz/Library/Application Support/Adobe/CEP/extensions/adobe-discord-rpc", "platform": "darwin", "scan_level": "", "user": "sharonkatz", "vendor": "", "version": "3.1.1" }, { "bundle_id": "com.yourcompany", "extension_type": "CEP", "host_application": "After Effects", "name": "cep-template", "path": "/Users/sharonkatz/Library/Application Support/Adobe/CEP/extensions/cep-template", "platform": "darwin", "scan_level": "", "user": "sharonkatz", "vendor": "", "version": "1.0" } ] ``` #### osqueryi table output ``` +-------------------+---------+-------------------------+----------------------------------------------------------------------------------------------------------------+----------------+------------+ | name | version | bundle_id | host_application | extension_type | user | +-------------------+---------+-------------------------+----------------------------------------------------------------------------------------------------------------+----------------+------------+ | adobe-discord-rpc | 3.1.1 | com.kureichi.discordrpc | After Effects, Photoshop, Premiere Pro, InCopy, Audition, Dreamweaver, Animate, InDesign, Illustrator, Prelude | CEP | sharonkatz | | cep-template | 1.0 | com.yourcompany | After Effects | CEP | sharonkatz | +-------------------+---------+-------------------------+----------------------------------------------------------------------------------------------------------------+----------------+------------+ ``` #### What this verified | Scenario | Result | | --- | --- | | Real CEP manifest with 11 host apps | ✅ All codes resolved (AEFT→After Effects, PHSP/PHXS→Photoshop, PPRO→Premiere Pro, etc.) | | Missing `<Author>` element | ✅ `vendor` is empty string, no crash | | Minimal CEP manifest (single host) | ✅ `host_application=After Effects`, version/bundle_id correct | | User-scoped detection | ✅ `user=sharonkatz` populated | | Schema registration | ✅ `.schema adobe_plugins` shows all 10 columns | | No Adobe installed + no plugins | ✅ 0 rows, no error | | Deep scan with no app bundles | ✅ 0 extra rows, no error | ### Windows Not tested yet — Windows paths are implemented and cross-compile, but need manual verification on a Windows host with Adobe CC. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added Adobe plugins osquery table for macOS and Windows platforms * Discovers and catalogs Adobe CEP, UXP, and native plugins * Extracts plugin metadata including version, vendor, host applications, and installation paths * Supports configurable scan depth for comprehensive plugin discovery <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45208) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan MontgomeryandCopilot Autofix powered by AI
|
bee5edaa0b |
Add server-side orbit debug logging enablement - currently only configurable as a duration-after-enrollment setting (#45367)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43997 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Configure Orbit to enable debug logging for a limited window on agent enrollment; enrolled hosts receive debug/verbose behavior while the window is active and it is reflected in agent config. * **Chores** * Added database column to record per-host debug-until timestamps and datastore support to extend it safely. * **Tests** * Added integration and unit tests covering validation, enrollment stamping, config generation, and runtime debug toggling. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45367) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
|
99babf436a |
Don't write the secret.txt when the secret is the dummy placeholder value (#45041)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44826 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] Verified that fleetd runs on macOS, Linux and Windows <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Windows MSI builds now correctly exclude placeholder secret values during installation, preventing unnecessary dummy configuration files from being created. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Allen Houchins
|
fa38063590 |
Fix Fleet Desktop not launching on OpenSUSE 16 (#44482)
This pull request addresses a startup issue with Fleet Desktop on openSUSE Leap 16 and similar Linux distributions. The main change is to adjust how Fleet Desktop and key-escrow dialogs are launched to avoid environment variable loss caused by login shell profile scripts. The fix is scoped specifically to openSUSE Leap 16+ to avoid impacting other distributions. **Distribution-specific sudo invocation changes:** * The `-i` (login shell) flag is now omitted from the `sudo` command when launching Fleet Desktop and key-escrow dialogs on openSUSE Leap 16 and newer, preventing environment variables from being lost due to profile script interference. [[1]](diffhunk://#diff-633ab361af6795ef458233819e2806dfba4ca56f684866d956321825b8fd2e91R1) [[2]](diffhunk://#diff-3e8315d9f12512bce490457c5d20bd7c5aebaa2a8e18b1abf50e504815dd7a9dR178-R193) * For all other supported distributions, the previous behavior (using `-i`) is preserved to maintain compatibility and avoid unnecessary re-testing. **Detection logic:** * Introduced a new helper function `isOpenSUSELeap16Plus` in `execuser_linux.go` to detect if the host is running openSUSE Leap 16 or newer by parsing `/etc/os-release`. This ensures the workaround is only applied where necessary. --- **Related issue:** N/A — surfaced via field investigation on openSUSE Leap 16 (arm64). This PR addresses two distinct issues that together prevent Fleet Desktop from working on openSUSE Leap 16, both validated end-to-end on a real Leap 16 (arm64) host. ## 1. Launch reliability — drop `sudo -i` `orbit/pkg/execuser/execuser_linux.go` On Linux, Orbit launches Fleet Desktop with: ``` sudo -n -i -u <user> -H env WAYLAND_DISPLAY=… … FLEET_DESKTOP_DEVICE_IDENTIFIER_PATH=/opt/orbit/identifier … /…/fleet-desktop ``` The `-i` flag makes sudo "simulate initial login" — it runs the target user's shell as a login shell and wraps the rest of the command in `bash --login -c '<escaped>'`. That sources `/etc/profile` and every script in `/etc/profile.d/*` before our `env KEY=val … fleet-desktop` line runs, and shell metacharacters (`=`, `:`, `/`, `.`) get backslash-escaped through the shell layer. On **openSUSE Leap 16 (arm64)**, that indirection causes the inline env-var assignments to not reach `fleet-desktop`, which exits immediately with: ``` FTL missing URL environment FLEET_DESKTOP_DEVICE_IDENTIFIER_PATH ``` Orbit then respawns it every ~15 s in a tight kill-and-respawn loop, so the tray icon never appears. **Fix:** drop `-i` from the sudo invocation. We don't need a login shell: - `-H` already sets `HOME` to the target user. - sudo's default `env_reset` sets `USER` / `LOGNAME` / `SHELL` / `MAIL` and `PATH` to `secure_path`. - All session vars (`WAYLAND_DISPLAY`, `DISPLAY`, `DBUS_SESSION_BUS_ADDRESS`, `LD_LIBRARY_PATH`) and every `FLEET_DESKTOP_*` var are already passed explicitly via `env KEY=val …`. After the change, sudo `execve()`s `env` directly with no shell layer in between, so `/etc/profile.d` sourcing and shell-escaping are out of the picture. The `runuser -l` /proc/keys-leak regression from PR #32309 does not apply — that was specific to `runuser -l` creating session keyrings; sudo without `-i` doesn't. # Checklist for submitter - [x] Changes file added: `orbit/changes/fleet-desktop-linux-no-login-shell` - [x] Input data is properly validated; untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops (script's wait loop now bounded at 90s). - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes — N/A. ## Testing Manual QA needed before merge: - [x] **openSUSE Leap 16 (arm64)** — Fleet Desktop process starts, stays running, env vars present, no FTL respawn loop. Done via `sudo` shim. - [x] **openSUSE Leap 16 (arm64) — extension fallback** — manual tarball install + schema compilation produces a working tray icon (matching what the script automates). - [ ] **Ubuntu 22.04 / 24.04** — regression check: Fleet Desktop tray icon still appears, key-escrow zenity dialog still renders, AppIndicator script still installs via the official path. - [ ] **Fedora (recent)** — regression check: same as above. - [ ] **Debian** — regression check: same as above. - [ ] **openSUSE Tumbleweed** — confirm `InstallRemoteExtension` path still works (no fallback path triggered). ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet — pure launch-flag change plus a script update; no protocol or schema impact. - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes — Go change is in `execuser_linux.go`, only built on Linux. The script is Linux-only by construction. - [ ] Verified that fleetd runs on macOS, Linux and Windows — Linux re-verification pending QA above; macOS/Windows code paths unchanged. - [ ] Verified auto-update works from the released version of component to the new version. ## Notes for reviewers - The tray-icon visibility issue is an OS-side prerequisite (GNOME 3.26+ has no native tray), so the AppIndicator extension is required regardless. Even after installing it, Wayland requires a logout/login to pick up new extensions — this is documented behavior and not specific to the fallback path. |
||
|
Carlo
|
5ac50a2dc9 |
Bound orbit retries on missing installer details to 5 mins (#44284)
Fixes #44084 |
||
|
Lucas Manuel Rodriguez
|
d4c0834cba |
Bump macadmins/osquery-extension to v1.4.1 and add network_quality ta… (#44214)
**Related issue:** Resolves #44202. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] Verified that fleetd runs on macOS, Linux and Windows - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added network quality table for macOS to monitor download and upload speeds with results formatted in both kilobits and megabits per second (requires macOS 12+) * **Chores** * Updated MacAdmins osquery extension dependency to v1.4.1 <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
df44a9342e |
Use Docker as default WiX runtime on macOS arm64 (#43715)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43484 # Details Apple Silicon Macs were being forced down the Wine+local-wix-dir path because the fleetdm/wix:latest image was deemed unreliable on arm64 in Jan 2024. Docker Desktop's amd64 emulation has matured since -- the image builds both amd64 and arm64 MSIs on arm64 macOS successfully. This PR: - Drops the arm64-forces-Wine guard in BuildMSI so the Docker path is the default on every macOS arch when --local-wix-dir isn't provided. - Drops the macOS "Install wine and wix" + "Build MSI on macOS (using local Wix)" CI steps. The ubuntu-latest matrix entry already exercises the Docker path, and the install-wine.sh flow is brittle against Gcenx release churn and homebrew-cask deprecation. - Updates the install-wine.sh script to fail and output a message indicating that Docker should be used, or else Wine installed manually. ``` ============================================================ This script no longer installs Wine. ============================================================ Wine is no longer required to build Windows (.msi) packages on macOS. fleetctl package now uses Docker by default on all macOS architectures. RECOMMENDED: install Docker Desktop https://docs.docker.com/get-docker If you cannot use Docker and still need to build MSIs with Wine on macOS see the upstream WineHQ wiki for installation instructions: https://gitlab.winehq.org/wine/wine/-/wikis/MacOS Automatic Wine installation via Homebrew is no longer attempted here because the wine-stable cask is deprecated and upstream Wine releases have caused repeated breakage. ``` - Retains the wix auto-download helper (downloadAndExtractZip, extractZipFile, wixDownload) for backwards-compatibility when Docker isn't detected, with a deprecation warning. The Wine + --local-wix-dir path remains available for macOS users who opt into it, but is no longer documented. See #43484. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - Dropped MacOS packaging tests. The Ubuntu test already exercises the Docker path that MacOS now uses. - [X] QA'd all new/changed functionality manually - Built and installed both amd64 and arm64 .msi packages successfully <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * MSI packages on macOS now build using Docker by default, removing the Wine dependency. * **Documentation** * Updated macOS setup guidance: Docker Desktop is now required for MSI packaging instead of Wine. * **Chores** * Simplified Wine-related helper scripts and removed outdated installation logic. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin SykulevandCopilot
|
2245359ad1 |
Orbit passes EUA token during enrollment (#43369)
**Related issue:** Resolves #41379 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added EUA token support to Orbit enrollment workflow * Introduced `--eua-token` CLI flag for Windows MDM enrollment * Windows MSI packages now support EUA_TOKEN property (Orbit v1.55.0+) * **Tests** * Added tests for EUA token handling in enrollment and Windows packaging * **Documentation** * Added changelog entry documenting EUA token inclusion in enrollment requests <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> |
||
|
Victor Lyuboslavsky
|
98e08ad4f3 |
Add Windows Go tests to CI (#43365)
Resolves #40809 Added a few basic tests. Fixed a small race condition. Manually tested orbit on Windows with the fix. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed a race during BitLocker worker shutdown on Windows to prevent hangs or unexpected failures. * **Tests** * Added comprehensive Windows-only tests for BitLocker behavior and related utilities. * Hardened tests to use stricter assertions and deterministic checks. * **Chores** * Added an automated Windows test workflow to run scheduled and PR-triggered Windows test runs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
58563852f0 |
Bitlocker: do not decrypt already encrypted drive. (#43130)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40809 **Orbit agent: key rotation replaces decrypt-then-re-encrypt:** - When the disk is already encrypted, orbit now adds a new Fleet-managed recovery key protector, removes old ones, and escrows the new key. The disk is never decrypted. - If key escrow fails, the rotated key is cached in memory and retried on subsequent ticks without rotating again. - Removes `DecryptVolume` and `decrypt()` (no longer called from production code). **Server: osquery query returns both protection_status and conversion_status:** - The `disk_encryption_windows` query now returns both columns instead of just checking `protection_status = 1`. This lets the server correctly identify a disk as encrypted via `conversion_status = 1` even when `protection_status = 0`. - New `directIngestDiskEncryptionWindows` function parses both values, handles parse errors, and normalizes `protection_status = 2` (unknown) to NULL. **Server: new `bitlocker_protection_status` column and status logic:** - Adds `bitlocker_protection_status` column to `host_disks` (DB migration). - When a disk is encrypted and key is escrowed but protection is off, the host shows "Action required" with a detail message explaining the issue, instead of misleadingly showing "Verified." - `protection_status = 2` (unknown) and `NULL` (older orbit hosts) are treated as protection on for backward compatibility. - The `profiles_verified` and `profiles_verifying` branches in the combined profiles+BitLocker summary now handle `bitlocker_action_required`, counting those hosts as "pending". Contributor docs updates: https://github.com/fleetdm/fleet/pull/43241 Public docs updates: https://github.com/fleetdm/fleet/pull/43243/changes # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Fixed Windows BitLocker encryption/decryption request loop on systems with secondary drives and auto-unlock. * **New Features** * Added BitLocker recovery key rotation capability, allowing safe key updates without full disk re-encryption. * Enhanced BitLocker protection status tracking to correctly display "Action required" when protection is disabled. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
75982f44de |
Rename Apple Business Manager in UI (#42584)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42512 --------- Co-authored-by: Luke Heath <luke@fleetdm.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> |
