8d616e31cb77312dfcd2920d007e194b948efcbe
2839
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Magnus Jensen
|
1abeb175f3 |
AULD: Enrollment insert and backfill osquery query (#50131)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #47714 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. (Will be part of another PR) - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Collect and persist macOS software update device identifiers for hosts during both manual and OTA enrollment flows. * Added an osquery detail/query to derive the identifier from hardware properties and upsert it into datastore. * **Bug Fixes** * Host deletion now also removes related Apple macOS OS update records. * **Improved Device Recognition** * Enhanced Mac model identifier parsing and refined Apple Silicon detection with expanded test coverage. * **Reliability** * Enrollment profile delivery remains unaffected if saving the identifier fails (errors are logged). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew MellorandMagnus Jensen
|
192ac4eb51 |
48093 auld api gitops latest os version (#50213)
**Related issue:** Resolves #48093 - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added “latest” version enforcement for macOS, iOS, and iPadOS updates using required `deadline_days`. * Updates dynamically target each device’s available OS version and deadline. * Configuration and GitOps outputs now include `deadline_days`. * **Bug Fixes** * Improved validation when switching update modes or omitting deadline settings. * GitOps updates now clear previously stored deadline values when omitted. * Changes to `deadline_days` are detected and applied consistently. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Magnus Jensen <magnus@fleetdm.com> |
||
|
Rajendra Kadam
|
5e95589554 |
Support custom activations and management declarations for DDM profiles (#50280)
**Related issue:** Resolves #49970 Adds custom activations to the single-profile paths for declaration (DDM) profiles — create, edit, delete and read — and unblocks management declarations. Part of #48222. Batch/GitOps is #49972; serving the custom activation to devices is #49971. ### Custom activations - `POST /configuration_profiles` and `PATCH /configuration_profiles/{uuid}` accept an optional `activation` file part, rejected for any profile type other than an Apple declaration. - Validation requires an activation `Type` (any `com.apple.activation.*`, so future Apple types need no Fleet change), an `Identifier`, and exactly one `StandardConfigurations` entry naming the configuration it ships with. `Predicate` and every other key are stored and served verbatim for the device to evaluate. - Premium-only, unconditionally. `parseAndValidateAppleDeclaration` requires premium only when a fleet or labels are involved, so an unassigned unlabeled DDM profile is free today; the activation carries its own gate. - The activation's Fleet variables are validated against `fleetVarsSupportedInDDMDeclarations` — already exactly the set specified for activations — and associated via `mdm_configuration_profile_variables.apple_ddm_activation_uuid`. - Returned base64-encoded on both the list and single-profile endpoints, per the API reference draft (#49768), and omitted entirely when absent. What an edit does to a stored activation: | Request | Result | | --- | --- | | activation supplied | replaces the stored one | | new profile content, no activation | stored one is cleared — this is how it's removed | | labels-only edit | stored one is carried forward | The third row matters: the datastore clears the activation of any declaration written without one, so a labels-only edit rebuilding the declaration from the existing row would otherwise silently wipe it. `GetMDMAppleDeclaration` loads the activation so it can be carried forward, and there's a test asserting it. ### Management declarations `com.apple.management.*` uploads are unblocked via a prefix check, so future management declarations work without a product change. Types to block go in the existing `ForbiddenDeclTypes` deny list, which is already evaluated ahead of the prefix. An activation supplied alongside a management declaration is rejected — those are never activated. Routing them to the manifest's Management section is #49971's work. ### Notes for review **Where the non-declaration guard lives differs by path, deliberately.** Create resolves the profile type in the endpoint from the uploaded file; edit resolves it in the service from the UUID prefix. The check sits wherever the type becomes known. Both use the same message so the mistake reads identically. **Endpoint-level errors must be returned from behind an authz check.** The create-path guard originally returned the error straight from the endpoint, which skips authorization and surfaces to the client as a bare `forbidden` rather than the validation message. It now goes through `NewMDMActivationUnsupportedProfile`, alongside the existing `NewMDMUnsupportedConfigProfile` and `NewMDMInvalidJSONConfigProfile`, which exist for the same reason. This was caught by the integration tests, not the unit tests — service-level tests bypass the authz middleware. **Activation rows are keyed on `declaration_uuid`, not inserted fresh.** An edit reuses the row, so the Fleet variable associations hanging off it survive. The UUID is read back after the upsert rather than reusing the generated one, since `ON DUPLICATE KEY UPDATE` keeps the existing row. **Secrets are expanded for validation but stored unexpanded**, so validation runs against the document the device receives without persisting secret values. `MDMAppleCustomActivation` is the storage type; `MDMAppleDDMActivation` was already taken by Apple's wire format. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. No changes file: the feature isn't reachable by users until the DDM sync work in #49971 lands. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually **Unit** (`server/fleet`): `GetRawActivationValues` and `ValidateUserProvided` — valid activation, unknown type under the activation prefix, missing `Type`, a configuration type supplied as an activation, missing `Identifier`, zero/multiple/mismatched `StandardConfigurations`, all problems reported at once, plus `IsManagementDeclaration`. **Service** (`server/service`): activation accepted, mismatched configuration rejected, malformed JSON rejected, rejected on a management declaration, supported Fleet variables recorded, unsupported rejected, premium required even where the declaration is free. On edit: activation-only edit keeps content, labels-only edit preserves the activation, new content without an activation clears it, and exactly one `edited_declaration_profile` activity fires. **Datastore** (`server/datastore/mysql`): write, read-back through list and single get, edit reusing the row, Fleet variable association, and removal cascading to the variable rows. **Integration** (`integration_mdm_ddm_test.go`): multipart upload with an activation, read back and asserted base64-decoded against the raw response body; the key omitted entirely for a declaration without one; two management declarations uploaded and coexisting; activation on a `.mobileconfig` rejected on both create and edit; activation-only `PATCH` replacing the activation while leaving the declaration untouched. The multipart test helper now supports more than one file part — nothing could build that request before, which is why the decode path was previously untested. Single-file callers are unchanged. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added optional custom activations for Apple DDM configuration declarations. - Activations support secrets, Fleet variables, and custom host vitals. - Activation data appears when viewing or downloading applicable profiles. - Activation files can be added, updated, preserved during label-only edits, or removed during content replacement. - Management declarations can coexist with supported configuration declarations. - **Validation** - Added checks for declaration matching, supported profile types, file limits, and Premium licensing. - Clear errors are provided when activations are used with management declarations or non-DDM profiles. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
a4af4d896c |
Add default fleet for new Windows MDM enrollments (#41787) (#49922)
Demo: https://www.youtube.com/watch?v=cWxZlu9WuwA Guide updates: https://github.com/fleetdm/fleet/pull/49603/changes IT admins can configure the fleet that hosts enrolling through user-driven Windows MDM enrollment (Windows Autopilot, Entra join) are automatically assigned to, via the Windows MDM settings page, the mdm.windows_enrollment.default_fleet config setting, or GitOps. - New windows_enrollment_config row stores the default team; the config API surfaces it by fleet name and hydrates reads from the row so team renames and deletions never serve a stale name. Deleting the fleet clears the setting. - New edited_windows_enrollment_default_fleet activity, emitted only when the value changes. - The OMA-DM session persists the device-reported SMBIOS serial on still-unlinked enrollments, and orbit enrollment reverse-links by that serial and assigns the default fleet before orbit's one-shot setup-experience init, so the default fleet's software, scripts, and profiles apply during the Autopilot ESP. The DevDetail and osquery link paths keep the same assignment as fallbacks, and the EUA-token link path now shares the same post-link bookkeeping. - Hosts are only assigned when new to Fleet in this enrollment cycle: existing hosts, including ones parked in Unassigned, keep their fleet on re-enrollment, matching macOS ABM behavior. - GitOps defers applying the setting until teams declared in the same run are created, and fleetctl generate-gitops exports it. - Windows MDM settings page redesign per Figma: programmatic enrollment toggle, User driven enrollment section with the Entra-gated Default fleet dropdown, and a Migration section. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41787 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for assigning a default Fleet Premium fleet to new Windows MDM enrollments, including Autopilot and Entra join. * Default-fleet settings can be configured, cleared, and managed through Windows MDM settings and GitOps. * Assigned fleet software, scripts, and profiles can apply during out-of-box setup. * Added activity-feed visibility for default-fleet changes. * Improved Windows enrollment matching using hardware serial numbers. * **Documentation** * Documented default-fleet assignment for Windows enrollment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
bd601fff84 |
Fixed nilaway issues (#50405)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50404 - Refactored `ListHostSoftware` and `ModifyAppConfig` functions beeing too big for nilaway - Added a hard check to make sure all our funcitons/packages are being analyzed by nilaway # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Improved software inventory filtering for self-service and macOS applications, producing more accurate results. * Improved application configuration updates so saved settings and related system changes are processed more reliably. * **Quality** * Added automated checks to identify overly complex functions and help maintain code quality. * Updated static analysis tooling and expanded validation coverage with new tests. * **Documentation** * Added a changelog entry describing the latest reliability and maintainability improvements. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
60ad78f897 |
Add Omarchy as a supported Linux platform
Resolves #50069 Omarchy 4 ships its own /etc/os-release with ID=omarchy, where earlier versions inherited ID=arch from Arch Linux. Since HostLinuxOSs and HOST_LINUX_PLATFORMS gate nearly every Linux check, these hosts had empty vitals and software inventory, were missed by linux-scoped policies and labels, had no disk encryption or key escrow, and lost Run script in the UI (the API was unaffected). Add "omarchy" to HostLinuxOSs, HostNeitherDebNorRpmPackageOSs (pacman- based), IsLUKSSupported, HOST_LINUX_PLATFORMS, DISK_ENCRYPTION_SUPPORTED_LINUX_PLATFORMS, and the Vitals disk-encryption tooltip. Regenerate understanding-host-vitals.md. Aggregate Omarchy onto the "Arch Linux" / "rolling" OS inventory row, where these hosts sat before quattro. Unlike CachyOS, Omarchy reports a real release number rather than BUILD_ID=rolling, so the version is pinned after parsing instead of rewriting the ingested build value. Also add a fleetd test container, built on archlinux since Omarchy publishes no image. |
||
|
Juan Fernandez
|
d92b7284d0 |
Trigger software_checksum_migration on startup
Relates #36365 Makes the software_checksum_migration cron to run automatically on server startup. |
||
|
Juan Fernandez
|
e529d97897 |
Fix duplicate software inventory entries from v4.76.0 checksum change
Resolves #36365 The v4.76.0 checksum change (#34097) reordered the fields hashed into `Software.ComputeRawChecksum` for non-`apps` sources, so software rows created before the upgrade no longer matched re-ingested rows and got duplicated (same name/version/source, split host counts). - Make `ComputeRawChecksum` the sole source of truth and delete the drifted parallel SQL checksum formula that caused the mismatch. - Add `ReconcileSoftwareChecksums`, a one-shot migration that merges existing duplicates onto the canonical row (batched host_software repointing) and logs each merge. Runs once after startup; re-run with `fleetctl trigger --name software_checksum_migration` |
||
|
Victor Lyuboslavsky
|
98060b08a6 |
Add Windows managed local account server flow (#48721) (#49924)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48721 Part 2 of https://github.com/fleetdm/fleet/issues/43488 # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Windows devices can now create and securely escrow managed local account passwords during enrollment. * Added Windows managed local account status and password availability to host details. * Device-reported setup errors are surfaced with helpful details. * Account creation is automatically requested when supported by the device, plan, and configuration. * **Bug Fixes** * Windows accounts are excluded from password rotation workflows. * Re-enrollment correctly triggers account creation when needed. * Passwords remain available when settings change after enrollment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
f7ffc07062 |
Improved software ingestion performance (#50354)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #50305 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance Improvements** * Improved software ingestion performance by optimizing software title lookups. * Reduced unnecessary database scanning while preserving matching for bundle identifiers, names, and Windows upgrade codes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Dante Catalfamo
|
2fd2a02e2d |
Split MDM platform helpers by Android semantics (#50185)
**Related issue:** Resolves #46118 |
||
|
Lucas Manuel Rodriguez
|
0dc8c382c5 |
Add 'linux' as platform for labels (#50270)
Resolves #44088. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Linux as a label platform option. * Linux labels now apply across supported distributions, including Ubuntu, Debian, RHEL, CentOS, and generic Linux hosts. * Updated platform names for improved clarity and consistency. * **Bug Fixes** * Improved platform matching so Linux labels apply consistently to compatible hosts. * Removed the obsolete Zorin platform option. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Bas Bleijerveld
|
60e6827071 |
Fix Apple built-in label memberships during ADE (#50287)
**Related issue:** Resolves #50285 ## Summary - Restore the `All Hosts` and Apple platform built-in label memberships in the same transaction that clears stale host state during Automated Device Enrollment (ADE). - Backfill missing built-in memberships for existing macOS, iOS, and iPadOS hosts. - Add regression coverage confirming that an iPadOS update declaration remains targeted and reaches verified status after the enrollment reset. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one host's records do not affect another) - [ ] QA'd all new/changed functionality manually Automated verification: ```sh MYSQL_TEST=1 go test -run 'TestMDMApple/MDMAppleResetOnReenrollment' ./server/datastore/mysql MYSQL_TEST=1 go test -run TestUp_20260731100711 ./server/datastore/mysql/migrations/tables MYSQL_TEST=1 go test -run 'TestIntegrationsMDM/TestIPadOSUpdateDeclarationAfterMDMReset' ./server/service go test -run TestMDMTokenUpdateResetOnReenrollment ./server/service go vet ./server/datastore/mysql ./server/service go build ./server/datastore/mysql/migrations/... make test-schema ``` ## Database migrations - [x] Checked schema for all modified tables for columns that auto-update timestamps during migration. - [x] Confirmed that timestamp behavior is acceptable and will not cause unwanted side effects. The migration inserts only missing memberships and leaves existing membership timestamps unchanged. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Apple devices now retain their built-in label memberships after Automated Device Enrollment or MDM reset. * Label-scoped profiles, software, and operating system updates can now continue to be delivered after a reset. * Platform-specific memberships are restored for macOS, iOS, and iPadOS devices, including applicable hosts with unspecified platforms. * iPadOS update declarations now reconcile successfully after an MDM reset. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Rajendra Kadam
|
9d0f510a8d |
Add DDM custom activations schema (#50133)
**Related issue:** Resolves #49966 Adds the schema for custom DDM activations (parent story #48222). - **Creates `mdm_apple_ddm_activations`** — stores the activation JSON as-is (`mediumtext`, so the generated `token` column hashes the exact stored bytes) with a `declaration_uuid` FK to `mdm_apple_declarations` that cascades on delete. - **Extends `mdm_configuration_profile_variables`** with `apple_ddm_activation_uuid` so activations can carry Fleet variables (needed by #49970). - **Adds `activation_updated_at`** to `host_mdm_apple_declarations` so a changed activation regenerates the declaration's effective token, mirroring `variables_updated_at` / `assets_updated_at`. - **Drops `mdm_apple_declaration_activation_references`** — created with the original DDM tables in `20240327115530_AddDDMTables.go`, never written to by any code path, so it is empty in every deployment. ### Deviations from the SQL in #49966 The `declaration_uuid` FK is the one addition, [confirmed with @MagnusHJensen](https://github.com/fleetdm/fleet/issues/49966): it keeps the 1:1 lifecycle enforced by the database rather than requiring cleanup in every delete path. `configuration_identifier` is kept alongside it for validation and DDM serving. Its unique key doubles as the FK's backing index. The rest are corrections needed for the specced SQL to work, all following the precedent in `20260409153715_AddDDMVariablesSupport.go`: - **`ck_mdm_configuration_profile_variables_exactly_one` is dropped and re-added** to count the new column. That constraint requires exactly one owner column to be non-null; adding a seventh without updating it means any row setting `apple_ddm_activation_uuid` sums to 0, fails the check, and is rejected. - **`UNIQUE (apple_ddm_activation_uuid, fleet_variable_id)` added** to match the six existing owner columns. That table's write path is `INSERT ... ON DUPLICATE KEY UPDATE`, which needs a unique key to collide on. - **`activation_updated_at` is `DATETIME(6)`, not `TIMESTAMP(6)`** — its siblings are `datetime(6)` and `EffectiveDDMToken` formats them into the token string, so `TIMESTAMP`'s session-timezone conversion on read would change tokens and re-push declarations to every host. - **`team_id` gets `DEFAULT '0'`** to match `mdm_apple_declarations`, where 0 is Unassigned. ### Note for #49970 `declaration_uuid` is `NOT NULL`, so the upload path must populate it in addition to `configuration_identifier`. The declaration UUID prefix has no separator (`MDMAppleDeclarationUUIDPrefix = "d"`, 1 char + 36-char UUID = the full `varchar(37)`). # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. No changes file: this sub-task adds schema only and ships no user-visible behavior. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually `TestUp_20260729115013` covers: the stale table is present before and gone after; pre-existing `mdm_configuration_profile_variables` rows survive the check constraint replacement (that `ADD CONSTRAINT` revalidates every existing row); an activation attaches to a declaration and gets its generated token; the 1:1 unique key and the FK both reject bad inserts; a variable row binds to an activation (the case the old constraint would have rejected); the constraint still rejects two-owner and zero-owner rows; and deleting the declaration cascades to the activation and through it to the activation's variable rows. Also ran the full migrations suite (`MYSQL_TEST=1 go test ./server/datastore/mysql/migrations/...`) to confirm no other migration is disturbed, and verified the regenerated `schema.sql` diff contains only changes from this migration. ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). Neither modified table has an `ON UPDATE CURRENT_TIMESTAMP` column, so no rows have their timestamps touched. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for Apple DDM custom activations. * Added activation-specific tokens and timestamps to support reliable declaration updates. * Enabled configuration variables to be associated with a specific activation. * Added validation to prevent duplicate or invalid activation associations. * Activations and related settings are now automatically removed when their declaration is deleted. * **Tests** * Added coverage for activation creation, uniqueness, validation, associations, token generation, and cascading cleanup. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
e5b0f313f9 |
Fix password reset accepting case-mutated tokens
Reset tokens are base64url (case-sensitive) but the password_reset_requests.token column used case-insensitive utf8mb4_unicode_ci, so a case-mutated token copy still matched. Switch the column to utf8mb4_bin for byte-exact comparison. |
||
|
|
c83ecc2231 |
Match Windows software with version in name to FMA software title
Resolves #44406 Windows programs report a version in their name (e.g. `Granola 7.373.2`), so each version created its own `software_title` and never linked to the Fleet-maintained app installer's title (`Granola`), hiding the uninstall action. macOS handles this via `bundle_identifier`; Windows had no join key. - Give matching Windows programs the canonical FMA name at ingestion (name-prefix match), so all versions collapse onto the title the installer owns. `software.name` is unchanged. - Merge already-mismatched versioned titles onto the canonical title in `ReconcileMaintainedAppSoftwareNames` (runs on FMA sync; no migration needed). --------- Co-authored-by: Tim Lee <timlee@fleetdm.com> Co-authored-by: Juan Fernandez <juan@fleetdm.com> |
||
|
Jonathan Katz
|
1a0f0101cc |
Fix gitops not updating FMA installer (#50000)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49811 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed Fleet-maintained app updates when a rebuilt installer keeps the same version. * Rebuilt installers now update their files, hashes, filenames, and install scripts correctly. * Prevented installers from being incorrectly skipped when their contents differ despite matching versions. * **Tests** * Added coverage for same-version installer rebuilds and team-specific caching behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
f5ca4b5b0d |
Add Android support for custom host vitals (#49696)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49421 Custom host vitals (`$FLEET_HOST_VITAL_<id>`) already worked in scripts and Apple/Windows configuration profiles, but Android configuration profiles and managed app configuration explicitly rejected them at upload to keep parity with `$FLEET_SECRET_*`. This left admins unable to inject per-host vitals (e.g. an asset tag) into Android MDM configuration the same way they can for every other platform. For more context, prior PRs: - https://github.com/fleetdm/fleet/pull/49334 - https://github.com/fleetdm/fleet/pull/49586 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually - Created an "Asset tag" host vital. - Enrolled an Android device. - Initially the test profile showed as "Failed" because no value was set for the vital. - Set a value for the vital, saw that it went from Enforcing to Verified. <img width="1446" height="510" alt="Screenshot 2026-07-24 at 8 57 46 AM" src="https://github.com/user-attachments/assets/c0e2348c-e521-48f3-85cd-6f884689b2cd" /> <img width="1520" height="936" alt="Screenshot 2026-07-24 at 8 56 56 AM" src="https://github.com/user-attachments/assets/169b9545-ec7a-429b-8f45-0e2740f61c77" /> <img width="1607" height="1136" alt="Screenshot 2026-07-24 at 8 57 30 AM" src="https://github.com/user-attachments/assets/a8213745-b224-4a36-a54d-32152a15c377" /> Also tested the rejection cases: - trying to upload a profile with an invalid custom host vital id (either a non-numeric value, a numeric but non-existent ID, and referencing a vital as a JSON key instead of a value) - deleting a vital referenced in a profile https://github.com/user-attachments/assets/e8b4acde-ddf4-41c0-b00a-5ab4945d0bc2 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Android app configurations and profiles now support custom host vital placeholders (`$FLEET_HOST_VITAL_<id>`). * Custom host vital values are expanded per device during Android delivery. * Managed Android profiles/configurations are automatically resent when a referenced vital value changes. * **Bug Fixes** * Added validation for malformed, missing, or undefined vital references during Android app association and profile/config uploads. * Prevented deletion of vitals referenced by Android profiles. * Improved error handling and delivery failure details when a device lacks a required vital value. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
ffc85a42ae |
Add Windows admin account config (#49863)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48720 Subtask of https://github.com/fleetdm/fleet/issues/43488 This PR only adds the Windows config, and doesn't mess with macOS configs. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added managed local account settings for Windows to app and team configuration, including GitOps support. * Exposed an explicit enabled/disabled toggle in configuration output and Fleet controls. * Added licensing and Windows MDM prerequisites for enabling the setting. * **Bug Fixes** * Managed local account enable/disable actions are now correctly persisted and declaratively applied. * Activity feed messages now display platform-specific (macOS vs Windows) wording. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew Mellor
|
f1228c873d |
47713 auld software update assets migration (#50036)
**Related issue:** Resolves #47713 - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for tracking available Apple OS update assets and supported devices. * Added per-host Apple OS update targets, deadlines, and resolution status. * Added configuration options for host target OS versions and deadlines. * **Database** * Updated the MySQL schema and migration seed data to include the new tables and fleet variables, and to reflect updated migration/status metadata. * **Tests** * Added migration tests to validate table creation, constraints, defaults, and upsert behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew Mellor
|
d06a4c222c |
47700 abm token invalid errors (#49770)
**Related issue:** Resolves #47700 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually. **_Not able to do for all code paths yet_** <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added `token_invalid` for Apple Business Manager tokens, automatically tracked based on Apple responses. * Enhanced host DEP assignment API responses with a structured `dep_device_error` field to classify why device details couldn’t be retrieved. * **Bug Fixes** * Improved error handling for DEP device lookup, distinguishing invalid/rejected tokens, expired terms, not-found devices, server/API errors, and unavailable/unspecified failures. * Added regression and unit test coverage for ABM token invalidation and DEP device error classification. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sharon Katzandcopilot-swe-agent[bot]
|
5c127e5fe4 |
Fix software ingestion lock convoys and unbatched deletes (#49894)
**Related issue:** Resolves #49805, Resolves #48719 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually --- ## Context A customer (~2,500 hosts, v4.89.1) had their DB writer slammed with `DELETE FROM host_software_installed_paths` statements carrying 30,000+ IDs each. These never completed, required repeated manual intervention, and the table grew from 14.5M to 14.8M rows in 2 days. This is #49805. While investigating, Victor linked #48719, a related `software_titles` INSERT lock convoy issue seen in load tests. Both are in the same software ingestion code path (`server/datastore/mysql/software.go`), so this PR fixes both. ## Root cause ### #49805: Unbatched DELETEs on `host_software_installed_paths` When a host's software changes, Fleet computes a delta and deletes stale rows from `host_software_installed_paths`. The function `deleteHostSoftwareInstalledPaths()` issued a **single** `DELETE FROM host_software_installed_paths WHERE id IN (?)` with all IDs expanded by `sqlx.In()`. With 30,000+ IDs and 14.8M rows in the table, these massive statements held row locks for minutes, timed out, and never completed. On the next agent check-in, the same (or larger) DELETE was retried, creating a feedback loop where the table grew unboundedly. Notably, the INSERT function for the same table (`insertHostSoftwareInstalledPaths`) already batched at 500 rows. The DELETE simply lacked the same treatment. ### #48719: INSERT IGNORE lock convoys on `software_titles` (related) When a host reports software that Fleet hasn't seen before, `preInsertSoftwareInventory()` runs `INSERT IGNORE INTO software_titles (...)` inside a `withRetryTxx` transaction. For homogeneous fleets (many hosts sharing the same software catalog, typical for imaged corporate Windows machines), hundreds of concurrent goroutines try to INSERT IGNORE the same title rows simultaneously. Even though `INSERT IGNORE` is a no-op when the row already exists, InnoDB still acquires row/gap locks on the unique index for the duration of the enclosing transaction. With many goroutines holding or waiting on the same index locks, the DB enters a "lock convoy" where sessions serialize on locks they don't actually need. In load tests (40 Fleet instances, 100K hosts, 141 identical Windows software items), this produced 690 average active sessions on the writer and 85s fleet-wide p99. The existing read-first check (`getIncomingSoftwareChecksumsToExistingTitles`) prevents the convoy at steady state. But on cold start (empty `software_titles`, e.g. after cleanup purges orphaned titles), the check finds nothing and all goroutines race to INSERT the same titles. ## How I reproduced it Started MySQL via `docker compose up -d mysql_test`, created a git worktree. ### #49805 `TestHostSoftwareInstalledPathsDeleteExplosion`: Created a host with 500 software items and installed paths, then replaced all software with an entirely new set. This triggers `deleteHostSoftwareInstalledPaths()` with all 500 old IDs in a single unbatched DELETE statement. At 500 IDs the local test completes quickly, but the structure confirms the problem: at 30K+ IDs on production Aurora with 14M rows, these never finish. ### #48719 `TestSoftwareTitlesInsertIgnoreLockConvoy`: Created 50 hosts, each reporting 100 identical software items (simulating a homogeneous fleet). Used a barrier to release all 50 goroutines simultaneously, then measured two phases: 1. **Cold start** (empty `software_titles`): All 50 hosts concurrently call `ds.UpdateHostSoftware()`. 2. **Steady state** (titles exist): Same 50 hosts re-ingest. **Before fix:** | Metric | Cold start | Steady state | |--------|-----------|-------------| | Wall time | 3.0s | 38ms | | Avg per-host | 1,981ms | 29ms | | **Convoy factor** | **79x** | | The 79x slowdown confirms the lock convoy. ## How I fixed it ### #49805: Batch the DELETE at 500 Changed `deleteHostSoftwareInstalledPaths()` from a single `DELETE ... WHERE id IN (all IDs)` to a loop that processes 500 IDs per batch, matching the existing INSERT batching pattern in the same file. ### #48719: Three-layer defense against lock convoys **Layer 1 - Move title INSERT IGNORE outside the transaction.** Previously, `INSERT IGNORE INTO software_titles` ran inside `withRetryTxx`, so locks were held for the full transaction duration. Now each title INSERT is executed via `ds.writer(ctx).ExecContext()` outside any transaction, auto-committing independently and holding locks for microseconds. **Layer 2 - singleflight per title key.** Added a `singleflight.Group` on the `Datastore` struct. For each title, only one goroutine actually executes the INSERT; concurrent goroutines wait and share the result. **Layer 3 - In-process cache (`sync.Map`).** After a title is inserted, its key is stored in `knownSoftwareTitleKeys`. Subsequent ingestions check the cache first and skip the INSERT entirely. `CleanupSoftwareTitles` clears the cache when it deletes orphaned titles. The three layers work together: the cache handles the common case (title already known), singleflight handles the cold-start race (only one INSERT per title), and auto-commit ensures even the winning INSERT holds locks for microseconds. ## How I tested that it works ### New reproduction tests - `TestSoftwareTitlesInsertIgnoreLockConvoy`: 50 concurrent hosts, 100 identical software items. Measures cold-start convoy factor and verifies all 100 titles are created. - `TestHostSoftwareInstalledPathsDeleteExplosion`: Full software replacement path with 500 items per host, including concurrent hosts. ### Existing test suite Ran all existing software tests including: - `UpdateHostSoftware`, `UpdateHostSoftwareDeadlock`, `PreInsertSoftwareInventory` - `SoftwareTitleUpgradeCodeDriftMatch`, `UpdateHostSoftwareSameBundleIDDifferentNames` - `CleanupSoftwareTitles` (validates cache invalidation works correctly) - `SaveHost`, `SyncHostsSoftware`, and ~80 other subtests All pass. ### After-fix measurements | Metric | Before fix | After fix | |--------|-----------|-----------| | Cold-start wall (50 hosts) | ~3.0s | ~1.4s | | Cold-start avg per-host | ~1,981ms | ~594ms | | Steady-state wall | ~38ms | ~7ms | | Titles created correctly | 100/100 | 100/100 | The remaining cold-start time is from other pipeline operations (`INSERT IGNORE INTO software`, host_software linking), not from `software_titles`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Performance Improvements** - Improved software inventory ingestion under large, concurrent workloads, including more efficient handling of repeated software-title inserts. - Reduced lock contention when many devices report the same titles at the same time. - Batched deletions of installed software-path records to speed up large updates. - **Bug Fixes** - Ensured deterministic, collation-safe software-title deduplication to prevent incorrect or stale title mapping. - Strengthened orphan cleanup behavior so caches are cleared when orphan titles are removed. - **Tests** - Added stress/regression tests for software-title insert contention and large installed-path delete workloads. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> |
||
|
Juan Fernandez
|
aeb56916ee |
Block host enrollment with empty enroll secrets
VerifyEnrollSecret matched by exact string, so an empty enroll_secret matched any stored empty secret and issued a valid node key. Guard the shared chokepoint: reject empty/whitespace secrets before matching, closing all enrollment paths (osquery, Orbit, Apple MDM, Android). Add a migration to delete pre-existing empty secrets. |
||
|
NicoandCopilot Autofix powered by AI
|
6bb0b1ea52 |
Stop leaking cross-team software title names via the hosts endpoint (#49638)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves: N/A # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected `software_title_id` filtering for hosts so software title details are strictly scoped to the current team and never backfill mismatched or out-of-scope data. * Removed unintended debug output and ensured software title details remain unset when the title isn’t accessible. * **Tests** * Added an enterprise integration test verifying cross-team `software_title_id` behavior. * Updated existing integration expectations for team-scoped visibility. * Added datastore coverage for team-scoped software title name lookup behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
George Karr
|
f75cd2e151 | Bump migration timestamps after 4.89.2 cherry-picks (#49849) | ||
|
Victor Lyuboslavsky
|
f72de68f43 |
Fixed unreleased Windows cert ingestion perf issue (#49787)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49705 Verified fix with 100k host Windows load test. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Bug Fixes** * Improved host certificate deduplication and automated self-healing when duplicate certificate records are ingested. * Updated source reconciliation to only change what’s stale, preventing unnecessary rewrites of unchanged source entries. * Ensured certificate sources consistently associate to the newest canonical certificate record for each certificate hash. * Improved certificate listing accuracy by returning a deduplicated set of certificate/source pairs with correct usernames. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
e42dc7accf |
Improved the performance of the configuration profiles status summary (#48873)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48340 Windows only. The fix is to use a rollup status table instead of recalculating the host profile summary on demand. Verified the fix in load test with 100k Windows MDM hosts. Note that this does not improve the host details page filtered by OS settings, which will be handled by the follow up https://github.com/fleetdm/fleet/issues/48996 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved Windows fleet configuration profile status summaries to avoid timeouts on large fleets. * Kept per-host Windows profile statuses accurate after profile updates, resends, certificate changes, cleanup, unenrollment, and host deletion. * Added automatic reconciliation to correct stale or orphaned status data. * **Data Integrity** * Improved Windows profile status reporting, including profile and BitLocker summaries, for more reliable results. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
83f3f4b560 |
Add clear error for Firefox / Firefox ESR conflict (#49714)
**Related issue:** Resolves #49682 Mozilla Firefox and Firefox ESR are distinct Fleet-maintained apps that share the macOS bundle identifier `org.mozilla.firefox`, so they resolve to one software title. Adding both to a fleet previously gave a generic conflict error (or no error at all). This adds a clear message — "Only one of Mozilla Firefox or Mozilla Firefox ESR can be added to the same fleet." — on both the single-add and GitOps/batch paths. The check is general (any two FMAs sharing a bundle identifier), with the app names filled in dynamically. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements). ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Prevented adding both Mozilla Firefox and Firefox ESR to the same fleet when they share a bundle identifier. - Updated the UI to show a specific conflict message explaining that only one of the two can be added. - Ensured existing workflows still work for adding new versions of the already-selected app. - **Tests** - Added backend and frontend test coverage for the new conflict detection and error-message formatting. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
9d6f25acd7 |
Make MFA token redemption atomic to prevent multiple sessions
Resolves #16770 The MFA login token redemption path (`POST /api/latest/fleet/sessions`) read the one-time verification token with a non-locking `SELECT` on the read replica, then created a session and deleted the token in a *separate* transaction without verifying the token was still present. Concurrent requests carrying the same token each passed the `SELECT` and each minted a distinct session, breaking the single-use guarantee. `SessionByMFAToken` now consumes the token and creates the session inside a single transaction: - The token row is locked with `SELECT ... FOR UPDATE`, then deleted, and the delete's rows-affected count is confirmed non-zero before the session is created. - Concurrent redemptions serialize on the row lock; the loser re-reads after the winner commits the delete, finds no row, and aborts before creating a session. - The user is still loaded *before* the transaction, so a concurrently-deleted user or a transient read error leaves the token intact for retry (preserving the pre-fix atomicity behavior). --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Juan Fernandez <juan@fleetdm.com> |
||
|
Juan Fernandez
|
fbccb8cc59 |
Emit created/deleted activities for setup experience scripts
Setup experience script add/replace/delete now record activities (API and GitOps), skipping no-op re-submissions. |
||
|
Juan Fernandez
|
d903ec58e1 |
Fix label update consistency issue
Persist label metadata and membership changes together in a single transaction so a failed update can't leave a partial change behind. |
||
|
Magnus Jensen
|
b9136f4da5 |
Release from AB backend support (#49680)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49367 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added “Release from Apple Business” for eligible Apple hosts, including per-device success/failure reporting and activity logging. * Added a new API endpoint to trigger the action and return results for each selected host with clear error details. * Introduced authorization rules for global admins and team admins to release only within allowed scope. * **Bug Fixes** * Improved validation and error handling: rejects oversized selections, reports unknown/ineligible hosts and DEP-related failures per device, and treats assignment-cleanup failures as non-blocking. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
10ac3c73a3 |
Harden password reset token handling
Ensure a password reset token can only be used once. |
||
|
George Karr
|
3b32a526ee |
Fix 500 on Apple MDM enroll when host has no DEP assignment (#47963) (#49623)
**Related issue:** Resolves #47963 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually ## Summary Fixes a 500 seen via monitoring during `POST /api/mdm/apple/enroll`: ``` checking os updates settings serial [redacted]: getting team id for host: sql: no rows in result set ``` ### Root cause During DEP enrollment, `CheckMDMAppleEnrollmentWithMinimumOSVersion` → `shouldOSUpdateForDEPEnrollment` calls `GetMDMAppleOSUpdatesSettingsByHostSerial`, which joins `hosts` to `host_dep_assignments` by serial. When no matching row exists yet — e.g. the enrollment request arrives before the host / DEP assignment row is created or replicated (replica lag / ordering) — `sqlx.GetContext` returns `sql.ErrNoRows`. The service layer already handles this case gracefully (skip the OS-update check, allow enrollment to proceed) via `fleet.IsNotFound(err)`. But the datastore wrapped the raw `sql.ErrNoRows` with a plain `ctxerr.Wrap`, which does not implement the `IsNotFound()` interface, so the graceful path never triggered and the request 500'd. ### Fix Convert `sql.ErrNoRows` into a proper `notFound` error in the datastore method, matching the existing pattern used throughout `apple_mdm.go`. This lets the existing service-layer graceful-skip path take over so enrollment proceeds. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed Apple MDM enrollment to continue gracefully when OS update settings are missing because a host’s DEP assignment hasn’t been created yet or hasn’t replicated. * Prevented enrollment from failing with an unexpected 500 error by returning a clear “not found” outcome instead. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
87c1a719c1 |
Support custom host vitals in host name templates (#49586)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49489 Custom host vitals were skipped when host name template enforcement (#38806) shipped, since both features were in development at the same time. This adds `$FLEET_HOST_VITAL_<id>` support to host name templates, matching the existing secret-variable pattern (validation, per-host resolution, resend on value change). I also introduced a new `IsInvalidReferencedCustomHostVitalsError` call after Copilot's comment below. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added support for `$FLEET_HOST_VITAL_<id>` in Apple host name templates. * Device-name template reconciliation now expands referenced per-host vital values and updates automatically when those values change. * **Bug Fixes** * Prevents deleting custom host vitals that are referenced by host name templates. * If a referenced vital has no value for a host, device-name delivery is marked failed for that host (retryable). * **Improved Error Handling** * Refined validation behavior so unknown/malformed vital references return user-facing invalid-argument errors, while infrastructure errors propagate unchanged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Magnus Jensen
|
966838b159 |
Don't queue profiles for non host_mdm.enrolled Apple hosts (#49611)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48845 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Apple MDM reconciliation no longer queues profiles for deleted or non–MDM-enrolled hosts. * Apple MDM reconciliation batching/snapshots now include only hosts with confirmed active MDM enrollment, reducing incorrect or stale reconciliation candidates. * **Tests** * Added MySQL datastore coverage to validate reconcile snapshot selection and reconcile host lookup behavior. * Improved Apple MDM and related test setups to explicitly ensure required MDM server configuration exists before reconciliation assertions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew Mellor
|
d5d1b1197e |
Add migration to track invalid ABM token state (#48560)
**Related issue:** Resolves #47698 # Checklist for submitter If some of the following don't apply, delete the relevant line. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for marking ABM tokens as invalid with a new default-enabled status field. * Existing token records are now initialized with a valid default state during the update. * **Tests** * Added coverage to verify the new token status field is created correctly and backfilled for existing records. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Lyuboslavsky
|
e14ef67b55 |
Fix Windows Autopilot ESP hang: gate release on user-scope ack (#49134) (#49542)
The ESP release wrote the user-scope ServerHasFinishedProvisioning Replace and immediately committed awaiting_configuration=None. During OOBE the device rejects user-scope writes with SyncML 405 until its user MDM context initializes, so the Account setup phase never received its completion signal and the device hung until the 3-hour timeout, while Fleet believed the ESP had completed (and relaxed the DMClient poll, crippling remediation). The release path now stays Active until the device acks the user-scope Replace with a 200: a new resend phase re-sends the Replace once per session (bounded by the existing 3-hour timeout), and the Active->None transition commits only on the 200. Live-validated on Win11 26200 on both a fresh and a re-enrolled device: the 405 reproduced at release time in both flows, and the retried Replace acked 200 one session after the user context came up, releasing the ESP. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49134 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes - Fixed an issue where Windows Autopilot enrollment could intermittently hang at **“Account setup”** on the Enrollment Status Page. - Updated Enrollment Status Page release handling so enrollment **stays active until the device acknowledges** the user-scope completion command. - When the user-scope completion is rejected or still unacknowledged, it is **retried in subsequent management sessions** until successfully acknowledged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
5d8296cd82 |
Improve custom host vital missing-value error message (#49640)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44954 When a custom host vital referenced in a script or profile has no value set for a host, the delivery failure detail didn't name the vital, making it hard for admins to tell which one needed a value. The message now includes both the vital's name and its `$FLEET_HOST_VITAL_<id>` token. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved missing custom host vital error messages by including both the vital name and its corresponding environment variable identifier. - Updated the wording to be clearer about why values can’t be populated when no value is set for the host. - Kept singular vs. plural messaging correct when one or multiple vital values are missing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrew MellorandJordan Montgomery
|
15a0f4b201 |
48342 edit config profile endpoint (#49141)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48342 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for editing existing Apple, Windows, and Android configuration profiles through the API. * Supports updating profile content, names where applicable, label targeting, and Fleet variable associations without replacing the profile identity. * Added support for editing Apple DDM declarations. * Added activity tracking for configuration profile edits. * **Bug Fixes** * Added validation for unsupported edits, invalid labels, duplicate names, missing profiles, and protected Fleet-managed profiles. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> |
||
|
Carlo
|
fb0e817bd0 |
Show .py script-only packages as available for install on macOS hosts (#49457)
**Related issue:** Resolves #49455 Offer `.py` script-only packages on macOS hosts, matching `.sh`. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Python (`.py`) installer packages are now treated as compatible alongside shell (`.sh`) installers on macOS and Linux. * Python installers can now appear in software availability, self-service installation, and setup experience selections. * Windows behavior remains unchanged (Unix-script installers are excluded). * **Bug Fixes** * Improved cross-platform compatibility matching for Unix-like hosts when choosing the first eligible installer package. * **Tests** * Added and expanded unit/integration coverage for `.py` installer compatibility across platforms and flows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Nico
|
900c54e822 |
Fix label membership being cleared when a label query errors (#49403)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #46399 When a label's query errors on a host (e.g. the extension socket is unavailable) instead of returning zero rows, Fleet was recording that error the same as a definitive "no match," clearing the host's existing label membership. This could unintentionally remove configuration profiles or other automations scoped to that label. The fix leaves existing label membership untouched when a label query errors. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually **Setup:** macOS VM enrolled as a Fleet host, with a dynamic label whose query targets a real, always-present table but with a deliberately invalid `WHERE` clause, so the query fails deterministically (a `no such column` SQL error). ```sql -- working version (label matches) SELECT * FROM os_version; -- broken version (query errors on every run) SELECT * FROM os_version WHERE this_column_does_not_exist = 1; ``` ### Before (bug reproduced on unpatched code) 1. Set the label's query to the working version and refetched the host — confirmed it shows up under the host's Labels. 2. Edited the label's query to the broken version. 3. Clicked **Refetch** on the host. 4. **Result:** the label disappeared from the host's Labels list — a query error incorrectly cleared existing membership. ### After (fix verified) 1. Reset the label's query to the working version and refetched — confirmed membership was restored. 2. Edited the label's query to the broken version again. 3. Clicked **Refetch** on the host. 4. **Result:** the label remained on the host's Labels list — a query error now correctly leaves existing membership untouched. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Preserved existing dynamic label memberships when label queries fail or yield unknown results. * Avoided treating unknown/failed evaluations as label removals. * Ensured label updates/removals are applied only when a definite match or non-match is returned. * **Tests** * Expanded coverage for label query errors across datastore, async processing, and distributed execution to confirm memberships remain unchanged. * Updated expectations for queued async updates to skip errored labels. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
7cb2399700 |
Redirect FMA installs to the active version after auto-update (#49525)
**Related issue:** Resolves #49495 Redirects queued Fleet-maintained app installs to the newly-active installer (canceling already-dispatched ones) atomically when an auto-update or pin change flips the active version, and re-resolves install retries to the active installer, so a host no longer installs a superseded cached version. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fleet-maintained app installs now consistently use the currently active version after automatic promotions, preventing stale installer targeting. * Queued installs tied to an older promoted installer are redirected to the newly active installer instead of being canceled. * Install retry flows now re-resolve to the active installer at retry time, avoiding stale retries after version changes. * **Tests** * Added datastore coverage for active-installer redirection and updated retry tests to verify the correct installer ID is used. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Katz
|
8a33fcd058 |
Fix FMA pinning not changing patch policy (#49519)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49474 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - Relied on integration test for testing changes made by the `maintained_apps_auto_update` job <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed patch policies for Fleet-maintained apps not updating when the active app version changes. * Patch policy queries now refresh to match the currently active (or pinned) installer version, including changes driven by pinning, cron, and GitOps. * Improved behavior when pins are cleared or switched, ensuring the policy continues referencing the correct version-specific query. * **Tests** * Expanded integration coverage to verify version-pinned patch policy queries across scenario updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Carlo
|
8cd9503267 |
Fix false-success reporting for failed software installs (#49515)
**Related issue:** Resolves #49475 Makes a non-zero install-script exit code a terminal failure so an install that failed but whose post-install script exited 0 is no longer reported as installed, in both the Go status computation and the `host_software_installs` `status`/`execution_status` generated columns. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. Redefining the `status`/`execution_status` generated columns rebuilds the table, but `ON UPDATE CURRENT_TIMESTAMP` is not triggered by `ALTER TABLE`, so `updated_at` is preserved. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Installations that fail during the install script are now correctly reported as failed, even if the post-install script succeeds. * Install and execution status reporting is now consistent about which script exit code takes precedence. * Pending, successful, failed, canceled, and uninstall outcomes continue to be reported correctly. * **Tests** * Added regression/unit test coverage for install-status and execution-status precedence across mixed install/post-install exit code scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lucas Manuel Rodriguez
|
da3f30df79 |
Allow Microsoft conditional access on premium self-hosted (#49414)
Resolves #47699. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Microsoft Entra Conditional Access is now supported for self-hosted Fleet Premium instances. * Conditional Access is available only on the Fleet Premium license tier. * **Changes** * Removed the Microsoft Compliance Partner API key configuration and updated the proxy behavior accordingly. * Removed the managed-cloud indicator from license/config responses and adjusted related UI rendering and gating. * **Tests / Maintenance** * Updated fixtures and automated tests to reflect the new licensing gates and API/proxy behavior (including updated failure codes). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Juan Fernandez
|
0d3a3bdc95 |
Added audit activities when secret variables are upserted
Added audit activities when secret variables are created or updated through the `PUT /api/latest/fleet/spec/secret_variables` endpoint. |
||
|
Juan Fernandez
|
83cef5483f |
Extend support for all built-in
Relates to #38806 Extend host name templates beyond the three host-identity variables to also accept the IdP end-user variables, and re-enqueue the rename when a referenced variable's value changes. Re-enqueue on value change: - An IdP data change (SCIM user/group create/update/delete) re-queues only the affected hosts whose template uses the changed IdP variable — IdP values are per host, so the scope is the specific hosts mapped to that user/group. - A custom (secret) value change re-queues every eligible host in each team / "No team" whose template references the changed secret — secret values are global, so the scope is the whole team/No-team. Built-in variables intentionally NOT supported: - Certificate/CA variables — $FLEET_VAR_NDES_SCEP_CHALLENGE, _NDES_SCEP_PROXY_URL, _CUSTOM_SCEP_CHALLENGE_*, _CUSTOM_SCEP_PROXY_URL_*, _SMALLSTEP_SCEP_CHALLENGE_*, _SMALLSTEP_SCEP_PROXY_URL_*, _DIGICERT_DATA_*, _DIGICERT_PASSWORD_*, _SCEP_WINDOWS_CERTIFICATE_ID, _CERTIFICATE_RENEWAL_ID (and legacy _SCEP_RENEWAL_ID), _PSSO_DEVICE_REGISTRATION_TOKEN. These resolve to one-time SCEP challenges, proxy URLs, base64 PKCS12 cert data, or Fleet-minted tokens — meaningless as a device name, and resolving them has side effects (issuing certificates, consuming one-time challenges) and would leak secrets into a name that's broadcast on-device, in osquery, and in the UI. - Legacy $FLEET_VAR_HOST_END_USER_EMAIL_IDP — deprecated ("avoid in new replacements") and not a documented built-in variable, so it's excluded in favor of the supported IDP_USERNAME variables. |
||
|
Juan FernandezandKonstantin Sykulev
|
621ede7584 |
Software > OS: Show Android versions and vulnerabilities (#49399)
Resolves #35075 - Added vulnerability (CVE) reporting for Android OS versions. - Folded the Android security patch level into the host's OS version. --------- Co-authored-by: Konstantin Sykulev <konst@sykulev.com> |
||
|
Carlo DiCelico
|
4ce133cb26 | merge main |