**Related issue:** Resolves#33296
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
**Bug Fixes**
- Disk encryption key escrowing now only proceeds when disk encryption
is explicitly enabled at the global or team level.
**Tests**
- Significantly expanded test coverage for Mobile Device Management,
including VPP app handling, device enrollment workflows, host lock/wipe
operations, SCEP proxy integrations, and DigiCert certificate handling.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Add Okta Verify for macOS as self-service software for IT department
members
## Changes
- Added `okta-verify/darwin` to workstations.yml configuration
- Configured as self-service for IT department only
## Test plan
- [x] Verify configuration syntax is valid
- [ ] Confirm Okta Verify appears in self-service for IT team members
- [ ] Verify it does not appear for non-IT department members
Currently, Android software can't be removed from the setup experience.
We have a story that we aim to ship in 4.82. Until we ship, I added a
callout in the setup experience guide.
Closes: https://github.com/fleetdm/fleet/issues/38472
Changes:
- Updated the URL of the testimonials page to be /customers
- Added a redirect for /testimonials
- Updated the layout and content of the /customers page to match the
latest wireframes
- Updated links to the /testimonials page to go to /customers
- Changed the "Customers" dropdown in the website nav to be a link to
the /customers page.
This pull request updates the configuration and output files for the
Evernote maintained app to simplify version management and improve
maintainability. The main changes involve switching to a "latest"
version tracking approach and marking the app as frozen.
**Version management updates:**
* Changed the tracked version in
`ee/maintained-apps/outputs/evernote/darwin.json` from a specific
version (`10.105.4`) to `"latest"`, and updated the `installer_url` to
always point to the latest Evernote DMG file. The `sha256` hash is now
set to `"no_check"` to accommodate the dynamic installer.
**Configuration changes:**
* Added `"frozen": true` to the Evernote app input configuration in
`ee/maintained-apps/inputs/homebrew/evernote.json` to indicate the app
is no longer actively updated in this system.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#39032
This pull request updates the installation process for the GitHub
Desktop application on macOS. The main improvement is switching the
extraction method in the install script from `unzip` to `ditto` with the
`--noqtn` flag, which prevents the app bundle from being quarantined
after installation. This change is reflected in both the input
configuration and the generated output files.
**Install script improvements:**
- The install script for GitHub Desktop (`github-desktop-install.sh`)
now uses `ditto -xk --noqtn` instead of `unzip` to extract the
application, ensuring the app is not marked as quarantined by macOS
after installation.
- The script logic and structure have been slightly refactored for
clarity, but the core install and relaunch logic remains the same.
**Configuration and reference updates:**
- The `install_script_path` property was added to the Homebrew input
JSON for GitHub Desktop, pointing to the new install script.
- The output configuration (`darwin.json`) updates the install script
reference to the new version and includes the updated script content.
[[1]](diffhunk://#diff-d9d687547de8380c36144e69b184a84cbfa749eae965cab3cb313e2ff88eff20L9-R9)
[[2]](diffhunk://#diff-d9d687547de8380c36144e69b184a84cbfa749eae965cab3cb313e2ff88eff20L18-R18)
**Related issue:** Resolves#38679
“Extremely” makes it sound like very large deployments are uncommon. But
they’re actually very common. Fleet excels with 40,000+ laptops, and
some deployments are 10x that large, when you include phones, ipads, and
servers.
**Related issue:** Resolves #
This expands and extends detail about the three phases of running
events:
1. Proposing and Approving new events
2. Managing the execution of events
3. Post Game for an event
---------
Co-authored-by: Ashish Kuthiala <53918208+akuthiala@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36494
Fixes:
- Allow matching software to title solely by non-empty upgrade code
- Match names case-insentive and trimmed whitespace and special unicode
characters (in our osquery-perf dataset)
- Match bundle ID case-insensitive
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Different variations/versions of the same software that share the same
upgrade code are now unified under a single software title, preventing
duplicate titles and improving linkage across releases.
* **Tests**
* Added a test verifying that entries with the same upgrade code but
different names link to an existing shared title.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#35299.
Triggers on issue create. Tested the same code in
https://github.com/iansltx/fleet/actions/workflows/auto-tag-unreleased-bugs.yml;
check the associated issues on that repo for the comments (or lack
thereof). Grabbed a bunch of issues from this repo to properly catch
edge cases. This only looks at issue body so the titles including
released/unreleased are for testing convenience and have no effect on
whether a comment happens either way.
I expect we'll need to dial this in further but this errs on the side of
categorizing something as unreleased because shipping regressions due to
mis-triage is worse than finding out a bug is released when we weren't
sure to begin with.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: iansltx <472804+iansltx@users.noreply.github.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Konstantin Sykulev