8a65ecf20bf63d5576edf6ce5358a22d82e6eaab
5
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Allen Houchins
|
48b8edaa9d |
Update patch policy generation and tests (#45799)
This pull request refactors how patch policy SQL queries are generated and validated, with the main goal of simplifying and correcting the construction of `NOT EXISTS` queries for version checks. The changes ensure that the generated queries are more accurate, especially in cases involving SQL `OR` conditions and platform-specific version columns. The update also adapts related test cases to match the new query structure. **Patch policy query generation improvements:** * Refactored the SQL generation logic in `GenerateQueryForManifest` to append the `version_compare` clause directly inside the original `WHERE` clause, rather than wrapping the entire query in extra parentheses. This results in simpler, more standard SQL queries. * Added logic to detect `OR` conditions in the `WHERE` clause and wrap them in parentheses to ensure correct SQL precedence when appending the `AND version_compare(...)` clause. * Improved selection of the version column (e.g., `bundle_short_version`, `version`, or `file_version`) based on platform and table name, ensuring correct queries for both macOS and Windows policies. **Test updates:** * Updated all relevant test cases in `patch_policy_test.go` to expect the new, simplified query format, removing the extra parentheses and validating correct handling of SQL with `OR` and platform-specific columns. [[1]](diffhunk://#diff-a770c8e2c3066123079c660322e318014a7c4870429e091a6e48d4acb222c340L23-R23) [[2]](diffhunk://#diff-a770c8e2c3066123079c660322e318014a7c4870429e091a6e48d4acb222c340L32-R32) [[3]](diffhunk://#diff-a770c8e2c3066123079c660322e318014a7c4870429e091a6e48d4acb222c340L41-R41) [[4]](diffhunk://#diff-a770c8e2c3066123079c660322e318014a7c4870429e091a6e48d4acb222c340L50-R61) * Adjusted a Homebrew ingester test to match the new query formatting, ensuring consistency across the codebase. |
||
|
Allen Houchins
|
98f82ce19f |
Wrap FMA exists query in parens to fix OR precedence in patched policy (#45647)
## Summary - `pkg/patch_policy/GenerateQueryForManifest` now wraps the caller-supplied exists query in an inner set of parentheses before appending the trailing `AND version_compare(...) < 0` clause. Without the wrap, any `OR` in the exists body binds *after* the appended `AND` (SQL precedence: `AND` > `OR`), producing an incorrect `patched` query. The bug is currently only observable on `codex-cli` (uses `path = ... OR path LIKE ...`) but would silently break any future FMA whose exists query contains `OR`. - All FMA outputs regenerated via `cmd/maintained-apps`. For AND-only exists queries (the vast majority of existing FMAs), the new patched SQL is semantically identical to the previous form — just with extra parens around the WHERE body. `codex-cli/windows.json`'s OR clause is now correctly grouped. - `docker-desktop` is unchanged: its patched SQL is constructed inline in the homebrew ingester at [ingester.go:198-201](https://github.com/fleetdm/fleet/blob/claude/compassionate-merkle-afbd8a/ee/maintained-apps/ingesters/homebrew/ingester.go#L198-L201) and bypasses the generator. ### Heads-up: upstream version drift bundled in The regeneration also pulled in a handful of upstream version bumps that landed since the last FMA run. These are real upstream changes, not generator artifacts: | App | Platform | Old → New | |---|---|---| | Figma | windows | 126.3.12 → 126.4.9 | | GoLand | darwin | 2026.1.1 → 2026.1.2 | | IntelliJ IDEA | darwin | 2026.1.1 → 2026.1.2 | | RubyMine | darwin | 2026.1.1 → 2026.1.2 | | Zed | darwin | 1.2.5 → 1.2.6 | If you'd prefer these isolated from the paren-only change, let me know and I'll split the PR. ### Code changes - [pkg/patch_policy/patch_policy.go](pkg/patch_policy/patch_policy.go): added `(` to `templateStart` and `)` to `templateEnd{Darwin,Windows}` so `GenerateQueryForManifest` emits `... NOT EXISTS ((<before>) AND version_compare(...) < 0);`. - [pkg/patch_policy/patch_policy_test.go](pkg/patch_policy/patch_policy_test.go): updated existing expectations and added an OR-precedence case mirroring codex-cli's exists query. - [ee/maintained-apps/ingesters/homebrew/ingester_test.go](ee/maintained-apps/ingesters/homebrew/ingester_test.go): updated the generic `Patched` assertion (docker-desktop's hardcoded expectation is unchanged — it bypasses the generator). - 282 regenerated files under `ee/maintained-apps/outputs/**/*.json`. ## Test plan - [x] `go test ./pkg/patch_policy/...` passes (incl. new OR case). - [x] `go test ./ee/maintained-apps/...` passes. - [x] `go vet ./pkg/patch_policy/... ./ee/maintained-apps/...` clean. - [x] `cmd/maintained-apps` runs end-to-end with no errors against the live Homebrew/winget APIs (with `NETWORK_TEST_GITHUB_TOKEN` set). - [x] `git diff` audited: every diffed `patched` line on `outputs/**/*.json` is a paren-only delta; non-`patched` deltas confined to the 5 upstream version bumps listed above. - [x] `docker-desktop/darwin.json` unchanged after regeneration. - [ ] CI green. |
||
|
Ian Littman
|
65030e905f |
Fix mis-assigned FMA bundle identifiers, switch to fuzzy matching on queries where Windows apps include version number in the name (incl. special fixes for Firefox ESR) (#42628)
Resolves #42714. Zed + Opus 4.6; initial prompts (see additional ones in follow-on commits): --- Audit our existing Fleet Maintained App catalog. Look for: 1. Software that has the wrong identifiers associated (e.g. Abstract), e.g. in `exists` queries 2. Software that has the version number in the name that leaks into the `exists` query, e.g. 7-zip or 010 Editor or Airtame. These should be fuzzy-matched. For each affected app, revise input manifests to fix the issues. For (1), revise apps.json if needed as well. Don't modify apps.json for (2) cases. --- Are there any discrepancies between bundle identifiers in input manifests for Darwin apps and apps.json? If so, fix them. --- Outputs will get overwritten by the ingester if neither the ingester nor the input JSON files are changed. Make whatever changes need to be made so that these edits survive an FMA ingestion cycle. --- Revise `fuzzy` to allow specifying a custom value e.g. `Mozilal Firefox % (ESR)` in addition to the existing true/false, then use that new functionality to build unique queries for Firefox ESR. --- Commit these changes, across multiple commits (there will be cases where a changes to a single file will be spread across multiple commits, most notably apps.json). Split commits out as follows: 1. All darwin-related changes 2. Windows switches to fuzzy matching + associated unique_identifier changes 3. Revised handling for Firefox ESR Prefix commit messages with "🤖 ". --- The ingester and test changes should've gone in commit 3. Move them there from commit 2. --- <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated application identifiers for Abstract, Amazon Chime, Beyond Compare, and Teleport Suite to use correct bundle and package identifiers. * Enhanced Windows and macOS installation detection queries to match multiple application versions using pattern matching instead of exact version strings. * **New Features** * Added support for configurable fuzzy matching patterns to improve application name matching flexibility. * **Tests** * Added tests validating fuzzy matching configuration unmarshaling and behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
fbb1573be9 |
Create default patch policy query in FMA manifest (#42559)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #42492 Includes changes from running ingestions on all FMAs # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually |
||
|
Jonathan Katz
|
0d15fd6cd6 |
Override patch policy query (#42322)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41815 ### Changes - Extracted patch policy creation to `pkg/patch_policy` - Added a `patch_query` column to the `software_installers` table - By default that column is empty, and patch policies will generate with the default query if so - On app manifest ingestion, the appropriate entry in `software_installers` will save the override "patch" query from the manifest in patch_query # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually - Relied on integration test for FMA version pinning ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). |