**Related issue:** N/A (dogfood GitOps change)
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually (YAML validated; will
verify install + patch policy on a Windows workstation after the GitOps
run applies)
## Details
Adds Okta Verify to Windows devices on the Workstations team following
the same pattern used for it on macOS, including the patch policy:
- Replaces the custom-package Okta Verify install
(`$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` + custom install/uninstall scripts)
with the `okta-verify/windows` Fleet-maintained app — `self_service:
true`, `setup_experience: true`, category Security, scoped to "x86-based
Windows hosts" (the FMA installer is x86-only).
- Adds a "Windows - Okta Verify up to date" patch policy with
`install_software: true` for automatic remediation, mirroring the macOS
policy.
- Adds the "x86 Windows hosts with Okta Verify installed" label that
scopes the patch policy to hosts that already have the app.
- Cleanup: deletes the now-orphaned custom package YAML and
`okta_verify_*.ps1` scripts. Follow-up (not in this PR — requires
`workflow` scope): remove the now-unused
`DOGFOOD_OKTA_VERIFY_WINDOWS_URL` env line from
`.github/workflows/dogfood-gitops.yml` and delete the GitHub secret.
Harmless in the meantime — the env var is exported but nothing consumes
it.
Hosts that installed Okta Verify from the old custom package are picked
up by the new label, and the patch policy will auto-update them to the
FMA version (currently 6.10.2.0) if they fall behind.
Remove local Zoom software manifests and icon and replace them with
fleet-maintained app slugs. Workstations fleet now references
zoom/darwin and zoom/windows slugs; added dynamic labels for Macs and
x86 Windows hosts with Zoom installed. Patch policies for macOS and
Windows updated to include Zoom using the new slugs so patch
checks/notifications are centralized. Deleted legacy
it-and-security/lib/*/software/zoom.yml and the Zoom icon to avoid
duplicate/local package definitions.
## Summary
- Adds Okta Verify as a custom package for x86 Windows workstations in
the Fleet GitOps configuration
- Creates `it-and-security/lib/windows/software/okta-verify.yml` using
the `$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret for the download URL
- Configures the app in `workstations.yml` with `self_service: true`,
`setup_experience: true`, the "Security" category, and scoped to
`x86-based Windows hosts` label
## Changes
1. **New file**: `it-and-security/lib/windows/software/okta-verify.yml`
— Software definition with the secret-referenced URL
2. **Modified**: `it-and-security/teams/workstations.yml` — Added Okta
Verify package reference under `software.packages` in the Windows apps
section
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924912095649)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
This pull request makes minor improvements to the software metadata for
Linux and Windows installers, and updates messaging in a MacOS
configuration profile. The main changes are the addition of display
names for several software packages and a small wording update in the
MacOS profile.
Software metadata improvements:
* Added the `display_name` field for 1Password, Slack, and Zoom
installers in both `.deb` and `.rpm` formats for Linux, improving
clarity in software listings.
[[1]](diffhunk://#diff-74a6b317e1363bc4c856fc04b9532876ec6fbdaec1ae7745bc7ec00c164b5ee8R2)
[[2]](diffhunk://#diff-a09b19aa20a36257dba104b182ec182a175198bf2b83b4c27bbe5b34e3f86a9cR2)
[[3]](diffhunk://#diff-63cf9bff568593d4d6681597dc69b3c3741cbd53197cfa8056e66a8ce6aa65a3R2)
[[4]](diffhunk://#diff-1c76fa28d50f586e4d7090a954db56d9235cdea759e8a613d2c5fb0ccdf28fdfR2)
[[5]](diffhunk://#diff-d3b614ed0d7209d14d8f70170e4326d56e660fdb87ed585674be14c344a59d7fR2)
[[6]](diffhunk://#diff-c5be3430c846b9b69a3d47f0157b0d1707a61dac731d823e38adbf78de4f5ebeR2)
* Added the `display_name` field for Zoom installers for Windows
(`zoom-arm.yml` and `zoom.yml`), making software identification easier.
[[1]](diffhunk://#diff-3f6d972edfe5bd7590c0cd9ffc76a416401410a4b6143e4d6b2d6a0f8efa83b5R2)
[[2]](diffhunk://#diff-2ea34a1db8efdb13d238a064e9bd2e0ba1e4565aba849549e6182fcbe38cd388R2)
MacOS configuration profile update:
* Updated the `subHeader` in the `nudge-configuration.mobileconfig` file
to reference the "IT team" instead of "IT & Enablement team," clarifying
the responsible group in user notifications.
Allen Houchins