<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37580
This PR adds certificate removal support and status report retry logic
to the Android Fleet agent. It also includes overall code review
fixes/improvements.
I apologize for the large PR. I would prefer smaller PRs, but there was
no one to review during the break.
Key changes
1. Managed configuration interface change
- certificate_templates now expects status and operation fields per
certificate
2. Certificate removal flow
- New cleanupRemovedCertificates() handles certificates with
operation="remove"
- Removes keypair from device keystore and reports status to Fleet
server
- Handles orphaned certificates (tracked locally but no longer in MDM
config)
3. Status report retry logic
- New statuses: INSTALLED_UNREPORTED and REMOVED_UNREPORTED
- When install/removal succeeds but status report fails, state is
persisted for retry
- retryUnreportedStatuses() retries on next worker run (up to 10
attempts)
- After max retries, transitions to final status (gives up reporting but
cert action completed)
4. Dependency injection for testability
- Converted CertificateOrchestrator from Kotlin object to class with
constructor injection
- Created CertificateApiClient interface (implemented by ApiClient)
- Instance held in AgentApplication (Google's AppContainer pattern)
- Added FakeCertificateApiClient for tests with call tracking
5. Naming improvements
6. Worker retries
- Previously, worker would get permanently stuck after 5 retries. Now we
recover after 15 minutes. We can extend this later if needed for load
testing.
7. New UUID managed config field to trigger re-installs or re-removals
of certificates.
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced certificate management with an application-scoped
orchestrator, improved state tracking, automatic retries and backoff for
enrollments.
* UI/Debug: shows host certificate entries and status/operation details;
new localized strings for certificate template status and operation.
* Managed Configuration: accepts certificate status and operation
fields.
* **Bug Fixes**
* Enrollment now auto-runs only when needed; safer keystore handling and
more robust error paths.
* **Tests**
* Expanded and refactored tests and test utilities for certificate
workflows.
* **Chores**
* App version bumped to 1.0.1.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds logic to handle cases where the expected app version is more
specific than the version reported by osquery (e.g., expected '6.4.0' vs
reported '6.4'). This ensures more robust version matching when
validating installed applications.
This pull request improves the robustness and reliability of the script
and workflows that detect changed or new maintained apps in pull
requests. The main focus is on making the detection script pass
validation when the test is triggered but no new FMAs are detected.
**Script robustness and error handling:**
* The `.github/scripts/detect-new-fmas-in-pr.sh` script is updated to
always exit successfully (status 0) when no changes are detected, and
only exit with error (status 1) for critical failures like missing `jq`.
A new `safe_exit` function is introduced to standardize output and
ensure graceful exits.
[[1]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dR7-R11)
[[2]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dL21-R39)
* Improved error handling for missing files, empty variables, and failed
commands throughout the script, including handling cases where
`merge-base`, `git show`, or `jq` fail, and ensuring empty or missing
data does not cause the script to error out.
[[1]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dL32-R66)
[[2]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dR87-R108)
[[3]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dL75-R155)
**Workflow improvements:**
* The `test-fma-darwin-pr-only.yml` and `test-fma-windows-pr-only.yml`
workflows are updated to default to "no changes" if the detection step
fails or does not set the expected output, preventing false positives or
workflow failures.
[[1]](diffhunk://#diff-28b30c8601cb7662d59efbfbbcf800cae91455fd3d875627659dced8c1257a24L70-R72)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaL76-R78)
Relates to #37771.
No changes file as the #37772 changes file covers this.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
This pull request adds support for Notepad++ as a maintained application
in the system. It includes metadata, installation and uninstallation
scripts, version tracking, and a custom icon for the frontend. The main
changes are grouped into backend app definition and scripting,
versioning/output updates, and frontend UI enhancements.
**Backend: Notepad++ App Definition and Scripting**
- Added a new app definition for Notepad++ in `winget` format, including
metadata and references to install/uninstall scripts (`notepad++.json`).
- Implemented PowerShell scripts for silent installation and
uninstallation of Notepad++ using NSIS-compatible flags
(`notepad++_install.ps1`, `notepad++_uninstall.ps1`).
[[1]](diffhunk://#diff-dbe7f508350f3d388cd03eba8739d31334cd4e8a20545dec83d40612cbb51190R1-R29)
[[2]](diffhunk://#diff-cda39039b54d874cec215f12e62ca7183f790fefe54d79affcb6f4965a305dbbR1-R99)
**Versioning and Outputs**
- Added Notepad++ entry to the main output apps registry (`apps.json`),
enabling it to be recognized as a supported app.
- Created a Notepad++ versioned output file for Windows, including
detection query, installer URL, SHA256, and script references.
**Frontend: UI Enhancements**
- Added a custom Notepad++ SVG icon component for use in the software
page UI (`Notepad++.tsx`).
- Registered the Notepad++ icon in the icon index and mapped it for
display with the app name.
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR8)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR376)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37494
Manually verified fixes with osquery-perf.
Fixes:
Issue 1: Duplicate entry error when updating upgrade_code
Issue 2: Case sensitivity mismatch causes duplicate titles
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Improved software title matching to be case-insensitive, preventing
duplicate entries for the same software reported with different
capitalization.
* Enhanced upgrade code reconciliation logic to properly detect and
handle conflicts when multiple software entries share upgrade codes.
* **Tests**
* Added test coverage for case-insensitive software title matching and
upgrade code reconciliation scenarios.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36315
## Testing
- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
- @kc9wwh: No issues with building or enrolling devices. Got it behind
SSL cert and MDM working, but I would need a supervised device to test
further.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36309
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Sorry for having so many PRs on this one!
Thank you again for correcting my original formatting. I was looking
over this more and wanted to improve how it appears on the site for
better readability.
## Issue
Closes#34131
## Description
- Android tooltip was there just commented out
- Added in tooltip on ChromeOS
- Improve UX so user can click on save button easier if they opened
tooltip and won't have to hover off tooltip for it to close
## Screen recording of fixes
https://github.com/user-attachments/assets/29e81596-45b4-437c-a58f-0db7a0d013db
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
Resolves#35006.
See
https://github.com/fleetdm/fleet/issues/35006#issuecomment-3693239452.
Output when running the dirty check on `main`:
```
make desktop-app-tar-gz
go run ./tools/desktop macos
{"level":"info","command":"/Users/lucas/go/bin/go build -o Fleet Desktop.app/Contents/MacOS/fleet-desktop_amd64 -ldflags -X=main.version= ./orbit/cmd/desktop","time":"2025-12-30T08:38:20-03:00","message":"Build fleet-desktop executable amd64"}
{"level":"info","command":"/Users/lucas/go/bin/go build -o Fleet Desktop.app/Contents/MacOS/fleet-desktop_arm64 -ldflags -X=main.version= ./orbit/cmd/desktop","time":"2025-12-30T08:38:23-03:00","message":"Build fleet-desktop executable arm64"}
{"level":"info","output":"On branch test-branch-dirty\nUntracked files:\n (use \"git add <file>...\" to include in what will be committed)\n\tFleet Desktop.app/\n\nnothing added to commit but untracked files present (use \"git add\" to track)\n","time":"2025-12-30T08:38:26-03:00","message":"git status"}
Error: detected dirty executable: {Path:github.com/fleetdm/fleet/v4 Version:v4.43.5-0.20251230113816-9bae7b475999+dirty Sum: Replace:<nil>}
exit status 1
make: *** [desktop-app-tar-gz] Error 1
```
Output on this branch:
```
make desktop-app-tar-gz
go run ./tools/desktop macos
{"level":"info","command":"/Users/lucas/go/bin/go build -o Fleet Desktop.app/Contents/MacOS/fleet-desktop_amd64 -ldflags -X=main.version= ./orbit/cmd/desktop","time":"2025-12-30T08:39:43-03:00","message":"Build fleet-desktop executable amd64"}
{"level":"info","command":"/Users/lucas/go/bin/go build -o Fleet Desktop.app/Contents/MacOS/fleet-desktop_arm64 -ldflags -X=main.version= ./orbit/cmd/desktop","time":"2025-12-30T08:39:47-03:00","message":"Build fleet-desktop executable arm64"}
Generated desktop.app.tar.gz successfully.
```
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## fleetd/orbit/Fleet Desktop
- [X] Verified that fleetd runs on macOS
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
This pull request updates the product maturity assessment documentation
to reflect improved maturity levels for several device management
features across different platforms. The changes adjust the maturity
icons for features such as Android Work Profile enrollment, setup
experiences, Fleet-maintained apps, and device unenrollment, indicating
progress in their development roadmap.
**Maturity level updates:**
* Android and Windows/Linux enrollment:
* Updated the maturity level for "Work Profile enrollment (Android)"
from 🐣 to 🐥 starting Q1 2026 and onward, showing advancement in feature
readiness.
* Updated "Setup experience (Windows)" and "Setup experience (Linux)"
from 🐣 to 🐥 starting Q1 2026 and onward, reflecting improved onboarding
experiences.
* Application management:
* Changed "Fleet-maintained apps" from 🐣 to 🐥 starting Q1 2026 and
onward, indicating enhanced support for these apps.
* Device lifecycle management:
* Adjusted "Device unenrollment" from 🐥 to 🐣 for Current and Q1 2026,
then to 🐥 for subsequent quarters, clarifying the timeline for maturity
improvements in this capability.
Log lines were of the form:
```
73:level=debug ts=2025-12-31T16:07:22.404852Z msg="No %s certificates on %s hosts to renew" digicert=apple
```
(Found while investigating some oncall issues.)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36311
<img width="689" height="308" alt="image"
src="https://github.com/user-attachments/assets/07af848d-8946-4bc7-8662-1b0d662763e2"
/>
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] QA'd all new/changed functionality manually
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
- [x] Confirmed that the fix is not expected to adversely impact load
test results
---------
Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
Fixes#37771
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For #36619. Zed + Opus 4.5, prompt was just "fix
https://github.com/fleetdm/fleet/issues/36619"
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file as this isn't in a Fleet release.
## Testing
- [ ] QA'd all new/changed functionality manually
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Fix for unreleased bug:
- Enforce validation rules for certificate template names (e.g., length,
allowed characters).
- Implement duplicate name error handling in MySQL datastore.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37761
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Certificate template naming now enforced with validation rules: no
empty or whitespace-only names, character restrictions, and maximum
length limits.
* Validation occurs on both client and server sides.
* **Bug Fixes**
* Improved error handling and messaging for duplicate certificate
templates.
* Corrected certificate validation error message text.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#37192
Separating generic endpoint_utils middleware logic from domain-specific
business logic. New bounded contexts would share the generic logic and
implement their own domain-specific logic. The two approaches used in
this PR are:
- Use common `platform` types
- Use interfaces
In the next PR we will move `endpointer_utils`, `authzcheck` and
`ratelimit` into `platform` directory.
# Checklist for submitter
- [x] Added changes file
## Testing
- [x] Added/updated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Restructured internal error handling and context management to support
bounded context architecture.
* Improved error context collection and telemetry observability through
a provider-based mechanism.
* Decoupled licensing and authentication concerns into interfaces for
better modularity.
* **Chores**
* Updated internal package dependencies to align with new architectural
boundaries.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
