Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 19 Packages Projects Releases Wiki Activity
26,552 Commits 2 Branches 0 Tags
2fd2a02e2d71b65e19bd06f97d14186866f514b7
Commit Graph
939 Commits
Author SHA1 Message Date
Luke Heath cb44e287f2 Fix high-severity CodeQL and Scorecard code scanning alerts (#50333) 2026-07-31 14:46:31 -05:00
Nico 7f1b330c90 Restrict deleting a fleet to global admins (#50271) 
# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Restricted fleet deletion to users with global write permissions,
including global administrators and GitOps.
* Corrected team deletion authorization to require global write access.
* Prevented global technicians, team technicians, and observer-level
users from deleting teams.
* Updated authorization behavior to consistently enforce the required
access level.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 08:43:51 -03:00
Carlo 3660b546f2 Fix FMA auto-update keeping the stale install script (#50200) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #50097

## Summary

FMA auto-update preserves an admin-customized install script by
comparing the active script against the new manifest's, but FMA scripts
hardcode the versioned installer filename, so a routine version bump
looked like an edit and the old script (old filename) was kept against
the newly downloaded installer, and the install failed. The fix
neutralizes the installer filename in both scripts before comparing
(mirroring the existing uninstall `$PACKAGE_ID` handling), so a
filename-only difference adopts the new script while a genuine edit is
still preserved.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`
(`changes/50097-fma-auto-update-keeps-stale-install-script`).

## Testing

- [x] Added/updated automated tests (adopt-on-version-bump regression +
preserve-genuine-edit counterpart).
- [x] QA'd all new/changed functionality manually.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed Fleet-maintained app auto-updates that could keep an outdated
install script after downloading a newer version, causing install
failures.
* Improved install-script change detection by ignoring version-only
installer filename differences.
* Continued to preserve administrator-customized install scripts when
updates change more than just the installer filename.
* **Tests**
* Added and expanded coverage for installer-script normalization and
auto-update install-script selection behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-30 17:42:55 -04:00
Carlo a442d7af3a Python script-only packages: follow-on QA fixes (#50143) 
**Related issues:** Resolves #50068, Resolves #50106, Resolves #50107,
Resolves #50108, Resolves #50110, Resolves #50114

Follow-on fixes from QA of #41470 (Python script-only packages):

- Software-installer validation errors are action-neutral, so the Add
and Edit flows each show the correct single verb, and the
unsupported-file error names a content/format mismatch instead of
blaming the extension (#50068, #50107).
- `.py` packages accept `setup_experience_platform` (`darwin`/`linux`),
matching `.sh` (#50106).
- A failed-to-run install script (exit code `-1`) now renders a
diagnostic instead of empty output, and orbit surfaces the underlying
execve error (#50108).
- The install-rejection message for `.sh`/`.py` packages says "macOS and
Linux hosts" instead of "linux" (#50110).
- Orbit writes each script's temp file with an extension matching its
shebang (`.py`/`.sh`/`.ps1`), so tracebacks reference the right file
type (#50114).

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes.
- [x] Verified compatibility with the latest released version of Fleet
(orbit-only change; the server↔agent `SoftwareInstallDetails` contract
is unchanged).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved installer validation and rejection messaging for
unsupported/invalid package contents (including correcting “add” vs
“edit” wording and avoiding duplicated phrasing).
* Added clearer diagnostics when install scripts fail to start
(including empty output cases).
* Corrected handling of script-only packages so Python scripts use the
proper script type/extension, reducing misleading tracebacks.
* Updated platform availability messaging so `.sh`/`.py` packages
display macOS+Linux support.
* **New Features**
* Python script-only packages can now specify macOS and Linux setup
experience platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-30 14:40:24 -04:00
Tim LeeTim LeeJuan Fernandez
 		c83ecc2231 Match Windows software with version in name to FMA software title 
Resolves #44406

Windows programs report a version in their name (e.g. `Granola
7.373.2`), so each version created its own `software_title` and never
linked to the Fleet-maintained app installer's title (`Granola`), hiding
the uninstall action. macOS handles this via `bundle_identifier`;
Windows had no join key.

- Give matching Windows programs the canonical FMA name at ingestion
(name-prefix match), so all versions collapse onto the title the
installer owns. `software.name` is unchanged.
- Merge already-mismatched versioned titles onto the canonical title in
`ReconcileMaintainedAppSoftwareNames` (runs on FMA sync; no migration
needed).

---------

Co-authored-by: Tim Lee <timlee@fleetdm.com>
Co-authored-by: Juan Fernandez <juan@fleetdm.com>
 2026-07-30 09:49:52 -04:00
Jonathan Katz 1a0f0101cc Fix gitops not updating FMA installer (#50000) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49811 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed Fleet-maintained app updates when a rebuilt installer keeps the
same version.
* Rebuilt installers now update their files, hashes, filenames, and
install scripts correctly.
* Prevented installers from being incorrectly skipped when their
contents differ despite matching versions.
* **Tests**
* Added coverage for same-version installer rebuilds and team-specific
caching behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-29 10:00:16 -04:00
Lucas Manuel RodriguezandCopilot Autofix powered by AI 9c2ef14947 Scrub device policy responses in Fleet Desktop (#50094) 
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Security Improvements**
* Updated device-authenticated policy and host-detail responses to omit
policy author identity fields and any raw SQL/query data.
* Device policy endpoints now return a device-safe policy representation
consistently.

* **Bug Fixes**
* Prevented administrative policy information from appearing in
device-authenticated host details and policy listings.

* **Tests**
* Strengthened integration coverage to verify device-safe responses
(required user-facing fields present; sensitive fields absent).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-29 09:34:31 -03:00
Nico f5ca4b5b0d Add Android support for custom host vitals (#49696) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49421

Custom host vitals (`$FLEET_HOST_VITAL_<id>`) already worked in scripts
and Apple/Windows configuration profiles, but Android configuration
profiles and managed app configuration explicitly rejected them at
upload to keep parity with `$FLEET_SECRET_*`. This left admins unable to
inject per-host vitals (e.g. an asset tag) into Android MDM
configuration the same way they can for every other platform.

For more context, prior PRs:
- https://github.com/fleetdm/fleet/pull/49334
- https://github.com/fleetdm/fleet/pull/49586

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

- Created an "Asset tag" host vital.
- Enrolled an Android device.
- Initially the test profile showed as "Failed" because no value was set
for the vital.
- Set a value for the vital, saw that it went from Enforcing to
Verified.

<img width="1446" height="510" alt="Screenshot 2026-07-24 at 8 57 46 AM"
src="https://github.com/user-attachments/assets/c0e2348c-e521-48f3-85cd-6f884689b2cd"
/>
<img width="1520" height="936" alt="Screenshot 2026-07-24 at 8 56 56 AM"
src="https://github.com/user-attachments/assets/169b9545-ec7a-429b-8f45-0e2740f61c77"
/>
<img width="1607" height="1136" alt="Screenshot 2026-07-24 at 8 57
30 AM"
src="https://github.com/user-attachments/assets/a8213745-b224-4a36-a54d-32152a15c377"
/>

Also tested the rejection cases:
- trying to upload a profile with an invalid custom host vital id
(either a non-numeric value, a numeric but non-existent ID, and
referencing a vital as a JSON key instead of a value)
- deleting a vital referenced in a profile



https://github.com/user-attachments/assets/e8b4acde-ddf4-41c0-b00a-5ab4945d0bc2



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Android app configurations and profiles now support custom host vital
placeholders (`$FLEET_HOST_VITAL_<id>`).
* Custom host vital values are expanded per device during Android
delivery.
* Managed Android profiles/configurations are automatically resent when
a referenced vital value changes.

* **Bug Fixes**
* Added validation for malformed, missing, or undefined vital references
during Android app association and profile/config uploads.
  * Prevented deletion of vitals referenced by Android profiles.
* Improved error handling and delivery failure details when a device
lacks a required vital value.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-29 08:22:57 -03:00
Victor Lyuboslavsky ffc85a42ae Add Windows admin account config (#49863) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48720 

Subtask of https://github.com/fleetdm/fleet/issues/43488
This PR only adds the Windows config, and doesn't mess with macOS
configs.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## New Fleet configuration settings

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added managed local account settings for Windows to app and team
configuration, including GitOps support.
* Exposed an explicit enabled/disabled toggle in configuration output
and Fleet controls.
* Added licensing and Windows MDM prerequisites for enabling the
setting.

* **Bug Fixes**
* Managed local account enable/disable actions are now correctly
persisted and declaratively applied.
* Activity feed messages now display platform-specific (macOS vs
Windows) wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-28 12:10:33 -05:00
Andrew Mellor d06a4c222c 47700 abm token invalid errors (#49770) 
**Related issue:** Resolves #47700

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests

- [ ] QA'd all new/changed functionality manually. **_Not able to do for
all code paths yet_**



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added `token_invalid` for Apple Business Manager tokens, automatically
tracked based on Apple responses.
* Enhanced host DEP assignment API responses with a structured
`dep_device_error` field to classify why device details couldn’t be
retrieved.
* **Bug Fixes**
* Improved error handling for DEP device lookup, distinguishing
invalid/rejected tokens, expired terms, not-found devices, server/API
errors, and unavailable/unspecified failures.
* Added regression and unit test coverage for ABM token invalidation and
DEP device error classification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 10:35:27 +01:00
Jordan Montgomery 89f67544b4 Add support for fleet vars in scripts(controls scripts, software scripts/script-only packages and setup experience scripts) (#49781) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49511  and #46837 as a whole

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for Fleet built-in variables in host scripts, software
installer scripts, setup-experience scripts, and maintained-app
installer scripts.
* Variables are resolved per host at execution time; saved content
remains unexpanded.
* **Bug Fixes**
* Requests now validate Fleet variables up-front, with clear
script-specific error messages for unsupported variables.
* Added improved messaging when variable resolution fails during
execution.
* Enforced Fleet Premium licensing for script/installer flows that use
Fleet variables.
* **Documentation**
* Documented supported variables and Premium requirements, including
usage examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 11:24:42 +02:00
RachelElysia 09fea47ce4 Fleet UI: Handle long fleet names across the Fleets UI (#49216) 
## Issue
Closes #47290

Also implements the "Cap free-text `maxLength` to the backend column
length" pattern established in [#49041 (patterns.md
thread)](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691).

## Description
Fleet name inputs had no `maxLength` cap and no service-layer length
check, so a name >255 chars failed with a raw MySQL `Data too long`
error, and several UI surfaces didn't handle long names gracefully. This
PR fixes all four manifestations called out in the bug, plus a related
label-overflow case on the host details page, and hardens adjacent name
inputs across the app.

**Frontend fixes for #47290:**
- Create/Rename fleet name inputs now cap at 255 characters (matches
`teams.name varchar(255)`).
- Fleets table Name column uses `LinkCell` with `tooltipTruncate` +
`className="w400"` so long names truncate with an ellipsis and full-name
tooltip instead of overflowing across the Hosts/Users columns.
- Fleet-detail page header (`.team-details__team-header`): h1 gets
`overflow: hidden; text-overflow: ellipsis; white-space: nowrap;`,
`__team-details` gets `min-width: 0; flex: 1`, and `.action-buttons`
gets `flex-shrink: 0` + `white-space: nowrap` on buttons so *Manage
enroll secrets / Rename / Delete* no longer wrap to a second line when
the fleet name is long.
- Manage enroll secrets modal body — `__description` gets
`overflow-wrap: anywhere; min-width: 0` so a long `<b>{fleet name}</b>`
wraps within the modal instead of spilling out the right edge.

**Backend fixes for #47290:**
- New `fleet.MaxTeamNameLength = 255` constant.
- `NewTeam`, `ModifyTeam`, and `ApplyTeamSpecs` now return
`fleet.NewInvalidArgumentError("name", "may not exceed 255 characters")`
instead of surfacing a raw `Data too long` MySQL error. Covers UI, API,
and GitOps entry points.

**Broader consistency pass (per [#49041
thread](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691)):**
- New shared `MAX_ENTITY_CHAR_LENGTH = 255` constant in
`frontend/utilities/constants.tsx`.
- Refactored 8 existing files that had ad-hoc `NAME_MAX_LENGTH = 255` /
`MAX_LABEL_NAME_LENGTH = 255` locals to use it.
- Slotted it into 16 additional `InputField` name/description inputs
that were missing a cap (API user, custom variable, certificate, label
name + description, pack name + description, and all 5 CA forms —
CustomEST, CustomSCEP, Smallstep, Digicert, Hydrant).
- Pruned dead FE length validators that can no longer fire now that the
DOM cap enforces the limit (certificate modal, custom variable modal,
both label helpers, both category modals). Unusual/shorter caps (e.g.
`varchar(64)`, custom business rules) still keep their inline validators
— silent truncation is only appropriate for the common 255-char norm.

**Bonus:** fixed the long-label overflow on the host details Labels card
by capping the pill button `max-width` at 300px.

## Screenrecording



https://github.com/user-attachments/assets/b917b72e-7437-4d0c-a1a1-c49b4b1c28ba



https://github.com/user-attachments/assets/3a3efbb2-09d8-4f47-9fd4-f158b3453b9e



https://github.com/user-attachments/assets/73e5e022-dc93-4381-82b3-be9549d050e6

Latest - max width 300px long label:

<img width="1106" height="262" alt="Screenshot 2026-07-23 at 11 29
24 AM"
src="https://github.com/user-attachments/assets/741fddbd-f78d-4578-a025-bddf64a81c25"
/>


## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

Test coverage:
- `CreateFleetModal.tests.tsx`, `RenameFleetModal.tests.tsx` — new case
per file asserting the name input's `maxLength === 255`.
- `AddCertificateModal.tests.tsx`, `Variables.tests.tsx` — the existing
"shows too-long error when pasting 256 chars" tests are now unreachable
via the DOM cap; converted to `maxLength === 255` assertions.
- `ee/server/service/teams_test.go` — `TestNewTeamNameValidation`,
`TestModifyTeamNameValidation`, and `TestApplyTeamSpecsNameValidation`
each get two new cases (accepts at the limit, rejects one over with the
expected error message).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Limited fleet, team, and other user-entered names and descriptions to
255 characters.
* Replaced database errors for oversized names with clear validation
messages.
* Prevented long fleet and label names from overflowing tables, headers,
modals, and host details.
  * Improved modal and dropdown layouts for long text.
* **Tests**
* Added coverage for character limits, boundary values, and multibyte
names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-24 11:22:06 -04:00
Juan Fernandez 4972732c75 Fix test failures by avoiding mutating shared state 
Fix test failures by avoiding mutating shared state
 2026-07-23 08:10:55 -04:00
Juan Fernandez fbccb8cc59 Emit created/deleted activities for setup experience scripts 
Setup experience script add/replace/delete now record activities (API
and GitOps), skipping no-op re-submissions.
 2026-07-23 06:41:51 -04:00
Victor Lyuboslavsky 95b535a622 Reverting printableCharacters SCEP validation (#49758) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49756

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Custom SCEP proxy challenges can again include characters such as
underscores.
  * Apple device enrollment works again with these challenges.
* Removed the overly strict printable-character validation from the
Custom SCEP configuration form.
* The Challenge field now only enforces the required-value rule and no
longer shows printable-character validation errors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 13:46:47 -05:00
Magnus Jensen b9136f4da5 Release from AB backend support (#49680) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49367 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added “Release from Apple Business” for eligible Apple hosts,
including per-device success/failure reporting and activity logging.
* Added a new API endpoint to trigger the action and return results for
each selected host with clear error details.
* Introduced authorization rules for global admins and team admins to
release only within allowed scope.
* **Bug Fixes**
* Improved validation and error handling: rejects oversized selections,
reports unknown/ineligible hosts and DEP-related failures per device,
and treats assignment-cleanup failures as non-blocking.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 20:01:41 +02:00
Nico 87c1a719c1 Support custom host vitals in host name templates (#49586) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #49489

Custom host vitals were skipped when host name template enforcement
(#38806) shipped, since both features were in development at the same
time. This adds `$FLEET_HOST_VITAL_<id>` support to host name templates,
matching the existing secret-variable pattern (validation, per-host
resolution, resend on value change).

I also introduced a new `IsInvalidReferencedCustomHostVitalsError` call
after Copilot's comment below.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.


## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added support for `$FLEET_HOST_VITAL_<id>` in Apple host name
templates.
* Device-name template reconciliation now expands referenced per-host
vital values and updates automatically when those values change.

* **Bug Fixes**
* Prevents deleting custom host vitals that are referenced by host name
templates.
* If a referenced vital has no value for a host, device-name delivery is
marked failed for that host (retryable).

* **Improved Error Handling**
* Refined validation behavior so unknown/malformed vital references
return user-facing invalid-argument errors, while infrastructure errors
propagate unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 09:38:24 -03:00
Magnus Jensen 94d5a7d27c create new appCfg entry on AB fleet updates if not found (#49559) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48653 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Improved Apple Business Manager configuration handling when updating
team assignments, including creating the assignment entry when it
doesn’t already exist.
- Removing an Apple Business Manager token now also removes its
corresponding assignment details and properly updates configuration
status when no tokens remain.
- Prevented `generate-gitops` from exporting an empty `apple_business`
section when default fleets are configured only via the UI.
- **Tests**
- Expanded coverage for team assignment updates to validate creation of
new configuration entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-21 21:33:36 +02:00
Juan Fernandez a156079d55 Fix SCIM deprovisioning edge case during user deactivation 
Resolve the matching Fleet user from the persisted SCIM record rather
than the incoming request state when handling deactivation, so
deprovisioning still works when identifiers change in the same request.
 2026-07-21 11:33:08 -04:00
Juan Fernandez 9f251c21fe Fix SCIM middleware persisting authorization failures to last_request 
The LastRequestMiddleware already skipped 401 responses but not 403s, so
unauthorized users could overwrite the admin-visible SCIM status. Skip
both.
 2026-07-21 11:32:36 -04:00
Carlo fb0e817bd0 Show .py script-only packages as available for install on macOS hosts (#49457) 
**Related issue:** Resolves #49455

Offer `.py` script-only packages on macOS hosts, matching `.sh`.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Python (`.py`) installer packages are now treated as compatible
alongside shell (`.sh`) installers on macOS and Linux.
* Python installers can now appear in software availability,
self-service installation, and setup experience selections.
* Windows behavior remains unchanged (Unix-script installers are
excluded).

* **Bug Fixes**
* Improved cross-platform compatibility matching for Unix-like hosts
when choosing the first eligible installer package.

* **Tests**
* Added and expanded unit/integration coverage for `.py` installer
compatibility across platforms and flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-20 15:13:50 -04:00
Carlo 7cb2399700 Redirect FMA installs to the active version after auto-update (#49525) 
**Related issue:** Resolves #49495

Redirects queued Fleet-maintained app installs to the newly-active
installer (canceling already-dispatched ones) atomically when an
auto-update or pin change flips the active version, and re-resolves
install retries to the active installer, so a host no longer installs a
superseded cached version.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fleet-maintained app installs now consistently use the currently
active version after automatic promotions, preventing stale installer
targeting.
* Queued installs tied to an older promoted installer are redirected to
the newly active installer instead of being canceled.
* Install retry flows now re-resolve to the active installer at retry
time, avoiding stale retries after version changes.
* **Tests**
* Added datastore coverage for active-installer redirection and updated
retry tests to verify the correct installer ID is used.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-18 06:01:45 -04:00
Dante Catalfamo 67c06a9820 Mask team enroll secrets in team write responses (#49422) 2026-07-17 16:45:40 -04:00
Juan Fernandez d2210243fc Rejected empty and whitespace-only enroll secrets when creating or updating teams 
Rejected empty and whitespace-only enroll secrets when creating or updating teams
 2026-07-16 18:54:38 -04:00
Carlo 57bab9e5ec Allow Python script-only packages (#49070) 
**Related issue:** Resolves #41470

Adds support for uploading Python (`.py`) script-only software packages
— accepted as script-only (the file contents become the install script;
advanced options and automatic install follow `.sh`/`.ps1`), assigned
the new `py_packages` source, and installable on macOS and Linux hosts
across the UI, REST API, and GitOps.

Feature branch combining the backend (#48942) and frontend (#48946)
sub-PRs.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for Python (`.py`) script-only software packages across
UI uploads, API/self-service installs, and GitOps parsing.
* Python installers now derive metadata correctly and render the proper
Python icon, with install eligibility for macOS & Linux.
* **Bug Fixes**
* Improved installer-script validation and “supported file types” error
messages to include `.py` (and consistent handling of related script
fields/options).
* **Tests**
* Expanded unit, integration, and GitOps tests to cover Python package
parsing, metadata derivation, platform/host eligibility, and UI
rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-16 14:20:03 -04:00
Juan Fernandez 83cef5483f Extend support for all built-in 
Relates to #38806

Extend host name templates beyond the three host-identity variables to
also accept the IdP end-user variables, and re-enqueue the rename when a
referenced variable's value changes.

Re-enqueue on value change:
- An IdP data change (SCIM user/group create/update/delete) re-queues
only the affected hosts whose template uses the changed IdP variable —
IdP values are per host, so the scope is the specific hosts mapped to
that user/group.
- A custom (secret) value change re-queues every eligible host in each
team / "No team" whose template references the changed secret — secret
values are global, so the scope is the whole team/No-team.

Built-in variables intentionally NOT supported:
- Certificate/CA variables — $FLEET_VAR_NDES_SCEP_CHALLENGE,
_NDES_SCEP_PROXY_URL, _CUSTOM_SCEP_CHALLENGE_*,
_CUSTOM_SCEP_PROXY_URL_*, _SMALLSTEP_SCEP_CHALLENGE_*,
_SMALLSTEP_SCEP_PROXY_URL_*, _DIGICERT_DATA_*, _DIGICERT_PASSWORD_*,
_SCEP_WINDOWS_CERTIFICATE_ID, _CERTIFICATE_RENEWAL_ID (and legacy
_SCEP_RENEWAL_ID), _PSSO_DEVICE_REGISTRATION_TOKEN. These resolve to
one-time SCEP challenges, proxy URLs, base64 PKCS12 cert data, or
Fleet-minted tokens — meaningless as a device name, and resolving them
has side effects (issuing certificates, consuming one-time challenges)
and would leak secrets into a name that's broadcast on-device, in
osquery, and in the UI.
- Legacy $FLEET_VAR_HOST_END_USER_EMAIL_IDP — deprecated ("avoid in new
replacements") and not a documented built-in variable, so it's excluded
in favor of the supported IDP_USERNAME variables.
 2026-07-16 10:43:37 -04:00
Carlo DiCelico 4ce133cb26 merge main 2026-07-15 19:17:29 -04:00
Nico b10642be3c 44954 custom host vitals (#49334) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44954 

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Custom Host Vitals management (create/edit/delete, search) with
copyable variable tokens and per-host values.
* Show Custom Host Vitals on host details, including role-based editing.
* Enabled Custom Host Vitals in host-vitals labels and the activity
feed.
* Extended GitOps to manage global Custom Host Vitals declaratively
(including dry-run behavior).
* Split Controls → Variables into Global Variables and Custom Host
Vitals, including routing updates.

* **Bug Fixes**
* Improved validation and expansion of Custom Host Vital references
across scripts, profiles, installers, and deployments, with clearer
failures when values are missing or invalid.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-15 19:35:27 -03:00
Carlo DiCelico a65af7461e Merge remote-tracking branch 'origin/main' into feat/28108-multiple-custom-packages 2026-07-15 17:47:12 -04:00
Carlo b8ddf171c4 Fix installer edit rejecting same-software new versions (#49353) 
**Related issue:** Resolves #49234

Editing a software installer to a new version failed with "The selected
package is for different software" when the title's stored
(osquery-reported) name differed from the installer's extracted name.
The edit now validates by software identity (bundle identifier / upgrade
code / name) instead of an exact name match.

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
 2026-07-15 17:16:38 -04:00
Juan Fernandez 89ec4f3abb Support custom (secret) variables in host name templates 
Relates to #38806

Host name templates previously accepted only built-in $FLEET_VAR_*
variables and rejected custom $FLEET_SECRET_* (secret) variables. Allow
secret variables so admins can embed an org-wide custom value in an
Apple host's name.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
 2026-07-15 14:29:02 -04:00
Dante Catalfamo 81ee9a86cd Fix NDES invalid credentials error to point to correct settings location (#49298) 
**Related issue:** Resolves #46380
 2026-07-15 12:34:59 -04:00
LeAnn f5e63a39bb Surface a more detailed error message if user doesn't have server_private_key configured (#49238) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43097

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved error messages for certificate authority operations when the
server private key is not configured.
* Added a direct “Learn more” reference to help resolve the
configuration issue.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-14 11:52:15 -07:00
RachelElysia f29ecfa09b Fleet: Pin installer download token to a specific package (#49239) (#49263) 2026-07-14 11:01:33 -07:00
Juan Fernandez 82db4d5389 macOS & iOS/iPadOS: Rename hosts 
Resolves #38806 

Add an IT-admin naming convention for macOS/iOS/iPadOS hosts. An admin
sets a name template (e.g. "iPad $FLEET_VAR_HOST_HARDWARE_SERIAL") under
Controls > OS settings > Host names for a fleet or for "No team"; Fleet
resolves it per host, delivers it via an Apple `Settings`/`DeviceName`
MDM command, renames its own record on ACK, then verifies the name via
osquery (macOS) or a DeviceInformation refetch (iOS/iPadOS). Clearing
the template stops enforcement without renaming any host. Fleet Premium
only, mirroring disk encryption.
 2026-07-14 10:28:19 -04:00
Carlo 5e2b76a3ad Rename setup_experience_platforms to singular comma-separated setup_experience_platform (#49245) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** #43667

# Summary

Renames the unreleased GitOps field `setup_experience_platforms` to
singular `setup_experience_platform`, accepting a comma-separated string
of `darwin`/`linux` (rejecting the `macos` alias) to match the
query/policy/label `platform` convention.

# Checklist for submitter

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

## New Fleet configuration settings

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Updated software setup-experience platform configuration to use a
single comma-separated `setup_experience_platform` value.
* Platform values are normalized for casing and whitespace,
deduplicated, and validated against supported platforms.
* macOS setup selections now use the canonical `darwin` value; the
`macos` alias is rejected.
* GitOps-generated configurations now use the updated field name and
platform format.
* **Bug Fixes**
* Improved validation messages for invalid setup-experience platform
values.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 20:02:36 -04:00
Konstantin Sykulev 3b329e49e7 Android certificates resent_certificate (#49171) 
**Related issue:** Resolves #49007

# Checklist for submitter

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* SCIM user create/reactivation, replace, patch, and delete flows now
automatically record certificate resend activities when applicable.
* Certificate resend activities are generated alongside SCIM
persistence, tied to the resulting “resent certificates”.
* **Bug Fixes**
* Improved reliability and synchronization of certificate resend
activity recording during SCIM and Google Workspace reconciliation.
* Failures to record individual resend activities no longer block the
underlying SCIM operation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 13:22:50 -05:00
Lucas Manuel Rodriguez 53c0ca8dda Use generated UUID for mdm_idp_account table on Linux and Windows (#49215) 
Resolves #47626.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Fixed Fleet re-enrollment on Linux for end-user authentication SSO
when the re-enrollment email differs from the original enrollment email.
- Re-enrollment now remaps the device to the correct SSO account, with
no SSO callback/login errors, and does not reuse the prior account UUID.
- **Tests**
- Added a regression test covering re-enrollment with the same device
host UUID but a different IdP user/email, validating email updates and
account UUID change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 14:43:39 -03:00
Jordan MontgomeryCopilot Autofix powered by AIMagnus Jensen
 		c5575e9d9a Add PSSO end to end integration tests (#48589) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47171

Added integration tests for the fleet-psso feature and added PSSO
functionality to our MDM test client - idea being it is so tightly
integrated into the MDM side of things on the Apple side AND we ideall
want osquery-perf to be able to exercise it(coming in the next PR)

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Apple Platform SSO (PSSO) support for device registration,
password login, key requests, and key exchange.
* Added a simulator/test device for exercising the full PSSO workflow
end-to-end.
* Made PSSO AASA development app IDs configurable and enhanced macOS
PSSO activity in performance testing (with new counters).
  * Improved local macOS Desktop packaging/signing configurability.

* **Bug Fixes**
* Strengthened PSSO token/crypto handling, including algorithm pinning,
key ID canonicalization, encrypted assertion `typ` validation, and
replay protection.

* **Tests**
* Added extensive crypto interoperability tests (including Apple
known-answer vectors) plus new end-to-end integration coverage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
 2026-07-10 18:51:33 -04:00
Carlo DiCelico 06863c4b37 Merge remote-tracking branch 'origin/main' into feat/28108-multiple-custom-packages 
# Conflicts:
#	frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/LibraryItemAccordion/LibraryItemAccordion.tsx
#	frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
#	pkg/spec/gitops.go
#	server/datastore/mysql/schema.sql
#	server/fleet/software_installer.go
 2026-07-10 14:48:55 -04:00
Carlo 6cfc4a3611 Add GitOps support for macOS script-only packages in setup experience (#49089) 
**Related issue:** Resolves #43667

  # Summary

Adds a `setup_experience_platforms` field to the GitOps software package
spec so `.sh` script-only installers can be selected for macOS setup
experience declaratively. Reconciles the cross-platform selection table
on every batch apply.

  # Checklist for submitter

  If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

  ## Testing

  - [x] Added/updated automated tests

  - [x] QA'd all new/changed functionality manually

  ## New Fleet configuration settings

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added declarative `setup_experience_platforms` to software package
definitions to control “setup experience” targets, including selecting
script-only installers for macOS (mapped appropriately).
* Batch uploads now propagate these cross-platform selections and
reconcile installer cross-entries.

* **Bug Fixes**
* Improved platform normalization (trimming, casing, alias mapping),
deduplication, and extension-specific validation.
* Enhanced update behavior: omitting the field leaves existing
selections unchanged; providing an empty list clears them, with correct
setup/installation timing.

* **Tests**
* Added unit and integration coverage for normalization and batch
re-apply/reconcile behavior (nil vs empty, idempotency, mixed updates,
and validation failures).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 13:52:48 -04:00
Magnus Jensen 790f457bf0 SAAD: GitOps for DDM assets (#49046) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48570

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. Added in a previous PR

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added end-to-end Apple DDM asset support in GitOps, including export
and GitOps parsing for `macOS settings` assets.
* Introduced Apple DDM asset management APIs
(list/get/download/create/delete) plus a batch set operation with
dry-run.
* **Bug Fixes**
* Improved Apple MDM/DDM reconciliation so referenced asset updates
trigger re-delivery via asset-aware tokening.
* Added safer validation around asset type changes and deletion
conflicts when assets are still referenced.
* **Tests**
* Expanded unit and integration coverage for asset parsing, upload/apply
behavior, reconciliation, and access control.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 12:56:26 -04:00
Sharon Katz 2f0c1b338a Restrict SCIM endpoints to global admin only (#48858) 
**Related issue:** N/A

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests

## Summary

Restricts SCIM endpoint access to global admin users only. Previously,
global maintainers also had access, which is broader than necessary.

### Changes
- **`server/authz/policy.rego`**: Removed `maintainer` from the SCIM
authorization rule, leaving only `admin`.
- **`ee/server/integrationtest/scim/scim_test.go`**: Updated auth tests
to verify maintainers now get 403, and that only admins can access SCIM
endpoints.

> **Breaking change for 4.89**: Customers using a global maintainer API
token for SCIM will need to update to a global admin token before
upgrading.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Restricted SCIM endpoint access to global administrators only.

* **Bug Fixes**
* Prevented unauthorized observer and maintainer users from accessing
SCIM reads, writes, and details.
* Improved authorization error tracking for denied SCIM requests
(including recorded request status and details).

* **Tests**
* Updated SCIM authorization integration tests to reflect the tightened
admin-only access rules.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-10 11:53:48 -04:00
Jordan MontgomeryCopilot Autofix powered by AIMagnus Jensen
 		a33481653d macos password sync feature branch (#47422) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45524

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Apple Platform SSO (PSSO) for macOS with device registration,
sign-in, and public discovery (JWKS + Apple app-site association)
protected by single-use nonces.
* Added Apple account provisioning (Platform SSO password sync)
configuration with masked client-secret handling and GitOps support.
* Added a host-scoped PSSO device registration token variable for Apple
MDM profile generation.
* **Bug Fixes**
* Fixed macOS packaging to correctly build, embed, and sign the Platform
SSO extension.
* Resetting device Apple MDM data now also clears stored PSSO enrollment
records.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
 2026-07-09 14:57:48 -04:00
Magnus Jensen a15d58e927 SAAD: Asset CRUD API (#49011) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48568 partly

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information. (Will add in followup)

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Apple DDM asset management endpoints: list, get, download (raw
JSON), create, and delete.
* Implemented datastore-backed Apple DDM asset CRUD with team-scoped and
global access, plus configurable upload size limits.
* Added strict asset JSON validation (including required fields, URI
checks, and secret expansion rules).
* **Bug Fixes**
* Improved authorization handling by returning not-found responses for
out-of-scope read/download/delete to avoid asset discovery.
* Added clearer conflict and linked-profile error mapping for
create/delete failures.
* **Tests**
* Added comprehensive authorization and validation test coverage for
Apple DDM assets and policy behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-09 18:34:17 +02:00
George Karr 69fa5ca435 Fix VPP/in-house app install on manual-profile BYOD iOS hosts (#48879) (#48916) 
**Related issue:** Resolves #48879

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (parameterized queries only).
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes — N/A,
no endpoint/path changes.

## Summary

Installing an App Store (VPP) or in-house app on an iOS/iPadOS host
enrolled via the **manual (profile-driven) BYOD** enrollment profile
failed: Fleet routed the install down the **Account-Driven User
Enrollment (user-scoped)** licensing path, tried to look up/register a
VPP user keyed on the host's Managed Apple ID, and returned _"Fleet
hasn't received a Managed Apple ID for this host yet."_ — which never
resolves, because a device-channel host has no Managed Apple ID.

### Root cause

The device-vs-user licensing decision keyed off
`host_mdm.is_personal_enrollment`. That flag is set for **both**:
- **Account-Driven User Enrollment** — user channel, backed by a Managed
Apple ID → user-scoped licensing (correct).
- **Manual-profile BYOD** — device channel, no Managed Apple ID → must
install **device-scoped**, exactly like company-owned manual enrollment.

### Fix

Branch on the actual enrollment **channel** — the presence of a
user-channel `nano_enrollments` row (`type='User' AND enabled=1`), the
same signal the MDM profile reconcile cron already uses
(`GetNanoMDMUserEnrollment`). This is timing-robust: the user
nano-enrollment exists from enrollment time, whereas the Managed Apple
ID only arrives minutes later via `TokenUpdate` (so `managed_apple_id`
emptiness is deliberately **not** used as the discriminator).

Three sites updated:
| File | Change |
|---|---|
| `ee/server/service/software_installers.go` |
`InstallVPPAppPostValidation` routes on `GetNanoMDMUserEnrollment`
instead of `is_personal_enrollment` |
| `server/datastore/mysql/vpp.go` | InstallApplication builder derives
`IsUserEnrollment` (ChangeManagementState omission) from a user-channel
`nano_enrollments` row |
| `server/datastore/mysql/activities.go` | same, for in-house `.ipa`
installs |

## Testing

- [x] Added/updated automated tests:
- `ee/server/service`:
`TestInstallVPPAppPostValidation_AssociateAssetsRouting` — added a
regression subtest asserting manual-profile BYOD (personal flag set,
device channel) routes via `serialNumbers` and performs **no** VPP user
lookup; repointed routing to the user-channel signal.
- `server/datastore/mysql`: new
`TestVPP/VPPInstallEnrollmentChannelRouting` — manual BYOD includes
`ChangeManagementState` despite `is_personal_enrollment=1`;
account-driven User Enrollment omits it.
- [x] Automated tests simulate multiple hosts and test for host
isolation (two distinct hosts, device- vs user-channel).
- [ ] QA'd all new/changed functionality manually — pending (draft).

For unreleased bug fixes in a release candidate:

- [x] Confirmed that the fix is not expected to adversely impact load
test results (adds one indexed lookup per install enqueue; removes a
`host_mdm` join).

## Database migrations

- N/A — no schema changes. The fix reads existing `nano_enrollments`
rows.

## fleetd/orbit/Fleet Desktop

- N/A

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed app installation for manually enrolled BYOD iPhone and iPad
devices so App Store and in-house apps install correctly on the device.
* Improved enrollment handling so device-scoped installs no longer fail
when a device is marked personal in one place but uses device-channel
enrollment.
* Account-Driven User Enrollment continues to use user-scoped licensing
and installs.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-09 07:32:37 -05:00
Victor Lyuboslavsky e1094096af Surface proxied Windows SCEP certificate failures (#45550) (#48842) 
Windows configuration profiles that Fleet proxies SCEP for previously
reported "verified" as soon as the device acknowledged the SyncML Exec
command, even when the asynchronous SCEP exchange later failed and no
certificate was ever issued.

- Proxied SCEP profiles (custom SCEP proxy, NDES) now move to
"verifying" on the device ACK and only reach "verified" once Fleet
observes the matching certificate on the host, keyed by the renewal-ID
marker (fleet-<profile_uuid>) in the certificate CN/OU.
- When Fleet's SCEP proxy observes an upstream CA error during
PKIOperation, it marks the profile "failed" with a detail naming the
operation and upstream status. If the device's own retry later succeeds,
the observed certificate flips the profile to "verified".
- Unconfirmed profiles stay "verifying" (offline host, agent that cannot
enumerate certificates, empty store, or a user-scoped profile before the
user logs in); absence is never treated as failure.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #45550 

Demo: https://www.youtube.com/watch?v=WNGuFdeBmzA
Docs: https://github.com/fleetdm/fleet/pull/48933/changes

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added Windows SCEP failure tracking with clearer, categorized detail
when upstream operations fail.
* Added reconciliation backstops for “stuck” proxied SCEP profiles,
including automatic recovery to verified when the expected certificate
is observed.

* **Bug Fixes**
* Prevented proxied Windows SCEP installs from being marked “verified”
until matching certificate evidence arrives.
* Improved classification and persistence behavior for timeouts,
connection/DNS issues, and HTTP error responses without disturbing
existing retry state.

* **Tests**
* Expanded Windows SCEP scenarios to cover reconciliation, skipping
conditions, and error classification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-09 07:38:47 +01:00
Carlo dfe0f1c871 Fix App Store picker 403 for non-admin roles (#48856) 
**Related issue:** Resolves #46057

Authorize `GetVPPTokens` against `VPPApp` instead of admin-only
`AppleCSR`, so maintainer/technician roles no longer get a 403 that
broke the App Store picker.

  # Checklist for submitter

  - [x] Changes file added for user-visible changes in `changes/`.

  ## Testing

  - [x] Added/updated automated tests
  - [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed the “Add software > App Store” picker so maintainer and
technician roles no longer encounter access errors when browsing VPP
tokens.
* Improved VPP token visibility for team-scoped users by restricting
listings to teams they can read, while including “all teams” tokens and
excluding unassigned/unauthorized ones.
* Ensured users without appropriate access receive the correct
authorization response instead of broader token listings.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 16:15:58 -04:00
Jordan Montgomery 88ee1fee97 Fix re-enrollment with pending SCEP(and ACME) renewals (#48661) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48486 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Apple MDM devices manually re-enrolled during a pending SCEP renewal
are now handled as a fresh enrollment, so enrollment steps run
correctly.
* Renewal and re-enrollment flows are now better distinguished, reducing
cases where profile or app setup could be skipped.
* Enrollment certificates now carry clearer markers to help the system
apply the right lifecycle behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-07 09:26:14 -04:00
Jonathan Katz 2c383d7b8d Differentiate between ipa and other zip file types in ExtractInstallerMetadata (#48802) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48102

Changes:
- Renames `ExtractIPAMetadata` to `ExtractZIPMetadata` because the magic
bytes for zip based installers (.ipa, .msix, .zip, etc) are the same so
any zip file reaches it. If the zip does not contain an `Info.plist`
file it will now fail with `ErrInvalidType`.
- Did **NOT** make typeFromBytes return "zip" instead of "ipa" because
meta.Extension is set from that which has downstream effects.
- Added test files 
The actual error message is still just "invalid file type". 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually
- Tested adding a valid `.ipa`, a macos FMA that uses a .zip file
(alt-tab/darwin), and a windows FMA that uses a .zip file
(vnc-server/windows).
- Tested an msix file (renamed or not) cannot be uploaded or edited for
an existing msi installer
  - Also tested the same things via GitOps
  

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved installer type detection so ZIP-based packages are less
likely to be misidentified.
* Fixed an error message that incorrectly referred to the wrong file
type when detection fails.
* MSIX packages are now reported more accurately when they don’t match
IPA parsing rules.
* **Refactor**
  * Cleaned up installer metadata handling for ZIP-based archives.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-06 18:18:16 -04:00