7dc802bcf952a073333d4934cf5611b34772792d
25975
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Steven Palmesano
|
7dc802bcf9 |
Add Fleet Agent Installer to restoring fleetd guide (#48991)
Not sure if we want to link to an unofficial app, but this solution may be easier for some users. |
||
|
Sam Pfluger
|
863a0dca53 | Comment out incorrect contact sources (#49095) | ||
|
George Karr
|
55c1783900 |
dibble: download seed installer fixtures at runtime instead of embedding (#48823)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — resolves high-severity code-scanning alerts in `tools/dibble` ## Problem The dibble seeder committed 14 installer fixtures under `tools/dibble/pkg/seed/data/installers/` and bundled them into the binary with `//go:embed`. The `.exe`/`.msi`/`.deb`/`.rpm` files tripped **8 high-severity "Binary-Artifacts" code-scanning alerts** on `main`. 11 of the 14 are byte-identical to fixtures already in `server/service/testdata/software-installers/`, but `go:embed` can't reference files outside the package (no `..`, no symlinks), so the copies couldn't simply point at the originals. ## Change Replace the embed with an on-demand fetch that runs **only when seeding software** (`SoftwareCustom`): - Fixtures are downloaded, **SHA-256 verified** against a pinned manifest, and cached under the user cache dir (`os.UserCacheDir()/dibble/installers`) so repeat runs stay offline. - Fixtures shared with Fleet's tests are pulled from `testdata` via `raw.githubusercontent.com` at a **pinned commit**; the 7-Zip and python-manager installers come from their **upstream URLs**. - No binaries remain committed in this module. Checksums for all sources were verified to match the previously-committed bytes exactly, and the download + verify + cache path was smoke-tested locally. ## Tradeoff `dibble software custom` now requires network access on first use (downloads are cached afterward). This only affects the software-seeding path; all other seeders are unchanged. # Checklist for submitter - [x] Input data is properly validated (downloaded fixtures are rejected unless their SHA-256 matches the pinned manifest), `SELECT *` is avoided, SQL injection is prevented, JS inline code is prevented, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops (HTTP client uses a 2-minute timeout; no retry loop). ## Testing - [x] QA'd all new/changed functionality manually (verified download, checksum verification, and cache reuse for testdata- and upstream-hosted fixtures) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Installer fixtures are now downloaded on demand and cached locally for faster repeat runs. * Expanded installer fixture coverage, including additional Windows-signed installers for improved platform support. * **Bug Fixes** * Added SHA-256 integrity verification for cached and newly downloaded installer fixtures. * Improved reliability and safety by re-downloading when cache contents don’t match and by writing downloads atomically to avoid partial files. * **Chores** * Updated indirect dependency versions related to OpenTelemetry and `golang.org/x/*`. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
853bb6abfe |
Add mdmclient log query to troubleshooting guide (#48959)
|
||
|
|
4a219a2c72 |
Update Fleet-maintained apps (#49055)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated maintained app entries so users get the latest releases for AltTab, Badgeify, BetterTouchTool, EM Client, Mendeley Reference Manager, Setapp, Signal, Tuple, Webex, WeChat, WhatsApp, and Worksheet Crafter. * Refreshed version checks and download details to match the newest available installers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com> |
||
|
Noah Talerman
|
4defd14352 |
Update product maturity assessment (#49042)
- macOS and iOS/iPadOS 🦆 complete and Android 🐥 viable by end of Q3 (aligns w/ https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?disco=AAAB-vryWHM) - Linux is already 🦆 - macOS 🦢 loveable in Q4. Context: |
||
|
Sam Pfluger
|
8d3755fad1 |
2026 07 09 sam (#49075)
Closes https://github.com/fleetdm/confidential/issues/16219 |
||
|
Allen Houchins
|
6c18e89e68 |
Revise workshop rollout details and remove redundancy (#49076)
Updated the timeline for core workshops and electives, and removed the redundant note about certification opening in August. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) |
||
|
Allen Houchins
|
318c85f696 |
Add article: Make your cross-platform skills official with Fleet certification (#48945)
# Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Manually reviewed the article for style, formatting, and accuracy ## Details Adds a new article announcing Fleet's first certification program, launching in August: - Three platform credentials: Fleet-certified Apple admin, Fleet-certified Windows admin, and Fleet-certified Linux admin - Two GitOps credentials: Fleet GitOps level 1 and level 2 - The Fleet expert capstone exam, gated on holding all five core credentials - Self-paced electives rolling out through the year (Fleet on-prem/self-managed, Developing with the Fleet API) Formatted per Fleet's article structure (dek, key takeaways, CTA button, closing CTA) and content style guidelines. **Before merging:** - [x] Set `publishedOn` date in the article's meta tags (currently blank) - [x] Add a cover image if one is available for this launch - [x] Verify program details (credential names, August timing, elective list) are final |
||
|
Juan Fernandez
|
73b4bc8e6a |
Policy status automation activities bug fixes
Relates to #38670 Several fixes to the policy details page's "Automation runs" feed and the labels modal: - Empty state: when activity expiry is enabled, show the configured retention window ("Automation history is retained for N days"); otherwise show a generic "Automation history will appear here". - Details column focus: replace the deprecated `text-icon` button variant with `inverse`, and inset the keyboard-focus outline so it no longer hugs the cell text or bleed into adjacent rows. - Labels modal: render policy labels as react-router links (real anchors) instead of buttons, so they can be opened in a new tab via middle-click or cmd/ctrl-click. - Status filtering: make the installed_software and VPP (installed_app_store_app) error/success conditions null-safe complements of the displayed status, so every row shown under "All" appears under exactly one of the status filters. Derive the VPP outcome from the historical details.status (activities are terminal-only) rather than the live verification columns, which mutate over the install's lifetime. - Install output: surface the pre-install query output and post-install script output as separate sections in the activity details modal, and fall back to them in the grid preview when the install-script output is empty (e.g. a pre-install-stage failure). - Add a datastore test asserting the status filters partition the feed (all = error ⊎ success) for every activity type. |
||
|
|
a33481653d |
macos password sync feature branch (#47422)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45524 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple Platform SSO (PSSO) for macOS with device registration, sign-in, and public discovery (JWKS + Apple app-site association) protected by single-use nonces. * Added Apple account provisioning (Platform SSO password sync) configuration with masked client-secret handling and GitOps support. * Added a host-scoped PSSO device registration token variable for Apple MDM profile generation. * **Bug Fixes** * Fixed macOS packaging to correctly build, embed, and sign the Platform SSO extension. * Resetting device Apple MDM data now also clears stored PSSO enrollment records. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Magnus Jensen <magnus@fleetdm.com> |
||
|
|
6d2167193e |
Apple MDM: require server URL confirmation before turning off (#48595)
Adds a text input to the "Turn off MDM" confirmation modal that requires the admin to type the Fleet server URL before the Turn off button becomes enabled. Prevents accidental MDM deactivation on the wrong Fleet instance. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42073 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved the Apple MDM disable flow by requiring the correct Fleet URL before confirming the action. * The disable confirmation modal now appears only when the needed configuration is available, reducing the chance of errors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai> |
||
|
Lucas Manuel Rodriguez
|
21c024313a |
Upgrade nfpm package in fleetctl (#48961)
Resolves #48954. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually Tested a package generated with new `fleetctl` on Fedora 43, Ubuntu 25.04, and Omarchy. ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary of changes * **Bug Fixes** * Improved Linux RPM packaging consistency, including more reliable output filename normalization and correct platform metadata. * Ensured RPM metadata extraction stays aligned with the updated packaging flow. * **Tests** * Added coverage for RPM filename normalization edge cases. * Updated a CPE rule validation test expectation to match the new error-string format. * **Chores** * Upgraded packaging tooling and refreshed Go dependencies. * **Security** * Removed a previously ignored CVE entry from vulnerability scan ignore settings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Eric
|
5cefa9d5bb |
Website: use git to get lastModifiedAt timestamps for markdown and yaml files, show last updated date on article pages (#48918)
Changes: - Updated the "Test Fleet website" and "Deploy Fleet website" workflows to include the full git history when checking out the repo. - Updated the website's build-static-content script to use git to build lastModifiedAt timestamps for Markdown and YAML files on the website. - Updated the article template page and article category pages to show a timestamp of when an article's Markdown file was last changed, if it was updated >3 days after it was published. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Articles now conditionally display an **Updated** timestamp when they were substantially modified after publication. * The **Updated** indicator is shown on both article listing pages and individual article pages (including mobile/desktop headers). * **Bug Fixes** * Timestamp rendering is now more consistent, helping readers distinguish original publish dates from later edits. * **Styling** * Added styling to support the new “updated timestamp” label and timestamp formatting within article cards. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
4f8677de3c |
Fix fleet_maintained_app_slug being allowed in a dynamic policy (#49034)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Changes: - Adds an explicit error message when `fleet_maintained_app_slug` is set for a dynamic policy in a gitops file (fleetctl gitops client) - Adds the same error message if it's done through the API only - Checks if policy type == patch in case `install_software: true` is set to prevent an irrelevant "[!] fleet-maintained app slug without software title ID:" warning # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Tightened policy validation so `fleet_maintained_app_slug` is only accepted for patch policies. * Dynamic or unspecified policy types now return a clear validation error when this field is set. * Improved GitOps policy handling so software details are only applied in supported cases. * **Tests** * Added coverage for accepted and rejected policy combinations involving `fleet_maintained_app_slug`. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
374aa7e612 |
LUKS key escrow validate against any keyslot (#48815)
**Related issue:** Resolves #46227 |
||
|
Andrey Kizimenko
|
d4a6ec3b03 |
Update Release QA template for current product groups (#49047)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA — Release QA process/template maintenance # Description Updates the Release QA issue template (`.github/ISSUE_TEMPLATE/release-qa.md`) to reflect the current product groups and to tighten the smoke tests. Changes: - **Assignees:** added `marcusallen97` and `thisisjoegrant`. - **Labels:** updated to the current product groups — `#g-mdm` → `#g-apple-at-work`, `#g-software` → `#g-auto-patching`, and added `#g-power-to-pc`. Reordered to match the section order in the template. - **Android:** moved the Android checks (Progress checkbox + test steps) from **Security & Compliance** to **Power to PC**, which now owns them. - **Fleet Free coverage:** added `Android MDM` to Power to PC's "works normally on Free" list (where Android now lives), and scoped Apple at Work's entry from "Apple and Android MDM" to "Apple MDM". - **Removed the UI / UX check from all product groups.** It was too abstract to be actionable — smoke tests should focus on specific action items, and there was no clean way to integrate it as a concrete step. We rely on QA noticing visual issues as we go through the specific checks, so a separate catch-all check added no value and just took up space. # Checklist for submitter - [ ] QA'd all new/changed functionality manually <sub>This is a change to the Release QA GitHub issue template only (markdown). No code, migrations, configuration, or fleetd/orbit changes — the remaining template checklist sections do not apply.</sub> |
||
|
Eric
|
b2f545b11b |
Move website workflows under the workflows folder in CODEOWNERS (#48966)
Changes: - Moved the website-related GitHub workflows below the `/.github/workflows/` folder in CODEOWNERS. The last matching rule is applied, so changes to the website workflows currently require a review from one of the folder codeowners. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Reorganized review rules for workflow-related changes to make the policy easier to find and maintain. * No product behavior or user-facing functionality changed. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
a15d58e927 |
SAAD: Asset CRUD API (#49011)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48568 partly # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. (Will add in followup) - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Apple DDM asset management endpoints: list, get, download (raw JSON), create, and delete. * Implemented datastore-backed Apple DDM asset CRUD with team-scoped and global access, plus configurable upload size limits. * Added strict asset JSON validation (including required fields, URI checks, and secret expansion rules). * **Bug Fixes** * Improved authorization handling by returning not-found responses for out-of-scope read/download/delete to avoid asset discovery. * Added clearer conflict and linked-profile error mapping for create/delete failures. * **Tests** * Added comprehensive authorization and validation test coverage for Apple DDM assets and policy behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
56763d13c1 |
Move fleet-mcp from tools/ to cmd/ (#49044)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #43544. Moves `fleet-mcp` from `tools/fleet-mcp/` to `cmd/fleet-mcp/`. It is becoming a production server used by customers, so it now lives under `cmd/` alongside the other Fleet binaries. Per the module strategy chosen for this move, it **remains a standalone Go module** (keeps its own `go.mod`/`go.sum` and isolated deps such as `mark3labs/mcp-go`, `logrus`, `gorilla/websocket`, `godotenv`) — the root `github.com/fleetdm/fleet/v4` module is unchanged. ### What changed - `git mv tools/fleet-mcp/ → cmd/fleet-mcp/` (history preserved as renames). - Updated all path references: - Root `Makefile` `update-go` module list. - `.github/workflows/test-fleet-mcp.yml` — trigger paths, `go-version-file`, `working-directory`. - `.github/dependabot.yml` — gomod directory. - `cmd/fleet-mcp/render.yaml` — `rootDir`. - `cmd/fleet-mcp/README.md`, `Makefile`, `schema.go` — path comments/links. - `articles/fleet-mcp.md` — README link. - Removed the `fleet-mcp/` row from `tools/README.md`. ### Follow-up (not in this PR) - The Render service's Blueprint file path must be updated from `tools/fleet-mcp/render.yaml` to `cmd/fleet-mcp/render.yaml` in the Render dashboard. ## Testing - `go build .` in `cmd/fleet-mcp` — OK - `go test -race -count=1 ./...` — `ok fleet-mcp` - [x] QA'd all new/changed functionality manually |
||
|
Allen Houchins
|
0fda179e92 |
Fix osascript is-running checks across 15 FMA custom scripts (#49033)
**Related issue:** Resolves #48638, resolves #48225 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] QA'd all new/changed functionality manually ## Details Follow-up to #49030 (GitHub Desktop, #48639), which fixed one instance of this bug. An audit for the raw pattern found **15 more custom FMA scripts** carrying the same broken check that #42951 fixed in the generated helpers: gating on the **exit status** of `osascript -e 'application id "..." is running'`. osascript exits 0 whether it prints `true` or `false`, so a fully-quit app is misclassified as running whenever the bundle id resolves. Impact by script: - **Relaunch after every patch (user-visible — the filed bugs):** `zoom_install.sh` (#48638) and `google_chrome_install.sh` (#48225) set `*_WAS_RUNNING=true` unconditionally and reopen the app after `installer`, even when the user had nothing open. - **Broken check, no relaunch step (needless quit attempts, misleading logs):** install scripts for 1Password, Adobe CC, ExpressVPN, Grammarly, LogiTune, Microsoft Edge, P4V, Slack; uninstall scripts for Adobe CC, CleanMyMac, GPG Suite, Microsoft Word, P4V. Note `tell application id X to quit` against a not-running app can briefly launch it to deliver the quit event, so these aren't purely cosmetic either. The fix is the same one-line pattern everywhere, style-matched to each script (`local`/POSIX `[ ]`/top-level variants preserved): capture osascript output and compare it to `"true"`. No other behavior changed — this PR deliberately does not touch relaunch methods or console-user guards. Regenerated the 13 affected darwin manifests with `go run ./cmd/maintained-apps -slug <slug>`. All diffs are script-ref-only except `google-chrome/darwin.json`, which also picked up the legitimate upstream 150.0.7871.115 version bump during regeneration (the daily ingest cron would publish it tonight regardless). An unrelated `google-chrome/windows.json` winget bump was excluded. ## Manual QA Reproduced the bug live on macOS with the shipped Zoom script logic (ref `05e6a85c`) against a **fully-quit** Zoom (verified `is running` = `false`, zero processes): the exit-status check set `ZOOM_WAS_RUNNING=true` and the relaunch step launched Zoom — exactly the customer report, no background helpers needed. The corrected output-compare check on the same state correctly reported not running. Equivalent verification for the shared-helper variant was done against GitHub Desktop in #49030 (both the fully-quit and running→quit→relaunch paths). Verified for all 16 scripts: `bash -n` passes, no `if [!] osascript -e "application id ...` pattern remains anywhere under `inputs/homebrew/scripts/`, and every regenerated manifest ref carries the output-compare check. Remaining by-design behavior (unchanged): an app running with a dock icon but no visible window is genuinely running and will still be quit and relaunched; window-aware relaunching would be a separate enhancement. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved app detection before install/uninstall steps, reducing unnecessary quit attempts and making setup flows more reliable. * Updated several app install/uninstall workflows to better handle running apps, cleanup, and restart behavior. * Refined a few app package definitions to point to newer supported versions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
56a3c75155 | Fix macOS software titles mis-named from embedded helper bundles (#44199) (#47831) | ||
|
Magnus Jensen
|
bfc986df7e |
update missed ABM references (#49027)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48314 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated Apple Business Manager references across admin and host device flows to use the shorter “AB” wording. * Improved user-facing copy in enrollment, status, tooltip, and error messages for consistency. * Adjusted the automatic enrollment button label to match the updated terminology. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fleet-releaseandallenhouchins
|
232c433214 |
Update Fleet-maintained apps (#49032)
Automated ingestion of latest Fleet-maintained app data. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Refreshed installer and update metadata for many maintained apps on macOS and Windows. * Improved version checks so upgrade detection matches the latest releases. * Updated download links and verification data to point to current installers. * Added support for newer app builds across browsers, utilities, developer tools, and collaboration apps. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com> |
||
|
Allen Houchins
|
598f425b66 |
Sync GitHub Desktop FMA install script with current quit/relaunch helpers (#49030)
**Related issue:** Resolves #48639 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] QA'd all new/changed functionality manually ## Details The GitHub Desktop FMA uses a custom install script (`ee/maintained-apps/inputs/homebrew/scripts/github-desktop-install.sh`) that embeds its own copies of `quit_and_track_application` and `relaunch_application`. Those copies were frozen before two fixes landed in the generated helpers in `ee/maintained-apps/ingesters/homebrew/scripts.go`: - #42951 — check osascript **output** instead of exit status. `osascript -e '... is running'` exits 0 whether it prints `true` or `false`, so the stale `if ! osascript ...` guard never fired. The app was marked `APP_WAS_RUNNING=1` on **every** install with a GUI user logged in and relaunched after every patch — even from a fully-quit state. This is the root cause of #48639. - #43842 — relaunch via `launchctl asuser ... open -b` as the console user instead of `osascript ... to activate` (which is unreliable from a root context), plus the updated empty/root/loginwindow console-user guards. This PR replaces both embedded functions with the current scripts.go constants (verified byte-for-byte identical) and regenerates `ee/maintained-apps/outputs/github/darwin.json` via `go run ./cmd/maintained-apps -slug github`. The manifest diff is script-ref-only (`98ab6ed8` → `c91ea2b5`); version and uninstall script are unchanged. The other five custom scripts (Docker Desktop, OpenVPN Connect, Webex, Max, Pd) already carry the updated helpers — GitHub Desktop was the only one missed. ## Manual QA Tested the updated `quit_and_track_application` / `relaunch_application` functions on macOS against GitHub Desktop itself (`com.github.GitHubClient`): - **Fully quit (the bug scenario):** verified `is running` returns `false` and zero `GitHub Desktop.app` processes. Fixed functions set `APP_WAS_RUNNING=0` and the app stays closed. Running the old shipped check (`if ! osascript ...`) against the same state misclassifies the app as running (osascript exits 0 with output `false`) and would have relaunched it. - **Running:** quit succeeds, `APP_WAS_RUNNING=1`, app relaunches successfully afterward. - `bash -n` passes on the updated script. Note: hosts where the FMA was already added keep the baked `98ab6ed8` script until their instance refreshes the manifest. The by-design behavior "app running with dock icon but no visible window → relaunched with a window" is unchanged; window-aware relaunching would be a separate enhancement. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved GitHub Desktop installation behavior on macOS so the app is more reliably closed and reopened after install. * Better handles login/session edge cases, helping ensure the app relaunches in the correct user’s desktop session. * Reduces failed or missed relaunches when the installer is run with elevated permissions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kilo-code-bot[bot]andkiloconnect[bot]
|
7130499104 |
Add 2-business-day SLA for CEO interviews (#49031)
This change adds a 2-business-day SLA for scheduling CEO interviews in the hiring process. **What's changed:** In `handbook/ceo/README.md`, under the "Schedule CEO interview" section, added language establishing that: - The CEO interview must be scheduled within 2 business days of receiving the scheduling request. - If the CEO's schedule is blocking a hire for more than 2 business days, the EA should add a "DISCUSS" item to the CEO roundup doc to resolve the scheduling blocker. This ensures hiring momentum is maintained and provides a clear escalation path when CEO availability becomes a bottleneck. Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> |
||
|
Lucas Manuel Rodriguez
|
703dcf0b4f |
Update go to 1.26.5 (#48993)
Resolves #48988. I ran `make update-go version=1.26.5`. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] QA'd all new/changed functionality manually Fleet: <img width="301" height="102" alt="Screenshot 2026-07-09 at 8 41 49 AM" src="https://github.com/user-attachments/assets/baf76ce7-6192-4506-a9db-52f5318939ee" /> fleetctl: ``` fleetctl --version fleetctl - version orbit-v1.57.0-402-ge3d0c005dc branch: 48988-update-go-1.26.5 revision: e3d0c005dc6698c024ad47a124c99e4f264855a0 build date: 2026-07-09 build user: lucas go version: go1.26.5 ``` Also verified orbit in Linux: <img width="582" height="121" alt="Screenshot 2026-07-09 at 8 51 55 AM" src="https://github.com/user-attachments/assets/65672676-8010-45a1-8c28-9f9959e72134" /> ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the project and all included tooling modules to Go 1.26.5. * Refreshed build images used by desktop Linux, load testing, and related utilities to the newer Go toolchain. * Updated change log entries to reflect the Go version bump. * **Bug Fixes** * Improved the automation that refreshes Go-pinned Docker image references to resolve and apply correct digests, helping prevent broken build images. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
9bc698d23d | Add note that Windows supports 1 proxied cert per profile (#49010) | ||
|
George Karr
|
69fa5ca435 |
Fix VPP/in-house app install on manual-profile BYOD iOS hosts (#48879) (#48916)
**Related issue:** Resolves #48879 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (parameterized queries only). - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes — N/A, no endpoint/path changes. ## Summary Installing an App Store (VPP) or in-house app on an iOS/iPadOS host enrolled via the **manual (profile-driven) BYOD** enrollment profile failed: Fleet routed the install down the **Account-Driven User Enrollment (user-scoped)** licensing path, tried to look up/register a VPP user keyed on the host's Managed Apple ID, and returned _"Fleet hasn't received a Managed Apple ID for this host yet."_ — which never resolves, because a device-channel host has no Managed Apple ID. ### Root cause The device-vs-user licensing decision keyed off `host_mdm.is_personal_enrollment`. That flag is set for **both**: - **Account-Driven User Enrollment** — user channel, backed by a Managed Apple ID → user-scoped licensing (correct). - **Manual-profile BYOD** — device channel, no Managed Apple ID → must install **device-scoped**, exactly like company-owned manual enrollment. ### Fix Branch on the actual enrollment **channel** — the presence of a user-channel `nano_enrollments` row (`type='User' AND enabled=1`), the same signal the MDM profile reconcile cron already uses (`GetNanoMDMUserEnrollment`). This is timing-robust: the user nano-enrollment exists from enrollment time, whereas the Managed Apple ID only arrives minutes later via `TokenUpdate` (so `managed_apple_id` emptiness is deliberately **not** used as the discriminator). Three sites updated: | File | Change | |---|---| | `ee/server/service/software_installers.go` | `InstallVPPAppPostValidation` routes on `GetNanoMDMUserEnrollment` instead of `is_personal_enrollment` | | `server/datastore/mysql/vpp.go` | InstallApplication builder derives `IsUserEnrollment` (ChangeManagementState omission) from a user-channel `nano_enrollments` row | | `server/datastore/mysql/activities.go` | same, for in-house `.ipa` installs | ## Testing - [x] Added/updated automated tests: - `ee/server/service`: `TestInstallVPPAppPostValidation_AssociateAssetsRouting` — added a regression subtest asserting manual-profile BYOD (personal flag set, device channel) routes via `serialNumbers` and performs **no** VPP user lookup; repointed routing to the user-channel signal. - `server/datastore/mysql`: new `TestVPP/VPPInstallEnrollmentChannelRouting` — manual BYOD includes `ChangeManagementState` despite `is_personal_enrollment=1`; account-driven User Enrollment omits it. - [x] Automated tests simulate multiple hosts and test for host isolation (two distinct hosts, device- vs user-channel). - [ ] QA'd all new/changed functionality manually — pending (draft). For unreleased bug fixes in a release candidate: - [x] Confirmed that the fix is not expected to adversely impact load test results (adds one indexed lookup per install enqueue; removes a `host_mdm` join). ## Database migrations - N/A — no schema changes. The fix reads existing `nano_enrollments` rows. ## fleetd/orbit/Fleet Desktop - N/A <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed app installation for manually enrolled BYOD iPhone and iPad devices so App Store and in-house apps install correctly on the device. * Improved enrollment handling so device-scoped installs no longer fail when a device is marked personal in one place but uses device-channel enrollment. * Account-Driven User Enrollment continues to use user-scoped licensing and installs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Steven Palmesano
|
9dd76b5b96 |
Dedupe connect guide (#48990)
While reviewing this guide with `customer-cisneros-a`, we noticed a duplicated section. It also looks like there was a link that needed an update. |
||
|
Steven Palmesano
|
89e653ce2b |
Update Windows MDM end user experience language (#47635)
**Related issue:** Resolves #43379 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated Windows MDM enrollment option labels from “Automatic/Manual” to “Fleet agent-driven/End user-driven” and refreshed the related on-page description/help text. * Adjusted radio help-text spacing and added styling for label formatting on the Windows MDM settings page. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gray Williams
|
91000c1aab |
Add instructions for iOS sysdiagnose (#48930)
This adds a section with instructions on collecting and exporting the sysdiagnose logs from an iOS or iPadOS device without having to use Feedback Assistant, or Apple Configurator. Closes #48929 |
||
|
Victor Lyuboslavsky
|
e1094096af |
Surface proxied Windows SCEP certificate failures (#45550) (#48842)
Windows configuration profiles that Fleet proxies SCEP for previously reported "verified" as soon as the device acknowledged the SyncML Exec command, even when the asynchronous SCEP exchange later failed and no certificate was ever issued. - Proxied SCEP profiles (custom SCEP proxy, NDES) now move to "verifying" on the device ACK and only reach "verified" once Fleet observes the matching certificate on the host, keyed by the renewal-ID marker (fleet-<profile_uuid>) in the certificate CN/OU. - When Fleet's SCEP proxy observes an upstream CA error during PKIOperation, it marks the profile "failed" with a detail naming the operation and upstream status. If the device's own retry later succeeds, the observed certificate flips the profile to "verified". - Unconfirmed profiles stay "verifying" (offline host, agent that cannot enumerate certificates, empty store, or a user-scoped profile before the user logs in); absence is never treated as failure. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45550 Demo: https://www.youtube.com/watch?v=WNGuFdeBmzA Docs: https://github.com/fleetdm/fleet/pull/48933/changes # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added Windows SCEP failure tracking with clearer, categorized detail when upstream operations fail. * Added reconciliation backstops for “stuck” proxied SCEP profiles, including automatic recovery to verified when the expected certificate is observed. * **Bug Fixes** * Prevented proxied Windows SCEP installs from being marked “verified” until matching certificate evidence arrives. * Improved classification and persistence behavior for timeouts, connection/DNS issues, and HTTP error responses without disturbing existing retry state. * **Tests** * Expanded Windows SCEP scenarios to cover reconciliation, skipping conditions, and error classification. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
00d7f4b63a |
Apply house article format to 17 articles (#48992)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA ## Summary Applies Fleet's article-formatting house style to 17 articles. Content/prose only — no code, config, or schema changes. Each article now follows the house structure: sentence-case `# Title`, italic dek, **Key takeaways** (5–6 outcome-first bullets placed above the fold), a post-takeaways CTA button, a tightened two-paragraph intro, a terminology sweep (customer-facing "osquery" → "Fleet's agent"/"fleetd", sentence-case headings), de-duplication, and format trimming. Detection-pack SQL, IOC/reference tables, and code blocks were left intact. All `<meta>` tags (including `category` values) and author fields were preserved unchanged. Articles updated: - shadow-ai-is-already-on-your-fleet - clickfix-copy-paste-fleet-detection-pack - shadow-earth-053-fleet-detection-pack - microsoft-is-rotating-every-windows-pcs-secure-boot-keys - pre-cve-threat-response-with-fleet - managing-linux-desktops-with-gitops - patch-management-and-vulnerability-reporting-for-linux-desktops - managing-linux-desktop-drift - linux-desktop-inventory-and-visibility - zero-trust-endpoint-security - natural-language-endpoint-security-fleet-mcp - detecting-the-mini-shai-hulud-npm-supply-chain-worm-with-fleet - security-compliance-automation - gitops-for-device-management - endpoint-management-mixed-platform - enterprise-device-management-2026 - what-is-device-attestation ## Claims flagged for human review before publishing **Content issues to reconcile:** - `detecting-the-mini-shai-hulud`: internal number conflict — intro/IOC say "175 additional packages", SQL section says "133 additional packages across 322 versions". Left as-is; pick one. - `linux-desktop-inventory-and-visibility`: "IdP group" was removed as a label type (couldn't confirm). Fleet does support IdP/SSO-group labels — likely should be restored. - `shadow-earth-053`: an ambiguous "17 validated queries" count was removed (15 numbered queries, some with two statements). Re-add a number if desired. **Claims softened for honesty (revert only if the stronger version can be backed):** - `managing-linux-desktops-with-gitops`: two absolute "only MDM/only platform with native GitOps" claims softened. - `gitops-for-device-management`: unverifiable "up to three retry attempts" number dropped; confirm CIS policies are Premium-gated. - `endpoint-management-mixed-platform`: "enforces OS updates across every supported platform" → "major platforms" (excludes Linux/ChromeOS); confirm Entra conditional-access "macOS and Windows" scope. **Specifics to confirm against fleetdm.com/tables or docs:** - `shadow-ai`: `mcp_listening_servers` table, `vscode_edition` column, MCP-client support list. - `clickfix`: agent-option flags, `powershell_events.cosine_similarity`, `es_process_events` columns, XProtect Remediator min macOS version. - `shadow-earth-053`: schema notes and author-hosted download links. - `microsoft-secure-boot-keys`: Microsoft cert-expiry dates / Event IDs (author-supplied). - `natural-language-endpoint-security-fleet-mcp`: fleet-mcp tool inventory (third-party repo); CTA points to the external `github.com/karmine05/fleet-mcp`. # Checklist for submitter - [x] No user-visible product changes; content/articles only (no `changes/` file required). - [x] QA'd rendered structure: each article has one `# Title`, dek, single Key takeaways section, and one CTA button; code blocks and tables preserved. |
||
|
Allen Houchins
|
cacd7308af |
Add missing FMA icons for software catalog (#48995)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA ## Summary Several Fleet-maintained apps were showing the generic fallback icon on the [fleetdm.com software catalog](https://fleetdm.com/software-catalog). The website resolves icons by slug (`app-icon-<slug>-60x60@2x.png`) with no reuse map, so each app needs its own PNG file — and these were missing. - **Amazon Corretto 11 / 17 / 8 / JRE 8** — added website PNGs reusing the shared Java "Duke" logo. (Already reuse `AmazonCorretto21` via the frontend icon map, so no frontend change.) - **AWS Session Manager Plugin** — added website PNG reusing the AWS CLI icon. (Already reuses `AwsCli` via the frontend map.) - **Amazon Redshift ODBC Driver** — had no icon on either surface. Added a new frontend icon component + map entry (official AWS Redshift icon) and the website PNG. Icons generated via `tools/software/icons/generate-icons.sh`. The duplicate-PNG-per-slug approach matches the existing catalog convention (e.g. `postgresql-15/16/17/18`, `python-3.13/3.14`, `azul-zulu-25-jdk/jre`). # Checklist for submitter - [ ] QA'd all new/changed functionality manually |
||
|
RachelElysia
|
7cb7a162b0 | Fleet UI: Policy details page labels/automations use TruncatedTextList (#48977) | ||
|
Victor Lyuboslavsky
|
0a3d73a732 |
Updated osquery perf for #45550 (#48935)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45550 # Checklist for submitter - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced Windows MDM SCEP certificate simulation to track issued certificate specs per host during check-ins. * **Bug Fixes** * Certificate data generation is now stably ordered and consistent across refreshes. * SCEP certificate processing now ignores failed installs (no certificate) and records only valid issued cert details. * **Testing** * A small subset of simulated agents may withhold one SCEP certificate to exercise verification edge cases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kitzy
|
087e67644d |
Fix misspelled bootstrap-package article filename (#48833)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA # Checklist for submitter - [x] QA'd all new/changed functionality manually ## Summary - Renamed `articles/manage-boostrap-package-with-gitops.md` to `articles/manage-bootstrap-package-with-gitops.md` to fix the "boostrap" typo (article title/content were already spelled correctly). - Added a 301 redirect in `website/config/routes.js` from the old misspelled URL (`/guides/manage-boostrap-package-with-gitops`) to the corrected URL (`/guides/manage-bootstrap-package-with-gitops`). - Updated the two internal links that pointed at the misspelled URL, in `articles/enroll-macbook-neo-at-scale-with-fleet-zero-touch.md` and `handbook/marketing/marketing-assets.md`. ## Testing - [x] QA'd all new/changed functionality manually — verified the redirect rule matches the existing pattern used for other renamed `/guides/*` pages in `website/config/routes.js`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Added a redirect for a misspelled guides URL so visitors are sent to the correct page automatically. * Improved navigation reliability for the affected guide link without changing any other routes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
f24af180c0 |
Add Windows FMAs (letter C): 13 apps (#48969)
**Related issue:** N/A — part of the Windows Fleet-maintained apps catalog expansion (letter C batch; follows #48872, #48881, #48950). Adds seventeen new Windows Fleet-maintained apps: | App | winget package | Installer | Notes | |-----|----------------|-----------|-------| | Advanced Installer | `Caphyon.AdvancedInstaller` | MSI, machine, x64 | Versioned ARP name ("Advanced Installer 23.8") → fuzzy match. | | Certify The Web | `CertifyTheWeb.CertifySSLManager` | Inno, machine, x64 | ARP name is "Certify Certificate Manager version 7.1.0.0" (product renamed at v7) → fuzzy on "Certify Certificate Manager". | | Chatbox | `Bin-Huang.Chatbox` | NSIS (electron-builder), machine, x64 | `/allusers /S`; custom exists query excludes the separate Chatbox Community Edition; uninstall matches `Chatbox [0-9]*`. | | Citrix Workspace | `Citrix.Workspace` | Vendor bootstrapper EXE, machine, x86 universal | ARP name "Citrix Workspace \<YYMM\>" → fuzzy. Uninstall runs the registered TrolleyExpress with `/uninstall /cleanup /silent`; 3010 treated as success. See "not added" for the LTSR caveat. | | CPU-Z | `CPUID.CPU-Z` | Inno, machine | `installer_locale` pinned to en-US (manifest also carries zh-CN); `/ALLUSERS` added to Inno switches; versioned ARP name → fuzzy. | | CodeMeter Runtime Kit | `Wibu-Systems.CodeMeterRuntimeKit` | Vendor bootstrapper embedding MSI, x64 | `installer_scope: ""` (manifest declares no scope; embedded MSI is per-machine). Install `/q /nosplash /ComponentArgs "*":"/quiet /norestart"`; uninstall via msiexec by ARP name prefix. Identity verified by carving the embedded MSI. | | ClipboardFusion | `BinaryFortress.ClipboardFusion` | Inno, machine, x64 | ARP name carries a locale-dependent "(64-bit)" suffix → fuzzy pattern `ClipboardFusion%`; `/LAUNCHAFTER=0` prevents post-install launch. | | CloudShow | `BinaryFortress.CloudShow` | Inno, machine, x64 | Same Binary Fortress framework; ARP name "CloudShow Launcher (64-bit)" is framework-inferred (no third-party corroboration exists) — the CI validator is the confirmation. | | ClockAssist | `ClockAssist.ClockAssist` | MSI, machine, x64 | Latest-pointer URL but actively maintained manifest (bot replaces the single version dir ~6-weekly) → `ignore_hash`. | | Crestron AirMedia | `Crestron.AirMedia` | MSI, machine, x86 | ARP name is "Crestron AirMedia Machine-Wide Installer" (Teams-style per-user stamping); identity from msiinfo. | | Crestron AirMedia Peripherals | `Crestron.AirMediaPeripherals` | MSI, machine, x64 | Clean MSI. LaunchCondition fails install (1603) on hosts with a pending reboot — noted. | | CrisisGo | `CrisisGo.CrisisGo` | InstallShield Basic MSI, machine, x86 | Custom install script passes `ISSETUPDRIVEN=1` to defuse the "must run setup.exe" guard (vendor ships this bare MSI for network deployment; winget sandbox validates it). | | Cyberduck CLI | `Iterate.CyberduckCLI` | MSI, machine, x64 | Clean WiX MSI. winget lags the vendor by ~4 releases, but pinned URLs stay live, so installs work — just not bleeding-edge. | | Cisco Webex Recorder and Player | `Cisco.WebexRecorderAndPlayer` | InstallShield MSI, machine, x86 | Legacy WRF player but actively updated by Cisco (8 winget bumps in 10 months); latest-pointer URL → `ignore_hash`. | | Creative Force Kelvin | `CreativeForce.Kelvin` | WiX MSI, machine, x64 | Manifest offers per-user NSIS, machine NSIS, and MSI — the MSI is selected (unversioned ARP name "Kelvin"). | | Creative Force Triad | `CreativeForce.Triad` | NSIS (electron-builder), machine, x64 | `/allusers /S`; versioned ARP name → fuzzy. | | Cube Browser | `RystadEnergy.CubeBrowser` | WiX burn bundle, machine, x64 | Bundle Arp manifest carved from the installer ("Cube Browser (64 bit)"); dual-mode uninstall (prefers bundle entry, msiexec fallback) since bundle + chained MSI may both register the same name. | Considered but **not** added (recorded in the workstream tracker): - **Citrix Workspace app LTSR** (`Citrix.Workspace.LTSR`): the LTSR and current tracks register the **identical** ARP key (`CitrixOnlinePluginPackWeb`) and the same "Citrix Workspace \<YYMM\>" DisplayName with no LTSR marker — the only discriminator is a registry value outside the programs table, so Fleet inventory cannot tell the tracks apart. An LTSR FMA would cross-match current-release installs (and vice versa). **Consequence for the shipped Citrix Workspace FMA:** hosts running LTSR will match it and may show "update available" toward the current release — flagged here for reviewer judgment. - **Charles** (`XK72.Charles`): all winget 5.x manifests are per-user MSIX only. The vendor ships a machine-scope MSI for 5.2 but it isn't indexed in winget; revisit if the manifest adds it. - **Calibrite Profiler** (`Calibrite.PROFILER`): abandoned winget manifest — one version dir ever while the vendor is five releases and a major version ahead. - **Cloud Drive Mapper** (`IAMCloud.CloudDriveMapperV3`): latest-pointer URL whose manifest SHA is already stale, and the MSI sets `ARPSYSTEMCOMPONENT=1`, hiding the ARP entry from inventory entirely. - **CloudCompare** (`CloudCompare.CloudCompare`): registry DisplayVersion (and the winget PackageVersion itself) embed a parenthetical date — "2.13.2 (07-06-2024)" — which breaks version comparison; manifest also stale. - **Classic Shell** (`IvoSoft.ClassicShell`): development ended in 2017; superseded by Open-Shell. (CutePDF Writer was already deferred in the letter A batch.) Identities verified per app (msiinfo Property tables; burn bundle Arp manifests carved from installers; AppxManifest/electron-builder sources; uninstall-database corroboration). SHAs verified against manifests for pinned URLs; `ignore_hash` used only where the manifest is demonstrably actively maintained. Icons via `tools/software/icons/generate-icons.sh`; the pre-existing CitrixWorkspace icon component is reused untouched. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [ ] QA'd all new/changed functionality manually (relying on the FMA CI validator for Windows install/uninstall validation) |
||
|
Lucas Manuel Rodriguez
|
4449830add |
Fix lint for linux only code (#48962)
- [X] QA'd all new/changed functionality manually
Fixes:
```
make lint-go
[...]
orbit/pkg/luks/snapd_client.go:21:7: const snapdSocketPath is unused (unused)
const snapdSocketPath = "/run/snapd.socket"
^
orbit/pkg/luks/snapd_client.go:46:6: func newSnapdClient is unused (unused)
func newSnapdClient() *snapdClient {
^
orbit/pkg/luks/snapd_fde.go:62:6: func newSnapdSocketFDE is unused (unused)
func newSnapdSocketFDE() *snapdSocketFDE {
^
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved Linux-specific handling for recovery-key and snapd
interactions.
* Added fallback behavior when an existing keyslot causes a conflict, so
recovery-key setup can still complete successfully.
* Better surfaces error messages from failed snapd requests.
* **Tests**
* Added Linux-only tests covering synchronous and asynchronous snapd
request flows.
* Added coverage for recovery-key creation, polling, fallback
replacement, and error responses.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Nico
|
4c6aa754e0 |
Time ago timestamps: use days instead of months when under 90 days (#48964)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46965 Relative "time ago" timestamps switched to months at ~30 days, so a timestamp 45 days ago read "about 2 months ago" (even 89 days showed "3 months ago"). This centralizes the day/month cutoff in a new `timeAgo` helper and routes existing call sites through it, so anything under 90 days is shown in days. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Relative “time ago” timestamps now keep values in **days** for items under **90 days**, switching to **months** later for more accurate wording. * Improved consistency of relative time labels across status modals, activity feeds, host details, and management screens (including “last updated,” “uploaded,” and “added” text). * **Tests** * Added/updated coverage for the shared relative-time cutoff and formatting behavior to prevent regressions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
6d1938b914 |
Fix test setting flag that caused further tests to fail (#48947)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves # Moves `TestInstallAllSelfServiceSoftware` from the enterprise integration suite (`TestIntegrationsEnterprise`) to the MDM integration suite (`TestIntegrationsMDM`), because setting the `MDM.EnabledAndConfigured` flag in the enterprise suite was leaking into and failing other tests (`TestLinuxDiskEncryption`, `TestTeamEndpoints`, `TestTeamSpecs`, `TestMDMNotConfiguredEndpoints`, `TestVPPAppsWithoutMDM`, `TestOrbitSetupExperienceStatusChecksAuthBeforeMDM`). # Checklist for submitter ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - checking this to avoid a CI failure, but there is nothing to actually manually check <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Expanded integration coverage for self-service software installs across team, label, category, and multi-host scenarios. * Added checks for install ordering, idempotency, queue consistency, and concurrent requests. * Included coverage for VPP-backed apps and mixed install queues to better validate real-world behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
5b2a1b9de0 |
fleet-mcp: use /fleets endpoints instead of legacy /teams (#48791)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Relates to #43544 The Fleet MCP calls the legacy `/api/v1/fleet/teams` routes for fleet and policy lookups. Fleet's current API endpoints catalog only lists the renamed `/fleets` routes, so an endpoint-restricted api-only user cannot be granted `/teams` and those calls return 403. This switches the MCP to the `/fleets` paths, which return the same response shape, so fleet resolution and per-fleet policy compliance work under a least-privilege token. Verified against a running Fleet. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Team-related Fleet data now loads from the correct service endpoints, improving policy and compliance views. * Policy listings and policy detail checks for teams should now return the expected results. * Updated test coverage to match the revised Fleet route behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
003ab766d3 |
Filter cross-team memberships from user list responses (#48890)
From Lucas:
- [X] QA'd all new/changed functionality manually
## Summary
A team-scoped admin listing users of a team they administer (`GET
/api/latest/fleet/users?team_id=A`) received the full team membership —
team IDs, names, and roles — of any user also shared with other teams,
disclosing teams the requester has no role in.
The single-user `GET /users/{id}` endpoint already blocks this: its
authorization requires the requester to administer *every* team the
target belongs to. The list endpoint authorizes against a synthetic
single-team object (correct, so team admins can manage their members),
but then returned each user's complete team list as loaded by the
datastore.
This filters each returned user's teams down to the requester's scope at
the response layer. Requesters with any global role are unchanged
(they're authorized to see all teams).
## Why the response layer, not `Service.User`
`ModifyUser` and the password-reset flow reuse `Service.User` and read
`user.Teams` to compute write diffs. Filtering there would silently drop
team memberships on edits, so the filter is applied in
`listUsersEndpoint` only.
`GET /users/{id}` is intentionally not changed — it is not exploitable
(authz already requires admin-of-all-the-target's-teams), and its
legitimate readers should keep seeing the full team list.
## Testing
- `TestListUsersFiltersTeamsToRequesterScope` — team-1 admin listing
team 1 sees only team 1 for a user shared with {1,2}.
- `TestListUsersGlobalRequesterSeesAllTeams` — global admin sees all
teams.
- Existing `TestUserAuth` / `TestAuthorizeUser` pass unchanged (no authz
regression).
Fixes fleetdm/confidential#16691
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed user listing so returned team membership details are scoped to
the requesting user’s permissions, including fleet-scoped context.
* Team-scoped requesters now only see memberships for teams they’re
allowed to view; global-role requesters still see all memberships.
* When scoped viewer context is missing, team membership details are no
longer included in the response.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
|
||
|
Steven Palmesano
|
c759f92f14 |
Include mobile hosts by default in "Hosts online" chart (#48769)
**Related issue:** Resolves #47661 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features / Improvements** * The “Hosts online” chart now includes mobile platforms (iOS/iPadOS/Android) by default, alongside desktop platforms. * **Bug Fixes** * Initial load no longer shows a default “Filtered” badge; the chart reflects the full default platform selection. * **Documentation** * Updated the “Hosts online” tooltip to clarify how locked iOS/iPadOS, lid-closed Mac, and locked Android states affect the online count. * **Tests** * Updated chart card tests to match the new default platform behavior and initial chart request parameters. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Allen Houchins
|
360789913a |
Add icon for Okta Advanced Server Access macOS FMA (#48956)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> The Okta Advanced Server Access macOS Fleet-maintained app had no icon — the Fleet UI fell back to the generic package icon, and the fleetdm.com software catalog used the fallback icon. The icon was extracted from the vendor's `ScaleFT.app` bundle inside `ScaleFT-1.108.0.pkg` (downloaded from the URL in `ee/maintained-apps/outputs/okta-advanced-server-access/darwin.json`; SHA-256 verified against the manifest) and generated with `tools/software/icons/generate-icons.sh`: - `frontend/pages/SoftwarePage/components/icons/ScaleFt.tsx`: new icon component. - `frontend/pages/SoftwarePage/components/icons/index.ts`: two map entries — `"okta advanced server access"` (matches the FMA list name) and `"scaleft"` (matches host inventory, since the app's `CFBundleName` is `ScaleFT` and there is no `CFBundleDisplayName`). - `website/assets/images/app-icon-okta-advanced-server-access-60x60@2x.png`: 128×128 PNG for the fleetdm.com software catalog (filename follows the `app-icon-<slug>` convention used by `build-static-content.js`). # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a new software icon for ScaleFT/Okta Advanced Server Access. * The icon now appears automatically when those software names are recognized in the app. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rahul Raghunathan
|
c92b848919 |
Return to previous page when the last policy on a page is deleted (#48683)
**Related issue:** Resolves #48641 ## Description Deleting the only policy on a paginated page (e.g., 21 policies, with 1 on page 2) left the user stranded on a now-empty page showing the "No policies" empty state. The policies list now steps back to the previous page when a delete empties the current page. **Before:** delete last policy on page 2 → empty state. **After:** delete last policy on page 2 → list returns to page 1. ### Screen recording demonstrating the fix https://github.com/user-attachments/assets/ae106a50-7f9b-4080-a19c-53e0c60fff48 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Server-side paginated tables now recover from empty states after deleting the last row on a page by redirecting to the last page that still has data. * Improved empty-state pagination handling for out-of-range pages, loading states, and cases where the total row count is known (including zero), avoiding unnecessary or repeated navigation. * Simplified the empty-state pagination UI to render only the empty component. * **Tests** * Expanded regression test coverage for server-side pagination edge cases and page-correction behavior to prevent future regressions. * **Style** * Removed unused empty/previous-button styling rules in the table container. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tim Lee
|
496d4f5e24 | Controls > OS settings > Certificates: View certificates (#48460) | ||
|
Allen Houchins
|
2708df6f40 |
Add Windows FMAs (letter B): 5 apps (#48950)
**Related issue:** N/A — part of the Windows Fleet-maintained apps catalog expansion (letter B batch; follows #48872 and #48881). Adds six new Windows Fleet-maintained apps: | App | winget package | Installer | Notes | |-----|----------------|-----------|-------| | BandiView | `Bandisoft.BandiView` | EXE (NSIS-style), machine, x64 | Unversioned InstallerUrl → `ignore_hash` (URL verified to serve the binary reliably without Referer tricks). DisplayName "BandiView" stable across releases. | | BleachBit | `BleachBit.BleachBit` | EXE (NsisMultiUser), machine, x86 | Install script passes the case-sensitive `/allusers /S` — without `/allusers` the NsisMultiUser installer's scope is ambiguous. winget declares a VCRedist 2010 x86 dependency Fleet can't satisfy; noted as a caveat. | | Bulk Crap Uninstaller | `Klocman.BulkCrapUninstaller` | EXE (Inno), machine, x86 | ARP DisplayName is versioned ("BCUninstaller 6.2.0.0") and never matches the friendly name, so `unique_identifier` "BCUninstaller" + `fuzzy_match_name`. Registry version is 4-part vs winget's "6.2" — `version_compare` pads, verified consistent. | | BrowserStackLocal | `BrowserStack.BrowserStackLocal` | MSI (WiX), machine, x64 | Clean MSI (ALLUSERS=1, identity verified via msiinfo). Unversioned InstallerUrl → `ignore_hash`. | | Burp Suite Professional | `PortSwigger.BurpSuite.Professional` | EXE (install4j), machine, x64 | Mirrors the existing Burp Suite Community FMA: `-q -Dinstall4j.suppressUnattendedReboot=true` plus the load-bearing `-dir` into Program Files (install4j defaults to per-user otherwise). DisplayName is versioned **without** "Edition" ("Burp Suite Professional 2026.3.3"), unlike Community — fuzzy pattern `Burp Suite Professional %` can't collide with Community's. | | Bytello Share | `Bytello.BytelloShare` | EXE (NSIS), machine, x86 | Uses the nullsoft `agent=d` variant whose ARP identity ("Bytello Share" / publisher "Bytello Share") matches real-world inventory; the zip variant registers a different name ("BytelloShare") and its nested-MSI path is version-pinned and already stale. Vendor URL is a latest-pointer already ahead of winget → `ignore_hash`. **Note:** the input says `installer_type: "msi"` — the ingester classifies this nullsoft entry as msi because its URL has no file extension (vendor-type → URL-extension → machine-scope fallback chain in `ingester.go`); the custom scripts handle the actual NSIS exe. | Considered but **not** added (recorded in the workstream tracker): - **Bambu Studio** (`Bambulab.Bambustudio`): the uninstaller shows a keep-user-data confirmation dialog even with `/S` (deployment guides work around it with Send-Keys, impossible in a SYSTEM session) — same failure class that disqualified Adobe AIR in the letter A batch. - **Bridge Designer** (`StephenRessler.BridgeDesigner`): installer URL 404s (file removed from SourceForge) and the desktop product was discontinued July 1, 2026 in favor of a browser-based edition. - **BurnAware Free** (`Burnaware.BurnAwareFree`): the vendor deletes each old release URL — the winget-pinned installer already redirects to their homepage, so pinned downloads break every release cycle. Registry identities were verified per app (msiinfo Property tables for MSIs; vendor installer sources, winget AppsAndFeaturesEntries, and uninstall-database corroboration for EXEs). Installer SHAs verified against manifests where URLs are version-pinned; unversioned URLs use `ignore_hash` per the TeamViewer/Chrome precedent. Icons generated via `tools/software/icons/generate-icons.sh`. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [ ] QA'd all new/changed functionality manually (relying on the FMA CI validator for Windows install/uninstall validation) |
||
|
Allen Houchins
|
08c22ebe58 |
Install Okta Verify on Windows workstations via Fleet-maintained app (#48952)
**Related issue:** N/A (dogfood GitOps change) # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually (YAML validated; will verify install + patch policy on a Windows workstation after the GitOps run applies) ## Details Adds Okta Verify to Windows devices on the Workstations team following the same pattern used for it on macOS, including the patch policy: - Replaces the custom-package Okta Verify install (`$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` + custom install/uninstall scripts) with the `okta-verify/windows` Fleet-maintained app — `self_service: true`, `setup_experience: true`, category Security, scoped to "x86-based Windows hosts" (the FMA installer is x86-only). - Adds a "Windows - Okta Verify up to date" patch policy with `install_software: true` for automatic remediation, mirroring the macOS policy. - Adds the "x86 Windows hosts with Okta Verify installed" label that scopes the patch policy to hosts that already have the app. - Cleanup: deletes the now-orphaned custom package YAML and `okta_verify_*.ps1` scripts. Follow-up (not in this PR — requires `workflow` scope): remove the now-unused `DOGFOOD_OKTA_VERIFY_WINDOWS_URL` env line from `.github/workflows/dogfood-gitops.yml` and delete the GitHub secret. Harmless in the meantime — the env var is exported but nothing consumes it. Hosts that installed Okta Verify from the old custom package are picked up by the new label, and the patch policy will auto-update them to the FMA version (currently 6.10.2.0) if they fall behind. |
