227e94de5b279decf0dec83550dd2eaa273aed56
4187
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Victor Lyuboslavsky
|
4fd9244195 |
Don't update host values that didn't change (reduce writer load) (#43992)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42545 Tested in loadtest. `host_orbit_info` and `host_disks` are seeing the massive skip wins # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance** * Avoids unnecessary database writes when incoming host data already match stored values, reducing steady-state update volume. * **Tests** * Added tests to validate skip-on-no-change behavior, including cases with small numeric precision differences and idempotency checks. * **Documentation** * Added changelog entry describing the reduced-write behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus JensenandCopilot
|
43e32d916e |
don't send AccountConfiguration for non macs (#44085)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43228 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Account configuration commands for SSO and managed local admin setup are no longer sent to iOS and iPadOS devices when end-user authentication is enabled; these commands are restricted to macOS only. * **Tests** * Added an integration test ensuring AccountConfiguration is not enqueued for iOS/iPadOS enrollments when end-user authentication is enabled. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> |
||
|
Scott Gress
|
207c3058c5 |
Add dashboard charts frontend (#43878)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** For #43769 # Details This PR adds "Hosts active" and "Hosts enrolled" charts to the dashboard. New components: * **ChartCard.tsx**: encapsulates a visualization-agnostic chart, for data provided by the new `/charts` endpoint created in https://github.com/fleetdm/fleet/pull/43910 * **ChartFilterModal.tsx**: modal for setting filters on a chart. Currently supports filtering by label, platform and individual host. * **CheckerboardViz.tsx**: a checkerboard visualization for use in ChartCard. Capable of charting 1, 7, 14 or 30 days at a time, although only 30 day charts are used right now. Bespoke rendering using SVG, since recharts scatterchart was harder to wrangle than it was worth. * **LineChartViz.tsx**: a line-chart visualization using Recharts * **HostsEnrolledCard.tsx**: a bar chart of enrolled hosts using Recharts # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually - With backend provided by https://github.com/fleetdm/fleet/pull/43910: <img width="1426" height="428" alt="image" src="https://github.com/user-attachments/assets/0f53b9d1-c87b-4225-a175-2d40af5afe41" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Dashboard now shows interactive "Hosts active" (line/heatmap) and "Hosts enrolled" (bar) charts with metric selection, filter modal (labels/platforms/hosts), legends, tooltips, and responsive layout. * **Tests** * Added comprehensive tests covering chart rendering, checkerboard heatmap, and no-data states. * **Chores** * Added charting library dependency to support visualizations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
1539c6b094 |
Enforce consistent fleet name uniqueness across UI and GitOps (#33557)
Resolves #33557 The tems.name column uses utf8mb4_unicode_ci, so names like "ABC" and "abc" compare as equal at the database level. Before this change name collisions were handled in different ways in the UI and in GitOps. The changes introduced here, consolidates the logic used for detecting name collisions in all code path. All conflicts return 409 with the canonical copy "Fleet names must differ by at least one non-special character (case-insensitive). |
||
|
Dante Catalfamo
|
90e1dc311b |
Update macOS 15 to CIS Benchmark 2.0.0 (#43909)
**Related issue:** Resolves #35171 # macOS 15 CIS benchmark v1.1.0 → v2.0.0 change set ## Policy changes | CIS ID | Policy name (new) | Change type | Effect | |---|---|---|---| | 1.1 | CIS - Ensure Apple-provided Software Updates Are Installed (Fleetd Required) | Modified | Renamed from "Ensure All Apple-provided Software Is Current"; resolution expanded with terminal `softwareupdate -i -a` method; `cis_id` added. Query unchanged (still uses fleetd's `software_update` table). | | 1.6 | CIS - Ensure Software Update Deferment Is Less Than or Equal to 30 Days (MDM Required) | Modified | Added Apple-deprecation note to description; `cis_id` added. Query unchanged. | | 1.7 | CIS - Ensure XProtect Is Running and Updated | Removed | Deleted — v2.0.0 removed 1.7 from the numbered benchmark and moved it to Supplemental section 7.4. Per authoring outline, Fleet does not track section 7+ recommendations. | | 2.1.1.1 | CIS - Ensure iCloud Passwords & Keychain is enabled/disabled (MDM Required) | Modified | Renamed from "iCloud Keychain" to match v2.0.0's "Audit iCloud Passwords & Keychain"; Description, Rationale, and Impact Statement updated from the new PDF; `cis_id` added to both enable/disable variants. Query unchanged (`allowCloudKeychainSync` key is the same). | | 2.3.1.1 | CIS - Ensure AirDrop Is Disabled (MDM Required) | Modified | Added note to resolution stating AirDrop can only be toggled via configuration profile; `cis_id` added. Query unchanged. | | 2.3.3.4 | CIS - Ensure Remote Login Is Disabled | Modified | Description rewritten to match v2.0.0 text; terminal remediation (`systemsetup -setremotelogin off`) added to resolution; `cis_id` added. Query unchanged (still checks `disabled.plist`). | | 2.6.3.1, 2.6.3.2, 2.6.3.3, 2.6.3.4 | CIS - Ensure Sending Diagnostic and Usage Data to Apple Is Disabled (MDM Required) | Modified | **Query change**: Siri Data Sharing Opt-In Status check moved from `com.apple.applicationaccess` → `com.apple.assistant.support` domain to track v2.0.0's new PayloadType; `cis_id` added (combined). | | 2.4.1 | CIS - Ensure Show Wi-Fi status in Menu Bar Is Enabled (MDM Required) | Removed | Deleted — recommendation removed in v2.0.0. | | 2.4.2 | CIS - Ensure Show Bluetooth Status in Menu Bar Is Enabled (MDM Required) | Removed | Deleted — recommendation removed in v2.0.0 (replaced by Manual 2.4.1 "Audit Menu Bar and Control Center Icons"). | | 6.1.1 | CIS - Ensure Show All Filename Extensions Setting is Enabled | Removed | Deleted — recommendation downgraded to Manual in v2.0.0. | Policy count: 113 → 109. ## Test artifacts added | Target CIS ID | File | Type | Notes | |---|---|---|---| | 2.3.3.4 | `ee/cis/macos-15/test/scripts/CIS_2.3.3.4_pass.sh` | pass script | `systemsetup -setremotelogin off` | | 2.3.3.4 | `ee/cis/macos-15/test/scripts/CIS_2.3.3.4_fail.sh` | fail script | `systemsetup -setremotelogin on` | | 1.6 | `ee/cis/macos-15/test/profiles/1.6.mobileconfig` | MDM profile | Sets `enforcedSoftwareUpdateDelay=30`, `forceDelayedSoftwareUpdates=true` | | 2.3.1.1 | `ee/cis/macos-15/test/profiles/2.3.1.1.mobileconfig` | MDM profile | Sets `allowAirDrop=false` | | 2.6.3.2 | `ee/cis/macos-15/test/profiles/2.6.3.2.mobileconfig` | MDM profile | Four payloads covering the combined Fleet query: Siri opt-in (new v2.0.0 domain), AutoSubmit, allowDiagnosticSubmission, AXSAudioDonationSiriImprovementEnabled | No test added for 1.1 — query depends on live OS update state (fleetd `software_update` table) and cannot be toggled by a script or profile. No test added for 2.1.1.1 — it is an org-decision Audit recommendation (Fleet ships both enable and disable variants); one of the two policies fails by construction regardless of system state. ## Documentation updates | File | Change | |---|---| | `ee/cis/macos-15/README.md` | Benchmark version bumped v1.1.0 → v2.0.0. Limitations list renumbered to v2.0.0 section numbers; added 2.4.1 (new "Audit Menu Bar and Control Center Icons") and 6.1.1 (now Manual "Audit Show All Filename Extensions"). Org-decision entry renamed from "Audit iCloud Keychain" to "Audit iCloud Passwords & Keychain" to match v2.0.0 terminology. | |
||
|
Victor Lyuboslavsky
|
fb499b9a01 |
Improved Windows MDM profiles summary performance (#44034)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44050 Original query like: ```sql SELECT CASE WHEN EXISTS ( SELECT 1 FROM host_mdm_windows_profiles hmwp WHERE h.uuid = hmwp.host_uuid AND hmwp.status = 'failed' -- fleet.MDMDeliveryFailed AND hmwp.profile_name NOT IN (<reserved_names>) ) THEN 'failed' WHEN EXISTS ( SELECT 1 FROM host_mdm_windows_profiles hmwp WHERE h.uuid = hmwp.host_uuid AND (hmwp.status IS NULL OR hmwp.status = 'pending') -- fleet.MDMDeliveryPending AND hmwp.profile_name NOT IN (<reserved_names>) AND NOT EXISTS ( SELECT 1 FROM host_mdm_windows_profiles hmwp2 WHERE h.uuid = hmwp2.host_uuid AND hmwp2.status = 'failed' AND hmwp2.profile_name NOT IN (<reserved_names>) ) ) THEN 'pending' WHEN EXISTS ( SELECT 1 FROM host_mdm_windows_profiles hmwp WHERE h.uuid = hmwp.host_uuid AND hmwp.operation_type = 'install' -- fleet.MDMOperationTypeInstall AND hmwp.status = 'verifying' -- fleet.MDMDeliveryVerifying AND hmwp.profile_name NOT IN (<reserved_names>) AND NOT EXISTS ( SELECT 1 FROM host_mdm_windows_profiles hmwp2 WHERE h.uuid = hmwp2.host_uuid AND hmwp2.operation_type = 'install' AND hmwp2.profile_name NOT IN (<reserved_names>) AND (hmwp2.status IS NULL OR hmwp2.status NOT IN ('verifying', 'verified')) ) ) THEN 'verifying' WHEN EXISTS ( SELECT 1 FROM host_mdm_windows_profiles hmwp WHERE h.uuid = hmwp.host_uuid AND hmwp.operation_type = 'install' AND hmwp.status = 'verified' -- fleet.MDMDeliveryVerified AND hmwp.profile_name NOT IN (<reserved_names>) AND NOT EXISTS ( SELECT 1 FROM host_mdm_windows_profiles hmwp2 WHERE h.uuid = hmwp2.host_uuid AND hmwp2.operation_type = 'install' AND hmwp2.profile_name NOT IN (<reserved_names>) AND (hmwp2.status IS NULL OR hmwp2.status != 'verified') ) ) THEN 'verified' ELSE '' END AS final_status, SUM(1) AS count FROM hosts h JOIN host_mdm hmdm ON h.id = hmdm.host_id JOIN mdm_windows_enrollments mwe ON h.uuid = mwe.host_uuid WHERE mwe.device_state = 'enrolled' -- microsoft_mdm.MDMDeviceStateEnrolled AND h.platform = 'windows' AND hmdm.is_server = 0 AND hmdm.enrolled = 1 AND <team_filter> GROUP BY final_status; ``` New query like: ```sql SELECT ( SELECT CASE WHEN SUM(CASE WHEN hmwp.status = 'failed' AND hmwp.profile_name NOT IN (<reserved_names>) THEN 1 ELSE 0 END) > 0 THEN 'failed' WHEN SUM(CASE WHEN (hmwp.status IS NULL OR hmwp.status = 'pending') AND hmwp.profile_name NOT IN (<reserved_names>) THEN 1 ELSE 0 END) > 0 THEN 'pending' WHEN SUM(CASE WHEN hmwp.operation_type = 'install' AND hmwp.status = 'verifying' AND hmwp.profile_name NOT IN (<reserved_names>) THEN 1 ELSE 0 END) > 0 THEN 'verifying' WHEN SUM(CASE WHEN hmwp.operation_type = 'install' AND hmwp.status = 'verified' AND hmwp.profile_name NOT IN (<reserved_names>) THEN 1 ELSE 0 END) > 0 THEN 'verified' ELSE '' END FROM host_mdm_windows_profiles hmwp WHERE hmwp.host_uuid = h.uuid ) AS final_status, SUM(1) AS count FROM hosts h JOIN host_mdm hmdm ON h.id = hmdm.host_id JOIN mdm_windows_enrollments mwe ON h.uuid = mwe.host_uuid WHERE mwe.device_state = 'enrolled' AND h.platform = 'windows' AND hmdm.is_server = 0 AND hmdm.enrolled = 1 AND <team_filter> GROUP BY final_status; ``` # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance Improvements** * Optimized Windows MDM profile summary and host OS settings filtering for faster, lower-cost server queries. * **Tests** * Added an exhaustive verification test covering all Windows MDM profile permutations to ensure correct status bucketing and host membership. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
28908e6083 |
Dashboard charts backend (#43910)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** For #42812 # Details This PR implements a new bounded context, `chart`, with a single endpoint `/charts`. The context encompasses a framework for recording and querying and aggregating historical data for Fleet hosts, and returning that data via the API for the purpose of charting. This initial iteration has a full implementation of a dataset called "uptime" which captures which hosts were online hour-by-hour (online meaning, having been "seen" at some point during that hour). It has a partial implementation of a "cve" dataset which will capture which hosts were vulnerable to which CVEs during a given day. ### Data storage Data is stored in an SCD (slowly-changing dimension) format in the `host_scd_data` table, where the main "value" in a row is stored in the `host_bitmap` column, which is a `mediumblob` where each bit encodes a host ID (bit one represents host ID 1, bit 1444 represents host ID 1444, etc.). The set of bits set on a row represents that hosts for which that dataset is "on" during a given time period represented by the `valid_from` (inclusive) and `valid_to` (exclusive) dates, where a `valid_to` can have the special "sentinel" value 9999-12-31T00:00:00.000 meaning that the row is still "open" (the value represents everything from `valid_from` to the present). Additionally an `entity_id` column can be used for datasets with multiple dimensions, e.g. CVE exposure or software usage which would have entity IDs representing CVEs or software items respectively. ### Data collection Data is collected via a cron job that runs every 10 minutes. Each dataset has its own `Collect` method which will sample the data for the given moment. For example the "uptime" dataset gathers the set of hosts that are online at the moment, and the "cve" dataset will gather the set of hosts that are vulnerable to each CVE at that moment. The sample can then be recorded using one of two strategies: * `accumulate`: bitwise OR the sample with any data already recorded for the current hour, or add a new pre-closed row for that hour. * `snapshot`: if there is no open row, create one with the sample and `valid_to set` to the sentinel. Otherwise: * If the sample has the same value as the current open row, do nothing * If the sample has a different value and the current open row's `valid_from` is within the same hour, update the current row's value * If the sample has a different value and the current open row's `valid_from` is not within the same hour, close the current open row and start a new one with `valid_from` = the start of the current hour ### Data retrieval 1. Gets the set of host IDs to retrieve data for. This starts with the set of host IDs in the requested fleet (or all the hosts a user has access to if no `fleet_id` param was passed to the `/charts` endpoint), and further whittled down by any filter options supplied with the request (labels, platforms, etc.). 2. Finds all `host_scd_data` rows for the requested dataset and date range (i.e. all rows whose `valid_from` is < the date range end and `valid_to` is > the date range start). 3. Calculates the date ranges of the "buckets" to return datapoints for. For the uptime chart we default to 3-hour buckets, so we want 8 buckets per day. 4. Iterates over each bucket and finds the row or rows from host_scd_data that cover that bucket range. For datasets using the "accumulate" strategy, the values for those rows are ORed together. For "snapshot"s, we take the one active at the bucket end time to represent the bucket (e.g. "which hosts had a given CVE at the end of the day") ### Tools This PR includes two dev tools that don't require deep review: * **chart-backfill** - used to backfill data to various datasets for testing * **charts-collect** - used to collect data from a live server via the API and put into a local hosts_scd_data table # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [X] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [X] QA'd all new/changed functionality manually - With [front-end branch](https://github.com/fleetdm/fleet/pull/43878) <img width="712" height="434" alt="image" src="https://github.com/user-attachments/assets/b2ccce49-b5fd-4076-b47f-0eea6a53260c" /> ## Database migrations - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [X] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [X] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added charting bounded context: HTTP API for metrics (uptime, CVE), dataset registry, hosted dataset collection, background collection/cleanup with opt-out env. * New utilities: host bitmap operations and string-list/uint-list parsers. * New CLI tools to collect and backfill chart data. * **Database** * Migration and schema to store host time-series SCD chart data. * **Tests** * Extensive unit and integration tests for service, storage, caching, cron, and utilities. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
9ff63eb52e |
macOS 14 CIS benchmark v3.0.0 update (#43797)
**Related issue:** Resolves #35172 Updates the macOS 14 (Sonoma) CIS policy set to benchmark v3.0.0, adds a `cis_id` field to every policy, fixes several broken test scripts, introduces an automated test runner, and ships `CIS-BENCHMARKS.md` as a central guide for authoring and maintaining CIS benchmarks. ## Summary of changes - `ee/cis/macos-14/cis-policy-queries.yml`: v3.0.0 updates + `cis_id` added to every entry - `ee/cis/CIS-BENCHMARKS.md`: new authoring/testing/automation guide for all macOS CIS benchmarks (and the pattern other OS dirs follow) - `tools/cis/cis-test-runner.py`: new 2150-line Python runner that drives end-to-end validation against a real tart VM + Fleet server - `ee/cis/macos-14/test/scripts/`: 10 new pass/fail script pairs, 8 existing scripts fixed (several were silently broken) # How the automated testing works The runner (`tools/cis/cis-test-runner.py`) exercises the full policy lifecycle against a real macOS VM: **Phases** 1. **Parse** `cis-policy-queries.yml` and filter by `--all`, `--cis-ids`, `--match`, and type flags (`--only-scripts`, `--only-mdm`, `--only-manual`). 2. **Classify** each policy into a test type based on available artifacts: | Priority | Type | Artifacts | Behavior | |---|---|---|---| | 1 | `PASS_FAIL` | `CIS_{id}_pass.sh` + `_fail.sh` | Run fail → verify query fails → run pass → verify passes | | 2 | `PASS_ONLY` | `CIS_{id}.sh` | Run script → verify passes | | 3 | `PROFILE` | `.mobileconfig` only | Verify query fails before profile → push profile → verify passes | | 4 | `ORG_DECISION` | paired `-enable`/`-disable` profiles | Toggle between variants | | 5 | `MANUAL` | none | Prompt operator, or skip with `--skip-manual` | 3. **Provision**: create a fresh Fleet team with a unique enroll secret, build a fleetd pkg bound to it, create+boot a tart VM, install the agent, and enroll. 4. **MDM**: prompt the operator for MDM enrollment if any tests need it. Clear team profiles, baseline the VM, push all required profiles in one batch, wait for delivery. 5. **Execute**: for each plan, SCP the script, run it over SSH, then run the policy via `fleetctl query --hosts <hostname>`. A query that returns rows = pass. 6. **Report** summary with PASS/FAIL/SKIP/ERROR counts. 7. **Cleanup** (with `--cleanup`) deletes the team, host record, and VM. **Special-case handling** (keyed by OS version because CIS IDs aren't stable across releases): - `SSH_BREAKING_CIS_IDS`: tests that disable sshd (2.3.3.4, 2.3.3.5) are forced to `MANUAL` so the runner doesn't lock itself out. - `PASSWORD_POLICY_CIS_IDS`: 5.2.x profiles invalidate the VM's `admin`/`admin` login — forced to `MANUAL`. - `NON_AUTOMATABLE_CIS_IDS`: tests that can't run reliably in a VM (Location Services, Touch ID, shared Siri profile state) forced to `MANUAL` with a per-entry reason. - `--keep-vm`: reuses the VM across runs, skipping agent install/enrollment if the host is already in Fleet. Falls back to fresh creation if SSH is unreachable. **Credential resolution order**: CLI flag → `FLEET_URL`/`FLEET_API_TOKEN` env → `~/.fleet/config` (from `fleetctl login`). ## How to use `CIS-BENCHMARKS.md` going forward The doc is the single reference for authoring and maintaining CIS benchmark policies across all macOS (and Windows) versions. For each new benchmark release, the workflow is: 1. **Read "Updating benchmarks when a new CIS version is released"** — directs you to the PDF's *Appendix: Change History* to enumerate Added/Modified/Removed recommendations. 2. **Use the field reference and query patterns** to write or update policies: direct table check, `managed_policies` EXISTS/NOT EXISTS, or plist negation check. Name qualifiers `(MDM Required)` / `(Fleetd Required)` / `(FDA Required)` are documented. 3. **Create matching test artifacts** — pass/fail scripts for togglable settings, `.mobileconfig` profiles for MDM-only settings. Script conventions (full paths, sudo pattern, `not_always_working_` prefix) are standardized. 4. **Update the per-OS README** with limitations, org-decision policies, and optional policies. 5. **Run the test runner** to validate. The doc also contains an **end-to-end AI agent prompt** (section at the bottom) designed to be handed a new CIS PDF plus the previous version's PDF, to automatically generate the diff, write policies, produce test artifacts, update docs, and run validation. This lets future benchmark updates start from a consistent, repeatable baseline rather than being hand-authored from scratch. ## Query changes All entries in `cis-policy-queries.yml` received a `cis_id` field so the runner (and humans) can map policies → scripts → profiles → the benchmark document without parsing the display name. | CIS ID | Change | |---|---| | 1.1 | Renamed "Ensure All Apple-provided Software Is Current" → "Ensure Apple-provided Software Updates Are Installed"; added terminal remediation to `resolution` | | 1.6 | Expanded description with v3.0.0 language about rapid security response updates | | 1.x (deferment) | **Removed** — "Ensure Software Update Deferment Is Less Than or Equal to 30 Days" dropped from v3.0.0 | | 2.3.1.1 | Renamed "Ensure AirDrop Is Disabled" → "Ensure AirDrop Is Disabled When Not Actively Transferring Files"; expanded description | | 2.3.3.1 (DVD/CD Sharing) | **Removed** — dropped from v3.0.0 | | 2.3.3.4 (Remote Login) | Query now checks BOTH `disabled.plist` AND that `com.openssh.sshd` is not in the `launchd` table; resolution updated to terminal method | | 5.1.7 | Query rewritten: sticky-bit dirs now properly excluded (first-char-of-mode check instead of bit-AND on full mode string); SIP-protected dirs excluded via `com.apple.rootless` xattr check | | 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.7 | Dropped `username = ''` filter — Safari profiles deliver at user scope, so the system-scope filter guaranteed zero rows | | 6.3.3 | Fixed `NOT EXISTS` domain typo: `com.apple.loginwindow` → `com.apple.Safari` (the check was previously meaningless) | | Wi-Fi/Bluetooth menu bar | **Removed** — "Show Wi-Fi status in Menu Bar" and "Show Bluetooth status in Menu Bar" dropped from v3.0.0 | | Show All Filename Extensions | **Removed** — dropped from v3.0.0 | ## Script changes ### New scripts | Script | Purpose | |---|---| | `CIS_1.1_pass.sh` / `_fail.sh` | Install updates (pass); clear `LastFullSuccessfulDate` (fail — caveat: only works when real updates are pending) | | `CIS_1.6_pass.sh` / `_fail.sh` | Open/remove the `1.6.mobileconfig` profile | | `CIS_2.3.1.1_pass.sh` / `_fail.sh` | Open/remove the AirDrop profile | | `CIS_2.3.2.2_pass.sh` / `_fail.sh` | `launchctl load/unload -w` of `com.apple.timed.plist` | | `CIS_2.3.3.4_pass.sh` / `_fail.sh` | `systemsetup -setremotelogin off/on` (runs as MANUAL via the runner's SSH-breaking safeguard) | ### Existing scripts fixed | Script | Bug | Fix | |---|---|---| | `CIS_2.3.3.1.sh` | Disabled `com.apple.ODSAgent` (DVD/CD sharing), not Screen Sharing | Now disables `com.apple.screensharing` | | `CIS_2.9.2.sh` | `pmset -a womp 0` sets Wake-on-Network, not Power Nap | Now `pmset -a/-b/-c powernap 0` | | `CIS_3.2.sh` | `sed` pipeline into root-owned file via user redirection silently failed; did nothing if the flags line was missing | `awk` with `tee`/`mv`; appends a flags line when absent; enforces 0400 root:wheel | | `CIS_3.3.sh` | Only stripped `all_max=`; never added `ttl=365` when missing, so the query could never pass from a fresh system | `awk` now both strips `all_max=` and inserts/updates `ttl=365` on the `* file` line | | `CIS_3.4.sh` | `sudo sed … > /etc/security/audit_control` — redirect runs as caller, not root; write silently failed | Rewrites via `tee`/`mv` with proper perms; appends when line is absent | | `CIS_3.5.sh` | `chmod -R o-rw` doesn't produce the exact `0400`/`0440` modes the query requires | Explicit `chmod 0400` on `audit_control`, `find … -exec chmod 0440 {}` under `/var/audit/` | | `CIS_5.1.7.sh` | `sudo IFS=$'\n'` runs IFS in a subshell that exits immediately; searched `/System/Volumes/Data/Library` but the query looks at `/Library/%` | IFS set in parent shell; searches `/Library`; skips SIP-protected dirs via xattr | | `CIS_5.7.sh` | Wrote `use-login-window-ui` which the query doesn't accept | Writes `authenticate-session-owner` | | `CIS_6.3.6.sh` | Contained literal `<username>` placeholders that were never substituted | Iterates non-system users (`UniqueID >= 500`) and runs `defaults write` as each | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * macOS 14 (Sonoma) CIS policies updated to v3.0.0 with refreshed policy names and CIS IDs. * New CLI test runner to automate CIS validation against macOS VMs. * **Bug Fixes / Improvements** * Updated remediations and audit/query logic; safer, atomic config updates; several policies revised or removed. * **Tests** * Many new and improved pass/fail helper scripts for validating CIS checks and profiles. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Martin Angers
|
5da912a33e |
Bugfix: escape characters not supported in JSON when resolving variables (#43955)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #38013 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually See https://drive.google.com/file/d/1zeFNLuf_rT5FWzDiYyL2_hbIBW2neba-/view?usp=drive_link <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * GitOps variables in JSON configuration profiles (Apple DDM declarations and Android profiles) are now automatically escaped for JSON special characters, ensuring proper handling of sensitive values. * **Tests** * Added JSON configuration profile escaping validation to the enterprise GitOps integration test suite. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
fe66e3fd08 |
Don't refetch "change management" settings page on focus (#44054)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43977 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] Added/updated automated tests - [X] QA'd all new/changed functionality manually - Repro'd issue on main - Verified on this branch that dirtying the form and then focusing elsewhere / refocusing on page doesn't lose changes. For unreleased bug fixes in a release candidate, one of: - [X] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes * Fixed an issue where the Change Management form would reset upon losing and regaining page focus. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew Mellor
|
2d687d94b3 |
41676 updated apple crs invalid domain error message (#43396)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41676 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ x] Added/updated automated tests - [x ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Apple MDM APNS certificate signing now shows a clear, domain-specific error when an unsupported email domain is supplied (applies to CSR requests and renewal flows), replacing the previous generic "invalid email" message. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew Mellor
|
bf3a12a960 |
Updated eula pdf upload size check to default max request body size (#43517)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40856 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * EULA PDF upload size validation now reports the configured maximum upload size (in MiB) instead of a fixed value, improving clarity of rejection messages. * **Tests** * Added tests covering EULA upload size validation, ensuring oversized uploads are rejected with the proper status and that configured request-body limits are respected. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew Mellor
|
e7cecc3085 |
Enroll page media screen max width updated (#43666)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41568 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually <img width="751" height="239" alt="Localhost pixel 9pro xl emulation" src="https://github.com/user-attachments/assets/2ad2d07a-aca8-4c4f-bbe2-0700736a51a4" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Adjusted the enrollment page responsive layout so the enroll button renders at full width on larger-resolution mobile and medium screens. * Increased spacing between device instructions and the enrollment action to improve layout clarity. * Visual-only change — no functional or behavioral modifications to the enrollment flow. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin SykulevandMarko Lisica
|
7fa1341c73 |
Windows wipe failed acivitiy (#43795)
**Related issue:** Resolves #42290 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Failed Windows MDM wipe attempts now create a tracked "Failed wipe" activity showing the affected host and display name for visibility; UI filter and activity feed now surface this type. * **Bug Fixes** * Improved detection and reporting of wipe result statuses so real failures are reliably surfaced. * Duplicate failure responses are suppressed to avoid repeated alerts. * **Tests** * Added tests validating wipe-failure activity creation and related control flows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> |
||
|
Tim Lee
|
9feb9c2be0 | Fix Recovery Lock password desync on MDM re-enrollment (#43827) | ||
|
Victor Lyuboslavsky
|
ad2c47c419 |
Added an index on software.bundle_identifier (#43979)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43978 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results - [x] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Optimized database performance for the app synchronization process by adding an index to improve query efficiency and reduce CPU load on large deployments. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus JensenandCopilot
|
1365068858 |
Fix various DDM stuck remove/pending issues (#43382)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40322 (Second part) # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Cleans up orphaned pending Apple MDM profile removals so pending remove rows no longer get stuck during batch processing. * Fixes DDM status handling so remove operations are skipped/handled based on the incoming update, preventing incorrect flips. * Reconciler now self-heals stuck pending removal profiles across batches. * **Tests** * Added unit tests covering cross-batch cleanup, orphaned pending removes, and DDM status/reporting edge cases. * **Documentation** * Updated changelog entry for DDM pending/remove fixes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> |
||
|
Sharon KatzandJuan Fernandez
|
0810d7a999 |
Allow saving policies with invalid SQL (#38348) (#43952)
<!--- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #38348 ## What this PR does On the Policies create and edit pages, the "Save" button was getting disabled whenever Fleet's SQL parser flagged the query as having a syntax error. That was a problem because Fleet's parser has gaps -- plenty of valid osquery SQL gets flagged as "invalid", which blocked admins from saving perfectly good custom queries. This PR changes the Save button behavior on the Policies form to match what Reports (formerly "Queries") already does: we still show the "Syntax error. Please review before saving." message under the editor, but the user can still click Save. An empty query still disables Save. The actual code change is small -- one line in `PolicyForm.tsx`: ```diff - !!size(errors); + (!!errors.query && errors.query === EMPTY_QUERY_ERR); ``` Previously the button was disabled for any error (including syntax errors). Now it's only disabled when the error is specifically the empty-query error. This exactly mirrors the existing logic in `EditQueryForm.tsx` for Reports. I also imported `EMPTY_QUERY_ERR` from the shared validator and dropped an obsolete `// @ts-ignore` on that import (the validator is now TypeScript). ## Testing All testing was done manually on macOS against a local Fleet dev server. Jest suites run clean. ### Before the change (reproducing the bug) 1. Checked out `main`, ran the dev server. 2. Went to Policies, clicked "Add policy". 3. Pasted a query with a syntax error: `SELCT * FROM users;`. 4. Observed: error message "Syntax error. Please review before saving." appears under the editor, and the Save button is **disabled** (greyed out, not clickable). Same behavior when editing an existing policy. ### After the change (fix verified) 1. Checked out `bug_38348`, refreshed the browser (webpack watch picked up the change). 2. Went to Policies, clicked "Add policy". 3. Pasted the same syntax-error query `SELCT * FROM users;`. 4. Observed: error message still shows, but the Save button is now **enabled**. Clicking Save opened the "Save policy" modal; completing the save wrote the policy with the user's exact SQL. 5. Edited the saved policy -- the same syntax-error SQL loaded, Save remained enabled, edits saved successfully. 6. Cleared the SQL to empty -- error changed to "Query text must be present" and Save went back to disabled. Good. 7. Ran the same flow on Reports (new and edit) to confirm no regression -- behavior unchanged from before. ### Tests - `frontend/pages/policies/edit/components/PolicyForm/PolicyForm.tests.tsx` -- 17/17 passing. - `frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tests.tsx` -- 15/15 passing (regression check). - No new unit test was added for the syntax-error path; an existing TODO in the test file documents why direct testing through react-ace is awkward. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/` (`changes/38348-allow-saving-invalid-sql`). - [x] Input data is properly validated (N/A -- frontend-only, no new SQL). - [x] QA'd all new/changed functionality manually (see Testing section above). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Policy forms now allow saving when the SQL has a syntax error; the syntax-error message remains visible for correction. * Saving is still blocked when the SQL/query is empty or only whitespace. * **Tests** * Added regression tests verifying save behavior for empty and syntactically invalid queries. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Juan Fernandez <juan@fleetdm.com> |
||
|
Jonathan Katz
|
c2eb45f9a7 |
🤖 Fix GitOps leaving duplicate software installer rows (#43903)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43738 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - Before the fix, switching from custom package to FMA via GitOps created two software installer rows and duplicate setup experience installers (the setup experience page said "2 software items will be installed during setup" even though only one was selected. - After the fix, switching from custom package to FMA via GitOps deleted the old installer and left only one row with the correct FMA. In setup experience, only one instance of the software was installed. - Added a custom package (obsidian) and a policy with a software install automation for it, then applied gitops and replaced obsidian with the FMA version and the policy with the FMA slug, and it redirected the policy to the new installer. - Adding setup experience software will only set `install_during_setup=1` on the active FMA, and not on installer rows with `is_active=0` <img width="1222" height="558" alt="image" src="https://github.com/user-attachments/assets/ace5922a-63ec-4591-b615-1a8534a70805" /> <img width="1173" height="483" alt="image" src="https://github.com/user-attachments/assets/05c7c718-4f4a-4549-bbf1-1e1d6dae75d0" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevent duplicate installs by ensuring only active installers are considered during setup; remove or replace custom installers when a managed (fleet‑maintained) installer is added, repointing policies to the active installer and canceling now-obsolete pending setup actions. * **Tests** * Added tests covering active-installer selection, custom→managed installer replacement, policy repointing, display-name preservation, and cancellation of pending setup activities. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
75d8102922 | Update class on exceptions field to fix padding (#43927) | ||
|
Martin AngersandCopilot
|
04c9abbdb6 |
Bugfix: fallback the script execution timeout from agent options to global if not set for team (#43911)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40952 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually See https://drive.google.com/file/d/1lot6KmliWmTpJ-paKyT_aI8GYq8PO71L/view?usp=drive_link <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Script execution timeout now falls back to the global agent setting when not explicitly defined at the team level, making timeout behavior more predictable. * **Tests** * Added test coverage validating timeout resolution across various team/global configuration scenarios to prevent regressions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> |
||
|
Magnus Jensen
|
fd0488a5f6 |
Update input action buttons app wide (#43906)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41147 See comment for images of all changes: https://github.com/fleetdm/fleet/issues/41147#issuecomment-4291447286 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Standardized and restyled action buttons (copy, show/hide secret, etc.) across the app for consistent appearance, sizing, hover states and keyboard focus outlines. * Improved input and textarea layouts so action buttons align neatly, copy/confirmation messages display correctly, and spacing adapts when actions are present. * **Documentation** * Added a changelog entry documenting the action-button styling and layout updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
1f6e556818 |
Improved Windows MDM performance (#43912)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43875 `POST /api/mdm/microsoft/management` is the hot endpoint for any Windows-MDM-enrolled fleet. Every enrolled host hits it twice per check-in interval. At 40k hosts that's a four-figure sustained queries-per-second rate on the database reader pool, dominated by one expensive query plus a handful of redundant `MDMWindowsGetEnrolledDeviceWithDeviceID` lookups on the same row. This PR cuts that load by: 1. Short-circuiting the pending-commands query when the device's queue is empty (the overwhelming common case). Replaces a 3-table join plus anti-join with a cheap primary-key probe. 2. Loading the enrolled device exactly once in `isTrustedRequest` and threading it through to every downstream consumer instead of re-fetching it three times. No behavior change to the protocol, no schema change. Also filed a related issue: https://github.com/fleetdm/fleet/issues/43897 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved Windows MDM server performance at scale by reducing database queries during device check-ins. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
c378e27d82 |
Fixed Android pubsub panic when host was deleted (#43788)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42494 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevented a server panic (HTTP 502) when Android pubsub status reports arrive for hosts deleted from Fleet by validating re-enrollment before processing. * Improved Android host creation to avoid creating duplicate hosts when an Orbit-only enrollment already exists. * **Tests** * Added unit tests for the re-enrollment flow for deleted hosts and deduplication between Orbit and Android enrollments. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Scott Gress
|
df44a9342e |
Use Docker as default WiX runtime on macOS arm64 (#43715)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43484 # Details Apple Silicon Macs were being forced down the Wine+local-wix-dir path because the fleetdm/wix:latest image was deemed unreliable on arm64 in Jan 2024. Docker Desktop's amd64 emulation has matured since -- the image builds both amd64 and arm64 MSIs on arm64 macOS successfully. This PR: - Drops the arm64-forces-Wine guard in BuildMSI so the Docker path is the default on every macOS arch when --local-wix-dir isn't provided. - Drops the macOS "Install wine and wix" + "Build MSI on macOS (using local Wix)" CI steps. The ubuntu-latest matrix entry already exercises the Docker path, and the install-wine.sh flow is brittle against Gcenx release churn and homebrew-cask deprecation. - Updates the install-wine.sh script to fail and output a message indicating that Docker should be used, or else Wine installed manually. ``` ============================================================ This script no longer installs Wine. ============================================================ Wine is no longer required to build Windows (.msi) packages on macOS. fleetctl package now uses Docker by default on all macOS architectures. RECOMMENDED: install Docker Desktop https://docs.docker.com/get-docker If you cannot use Docker and still need to build MSIs with Wine on macOS see the upstream WineHQ wiki for installation instructions: https://gitlab.winehq.org/wine/wine/-/wikis/MacOS Automatic Wine installation via Homebrew is no longer attempted here because the wine-stable cask is deprecated and upstream Wine releases have caused repeated breakage. ``` - Retains the wix auto-download helper (downloadAndExtractZip, extractZipFile, wixDownload) for backwards-compatibility when Docker isn't detected, with a deprecation warning. The Wine + --local-wix-dir path remains available for macOS users who opt into it, but is no longer documented. See #43484. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - Dropped MacOS packaging tests. The Ubuntu test already exercises the Docker path that MacOS now uses. - [X] QA'd all new/changed functionality manually - Built and installed both amd64 and arm64 .msi packages successfully <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * MSI packages on macOS now build using Docker by default, removing the Wine dependency. * **Documentation** * Updated macOS setup guidance: Docker Desktop is now required for MSI packaging instead of Wine. * **Chores** * Simplified Wine-related helper scripts and removed outdated installation logic. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
1d41ba5605 |
make DDM name check case insensitive (#43347)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40322 The issue was due to case insensitivity in go maps, so when we checked if we should keep the DDM profile or not, it failed. So we now default to lowercasing all profile names to make it case insensitive. _While that fixes the cause, for the issue, I will follow up with another PR for the all profiles stuck in pending, since it's a scaling issue due to batching and always taking installs before removes, so with 11k hosts it would never have both install and remove in the same run, failing to clear out the stuck pending. It can be manually remediated, but we want to have a better fix for this that actually cleans it up, if this is met as it can be perfectly valid._ # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed Apple MDM profile batch operations to handle declaration names case-insensitively. Updating a declaration with different name casing (e.g., mixed-case to lowercase) no longer creates duplicate profiles or triggers unnecessary operations. * **Tests** * Added test coverage for case-insensitive Apple MDM declaration name handling across team and non-team configurations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
RachelElysia
|
4da30fc321 | Fleet UI: Improve host policy empty modal (#43805) | ||
|
Juan Fernandez
|
2b35eabd5d |
Added middleware for api-only users auth (#43772)
Fixes #42885 Added new middleware (APIOnlyEndpointCheck) that enforces 403 for API-only users whose request either isn't in the API endpoint catalog or falls outside their configured per-user endpoint restrictions. |
||
|
Jonathan Katz
|
7d9c134942 |
Allow icon in team level yaml for script-only packages (#43783)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43142 Since script-only packages have to be specified as a path, add some logic to allow icon to be set as a path in that situation. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - `TestSoftwarePackagesPathWithInline` checks custom package yml path so there is no regression, added `TestScriptOnlyPackagesPathWithInline` to test script-only package path. - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - Tested .sh and .ps1 script-only packages with icon path specified in the team level yaml. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed custom icon handling for script-only packages (e.g., .sh and .ps1), allowing icons to be set and resolved correctly for packages referenced by path. * **Tests** * Added test coverage validating custom icon functionality and path resolution for script-only packages; included a sample script used by the test. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
682202444c |
Update go to 1.26.2 and update tooling to update it (#43771)
Golang 1.26.2 has been released. It fixes some CVEs: https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated Go toolchain to 1.26.2 across the repository and build configs. * Updated Docker build images to use Go 1.26.2. * Expanded the set of tracked modules for the Go version update so additional module files are included in automated updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
b6bacca415 |
Fixed stale MDM profiles after MDM toggle (#43719)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42427 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Pending MDM profile records are cleared when Apple or Windows MDM is turned off, preventing stale profiles from reappearing if MDM is re-enabled. * Pending Windows profile records are removed when a device is unenrolled, avoiding leftover pending installations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
NicoandJuan Fernandez
|
578f35292c |
[Frontend] Create API-only users that only have access to customer-defined Fleet API endpoints (#43281)
**Related issue:** Resolves #42879 * Full UI for API-only user management: create/edit flows, fleet/role assignment, selectable API endpoint permissions, and one-time API key display. * New reusable components: API user form, endpoint selector, API access section, and API key presentation. * Admin workflow switched from in-page modals to dedicated pages and streamlined action dropdown navigation. * Layout and styling refinements for user management, team lists, and dropdown behaviors. --------- Co-authored-by: Juan Fernandez <juan@fleetdm.com> |
||
|
Martin Angers
|
2a8803884b |
DDMV: Support Fleet variables in DDM (#43222)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43047 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually See https://github.com/fleetdm/fleet/issues/42960#issuecomment-4244206563 and subsequent comments. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Apple DDM declarations support a vetted subset of Fleet variables with per-host substitution; premium license required. Declaration tokens and resend behavior now reflect variable changes; unresolved host substitutions mark that host’s declaration as failed. * **Bug Fixes** * Clearer errors for unsupported or license-restricted Fleet variables and more consistent DDM resend/update semantics when variables change. * **Tests** * Added extensive unit and integration tests covering Fleet variable validation, substitution, token changes, resends, and failure states. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordan Montgomery
|
15b0cf4277 |
Do not replace EVs in script-only packages (#43606)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43311 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Made environment-variable expansion conditional by package type: script-only packages no longer expand host env vars during parsing, while YAML packages still have env vars expanded (expansion errors are recorded and parsing continues). * **Tests** * Added a test to confirm script packages do not expand standard shell variables during parsing. * **Chores** * Updated changelog entry describing the script-only package fix. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
f791f4b309 |
Allow the creation of API-only users (#43440)
**Related issues:** - Resolves #42882 - Resolves #42880 - Resolves #42884 # Changes - Added POST /users/api_only endpoint for creating API-only users. - Added PATCH /users/api_only/{id} for updating existing API-only users. - Updated `fleetctl user create --api-only` removing email/password field requirements. |
||
|
|
aff440236e |
Add cache option for software packages to skip re-downloading unchanged content (#42216)
**Related issue:** Ref #34797 Ref #42675 ## Problem When a software installer spec has no `hash_sha256`, Fleet re-downloads the package, re-extracts metadata, and re-upserts the DB on every GitOps run, even if the upstream file hasn't changed. For deployments with 50+ URL-only packages across multiple teams, this wastes bandwidth and processing time on every run. ## Solution By default, use etags to avoid unnecessary downloads: 1. First run: Fleet downloads the package normally and stores the server's ETag header 2. Subsequent runs: Fleet sends a conditional GET with `If-None-Match`. If the server returns 304 Not Modified, Fleet skips the download, metadata extraction, S3 upload, and DB upsert entirely Opt-out with `always_download:true`, meaning packages continue to be downloaded and re-processed on every run, same as today. No UI changes needed. ```yaml url: https://nvidia.gpcloudservice.com/global-protect/getmsi.esp?version=64&platform=windows always_download: true install_script: path: install.ps1 ``` ### Why conditional GET instead of HEAD Fleet team [analysis of 276 maintained apps](https://github.com/fleetdm/fleet/pull/42216#issuecomment-4105430061) showed 7 apps where HEAD requests fail (405, 403, timeout) but GET works for all. Conditional GET eliminates that failure class: if the server doesn't support conditional requests, it returns 200 with the full body, same as today. ### Why opt-in 5 of 276 apps (1.8%) have stale ETags (content changes but ETag stays the same), caused by CDN caching artifacts (CloudFront, Cloudflare, nginx inode-based ETags). The `cache` key lets users opt in per package for URLs where they've verified ETag behavior is correct. Validation rejects `always_download: true` when hash_sha256` is set ## Changes - New YAML field: `cache` (bool, package-level) - New migration: `http_etag` VARCHAR(512) column (explicit `utf8mb4_unicode_ci` collation) + composite index `(global_or_team_id, url(255))` on `software_installers` - New datastore method: `GetInstallerByTeamAndURL` - `downloadURLFn` accepts optional `If-None-Match` header, returns 304 as `(resp, nil, nil)` with `http.NoBody` - ETag validated per RFC 7232 (ASCII printable only, no control chars, max 512 bytes) at both write and read time - Cache skipped for `.ipa` packages (multi-platform extraInstallers) - TempFileReader and HTTP response leak prevention on download retry - Docs updated in `yaml-files.md` ## What doesn't change - Packages with `hash_sha256`: existing hash-based skip, untouched - FMA packages: FMA version cache, untouched - Packages with `always_download: true`: identical to current behavior - Fleet UI: no changes ## Test plan Automated testing: - [x] 16 unit tests for `validETag` - [x] 8 unit tests for conditional GET behavior (304, 200, 403, 500, weak ETag, S3 multipart, no ETag) - [x] MySQL integration test for `GetInstallerByTeamAndURL` - [x] All 23 existing `TestSoftwareInstallers` datastore tests pass - [x] All existing service tests pass Manual testing: - [x] E2E: 86 packages across 6 CDN patterns, second apply shows 51 conditional hits (304) - [x] @sgress454 used a local fileserver tool to test w/ a new instance and dummy packages <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * ETag-based conditional downloads to skip unchanged remote installer files. * New always_download flag to force full re-downloads. * **Tests** * Added integration and unit tests covering conditional GETs, ETag validation, retries, edge cases, and payload behavior. * **Chores** * Persist HTTP ETag and related metadata; DB migration and index to speed installer lookups. * Added installer lookup by team+URL to support conditional download flow. * **Bug Fix** * Rejects using always_download together with an explicit SHA256 in uploads. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Scott Gress <scott@fleetdm.com> Co-authored-by: Scott Gress <scott@pigandcow.com> Co-authored-by: Ian Littman <iansltx@gmail.com> |
||
|
Ian Littman
|
3675f8ff90 |
Clean up setup experience cancellation behavior (#43437)
Fixes #34288. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Setup experience cancellations now create explicit cancellation activities for skipped/failed software and VPP app installs, plus a new "Canceled setup experience" activity type and a from_setup_experience flag. Activity text and host activity views now indicate "during setup experience" when applicable. * **Tests** * Added and updated tests for cancellation activity creation, VPP license-failure handling, and WasFromAutomation/from_setup_experience behaviors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
RachelElysia
|
53d65973d7 | Fleet UI: Fix gitops mode wonkiness (#43428) | ||
|
RachelElysia
|
ecf2bad9a5 | Fleet UI: Improve internal links/buttons (#43470) | ||
|
Magnus Jensen
|
7bcc2c6894 |
don't clear bootstrap token when doing MDM cert renewals (#43098)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41167 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit # Release Notes * **Bug Fixes** * Fixed an issue preventing device wipes after certificate renewal. The bootstrap token is now properly preserved during the certificate renewal process, ensuring reliable device wipe operations following renewal. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Konstantin Sykulev
|
83a886b0ec |
Added EUA to the Fleet MSI installer (#43295)
**Related issue:** Resolves #41381 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** - Forward end-user authentication context (EUA token) to the Fleet MSI installer and enrollment flow on Windows MDM to avoid duplicate auth prompts and link devices to hosts. * **Tests** - Added comprehensive unit and integration tests for EUA token creation, validation, and processing to improve reliability. * **Documentation** - Added a note describing support for forwarding end-user authentication context during Windows MDM enrollment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
ebd2cb0012 |
Fix patch policy bugs (#43420)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43389 1. Added verifyPatchPolicy check 2. Fixed nil pointer dereference when calling spec/policies with no fleet_maintained_app_slug key provided 3. Fixed bug where renaming a patch policy in a gitops file caused it to be deleted on the first run, and only added when gitops is run again. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Renaming a patch policy via GitOps now updates the existing policy instead of deleting it. * Fixed nil-pointer errors in policy API operations. * Reject applying patch policies with missing, invalid, or disallowed Fleet Maintained App references (including global/enterprise slugs). * Improved matching for patch policies to avoid unintended deletions when names differ. * Patch policies now preserve intended platform/target behavior during apply/update. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
1bc32467a7 |
Implement GET /api/v1/fleet/rest_api (#42883)
**Related issue:** Resolves #42883 Added a new premium GET /api/_version_/fleet/rest_api endpoint that returns the contents of the embedded `api_endpoints.yml` artifact. |
||
|
RachelElysia
|
1d96eb2e3d | Fleet UI: Policy details page followup (#43324) | ||
|
Ian Littman
|
8509b18c46 |
🤖 Add fallback for FMA manifest URL pulls (#43312)
**Related issue:** Resolves #42754 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved app manifest retrieval with automatic fallback to hosted copies when the primary source is unavailable, reducing sync failures. * **Documentation** * Clarified that Fleet will fall back to hosted manifest copies if the new manifest site is inaccessible. * **New Features** * Streamlined maintained-app synchronization to use a simpler sync entrypoint and unified primary/fallback fetch logic. * **Tests** * Added comprehensive tests for primary/fallback fetch flows, error handling, large-response truncation, and environment-based overrides. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
58563852f0 |
Bitlocker: do not decrypt already encrypted drive. (#43130)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40809 **Orbit agent: key rotation replaces decrypt-then-re-encrypt:** - When the disk is already encrypted, orbit now adds a new Fleet-managed recovery key protector, removes old ones, and escrows the new key. The disk is never decrypted. - If key escrow fails, the rotated key is cached in memory and retried on subsequent ticks without rotating again. - Removes `DecryptVolume` and `decrypt()` (no longer called from production code). **Server: osquery query returns both protection_status and conversion_status:** - The `disk_encryption_windows` query now returns both columns instead of just checking `protection_status = 1`. This lets the server correctly identify a disk as encrypted via `conversion_status = 1` even when `protection_status = 0`. - New `directIngestDiskEncryptionWindows` function parses both values, handles parse errors, and normalizes `protection_status = 2` (unknown) to NULL. **Server: new `bitlocker_protection_status` column and status logic:** - Adds `bitlocker_protection_status` column to `host_disks` (DB migration). - When a disk is encrypted and key is escrowed but protection is off, the host shows "Action required" with a detail message explaining the issue, instead of misleadingly showing "Verified." - `protection_status = 2` (unknown) and `NULL` (older orbit hosts) are treated as protection on for backward compatibility. - The `profiles_verified` and `profiles_verifying` branches in the combined profiles+BitLocker summary now handle `bitlocker_action_required`, counting those hosts as "pending". Contributor docs updates: https://github.com/fleetdm/fleet/pull/43241 Public docs updates: https://github.com/fleetdm/fleet/pull/43243/changes # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Fixed Windows BitLocker encryption/decryption request loop on systems with secondary drives and auto-unlock. * **New Features** * Added BitLocker recovery key rotation capability, allowing safe key updates without full disk re-encryption. * Enhanced BitLocker protection status tracking to correctly display "Action required" when protection is disabled. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
90f75f1644 |
simplify OS modal (#43252)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40702 New look: <img width="812" height="350" alt="image" src="https://github.com/user-attachments/assets/83e82480-b756-4c51-be3f-09a72e736770" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Simplified pending status labels in OS Settings modal by removing "(pending)" suffix from states like "Enforcing" and "Removing enforcement" * Improved OS Settings modal table layout and styling * **New Features** * Added dedicated action buttons to resend MDM profiles and rotate Recovery Lock password * Enhanced error tooltip handling for failed profile states <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ian Littman
|
da6cfd8e9f |
Show configuration profile name and more fine-grained status (#42126)
Resolves #40177 and subissues. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [sorta] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Profile names are now displayed alongside mobile device management commands for installing or removing profiles. These names are visible in command details modals and within device activity timelines. * Added "NotNow" status for deferred profile commands, providing improved transparency into which profiles are being managed and the current status of profile installation or removal operations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ian Littman
|
2891904f31 |
🤖 Switch InputField + InputFieldWithIcon JSX components to TS, add more test coverage, fix Storybook build (#43307)
Zed + Opus 4.6; prompt: Convert the InputField JSX component to TypeScript and remove the ts-ignore directives that we no longer need after doing so. - [x] Changes file added - [x] Automated tests updated |
||
|
Ian Littman
|
f829170923 |
Update to TypeScript 6.0 (#43141)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] QA'd all new/changed functionality manually |