460de7ca9cb036974bf45ea9f08bb86f41db63b4
26471
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 LeAnn
|
460de7ca9c |
Update routes.js (#50010)
Add two new UI routes for Android host vitals tooltips <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #49791 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added convenient links for learning more about device security posture and software update status. * These links redirect to the relevant Google Android Management API reference documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
c25f37abd6 |
Update Fleet-maintained apps (#50156)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated maintained app releases for Gitify, JetBrains Toolbox, Microsoft 365 Copilot, Spokenly, Tower, and Vivaldi. * Refreshed installer links and verification checksums for the latest versions across macOS and Windows. * **Bug Fixes** * Updated Pastebot’s macOS uninstall process to remove the app and related user files while avoiding removal of additional system paths. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
|
daed574428 |
Update MDM commands documentation with usage details (#49657)
Added note about MDM command limitations and usage of fleetctl. --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com> |
||
|
Gray WilliamsandLucas Manuel Rodriguez
|
43b8a27950 |
Update disk_space.yml (#50142)
Resolves #50058 where links do not show the expected text in the table description <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated disk space table documentation to improve cross-referenced links for Windows logical drives and Linux mounts by adjusting Markdown formatting. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Lucas Manuel Rodriguez
|
1397531199 |
Authorize packs before returning them in query responses (#50148)
- [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Query responses now include pack details only when the requester has permission to view them. * Prevented pack metadata from being disclosed across fleets when query names overlap. * Corrected target selection labels and empty-state messaging for fleet-based targets. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
ddf3e96fa9 |
Update Fleet-maintained apps (#50150)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Versions** * Updated release metadata and installer details for AnyBurn, BetterDisplay, Blender, ChatGPT, ChatWise, CLion, DataGrip, Dataspell, Draw.io Desktop, Elgato Camera Hub, Firefox, Firefox Nightly, GIMP, GoLand, IntelliJ IDEA (and variants), Keka, Kitty, LibreOffice, MacPacker, MuseScore, Nudge, OBS, PhpStorm, PyCharm (CE), Rider, RubyMine, RustRover, Spyder, Typinator, Visual Studio Code, VLC, WebStorm, Wispr Flow, XLD, and others. * Refreshed app version detection and package checksums accordingly. * **Bug Fixes** * Improved uninstall reliability on macOS and Windows by removing unintended extra cleanup actions while keeping application and user-data removal. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
DanFashauer
|
54b32ddf88 |
Fix typo in LinkedIn tracking workflow section (#50151)
Fixed spelling on LinkedIn posting. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Harrison RavazzoloandAllen Houchins
|
b7654a55a0 |
Custom windows update article (#49961)
Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
fleet-releaseandallenhouchins
|
f67d9a5b3c |
Update Fleet-maintained apps (#50138)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for the latest versions of AnyBurn, BetterZip, Canva, Eclipse Temurin, ExifCleaner, Gemini, LibreOffice, NordVPN, Postman, TablePlus, Tailscale, and other maintained applications across Windows and macOS. * **Bug Fixes** * Improved macOS uninstall cleanup for numerous applications by removing additional caches, preferences, recent-document entries, containers, support files, and related data. * Updated installer downloads and verification checks to match the latest releases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Victor Lyuboslavsky
|
40b901c842 |
Fix broken gitops-auto-complete build. (#50081)
The gitops-auto-complete uses `replace github.com/fleetdm/fleet/v4 => ../..` which means it is frequently broken whenever fleet updates shared libraries. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Added automated build and dependency verification for the GitOps auto-complete tool. * Updated workflow triggers so changes to the tool are checked automatically. * Refreshed supporting service dependencies used by the tool. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
1a0f0101cc |
Fix gitops not updating FMA installer (#50000)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49811 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed Fleet-maintained app updates when a rebuilt installer keeps the same version. * Rebuilt installers now update their files, hashes, filenames, and install scripts correctly. * Prevented installers from being incorrectly skipped when their contents differ despite matching versions. * **Tests** * Added coverage for same-version installer rebuilds and team-specific caching behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Luke Heath
|
699bdb50ac | Prepare to archive fleet-gitops repo (#50134) | ||
|
Magnus Jensen
|
e6118b4cc5 |
extra error message checks and correct escaping in error message (#50136)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40074 unreleased bug <img width="539" height="141" alt="image" src="https://github.com/user-attachments/assets/1ac8e2c2-236d-4567-a200-0eb35cce46e7" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved configuration profile validation for unescaped special characters in Apple payloads. * Error messages now consistently indicate when characters like `&` and `<` must be XML-escaped. * Updated error examples to show properly escaped guidance. * Expanded test coverage to verify the standardized XML-escaping error for additional failing scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel RodriguezandCopilot Autofix powered by AI
|
9c2ef14947 |
Scrub device policy responses in Fleet Desktop (#50094)
- [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security Improvements** * Updated device-authenticated policy and host-detail responses to omit policy author identity fields and any raw SQL/query data. * Device policy endpoints now return a device-safe policy representation consistently. * **Bug Fixes** * Prevented administrative policy information from appearing in device-authenticated host details and policy listings. * **Tests** * Strengthened integration coverage to verify device-safe responses (required user-facing fields present; sensitive fields absent). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Magnus Jensen
|
451319b384 |
Hide Account Provisioning on Fleet free (#50130)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50122 <img width="730" height="148" alt="image" src="https://github.com/user-attachments/assets/e7a803bd-b50d-404f-8af2-9fa32cc34772" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. (Unreleased bug) - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Account provisioning settings now indicate when the feature is included with Fleet Premium. - Premium-tier accounts continue to see the full provisioning configuration and save controls. - **Bug Fixes** - Improved license-tier handling so account provisioning displays the appropriate experience for free and premium plans. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
f5ca4b5b0d |
Add Android support for custom host vitals (#49696)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49421 Custom host vitals (`$FLEET_HOST_VITAL_<id>`) already worked in scripts and Apple/Windows configuration profiles, but Android configuration profiles and managed app configuration explicitly rejected them at upload to keep parity with `$FLEET_SECRET_*`. This left admins unable to inject per-host vitals (e.g. an asset tag) into Android MDM configuration the same way they can for every other platform. For more context, prior PRs: - https://github.com/fleetdm/fleet/pull/49334 - https://github.com/fleetdm/fleet/pull/49586 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually - Created an "Asset tag" host vital. - Enrolled an Android device. - Initially the test profile showed as "Failed" because no value was set for the vital. - Set a value for the vital, saw that it went from Enforcing to Verified. <img width="1446" height="510" alt="Screenshot 2026-07-24 at 8 57 46 AM" src="https://github.com/user-attachments/assets/c0e2348c-e521-48f3-85cd-6f884689b2cd" /> <img width="1520" height="936" alt="Screenshot 2026-07-24 at 8 56 56 AM" src="https://github.com/user-attachments/assets/169b9545-ec7a-429b-8f45-0e2740f61c77" /> <img width="1607" height="1136" alt="Screenshot 2026-07-24 at 8 57 30 AM" src="https://github.com/user-attachments/assets/a8213745-b224-4a36-a54d-32152a15c377" /> Also tested the rejection cases: - trying to upload a profile with an invalid custom host vital id (either a non-numeric value, a numeric but non-existent ID, and referencing a vital as a JSON key instead of a value) - deleting a vital referenced in a profile https://github.com/user-attachments/assets/e8b4acde-ddf4-41c0-b00a-5ab4945d0bc2 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Android app configurations and profiles now support custom host vital placeholders (`$FLEET_HOST_VITAL_<id>`). * Custom host vital values are expanded per device during Android delivery. * Managed Android profiles/configurations are automatically resent when a referenced vital value changes. * **Bug Fixes** * Added validation for malformed, missing, or undefined vital references during Android app association and profile/config uploads. * Prevented deletion of vitals referenced by Android profiles. * Improved error handling and delivery failure details when a device lacks a required vital value. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra Kadam
|
5983f9de40 |
Require Fleet MDM enrollment before escrowing macOS disk encryption key (#50042)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48965 ## Description Fleet was escrowing a macOS disk encryption key — and logging an "escrowed a disk encryption key" activity — for hosts that aren't enrolled in Fleet's MDM (e.g. still managed by Jamf, or with a leftover `/var/db/FileVaultPRK.dat`). Because Fleet never installed its FileVault escrow profile on such a host, the stored key is unusable: the cron marks it `decryptable = 0` and `GET /hosts/:id/encryption_key` returns 422, so "Show disk encryption key" never appears. The result is a misleading activity and a dead key row. Root cause: the macOS key ingestion (`directIngestDiskEncryptionKeyFileDarwin` and its `file_lines` fallback) gated only on the disk being encrypted and disk encryption being enabled for the host's team — it never checked Fleet MDM enrollment. The Windows/orbit key path (`SetOrUpdateDiskEncryptionKey`) already performs this check. - **`server/service/osquery_utils/queries.go`** — added an `IsHostConnectedToFleetMDM` guard to both macOS ingestion functions, skipping archival (no key stored, no activity) when the host isn't connected to Fleet MDM. Mirrors the existing Windows path. Prevention only — this stops new bad escrows; it does not delete keys previously escrowed for non-enrolled hosts. ## Testing - **Unit** (`queries_test.go`): added a "host not connected to Fleet MDM" case asserting neither ingestion function escrows when the host isn't Fleet-MDM-connected, and initialized the `IsHostConnectedToFleetMDM` mock so existing cases still pass. - **Integration** (`integration_mdm_test.go`): `TestMDMAppleHostDiskEncryptionWithDisabledEncryptionSetting` was creating an orbit-only host (no Fleet MDM) and expecting escrow to succeed — i.e. relied on the bug. Switched it to a Fleet-MDM-enrolled host (`createHostThenEnrollMDM`), which is now required for escrow. Passes. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements). ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- covered by automated integration test; live no-device repro is impractical, flagged for reviewer --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - FileVault recovery keys are now archived/escrowed only for macOS hosts that are connected to Fleet MDM. - Hosts without an active Fleet MDM connection no longer attempt to archive encryption keys. - Disk-encryption key archival now cleanly reports MDM connectivity errors when checks fail. - **Tests** - Added/updated coverage to verify both connected and disconnected host scenarios, including ensuring no archival occurs when MDM is not connected. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gray Williams
|
c1dde775d8 |
Update deploying-crowdstrike-with-fleet.md for exe support (#50040)
Updates the article to improve the instructions for deploying CrowdStrike using the .exe. Moves the exe part to a separate section, and includes the install/uninstall script. - Closes #49397 |
||
|
kitzy
|
f4d7064f9a |
Add Rtools as a Windows FMA (#50028)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **Rtools** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install script hit the validator's 10-minute `executeScript` cap exactly: ``` 20:41:22 INFO msg="Executing install script..." app=Rtools 20:51:22 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:51:22 WARN msg="failed to remove rtools45-6768-6492.exe: ... Access is denied." ``` The locked installer in the temp dir shows a process was still alive. `Start-Process -Wait` waits for the process *and all of its descendants*, which is the same root cause as the other install-timeout apps in this batch. Rtools is also the one app in the batch where a **slow unpack** is a plausible second cause — the installer is ~460 MB and expands a full toolchain. So rather than assume, the script now waits on the installer process alone with a 480s cap (under the caller's 10-minute budget) and logs elapsed time plus Add/Remove Programs registration state on every poll. If the cap is reached: - **registered** → the install finished and only a lingering child remains, so it stops that process and succeeds; - **not registered** → the unpack genuinely didn't finish, and it fails with that stated explicitly. Either way the CI log now says which one happened instead of just timing out. ## Notes - **Identity verified against the installer**, not winget metadata. The setup stub's PE version resource reads `CompanyName: The R Foundation`, `ProductName: Rtools`. Inno derives `VersionInfoCompany` from `AppPublisher`, so the ARP publisher is `The R Foundation` — which is what the exists query uses. - **Versioned ARP name.** The registry `DisplayName` is `Rtools 4.5 (6768-6492)`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Rtools %'`. - Installs to `C:\rtools45`, not Program Files, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30384196159](https://github.com/fleetdm/fleet/actions/runs/30384196159) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries checked against the installer's PE version resource, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Rtools as a supported Windows application. * Added installation and uninstallation support with silent setup and silent removal. * Added Rtools version metadata, installer verification, and Developer tools categorization. * Added a dedicated Rtools icon for software listings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
ea3f95ccc5 |
Add Google Earth Pro as a Windows FMA (#50022)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **Google Earth Pro** as a Windows Fleet-maintained app (a Windows counterpart to the existing `google-earth-pro/darwin` FMA). One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Install and detection were already fine on the SYSTEM-context Windows runner — osquery found `Google Earth Pro` 7.3.7.1155. **Uninstall** was the failure: ``` INFO msg="Executing uninstall script for app..." app="Google Earth Pro" INFO msg="Found app: 'Google Earth Pro' at , Version: 7.3.7.1155" ERROR msg="App still present after uninstall (expected no match for version '7.3.7.1155' in programs)" ``` The EXE wraps a WiX MSI, so the ARP `UninstallString` is `MsiExec.exe /X{ProductCode}` — with **no quiet switch**. The old script ran that string verbatim, which raises a confirmation dialog in session 0 where nothing can click it, so the uninstall silently no-ops. The uninstall script now resolves the MSI product code (from the `UninstallString`, falling back to the registry key name) and runs `msiexec /x <code> /quiet /norestart` with a bounded 5-minute wait, then drains child `msiexec` processes. `3010`/`1641` are treated as success. ## Notes - **Identity verified against the real installer**, not winget metadata. The installer's embedded MSI Property table reads: `ProductName` = `Google Earth Pro`, `Manufacturer` = `Google`, `ProductVersion` = `7.3.7.1155`, `ALLUSERS` = `1`, `ProductCode` = `{E3B69BB6-FFD8-441C-933E-BB8A3136ED8F}`. No `ARPSYSTEMCOMPONENT`, so it is not a bootstrapper. That confirms `unique_identifier` = `Google Earth Pro` and the exists-query publisher `Google` (not "Google LLC"). - Installs to `C:\Program Files (x86)`, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Reuses the existing `google earth pro` catalog icon — no new icon needed. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30383934805](https://github.com/fleetdm/fleet/actions/runs/30383934805) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries checked against the MSI Property table, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Google Earth Pro for Windows to the maintained app catalog. * Added maintained-apps install and uninstall support for Google Earth Pro (version 7.3.7.1155). * Included automated download integrity verification and detection logic for installed/updated versions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
c61632305a |
Add Logitech Unifying Software as a Windows FMA (#50024)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **Logitech Unifying Software** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing Install and detection were already fine on the SYSTEM-context Windows runner — osquery found `Logitech Unifying Software 2.52` at `C:\Program Files\Common Files\LogiShrd\Unifying`. **Uninstall** was the failure: ``` 20:40:55 INFO msg="Executing uninstall script for app..." 20:40:57 INFO msg="Found app: 'Logitech Unifying Software 2.52' ... Version: 2.52.33" 20:40:57 ERROR msg="App still present after uninstall (expected no match for version '2.52.33' in programs)" ``` Two seconds start to finish — the uninstaller hadn't actually done anything yet. This is standard NSIS behavior: the uninstaller copies itself to `%TEMP%` and relaunches, so the process the script starts exits almost immediately while the real work happens in a detached child. The fix passes NSIS's `_?=<dir>` switch, which runs the uninstaller in place instead of relaunching, making it synchronous. It has to be the last argument and unquoted, so the script builds a single argument string rather than an array (PowerShell would quote an element containing spaces). A bounded poll on the ARP key follows as a backstop, and the script fails explicitly if the entry is still there. ## Notes - **Versioned ARP name.** The registry `DisplayName` is `Logitech Unifying Software 2.52`, so the input uses `fuzzy_match_name` and the exists query is `name LIKE 'Logitech Unifying Software %'`. The uninstall script matches the same prefix rather than an exact string. - Publisher `Logitech` confirmed against the winget locale manifest. - Installs under `C:\Program Files\Common Files`, so the validator's "no changes detected in `C:\Program Files`" line is an expected warning, not a failure. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30384010810](https://github.com/fleetdm/fleet/actions/runs/30384010810) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Logitech Unifying Software to the Windows software catalog, including the version 2.52.33 download, checksum, and install-detection metadata. * Implemented silent installation and a robust, registry-aware uninstall flow (with process lock handling and timeout behavior). * Added a dedicated Logitech Unifying Software icon to the software page UI. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
cfbb5a59fa |
Add GNU Privacy Guard as a Windows FMA (#50025)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **GNU Privacy Guard** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install itself worked — the validator logged `New application detected at: C:\Program Files\GnuPG`. The *script* never returned: ``` 20:18:36 INFO msg="Executing install script..." app="GNU Privacy Guard" 20:28:36 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:28:36 INFO msg="New application detected at: C:\Program Files\GnuPG" ``` Ten minutes on the nose is the validator's `executeScript` timeout. The cause is a PowerShell detail rather than anything wrong with the installer: **`Start-Process -Wait` waits for the process *and all of its descendants***. GnuPG's installer starts `gpg-agent`, `dirmngr`, `keyboxd` and `scdaemon` and leaves them resident, so `-Wait` never returns. The same run left the installer `.exe` locked in the validator's temp dir, which is the other tell that a child process was still alive. The install script now follows the pattern already established by [`ollama_install.ps1`](ee/maintained-apps/inputs/winget/scripts/ollama_install.ps1): start with `-PassThru` (no `-Wait`), wait on the installer process alone with a 7-minute cap (below the caller's 10-minute script budget), poll for the Add/Remove Programs entry so a fast-returning installer can't be mistaken for a finished one, then stop the daemons. Stopping the daemons also fixes the uninstall, which would otherwise fail on files those processes hold open. The uninstall script stops them up front, uses NSIS's `_?=<dir>` switch so the uninstaller runs in place instead of relaunching itself detached from `%TEMP%`, and polls the ARP key to confirm removal. ## Notes - Clean ARP `DisplayName` (`GNU Privacy Guard`), so exact name matching — no `fuzzy_match_name` needed. Publisher `The GnuPG Project`. - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30384069714](https://github.com/fleetdm/fleet/actions/runs/30384069714) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added GNU Privacy Guard as a supported Windows application in the maintained apps catalog. * Added install/upgrade detection and uninstall support for Windows. * Added GNU Privacy Guard to the software catalog (Security category). * Added a dedicated GNU Privacy Guard icon to the software interface for proper name-based display. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
2fc41c7592 |
Add Azure Data Studio as a Windows FMA (#50027)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #50020 # What this does Adds **Azure Data Studio** as a Windows Fleet-maintained app. One of the 11 apps split out of #48501 that failed the FMA validator; #50016 shipped the 6 that passed. ## Why it was failing The install itself worked — the validator logged `New application detected at: C:\Program Files\Azure Data Studio`. The *script* never returned: ``` 20:08:19 INFO msg="Executing install script..." app="Azure Data Studio" 20:18:19 ERROR msg="Error executing install script: exit status 1" # exactly 10:00 later 20:18:19 INFO msg="New application detected at: C:\Program Files\Azure Data Studio" ``` Ten minutes on the nose is the validator's `executeScript` timeout. Azure Data Studio is a Visual Studio Code fork and ships the same Inno Setup script — including the **`runcode` task, which launches the app when the install finishes**. Because `Start-Process -Wait` waits for the process *and all of its descendants*, the launched app kept the script blocked forever. The fix is the switch VS Code's own FMA already uses: `/MERGETASKS=!runcode` (see [`vscode_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscode_install.ps1) and [`vscodium_install.ps1`](ee/maintained-apps/inputs/winget/scripts/vscodium_install.ps1), both of which pass validation). The script also waits on the installer process alone rather than its descendants, polls for the Add/Remove Programs entry, and stops a stray `azuredatastudio` process as a backstop in case a future build ignores the task suppression. ## Notes - Machine-scope x64 installer, per the winget manifest — Azure Data Studio publishes both user and machine scope, and Fleet installs run as SYSTEM, so machine scope is required. - Clean ARP `DisplayName` (`Azure Data Studio`), so exact name matching. Publisher `Microsoft Corporation`. - Uninstall is unchanged: the Inno uninstaller doesn't leave anything resident, and `-Wait` waiting on descendants is the desired behavior there (Inno relaunches itself from `%TEMP%`). - Ships a new catalog icon and website asset. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] FMA CI validator (install → detect → uninstall) **passes** on the SYSTEM-context Windows runner — [run 30384162280](https://github.com/fleetdm/fleet/actions/runs/30384162280) (`All checks passed`) - [x] Generated output verified locally: manifest SHA matches the winget manifest, exists/patched queries reviewed for name + publisher correctness, `apps.json` is valid JSON with a description filled in. - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Azure Data Studio to the available Windows software catalog. * Added support for installing and uninstalling Azure Data Studio (version 1.52.0) via silent installer and uninstaller flows with completion detection. * Added an Azure Data Studio icon to the software interface for better visual identification. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
38d1f6a856 |
Update Fleet-maintained apps (#50113)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for numerous current macOS and Windows application releases, including updated installers, download links, and integrity checks. * Improved uninstall cleanup for several applications by removing additional services, launch items, recent-document entries, and application data. * **Bug Fixes** * Corrected version detection thresholds so outdated installations are accurately identified. * Updated installer and uninstaller behavior for newer application builds, including improved relaunch and cleanup handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Allen Houchins
|
a3cdb7e14b |
Fix macOS-only copy on two Windows FMA catalog entries (#50111)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A — found while removing the macOS Yubikey Manager FMA (#50109) Two Windows Fleet-maintained apps describe themselves as macOS software in `ee/maintained-apps/outputs/apps.json`, because the entries were copy-pasted from their macOS counterparts. This copy is customer-facing: it shows in the Fleet UI's software catalog and on `fleetdm.com/software-catalog/<slug>`. - `proxyman/windows` — "Proxyman is a high-performance **macOS** app that enables developers to view HTTP/HTTPS requests and responses." → drops "macOS". (The `proxyman/darwin` description keeps it; it's accurate there.) - `wechat/windows` — name "**WeChat for Mac**" and "**WeChat for Mac** is a free messaging and calling application." → "WeChat". The winget input (`inputs/winget/wechat.json`) already declares `"name": "WeChat"`, so this also makes `apps.json` agree with its own input. The `wechat/darwin` entry keeps "WeChat for Mac", which is the actual macOS product name. Renaming the Windows entry needs a matching icon key. `getMatchedSoftwareIcon` matches on the lowercased app name and requires an exact match or a whole-word prefix (`matchLoosePrefixToKey`: `s === key || s.startsWith(key + " ")`), so the existing `"wechat for mac"` key would **not** match a name of "WeChat" and the app would fall back to the generic package icon. Added a `wechat: Wechat` key alongside it (both point at the same component; the `"wechat for mac"` key stays for macOS and for hosts reporting that name in inventory). No server-side impact: `UpsertMaintainedApp` keys on `slug` and updates `name` in place, and `ReconcileMaintainedAppSoftwareNames` only renames `darwin` titles, so the Windows rename doesn't touch existing software titles. Website icons resolve from the slug (`build-static-content.js` builds `app-icon-<slug>-60x60@2x.png`), not the name, so `app-icon-wechat-60x60@2x.png` is unaffected. Descriptions here mirror upstream cask/winget copy, so these are minimal factual corrections rather than a voice rewrite. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually: - `apps.json` still parses; 1378 apps; verified the four `proxyman`/`wechat` entries read as intended and the `darwin` ones are untouched. - Traced the icon lookup by hand: name "wechat" now hits the new exact-match key; "wechat for mac" still hits the original. - Swept every non-darwin entry in `apps.json` for macOS-only phrasing (`Rosetta`, `macOS`, `Mac`, `Apple`) — these two were the only genuine mismatches. `duo-desktop/windows` (lists macOS, Windows, and Linux) and `imazing-profile-editor/windows` (edits Apple configuration profiles) are correct as written. Note: `node_modules` isn't installed in my working copy, so ESLint/Prettier weren't run locally — the added line is a one-line map entry matching the surrounding style. CI will confirm. |
||
|
Allen Houchins
|
1e8b96e03d |
Remove Yubikey Manager as a macOS FMA (#50109)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow The `yubico-yubikey-manager` cask was removed from homebrew-cask on 2026-07-28 ([Homebrew/homebrew-cask@7ffabaa](https://github.com/Homebrew/homebrew-cask/commit/7ffabaad8fcc657dc90343844ad76a50bb60b945)) after being disabled on 2025-07-27 `because: :discontinued, replacement_cask: "yubico-authenticator"` — Yubico discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pinned) in favor of Yubico Authenticator. The brew API now returns 404 for the token, so the maintained-apps ingester panics: ``` {"level":"INFO","msg":"ingesting homebrew app","name":"Yubikey Manager"} panic: ingesting homebrew app: app not found in brew API ``` Freezing the app in #50054 did not resolve this: `fetchCask` runs before the `frozen` flag is applied, so the ingester still fetches the cask and fails on the 404. This is the follow-up that PR called out. Removes Yubikey Manager as a **macOS** Fleet-maintained app, following the same pattern as #50050 (Nocturnal), #46541 (Messenger), and #47420 (Dell Display Manager): - `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` — Homebrew input - `ee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json` — macOS output data - `ee/maintained-apps/outputs/apps.json` — the `yubico-yubikey-manager/darwin` entry - `website/config/routes.js` — the bare `/software-catalog/yubico-yubikey-manager` redirect pointed at `-darwin`, which would now 404; retargeted to `-windows` The **Windows** FMA is unaffected and continues to update, so these are deliberately kept: - `ee/maintained-apps/inputs/winget/yubico-yubikey-manager.json` and its install/uninstall scripts - `ee/maintained-apps/outputs/yubico-yubikey-manager/windows.json` - the `yubico-yubikey-manager/windows` entry in `apps.json` - `frontend/pages/SoftwarePage/components/icons/YubikeyManager.tsx` and its `"yubikey manager"` mapping in `index.ts` - `website/assets/images/app-icon-yubico-yubikey-manager-60x60@2x.png` Also drops "Requires Rosetta 2." from the Windows entry's description in `apps.json`. Rosetta is macOS-only; the sentence was copy-pasted from the macOS entry, and with macOS gone the Windows page is what `/software-catalog/yubico-yubikey-manager` now resolves to. Descriptions in `apps.json` are hand-maintained — `updateAppsListFile` in `cmd/maintained-apps/main.go` only appends entries whose slug it doesn't already find, so it won't overwrite the edit. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually: - `go run ./cmd/maintained-apps -slug yubico-yubikey-manager/darwin` exits 0 with no panic and writes no files (before this change, the same run panicked on the brew 404). - `apps.json` still parses and holds 1377 apps; the only remaining `yubico-yubikey-manager` entry is `/windows`. - Grepped the repo for `yubico-yubikey-manager`: remaining hits are the winget input, its two script paths, the windows `apps.json` entry, and the retargeted website redirect. No automated tests added — this is a data-file removal with no new code paths. |
||
|
Noah Talerman
|
3a78739c10 |
Low contrast text on dashboard charts (#49651)
- [x] QA'd all new/changed functionality manually For the following bug: - https://github.com/fleetdm/fleet/issues/49626 Before: <img width="1362" height="492" alt="Screenshot 2026-07-28 at 12 59 19 PM" src="https://github.com/user-attachments/assets/2a8be8a5-4687-4259-8aec-7b49e4c2b93e" /> <img width="1365" height="477" alt="Screenshot 2026-07-28 at 1 00 11 PM" src="https://github.com/user-attachments/assets/855b19c7-e855-40b9-9952-3ca45a443dee" /> <img width="928" height="443" alt="Screenshot 2026-07-28 at 1 01 51 PM" src="https://github.com/user-attachments/assets/f66ed7f9-9f0f-4416-a938-57a6c6b3d984" /> <img width="923" height="443" alt="Screenshot 2026-07-28 at 1 01 54 PM" src="https://github.com/user-attachments/assets/83fab0ae-1496-44b0-b65e-c256e4f0d0bc" /> After: <img width="1349" height="469" alt="Screenshot 2026-07-28 at 12 59 08 PM" src="https://github.com/user-attachments/assets/f51e6cce-6f2f-4385-8c7d-81a8d3e99ec3" /> <img width="1368" height="552" alt="Screenshot 2026-07-28 at 12 59 55 PM" src="https://github.com/user-attachments/assets/75557fea-d614-4383-a557-8ef7f6a8f3ef" /> <img width="919" height="378" alt="Screenshot 2026-07-28 at 1 01 39 PM" src="https://github.com/user-attachments/assets/82db0bdf-c8c2-40a2-90e0-f531c0cfb9b3" /> <img width="920" height="435" alt="Screenshot 2026-07-28 at 1 01 42 PM" src="https://github.com/user-attachments/assets/ed01a037-22ba-40a6-9833-a7f98541e536" /> |
||
|
Rahul Raghunathan
|
8f7a4ba2a0 | Redirect to software inventory on 404 when switching fleets on title (#48389) | ||
|
Rahul Raghunathan
|
5bdbcc8495 | 48792 fix actions dropdown layout shift (#49430) | ||
|
RachelElysia
|
f7c2cf4106 | Fleet UI: PR #49292 follow-up — buttons, 8px gaps, focus ring (#50049) | ||
|
Juan Fernandez
|
360e4b74ff |
Update macOS disk encryption banner copy for ADE-enrolled hosts
Relates #47832 Both the Host details and My device pages told the reader to log out or restart when Fleet didn't have a Mac's FileVault key. That's wrong for ADE-enrolled hosts: they escrow the key automatically, and the only thing standing between the host and a cleared banner is the next vitals refetch. It stays correct for manual enrollment, where Escrow Buddy only generates a new key at next login. |
||
|
Juan Fernandez
|
07d4423c84 |
Add homebrew_outdated table to fleetd
Fixes #47692 New macOS-only extension table returning outdated Homebrew packages (formulae and casks) with installed and latest-available versions, for querying out-of-date packages and driving patching policies. Runs `brew outdated`/`brew info` as the console user; auto-update left on so current_version stays accurate. |
||
|
Rachael ShawandJuan Fernandez
|
56653202b4 |
#38670 API design: Policy status page (#46791)
> WIP For user story: + #38670 --------- Co-authored-by: Juan Fernandez <juan@fleetdm.com> |
||
|
Sharon Katz
|
0fd5739514 |
Auto-create QA tickets for Dependabot PRs (#48008)
**Related issue:** Resolves #48007 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/` - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## What When Dependabot opens a code-dependency PR (Go or npm), a GitHub Actions workflow now auto-creates a QA tracking issue assigned to @AndreyKizimenko and places it on the `:help-qa` board in "Ready" status. Also exempts `dependabot[bot]` from the PR template check. ### Files changed - **`.github/workflows/dependabot-qa-ticket.yml`** (new) - The core workflow. Triggers on `pull_request_target[opened]`, filters for code-dependency Dependabot PRs (Go modules + npm, excluding website/slackbot), creates a QA tracking issue, comments on the PR, and adds the issue to the `:help-qa` project board. - **`.github/workflows/check-pr-template.yml`** - Exempts `dependabot[bot]` from the PR description template check (Dependabot PRs have auto-generated descriptions). - **`.github/zizmor-gate.yml`** - Suppresses two expected zizmor findings: `dangerous-triggers` (uses `pull_request_target` but never checks out PR code) and `bot-conditions` (gates on `user.login` which is not spoofable for same-repo Dependabot PRs). - **`changes/48007-dependabot-qa-ticket`** - Release note. ## Security review This workflow uses `pull_request_target`, a known attack surface for GitHub Actions. A dedicated security audit was performed covering all standard threat vectors: | Area | Status | Details | |------|--------|---------| | **Code checkout injection** | SAFE | No `actions/checkout` or `git clone`. The workflow only calls the GitHub API via `actions/github-script`. The inline JavaScript is embedded in the base-branch YAML, not loaded from PR code. | | **Script/template injection** | SAFE | PR data (`pr.title`, `pr.head.ref`) is used in JavaScript template literals passed to the GitHub API as strings. There is no shell interpolation, no `eval()`, no `${{ }}` expressions in `run:` blocks. | | **Bot identity spoofing** | SAFE | Gates on `github.event.pull_request.user.login == 'dependabot[bot]'`, which is server-set by GitHub and cannot be spoofed. Uses `user.login` (immutable) rather than `github.actor` (which can differ on re-runs). The `[bot]` suffix is reserved for GitHub App accounts. | | **Secret exposure** | SAFE | `FLEET_GITHUB_TOKEN_PROJECTS` is passed via `env:` block, accessed as `process.env.PROJECT_TOKEN`, and used only as an argument to `getOctokit()`. Never logged, never interpolated into output. | | **Permission scope** | MINIMAL | Top-level: `contents: read`. Job-level: `contents: read` + `issues: write`. No `pull-requests: write` (PR comments use the Issues API). | | **Idempotency** | SAFE | Before creating an issue, searches for an existing open issue with the same title and `dependabot` label. Prevents duplicates on workflow re-runs. | | **Markdown injection** | LOW (theoretical) | `pr.title` is interpolated into issue title/body. Dependabot controls the title format ("Bump X from Y to Z") and package names are registry-constrained. Not exploitable without compromising Dependabot itself. | | **Denial of service** | LOW (theoretical) | Bounded by Dependabot's own rate limits (default 5 PRs/ecosystem/day) plus the idempotency guard. | | **Zizmor waivers** | JUSTIFIED | `dangerous-triggers`: no code checkout, API-only. `bot-conditions`: uses `user.login` not `github.actor`. Both include inline rationale comments. | | **check-pr-template.yml** | SAFE | `AUTHOR` is passed via `env:` (not `${{ }}` in shell), double-quoted in comparison. `user.login` is GitHub-constrained to alphanumeric + hyphens. | **Actions are SHA-pinned** with version comments: `step-security/harden-runner@9af8...` (v2.19.4) and `actions/github-script@60a0...` (v7.0.1). ## Testing - [x] QA'd all new/changed functionality manually Since this is a GitHub Actions workflow that triggers on Dependabot PR opens, it cannot be fully end-to-end tested without a real Dependabot PR. The following offline validations were performed: ### 1. YAML syntax validation ``` $ ruby -e "require 'yaml'; YAML.safe_load(File.read('.github/workflows/dependabot-qa-ticket.yml')); puts 'YAML: valid'" YAML: valid ``` ### 2. Verified hardcoded GraphQL IDs against the live GitHub API **Project board ID** (`PVT_kwDOBDAnic4A5q11`): ``` $ gh api graphql -f query='query { node(id: "PVT_kwDOBDAnic4A5q11") { ... on ProjectV2 { title number url } } }' -> title: ":help-qa", number: 85, url: "https://github.com/orgs/fleetdm/projects/85" ``` **Status field ID** (`PVTSSF_lADOBDAnic4A5q11zgubZ6Y`) and option ID (`f75ad846`): ``` $ gh api graphql -f query='query { node(id: "PVTSSF_lADOBDAnic4A5q11zgubZ6Y") { ... on ProjectV2SingleSelectField { name options { id name } } } }' -> field name: "Status", option f75ad846 = "Ready" ✅ ``` ### 3. Verified assignee and label exist ``` $ gh api users/AndreyKizimenko --jq '.login' -> AndreyKizimenko ✅ $ gh label list --search dependabot -> dependabot ✅ ``` ### 4. Branch filtering logic unit tested Extracted the JavaScript filter logic and ran it against 8 test cases covering single-package updates, grouped updates, and exclusions: ``` $ node -e "<test script>" PASS | dependabot/go_modules/golang.org/x/crypto-0.24.0 | match (Go single) PASS | dependabot-go_modules-google.golang.org-grpc-1.82.1 | match (Go grouped) PASS | dependabot/npm_and_yarn/typescript-5.5.0 | match (npm single) PASS | dependabot-npm_and_yarn-postcss-8.5.18 | match (npm grouped) PASS | dependabot/npm_and_yarn/website/next-14.0.0 | skip (website single) PASS | dependabot-npm_and_yarn-website-next-14.0.0 | skip (website grouped) PASS | dependabot/npm_and_yarn/fleet-slackbot/axios-1.7.0 | skip (slackbot single) PASS | dependabot/github_actions/actions/checkout-4 | skip (GitHub Actions) 8/8 passed ``` ### 5. Validated filter against real Dependabot PRs Checked the 20 most recent Dependabot PRs (`gh pr list --author 'app/dependabot' --state all --limit 20`) to confirm real branch names match the filter patterns. This revealed three bugs that were fixed: 1. **Go branch prefix was wrong**: Real branches use `dependabot/go_modules/`, not `dependabot/gomod/`. Fixed. 2. **Grouped updates use dashes**: Real grouped branches like `dependabot-go_modules-...` and `dependabot-npm_and_yarn-...` were not matched. Added dash-variant prefix checks and exclusions. 3. **Status label mismatch**: The constant was named `AWAITING_QA` but the option ID maps to "Ready" on the board (there is no "Awaiting QA" status). Renamed to `READY` and updated comments. ### 6. CI checks All CI checks pass (CodeQL, zizmor, dependency-review, build-binaries, publish). **Note:** The project board integration requires a `FLEET_GITHUB_TOKEN_PROJECTS` repo secret with Organization Projects read/write scope. Without it, the issue is still created but not added to the board (a warning is logged). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an automated GitHub Actions workflow for eligible Dependabot update pull requests. * Creates (and deduplicates) labeled QA issues with pull request details and checklist content, and posts the issue back to the pull request. * Optionally links new QA issues to project tracking with an “Awaiting QA” status when configured. * **Chores** * Hardened the automation workflow’s runner and permissions. * Updated safety-gate configuration to waive checks for the new Dependabot QA workflow. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
LeAnn
|
418fd60e9c |
Clarify "Not supported" on Hosts page by adding tooltip (#49301)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #39987 - Added tooltips to the "Agent," "Last restarted," and "Status" column headers on the Hosts page explaining which platforms are supported and why. - On the Host details page, vitals with a "Not supported" value are now hidden instead of shown. - Fixed the "Last restarted" vital showing on ChromeOS hosts, where it's not actually collected. - Updated the "Last opened" tooltip on the Host details Software table to explain why it's only supported for native macOS, Windows, and Linux apps and packages. - Remove cellProps.rows.length === 1 workaround (which suppresses the tooltip whenever the table has exactly one row) by adding the correct CSS which removes the tooltip overflowing if host table is only 1 row # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added/updated explanatory tooltips for Hosts table column headers (Agent, Last restarted, Status) with clearer supported-platform wording. - Clarified “Last opened” tooltip scope to native macOS, Windows, and Linux app/package entries. - **Bug Fixes** - Removed “Last restarted” from Host details for ChromeOS hosts when the value isn’t collected. - Prevented vitals rows from rendering when their values resolve to “Not supported,” and tightened “Last restarted” platform visibility. - Fixed tooltip overflow/positioning in the single-row Host software table case. - **Tests** - Updated and expanded vitals/header coverage to match the new display rules. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
5250936179 |
Consistent URL/email on-blur validation across forms (#40410 follow-up) (#49932)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40410 Follow-up to #48854, which added on-blur validation to the software vulnerability automations webhook. QA found three more forms with inconsistent validation, in two flavors: - **Validated only on save** (no on-blur feedback): Policies > Manage automations > Other workflows > Destination URL. - **Errored before any input** (validation fired on mount/enable): Settings > Users > Add/edit user > Email, and the host status webhook Destination URL (both global and fleet settings). This makes them consistent with the rest of the app: no error on open/enable → validate on blur → clear the field's error as the user edits → validate on submit. - `OtherWorkflowsModal` — added an on-blur handler for the Destination URL (guarded by the field's disabled condition). - `UserForm` — on-blur now validates only the blurred field (so blurring the autofocused Name no longer flags the empty Email/Password); submit validates all fields. - `GlobalHostStatusWebhook` — removed the `useEffect` that validated the moment the webhook was enabled; validation now runs on blur and submit. - `TeamSettings` (fleet host status webhook) — the Destination URL error is no longer surfaced on change/enable; it validates on blur and submit. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated (URL and email fields validate on blur and on submit; no errors are shown before the user interacts). ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved webhook destination URL validation across integrations, team settings, and workflow automation forms. * Validation messages now appear after leaving the URL field, rather than prematurely while enabling or editing. * Prevented saving or submitting forms with missing or invalid destination URLs. * Correctly clears validation errors once a valid URL is entered. * Improved user form validation so field-specific errors appear only for the field being reviewed, while submit continues to validate the full form. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Eric
|
8b8064e44d |
Website: update primary cta on homepage (#50071)
Changes: - Updated the primary cta on the homepage to "Try it yourself" <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Updated homepage calls to action to encourage visitors to try the product directly. * Added a “Try it yourself” option to the bottom CTA section. * Retained the “Get a demo” option as the final CTA button. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
ffc85a42ae |
Add Windows admin account config (#49863)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48720 Subtask of https://github.com/fleetdm/fleet/issues/43488 This PR only adds the Windows config, and doesn't mess with macOS configs. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added managed local account settings for Windows to app and team configuration, including GitOps support. * Exposed an explicit enabled/disabled toggle in configuration output and Fleet controls. * Added licensing and Windows MDM prerequisites for enabling the setting. * **Bug Fixes** * Managed local account enable/disable actions are now correctly persisted and declaratively applied. * Activity feed messages now display platform-specific (macOS vs Windows) wording. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel RodriguezandAllen Houchins
|
4b8a8435af |
Amend Docker Desktop patch policy SQL (#50041)
My workstation has Docker Desktop 4.84.0 (latest as of today) and was incorrectly failing the "macOS - Docker Desktop up to date" patch policy. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved Docker Desktop patch-status detection on macOS by excluding application paths containing `.back` anywhere in the path, avoiding incorrect patching of nested/backup bundles. - **Improvements** - Enhanced Docker Desktop install and uninstall cleanup to remove stale `Docker.app.back` artifacts and related staged in-progress update copies (including cleanup during upgrade timing). - **Tests** - Updated macOS Docker Desktop ingestion/patched check expectations to match the new `.back` path filtering behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Noah Talerman
|
c715d1c8e4 | 'Unpacking the why' issues live in inbox on product group boards (#50066) | ||
|
Noah Talerman
|
ef21534c3f |
Pushed stories: Notify customer success only if ~activation-blocker or ~customer promise (#49982)
- Why? https://fleetdm.slack.com/archives/C02A8BRABB5/p1785167309299099?thread_ts=1785160865.854089&cid=C02A8BRABB5 - Also move to one section in "Product groups" to de-duplicate |
||
|
Mike Thomas
|
3a81ede6cb |
Website: rename "Reporting" pricing feature for clarity (#50035)
## Summary Renames "Reporting" on /pricing to "Report on groups of devices" and updates the description for accuracy — it was easily confused with the "Reports" feature listed just above it. ## Related - fleetdm/confidential#16974 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for generating reports scoped to specific fleets of devices instead of the entire deployment. * Updated the pricing features table to reflect fleet-level reporting capabilities. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon KatzandLucas Manuel Rodriguez
|
24e64614aa |
Fix resource exhaustion in MSI metadata parser (#49739)
Resolves https://github.com/fleetdm/confidential/issues/16902 - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Reproduction **Attack vector:** An authenticated Fleet admin uploads a crafted `.msi` file via the software upload API. The server's MSI metadata parser (`pkg/file/msi.go` > `ExtractMSIMetadata` > `decodeStrings`) processes the file's `_StringPool` and `_StringData` streams during upload. A malicious `_StringPool` can claim arbitrarily large string sizes that trigger speculative memory allocation before the actual data is read. **Manual reproduction:** Wrote a standalone Go program that constructs the two raw byte streams the parser consumes (a 12-byte `_StringPool` claiming a 64 MB string, and an empty 0-byte `_StringData`), then measures heap allocation via `runtime.MemStats` before and after calling the vulnerable code path. **Before fix (vulnerable):** ``` Pool input size: 12 bytes StringData size: 0 bytes Claimed string size: 67108864 bytes (64 MB) Error returned: failed to read string data: EOF Heap allocated: 67117016 bytes (64.0 MB) Amplification: 12 input bytes -> 67117016 byte allocation (5593084x) ``` 12 bytes of pool input forced a 64 MB heap allocation via `buf.Grow()` before `io.CopyN` discovered there was no data to read. **After fix:** ``` Error returned: failed to read string data: EOF Heap allocated: 3072 bytes (3.0 KB) Memory amplification eliminated: true ``` Same input, 3 KB allocated instead of 64 MB. Without the speculative `buf.Grow()`, `io.CopyN` grows the buffer incrementally based on actual available data and immediately hits EOF. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Fixed a potential resource exhaustion issue when processing MSI metadata with unusually large string-size declarations. - MSI files with missing string data are now handled without excessive memory allocation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> |
||
|
Lucas Manuel Rodriguez
|
f674cf145c |
Update tools/telemetry (#50043)
Had to use `tools/telemetry` to smoke test https://github.com/fleetdm/fleet/pull/49957. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Enhancements** * Updated telemetry collection to use the standard OpenTelemetry Collector image. * Improved trace forwarding to Jaeger and added clearer diagnostic output. * Reworked span-to-metrics processing for more reliable telemetry metrics. * Updated telemetry endpoints and pipeline routing for improved connectivity. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
1f2ca668f8 |
Fix flaky test TestCheckExecRealBinary (#50057)
Fixes flaky test found in nightly run: https://github.com/fleetdm/fleet/actions/runs/30330273165. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Improved execution checks to tolerate transient busy-file errors during retries. * Strengthened validation for both healthy and corrupted binaries, ensuring tests report the intended result. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
RachelElysia
|
0585ab68d1 |
Website: Handle unexpected responses from Microsoft's compliance and Graph APIs (#50015)
## Issue #50013 ## Description The Microsoft compliance proxy controller (`website/api/controllers/microsoft-proxy/receive-redirect-from-microsoft.js`) called `JSON.parse` on response bodies from Microsoft's Partner Compliance and Graph APIs without checking for empty bodies or unexpected response shapes. When Microsoft returned an unexpected response — for example, a 2xx status with an empty body, which can happen on partial-setup tenant states or when API permissions on the enterprise app haven't been fully consented — the controller threw a raw `SyntaxError: Unexpected end of JSON input` that surfaced verbatim in the Fleet UI as the `setup_error` string, giving admins a Node.js stack trace instead of a useful message. Changes: - Added explicit empty-body checks before `JSON.parse` at both API-response parse sites, with a friendly `setup_error` message pointing at the likely causes (partial setup / missing API permissions). - On parse failure, expanded the diagnostic log to include response status code, body length, and a 200-char body snippet so we can diagnose future occurrences from server logs instead of asking admins to reproduce. - Added defensive checks on `parsedPoliciesResponse.value` and `parsedGroupResponse.value` before indexing — previously `parsedPoliciesResponse.value[0].Id` would throw `TypeError` if Microsoft returned a well-formed response missing the expected shape. **Note for reviewers:** The new `sails.log.warn` calls interpolate the runtime tenant ID (`informationAboutThisTenant.entraTenantId`) — same pattern as the existing log at line 209 that logs `fleetInstanceUrl`. Heroku logs will contain tenant IDs when these error paths fire, which is intentional so infra can grep by tenant when triaging. If we'd rather rely on request-correlation IDs and keep tenant IDs out of logs, happy to make that a follow-up. ## Screenrecording ## Testing - [ ] Sanity-checked locally by inducing an empty response body - [ ] Verified no changes to the happy-path flow - [ ] Verified existing setup_error strings that the Fleet UI checks for (admin-did-not-consent, missing-conditional-access-group) are unchanged <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved Microsoft integration setup handling when API responses are empty, invalid, or missing expected data. * Added clearer setup error messages for missing policies or the “Fleet conditional access” group. * Enhanced diagnostics to help identify response-related setup failures. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
95008e853d |
Freeze the macOS Yubikey Manager FMA (#50054)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A Pins the macOS Fleet-maintained app for Yubikey Manager at its current output version, `1.2.5`, by setting `"frozen": true` on the Homebrew input. - `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` — added `"frozen": true` The flag is read by the ingester into the manifest ([`homebrew/ingester.go`](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/ingesters/homebrew/ingester.go)) and then consumed in two places: - [`cmd/maintained-apps/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/main.go) skips overwriting `outputs/yubico-yubikey-manager/darwin.json` when the output file already exists, so the published version, installer URL, SHA256, and patch-policy query stop moving. - [`cmd/maintained-apps/validate/main.go`](https://github.com/fleetdm/fleet/blob/main/cmd/maintained-apps/validate/main.go) skips the app entirely during validation. `frozen` is tagged `json:"-"` on the manifest struct, so it does not appear in the output JSON — that file is intentionally left untouched by this PR. The Windows FMA (`inputs/winget/yubico-yubikey-manager.json`) is deliberately **not** frozen and continues to update. ## Note for reviewers While preparing this change I found that the `yubico-yubikey-manager` cask has been **removed from homebrew-cask**: ``` https://formulae.brew.sh/api/cask/yubico-yubikey-manager.json → 404 ``` The full cask list now contains only `pallotron-yubiswitch`, `yubico-authenticator`, and `yubihsm2-sdk`, and the token is not present in `inputs/homebrew/custom-tap/` either. This matches upstream: Yubico discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pins) in favor of Yubico Authenticator. **Freezing does not resolve that 404.** The ingester fetches cask metadata *before* the frozen flag is applied, so the scheduled "Update Fleet-maintained apps" workflow is still expected to fail for this app with: ``` panic: ingesting homebrew app: app not found in brew API ``` Fully resolving that would mean removing the macOS FMA, the way #50050 did for Nocturnal (input, output, `apps.json` entry, frontend icon + mapping, website PNG). This PR is scoped to the freeze only, per the request; the removal can be a follow-up if that is the direction we want. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually — confirmed the edited input still parses as JSON, and traced the `frozen` flag through the ingester into both the output-write skip and the validation skip. No automated tests were added; this is a single data-file flag with no new code paths. --------- Co-authored-by: Kitzy <kitzy@kitzy.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
|
210b716d20 |
Add guide: Speeding up your GitOps runs in Fleet (#46516)
## Summary - Adds a new guide article covering three strategies to reduce Fleet GitOps run times: path-based `include` references, Fleet-maintained apps (FMAs), and ETag-based conditional downloads for custom packages. - Aimed at Fleet users managing large deployments who want to optimize their CI/CD pipeline performance. ## Changes - New file: `articles/speeding-up-your-gitops-runs-in-fleet.md` --- Built for [Mike McNeil](https://fleetdm.slack.com/archives/C04K44UAPB9/p1780119889099049?thread_ts=1779840298.690529&cid=C04K44UAPB9) by [Kilo for Slack](https://kilo.ai/slack) --------- Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com> |
||
|
Jonathan Katz
|
b99e5564e9 |
GitOps schema generator and IDE integration (#49717)
### Summary: Generates a json schema for valid GitOps yaml files, to be used with [yaml-language-server](https://github.com/redhat-developer/yaml-language-server) for IDE integration. This PR includes the actual generated file, so it can be used without running the tool. All files are in `/tools/gitops-autto-complete`, so nothing else gets affected. #### What it adds: - Complete json schema that defines valid GitOps yaml files and can be integrated with [yaml-language-server](https://github.com/redhat-developer/yaml-language-server). - Auto-completion, error checking, type checking, descriptions. - Defines all keys for osquery options/flags (based on `server/fleet/agent_options_generated.go`). - Additional validation: required keys, strings that must be enclosed in quotation marks, path support. - Additional data: descriptions from code comments, notices for fields that don't reset if null or empty. #### Limitations: - Some structs and data are duplicated into the tool and will inevitebly mismatch over time, because the structs used for gitops are not sufficient for the schema generation: - Some fields use an interface/any type that so can't be used for the schema generation. - Some important details are not encoded in the type or struct tags for gitops fields at all. - Some details (like required fields) are encoded in the Validate() interface, but the IDE integration cannot run Go code. - Doesn't work with all yaml file types used for gitops (like a yaml file that specifies multiple software packages), only the default/fleet level files. This will require having a subsection of the schema for each type of file, and some way to detect what it actually is (maybe specifying the schema in the file itself). - Requires manual setup to integrate with IDE, it's not an easy to use extension currently. #### Dependencies: - `invopop/jsonschema` reflects Fleet's GitOps structs into the schema. - `santhosh-tekuri/jsonschema/v6` validates the test fixtures against that schema. - `ghodss/yaml` decodes the fixture YAML the way fleetctl does. https://github.com/user-attachments/assets/b6ffacd0-e602-41a2-b46a-7d10300c6ea5 ## Testing - [x] QA'd all new/changed functionality manually - I have been using and working on this for the past week so it's in a pretty good state, but some descriptions or keys are probably still missing. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added GitOps YAML auto-completion powered by a comprehensive JSON Schema. * Added validation for GitOps configuration structure, supported fields, data types, required combinations, and unknown keys. * Added support for external file references using `path` and `paths` in supported sections. * Added clearer guidance for deprecated fields and special field behaviors. * **Bug Fixes** * Improved detection of incorrectly typed values and invalid configuration shapes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra Kadamandmelpike
|
6e4b913a00 |
Add scripts and configuration profiles steps to downgrade guide (#50038)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA ## Description Improves the [downgrade guide](https://fleetdm.com/guides/downgrade-fleet) instead of changing product behavior, per product design's direction. The guide told users to move fleet-level **reports** and **policies** to the global level before downgrading, but omitted **scripts** and **configuration profiles**. Both are scoped per fleet and become inaccessible once fleets are deleted during the downgrade, so users lose them with no warning. Adds two sections — "Move all fleet-level scripts to Unassigned" and "Move all fleet-level configuration profiles to Unassigned" — placed before the fleet-deletion step so users move them while the fleets still exist. Unlike reports/policies (which move to the global level), scripts and configuration profiles have no global bucket — they live under a fleet or **Unassigned** — so the steps direct users to re-add them under **Unassigned**, which remains available on Fleet Free. > **Draft — pending wording pass.** The steps use "Unassigned" to match the label in the Controls dropdown. Flagging for @Mel for a wording review before this goes out. ## Testing - [ ] N/A — documentation only. # Checklist for submitter - [x] Documentation change only; no code, tests, or migrations. --------- Co-authored-by: melpike <79950145+melpike@users.noreply.github.com> |
