<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36682
- Added similar "not found" handling than the one we have when calling
`getHostScriptExecutionResultDB` within the `GetHostLockWipeStatus`
function for consistency => now return a 404 instead of a 500 when no
rows are returned.
- Applied similar changes to
https://github.com/fleetdm/fleet/issues/33090 (PR:
https://github.com/fleetdm/fleet/pull/40009) => logging an error instead
of returning a 404, so that the Host details page does not crash.
The actual fix would be to remove the `host_mdm_actions` record that
contains the orphan `lock_ref` mentioned in the issue.
I'm not sure what the root cause is, but I think setting up some
monitoring on the logs I added should help determining that.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
## Summary
- Adds Okta Verify as a custom package for x86 Windows workstations in
the Fleet GitOps configuration
- Creates `it-and-security/lib/windows/software/okta-verify.yml` using
the `$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret for the download URL
- Configures the app in `workstations.yml` with `self_service: true`,
`setup_experience: true`, the "Security" category, and scoped to
`x86-based Windows hosts` label
## Changes
1. **New file**: `it-and-security/lib/windows/software/okta-verify.yml`
— Software definition with the secret-referenced URL
2. **Modified**: `it-and-security/teams/workstations.yml` — Added Okta
Verify package reference under `software.packages` in the Windows apps
section
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924912095649)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
This pull request updates the workstation team settings to ensure that
disk space policies are enforced across all major operating systems. The
most important change is the addition of specific policy IDs for
monitoring disk space on Linux, macOS, and Windows.
**Policy enforcement improvements:**
* Added `policy_ids` for disk space monitoring on Linux (`38244`), macOS
(`38230`), and Windows (`38239`) in the `team_settings` section of
`it-and-security/teams/workstations.yml`.
Added a section for the ExpedITioners podcast with episode details,
including dates, guests, and descriptions.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
Updated marketing assets with new case studies and comparisons,
including details on various organizations using Fleet for device
management. Added new entries and modified existing ones for clarity and
completeness.
## Summary
- Add Claude Desktop as a Fleet-maintained app for macOS and Windows on
the Workstations team
- Both platforms have self-service and setup experience enabled
- Windows app scoped to x86 hosts via `x86-based Windows hosts` label
- Add version update policies for both platforms (macOS v1.1.4328,
Windows v1.1.4088)
## Test plan
- [ ] Verify `fleetctl gitops --dry-run` passes with workstations.yml
- [ ] Confirm Claude Desktop appears in self-service for macOS and
Windows hosts
- [ ] Confirm Claude Desktop is part of the macOS and Windows setup
experience
- [ ] Verify update policies flag hosts running older versions
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This pull request makes a small change to the GitHub Actions workflow
configuration by adding a new secret environment variable for use in the
dogfood environment.
- Added the `DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret to the environment
variables in the `.github/workflows/dogfood-gitops.yml` workflow file.
## Summary
- Adds cross-platform disk space check policies (macOS, Windows, Linux)
scoped to the workstations team
- Each policy calculates the percentage of available disk space relative
to total disk space and **fails when available disk space is 10% or
less**
- macOS/Linux policies query the `mounts` table for the root partition
(`/`); Windows policy queries the `logical_drives` table for NTFS drives
- Resolution contact channel is `#help-it`
### New files
- `it-and-security/lib/macos/policies/disk-space-check.yml`
- `it-and-security/lib/windows/policies/disk-space-check.yml`
- `it-and-security/lib/linux/policies/disk-space-check.yml`
### Modified files
- `it-and-security/teams/workstations.yml` — registers the three new
policies
### How it works
| Platform | Query logic |
|---|---|
| macOS | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Linux | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Windows | `SELECT 1 WHERE (SELECT CAST(SUM(free_space) AS REAL) /
SUM(size) FROM logical_drives WHERE file_system = 'NTFS') > 0.10` |
- **Pass (returns rows):** available disk space is more than 10%
- **Fail (returns no rows):** available disk space is 10% or less
### Why >10% free disk space matters
Each policy description now includes context on why maintaining
sufficient free disk space is important:
- **System stability:** Low disk space can cause system instability,
slowdowns, and crashes
- **OS requirements:** Operating systems need free space for virtual
memory/swap, temporary files, and system updates
- **Application reliability:** Applications may fail to save data or
function properly when disk space is critically low
- **Data protection:** Keeping sufficient free space ensures reliable
performance and prevents data loss
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772934328893319?thread_ts=1772933835.386689&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds `conditional_access.bypass_disabled: true` to
`it-and-security/default.yml` to disable the bypass option for
conditional access in Fleet's GitOps configuration
- This prevents end users from bypassing conditional access blocking
during login attempts
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772933047288969)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
This pull request makes a small change to the
`it-and-security/teams/workstations.yml` configuration file by clearing
the list of policy IDs for failing policies webhooks. No other settings
are modified.
- Set `policy_ids` to an empty list in the `team_settings` section,
removing the previous policy associations.
## Summary
- Added `calendar_events_enabled: false` to the "macOS - 1Password up to
date" policy to disable webhook/calendar automation
- The "macOS - Enrollment profile up to date" policy already had
`calendar_events_enabled: false` set, so no change was needed
## Changes
Only `it-and-security/lib/macos/policies/update-1password.yml` was
modified — a single line addition of `calendar_events_enabled: false` to
match the pattern used by other policies (e.g., `update-slack.yml`,
`latest-macos.yml`, `enrollment-profile-up-to-date.yml`).
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772931433677899)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Restores the Google Calendar integration settings in
`it-and-security/default.yml` that were removed in PR #39532
- Re-adds the `api_key_json` and `domain` configuration under
`org_settings.integrations.google_calendar`, reverting from the empty
array (`[]`) back to the original service account configuration
## Changes
The `google_calendar` integration in `it-and-security/default.yml` was
changed from an empty array back to:
```yaml
google_calendar:
- api_key_json: $DOGFOOD_CALENDAR_API_KEY
domain: fleetdm.com
```
This is an exact reversal of the change made in #39532.
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772930523927149?thread_ts=1772928789.366369&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- **Alex Mitchell** — Title changed from "Chief Customer Officer" to
"Head of Account Management". Moved from the Customer Success department
to the Sales department, now reporting to Chaz MacLaughlin (Global SVP
of Sales).
- **Zay Hanlon** — Now heads the Customer Success department (reports
directly to the CEO). Previously listed under Alex Mitchell.
- **Allen Houchins** — Already heads the IT department (reports directly
to the CEO). No handbook changes needed; verified no references placed
him under another manager.
- **Dhruv Majumdar** — Remains in the Customer Success department, now
reporting to Zay Hanlon (who heads the department).
### Files changed
- `handbook/customer-success/README.md` — Removed Alex Mitchell (Chief
Customer Officer) from team table; Zay Hanlon is now the top-listed role
as department head.
- `handbook/sales/README.md` — Added Alex Mitchell as "Head of Account
Management" under Chaz MacLaughlin.
Built for [Savannah
Friend](https://fleetdm.slack.com/archives/D0AK3T404H3/p1772927898988769)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Savannah Friend <157323611+SFriendLee@users.noreply.github.com>
## Summary
- Removes the `okta-verify/windows` Fleet-maintained app entry from the
workstations team GitOps configuration
(`it-and-security/teams/workstations.yml`)
- Okta Verify will no longer be available as self-service software or in
the setup experience for Windows workstations
- All other platform configurations (macOS, iOS, Android) for Okta
Verify remain unchanged
## Changes
**`it-and-security/teams/workstations.yml`**: Removed the following
maintained app entry from the `software.fleet_maintained_apps` section:
```yaml
- slug: okta-verify/windows
self_service: true
setup_experience: true
labels_include_any:
- "x86-based Windows hosts"
categories:
- Security
```
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924324101579)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a new Fleet guide article for the community Intune-to-Fleet CSP
converter tool
- Covers how the tool works, prerequisites, step-by-step usage, result
monitoring, resolver map, customization, and troubleshooting
- Sets honest expectations upfront: ~70–75% policy coverage, community
tool (not official Fleet product)
## Changes
- `articles/migrating-intune-policies-to-fleet-csp-converter.md` — new
guide article
## Notes
- Tool repo: https://github.com/tux234/intune-to-fleet
- Modeled on the style of `creating-windows-csps` and the Okta Verify on
Windows guide
- Download links in the guide point to the external tool repo
---------
Co-authored-by: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40496
# Details
This is the first phase of an effort to detect unknown keys in GitOps
.yml files. In the regular `fleetctl gitops` case, it will fail when
unknown keys are detected. This behavior can be changed with a new
`--allow-unknown-keys` flag which will log the issues and continue.
In this first phase we are detecting unknown keys in _most_ GitOps
sections, other than the top-level `org_settings:` and `settings:`
sections which have more complicated typing. I will tackle those
separately as they require a bit more thought. Also ultimately I'd like
us to be doing this validation in a more top-down fashion in one place,
rather than spreading it across the code by doing it in each individual
section, but this is a good first step.
As a bonus, I invited my pal Mr. Levenshtein to the party so that we can
make suggestions when unknown keys are detected, like:
```
* unknown key "queyr" in "./lib/some-report.yml"; did you mean "query"?
```
> Note: the goal is to return as many validation errors as possible to
the user, so they don't have to keep running `fleetctl gitops` to get
the next error. I did _not_ update any other errors to stop returning
early, in an effort to keep this as low-touch as possible.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
- [X] Tested this against existing it-and-security folder and one with
updated keys from https://github.com/fleetdm/fleet/pull/40959; no
unknown keys detected
- [X] Added unknown keys at various levels, GitOps errored with helpful
messages
- [X] Same as above but with `--allow-unknown-keys`; GitOps outputted
helpful messages but continued.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* GitOps runs now fail when unknown or misspelled keys are present in
configuration files.
* New CLI flag --allow-unknown-keys lets unknown keys be treated as
warnings instead of errors.
* Unknown-key messages include suggested valid key names to help correct
mistakes.
* **Tests**
* Expanded test coverage to validate unknown-key detection and the
allow-as-warning option.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ian Littman <iansltx@gmail.com>
Updated the marketing assets section to include new case studies and
success stories, enhancing the documentation with relevant links and
descriptions.
## Summary
- `checkPermFile` in `pkg/secure/secure.go` now self-heals incorrect
file permissions via `os.Chmod` instead of returning a fatal error
- Fixes orbit crash-looping indefinitely when
`/opt/orbit/updates-metadata.json` has mode 755 instead of the expected
600
## Problem
Orbit refuses to start when `updates-metadata.json` has wrong
permissions (e.g. 755 instead of 600), entering an infinite restart loop
(`systemd` restart counter observed at 3447+). The manual workaround is
`chmod 600 /opt/orbit/updates-metadata.json`, but the root cause — an
external process changing file permissions — is intermittent and hard to
track.
The `checkPermFile` function in `pkg/secure/secure.go` was designed as a
security check, but its behavior of fatally erroring on any permission
mismatch causes a denial-of-service on the legitimate user. For
comparison, `checkPermPath` (the directory equivalent) already tolerates
permissions that are less permissive than expected.
## Fix
When `checkPermFile` detects a permission mismatch, it now attempts
`os.Chmod` to correct the permissions before proceeding. It only returns
an error if the chmod itself fails (e.g. insufficient privileges). This
preserves the security intent — files end up with correct permissions —
while making orbit resilient to external permission drift.
## Test plan
- [ ] `go test ./pkg/secure/ -v -run TestOpenFile` — verifies
self-healing behavior
- [ ] `go test ./pkg/secure/ -v -run TestMkdirAll` — unchanged, verifies
directory checks still work
- [ ] Manual: create `/opt/orbit/updates-metadata.json` with mode 755,
start orbit, confirm it self-heals and starts normally
---------
Co-authored-by: Bash Bandicoot <bash-bandicoot@users.noreply.github.com>
Nico