fleet

Author	SHA1	Message	Date
Jonathan Katz	a0805e49d8	Add software installer file size check before upload (#50475 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #42735 - Exposes max_software_package_size in the `GET /api/v1/fleet/config` endpoint - Add frontend logic to use it to deny files that are too big before they get uploaded # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually - Tested on Chrome, Safari, and Firefox on macOS <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added a configurable maximum software package size to application settings. * Software uploads exceeding the limit are rejected with a clear, size-specific error message. * Packages at or below the configured limit are accepted. * Added user-friendly file-size formatting across common units. * Upload validation accounts for the complete request size, including scripts and settings. * Tests * Added coverage for upload validation, boundary conditions, size formatting, and configuration responses. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-05 15:57:20 -04:00
Magnus Jensen	1abeb175f3	AULD: Enrollment insert and backfill osquery query (#50131 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #47714 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. (Will be part of another PR) - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Collect and persist macOS software update device identifiers for hosts during both manual and OTA enrollment flows. * Added an osquery detail/query to derive the identifier from hardware properties and upsert it into datastore. * Bug Fixes * Host deletion now also removes related Apple macOS OS update records. * Improved Device Recognition * Enhanced Mac model identifier parsing and refined Apple Silicon detection with expanded test coverage. * Reliability * Enrollment profile delivery remains unaffected if saving the identifier fails (errors are logged). <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-05 15:37:05 +02:00
Andrew MellorandMagnus Jensen	192ac4eb51	48093 auld api gitops latest os version (#50213 ) Related issue: Resolves #48093 - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added “latest” version enforcement for macOS, iOS, and iPadOS updates using required `deadline_days`. * Updates dynamically target each device’s available OS version and deadline. * Configuration and GitOps outputs now include `deadline_days`. * Bug Fixes * Improved validation when switching update modes or omitting deadline settings. * GitOps updates now clear previously stored deadline values when omitted. * Changes to `deadline_days` are detected and applied consistently. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Magnus Jensen <magnus@fleetdm.com>	2026-08-05 12:37:11 +01:00
Rajendra Kadam	5e95589554	Support custom activations and management declarations for DDM profiles (#50280 ) Related issue: Resolves #49970 Adds custom activations to the single-profile paths for declaration (DDM) profiles — create, edit, delete and read — and unblocks management declarations. Part of #48222. Batch/GitOps is #49972; serving the custom activation to devices is #49971. ### Custom activations - `POST /configuration_profiles` and `PATCH /configuration_profiles/{uuid}` accept an optional `activation` file part, rejected for any profile type other than an Apple declaration. - Validation requires an activation `Type` (any `com.apple.activation.`, so future Apple types need no Fleet change), an `Identifier`, and exactly one `StandardConfigurations` entry naming the configuration it ships with. `Predicate` and every other key are stored and served verbatim for the device to evaluate. - Premium-only, unconditionally. `parseAndValidateAppleDeclaration` requires premium only when a fleet or labels are involved, so an unassigned unlabeled DDM profile is free today; the activation carries its own gate. - The activation's Fleet variables are validated against `fleetVarsSupportedInDDMDeclarations` — already exactly the set specified for activations — and associated via `mdm_configuration_profile_variables.apple_ddm_activation_uuid`. - Returned base64-encoded on both the list and single-profile endpoints, per the API reference draft (#49768), and omitted entirely when absent. What an edit does to a stored activation: \| Request \| Result \| \| --- \| --- \| \| activation supplied \| replaces the stored one \| \| new profile content, no activation \| stored one is cleared — this is how it's removed \| \| labels-only edit \| stored one is carried forward \| The third row matters: the datastore clears the activation of any declaration written without one, so a labels-only edit rebuilding the declaration from the existing row would otherwise silently wipe it. `GetMDMAppleDeclaration` loads the activation so it can be carried forward, and there's a test asserting it. ### Management declarations `com.apple.management.` uploads are unblocked via a prefix check, so future management declarations work without a product change. Types to block go in the existing `ForbiddenDeclTypes` deny list, which is already evaluated ahead of the prefix. An activation supplied alongside a management declaration is rejected — those are never activated. Routing them to the manifest's Management section is #49971's work. ### Notes for review Where the non-declaration guard lives differs by path, deliberately. Create resolves the profile type in the endpoint from the uploaded file; edit resolves it in the service from the UUID prefix. The check sits wherever the type becomes known. Both use the same message so the mistake reads identically. Endpoint-level errors must be returned from behind an authz check. The create-path guard originally returned the error straight from the endpoint, which skips authorization and surfaces to the client as a bare `forbidden` rather than the validation message. It now goes through `NewMDMActivationUnsupportedProfile`, alongside the existing `NewMDMUnsupportedConfigProfile` and `NewMDMInvalidJSONConfigProfile`, which exist for the same reason. This was caught by the integration tests, not the unit tests — service-level tests bypass the authz middleware. Activation rows are keyed on `declaration_uuid`, not inserted fresh. An edit reuses the row, so the Fleet variable associations hanging off it survive. The UUID is read back after the upsert rather than reusing the generated one, since `ON DUPLICATE KEY UPDATE` keeps the existing row. Secrets are expanded for validation but stored unexpanded, so validation runs against the document the device receives without persisting secret values. `MDMAppleCustomActivation` is the storage type; `MDMAppleDDMActivation` was already taken by Apple's wire format. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. No changes file: the feature isn't reachable by users until the DDM sync work in #49971 lands. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually Unit* (`server/fleet`): `GetRawActivationValues` and `ValidateUserProvided` — valid activation, unknown type under the activation prefix, missing `Type`, a configuration type supplied as an activation, missing `Identifier`, zero/multiple/mismatched `StandardConfigurations`, all problems reported at once, plus `IsManagementDeclaration`. Service (`server/service`): activation accepted, mismatched configuration rejected, malformed JSON rejected, rejected on a management declaration, supported Fleet variables recorded, unsupported rejected, premium required even where the declaration is free. On edit: activation-only edit keeps content, labels-only edit preserves the activation, new content without an activation clears it, and exactly one `edited_declaration_profile` activity fires. Datastore (`server/datastore/mysql`): write, read-back through list and single get, edit reusing the row, Fleet variable association, and removal cascading to the variable rows. Integration (`integration_mdm_ddm_test.go`): multipart upload with an activation, read back and asserted base64-decoded against the raw response body; the key omitted entirely for a declaration without one; two management declarations uploaded and coexisting; activation on a `.mobileconfig` rejected on both create and edit; activation-only `PATCH` replacing the activation while leaving the declaration untouched. The multipart test helper now supports more than one file part — nothing could build that request before, which is why the decode path was previously untested. Single-file callers are unchanged. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added optional custom activations for Apple DDM configuration declarations. - Activations support secrets, Fleet variables, and custom host vitals. - Activation data appears when viewing or downloading applicable profiles. - Activation files can be added, updated, preserved during label-only edits, or removed during content replacement. - Management declarations can coexist with supported configuration declarations. - Validation - Added checks for declaration matching, supported profile types, file limits, and Premium licensing. - Clear errors are provided when activations are used with management declarations or non-DDM profiles. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-05 15:29:52 +05:30
Victor Lyuboslavsky	a4af4d896c	Add default fleet for new Windows MDM enrollments (#41787 ) (#49922 ) Demo: https://www.youtube.com/watch?v=cWxZlu9WuwA Guide updates: https://github.com/fleetdm/fleet/pull/49603/changes IT admins can configure the fleet that hosts enrolling through user-driven Windows MDM enrollment (Windows Autopilot, Entra join) are automatically assigned to, via the Windows MDM settings page, the mdm.windows_enrollment.default_fleet config setting, or GitOps. - New windows_enrollment_config row stores the default team; the config API surfaces it by fleet name and hydrates reads from the row so team renames and deletions never serve a stale name. Deleting the fleet clears the setting. - New edited_windows_enrollment_default_fleet activity, emitted only when the value changes. - The OMA-DM session persists the device-reported SMBIOS serial on still-unlinked enrollments, and orbit enrollment reverse-links by that serial and assigns the default fleet before orbit's one-shot setup-experience init, so the default fleet's software, scripts, and profiles apply during the Autopilot ESP. The DevDetail and osquery link paths keep the same assignment as fallbacks, and the EUA-token link path now shares the same post-link bookkeeping. - Hosts are only assigned when new to Fleet in this enrollment cycle: existing hosts, including ones parked in Unassigned, keep their fleet on re-enrollment, matching macOS ABM behavior. - GitOps defers applying the setting until teams declared in the same run are created, and fleetctl generate-gitops exports it. - Windows MDM settings page redesign per Figma: programmatic enrollment toggle, User driven enrollment section with the Entra-gated Default fleet dropdown, and a Migration section. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #41787 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added support for assigning a default Fleet Premium fleet to new Windows MDM enrollments, including Autopilot and Entra join. * Default-fleet settings can be configured, cleared, and managed through Windows MDM settings and GitOps. * Assigned fleet software, scripts, and profiles can apply during out-of-box setup. * Added activity-feed visibility for default-fleet changes. * Improved Windows enrollment matching using hardware serial numbers. * Documentation * Documented default-fleet assignment for Windows enrollment. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-04 16:30:02 -05:00
Victor Lyuboslavsky	bd601fff84	Fixed nilaway issues (#50405 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #50404 - Refactored `ListHostSoftware` and `ModifyAppConfig` functions beeing too big for nilaway - Added a hard check to make sure all our funcitons/packages are being analyzed by nilaway # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Improvements * Improved software inventory filtering for self-service and macOS applications, producing more accurate results. * Improved application configuration updates so saved settings and related system changes are processed more reliably. * Quality * Added automated checks to identify overly complex functions and help maintain code quality. * Updated static analysis tooling and expanded validation coverage with new tests. * Documentation * Added a changelog entry describing the latest reliability and maintainability improvements. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-04 15:41:18 -05:00
Dante Catalfamo	f17c8cbd8d	Bound Google Workspace directory sync pagination (#50092 ) Related issue: Resolves #49365	2026-08-04 11:36:02 -04:00
Juan Fernandez	60ad78f897	Add Omarchy as a supported Linux platform Resolves #50069 Omarchy 4 ships its own /etc/os-release with ID=omarchy, where earlier versions inherited ID=arch from Arch Linux. Since HostLinuxOSs and HOST_LINUX_PLATFORMS gate nearly every Linux check, these hosts had empty vitals and software inventory, were missed by linux-scoped policies and labels, had no disk encryption or key escrow, and lost Run script in the UI (the API was unaffected). Add "omarchy" to HostLinuxOSs, HostNeitherDebNorRpmPackageOSs (pacman- based), IsLUKSSupported, HOST_LINUX_PLATFORMS, DISK_ENCRYPTION_SUPPORTED_LINUX_PLATFORMS, and the Vitals disk-encryption tooltip. Regenerate understanding-host-vitals.md. Aggregate Omarchy onto the "Arch Linux" / "rolling" OS inventory row, where these hosts sat before quattro. Unlike CachyOS, Omarchy reports a real release number rather than BUILD_ID=rolling, so the version is pinned after parsing instead of rewriting the ingested build value. Also add a fleetd test container, built on archlinux since Omarchy publishes no image.	2026-08-04 10:32:44 -04:00
Juan Fernandez	d92b7284d0	Trigger software_checksum_migration on startup Relates #36365 Makes the software_checksum_migration cron to run automatically on server startup.	2026-08-04 09:35:36 -04:00
Lucas Manuel Rodriguez	f053a9fd49	Allow enabling/disabling software inventory per-fleet via the API (#50481 ) Resolves #45735. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [x] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Team settings can now enable or disable Software Inventory through API updates. * Partial updates preserve existing settings when the Software Inventory option is omitted. * Software Inventory configuration can be re-enabled after being disabled. * Bug Fixes * Invalid or null Software Inventory values are handled correctly without affecting global or Unassigned settings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-04 08:48:32 -03:00
Juan Fernandez	e529d97897	Fix duplicate software inventory entries from v4.76.0 checksum change Resolves #36365 The v4.76.0 checksum change (#34097) reordered the fields hashed into `Software.ComputeRawChecksum` for non-`apps` sources, so software rows created before the upgrade no longer matched re-ingested rows and got duplicated (same name/version/source, split host counts). - Make `ComputeRawChecksum` the sole source of truth and delete the drifted parallel SQL checksum formula that caused the mismatch. - Add `ReconcileSoftwareChecksums`, a one-shot migration that merges existing duplicates onto the canonical row (batched host_software repointing) and logs each merge. Runs once after startup; re-run with `fleetctl trigger --name software_checksum_migration`	2026-08-04 07:12:16 -04:00
Magnus Jensen	6ce0f70ebc	Not Now edge case fixes for Apple profiles (#50044 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #47411 (Speculative, but we will keep investigating if we get new reports) # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Bug Fixes* - Fixed Apple MDM profile handling for devices that respond with “Not Now” by ensuring the response is issued only on first delivery and doesn’t trigger repeated retries. - Improved reconciliation so superseded InstallProfile commands are properly canceled and cleanup is correct for user-scoped and pending installs. - When host verification fails after an acknowledged install, devices now receive the appropriate RemoveProfile operation. - Tests - Added regression integration coverage for “Not Now” cancellation, scope changes, profile edits, undelivered installs, and failed verification cleanup. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-04 09:40:20 +02:00
Sharon Katz	301e0e009b	Improve Windows profile LocURI content validation (#49715 ) Related issue: Resolves fleetdm/confidential#16881 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Improved Windows MDM validation for `LocURI`, ensuring full values are considered before checks. * Rejects empty or whitespace-only `LocURI` entries. * Strengthens `LocURI` validation for Fleet-reserved, SCEP-specific, and BitLocker-related formats after complete assembly. * Tests * Added new test cases for malformed BitLocker `LocURI` values split across CDATA and XML comment boundaries. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-03 13:39:38 -04:00
Victor Lyuboslavsky	05bc7be89e	Add Windows managed local admin account support to fleetd (#50088 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48723 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows (did not do macOS, but should be the same as Linux) - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added support for Fleet-managed local administrator accounts on Windows. * When enabled, creates or updates a hidden `_fleetadmin` account, securely generates a password, and escrows it to Fleet. * Reports provisioning errors and supports safe retries without blocking other configuration updates. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-03 11:15:20 -05:00
Victor Lyuboslavsky	98060b08a6	Add Windows managed local account server flow (#48721 ) (#49924 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48721 Part 2 of https://github.com/fleetdm/fleet/issues/43488 # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Windows devices can now create and securely escrow managed local account passwords during enrollment. * Added Windows managed local account status and password availability to host details. * Device-reported setup errors are surfaced with helpful details. * Account creation is automatically requested when supported by the device, plan, and configuration. * Bug Fixes * Windows accounts are excluded from password rotation workflows. * Re-enrollment correctly triggers account creation when needed. * Passwords remain available when settings change after enrollment. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-03 09:03:27 -05:00
Juan Fernandez	6c3de12f69	Base Orbit enrollment end user auth on server policy EnrollOrbit now determines end user authentication requirements from server policy rather than the client-supplied X-Fleet-Capabilities header, which is treated as an informational hint. Adds the mdm.allow_orbit_end_user_auth_bypass setting (enabled by default) controlling whether hosts that do not complete end user authentication may enroll into a team that requires it; set it to false to strictly enforce end user auth. The setting also governs installers built with fleetctl package --bypass-end-user-auth.	2026-08-03 07:40:48 -04:00
Lucas Manuel Rodriguez	001b57cb9d	Optimize memory usage in CVE chart cron job (#50385 ) Resolves #50266. At production numbers the table looks like this - 20,691 CVEs × 83,000 hosts, ~268M raw (cve, host) rows (software + OS joins combined): ``` ┌─────────────────────────┬─────────────────────────┬───────────────────────┐ │ Shape of host IDs │ Old (map[string][]uint) │ New (roaring bitmaps) │ ├─────────────────────────┼─────────────────────────┼───────────────────────┤ │ Dense (contiguous runs) │ 2,479 MB │ 4.5 MB │ ├─────────────────────────┼─────────────────────────┼───────────────────────┤ │ Sparse (random) │ 2,488 MB │ 282 MB │ └─────────────────────────┴─────────────────────────┴───────────────────────┘ ``` A few things worth noting about how these map to your real data: - The old cost is shape-independent: ~2.5 GB retained just for the result map (268M rows × 8 bytes plus append slack), and the peak during collection is higher still because append doubling leaves garbage behind. That's the number that was blowing up the cron. - The new sparse figure is an overstated worst case. Your 268M rows include duplicates — multiple vulnerable software rows per host for the same CVE (the multi-kernel case) and overlap between the software and OS joins. The old code retained every raw row; the bitmap dedupes on Add, so it's bounded by unique pairs, and real fleets with AUTO_INCREMENT host IDs sit much closer to the dense row than the sparse one. - The new representation also has a hard ceiling the old one doesn't: a roaring bitmap over 83k host IDs maxes out around 16 KB per CVE regardless of contents, so even a pathological dataset caps at ~330 MB for all 20,691 CVEs — versus the old form growing linearly with join rows, unbounded. TL;DR: At scale the change is roughly a 550× reduction in the realistic (dense) case, and at minimum ~9× in the theoretical worst case. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [X] Confirmed that the fix is not expected to adversely impact load test results - [X] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Performance - Reduced memory usage for CVE chart data collection. - Improved efficiency when processing large CVE and affected-host datasets. - Bug Fixes - Preserved correct CVE filtering, duplicate-host handling, disabled-fleet exclusions, and empty-result behavior. - Added coverage for CVEs sourced from both software and operating-system data. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-02 14:16:34 -03:00
Victor Lyuboslavsky	f7ffc07062	Improved software ingestion performance (#50354 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #50305 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Performance Improvements * Improved software ingestion performance by optimizing software title lookups. * Reduced unnecessary database scanning while preserving matching for bundle identifiers, names, and Windows upgrade codes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-08-01 07:20:05 -05:00
Jonathan Katz	45abf8c9ad	Add software installer upload/download progress to GitOps runs (#50250 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #45728 Changes: - Adds a new redis key to keep track of downloaded packages. It starts out with an empty list and gets filled with each download. Each update writes the entire struct at once to the key. - Adds logging in the fleetctl gitops client to show which packages were downloaded - Fixes the categories key potentially expiring # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - ❌ Timeouts are implemented and retries are limited to avoid infinite loops - Right now the batch will write the whole slice of all packages to a single redis key for every package in the loop. Looks like performance is acceptable for now (500 packages), but maybe this will need to be limited. - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## New Features - Added per-package software download progress in fleetctl GitOps. - Progress now reports downloading, completed, skipped, and failed packages during real and dry runs. - Installation output now distinguishes applying and applied stages. ## Bug Fixes - Improved download error messages and cached-package handling. - Prevented duplicate progress messages and ensured tracking issues do not interrupt successful software batches. ## Tests - Expanded coverage for progress reporting, failures, dry runs, package types, and authorization scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-31 21:36:44 -04:00
Dante Catalfamo	2fd2a02e2d	Split MDM platform helpers by Android semantics (#50185 ) Related issue: Resolves #46118	2026-07-31 15:52:19 -04:00
Luke Heath	cb44e287f2	Fix high-severity CodeQL and Scorecard code scanning alerts (#50333 )	2026-07-31 14:46:31 -05:00
Lucas Manuel Rodriguez	0dc8c382c5	Add 'linux' as platform for labels (#50270 ) Resolves #44088. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [X] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added Linux as a label platform option. * Linux labels now apply across supported distributions, including Ubuntu, Debian, RHEL, CentOS, and generic Linux hosts. * Updated platform names for improved clarity and consistency. * Bug Fixes * Improved platform matching so Linux labels apply consistently to compatible hosts. * Removed the obsolete Zorin platform option. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-31 15:02:57 -03:00
Bas Bleijerveld	60e6827071	Fix Apple built-in label memberships during ADE (#50287 ) Related issue: Resolves #50285 ## Summary - Restore the `All Hosts` and Apple platform built-in label memberships in the same transaction that clears stale host state during Automated Device Enrollment (ADE). - Backfill missing built-in memberships for existing macOS, iOS, and iPadOS hosts. - Add regression coverage confirming that an iPadOS update declaration remains targeted and reaches verified status after the enrollment reset. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one host's records do not affect another) - [ ] QA'd all new/changed functionality manually Automated verification: ```sh MYSQL_TEST=1 go test -run 'TestMDMApple/MDMAppleResetOnReenrollment' ./server/datastore/mysql MYSQL_TEST=1 go test -run TestUp_20260731100711 ./server/datastore/mysql/migrations/tables MYSQL_TEST=1 go test -run 'TestIntegrationsMDM/TestIPadOSUpdateDeclarationAfterMDMReset' ./server/service go test -run TestMDMTokenUpdateResetOnReenrollment ./server/service go vet ./server/datastore/mysql ./server/service go build ./server/datastore/mysql/migrations/... make test-schema ``` ## Database migrations - [x] Checked schema for all modified tables for columns that auto-update timestamps during migration. - [x] Confirmed that timestamp behavior is acceptable and will not cause unwanted side effects. The migration inserts only missing memberships and leaves existing membership timestamps unchanged. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Apple devices now retain their built-in label memberships after Automated Device Enrollment or MDM reset. * Label-scoped profiles, software, and operating system updates can now continue to be delivered after a reset. * Platform-specific memberships are restored for macOS, iOS, and iPadOS devices, including applicable hosts with unspecified platforms. * iPadOS update declarations now reconcile successfully after an MDM reset. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-31 16:50:03 +02:00
Nico	7f1b330c90	Restrict deleting a fleet to global admins (#50271 ) # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Restricted fleet deletion to users with global write permissions, including global administrators and GitOps. * Corrected team deletion authorization to require global write access. * Prevented global technicians, team technicians, and observer-level users from deleting teams. * Updated authorization behavior to consistently enforce the required access level. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-31 08:43:51 -03:00
Rajendra Kadam	9d0f510a8d	Add DDM custom activations schema (#50133 ) Related issue: Resolves #49966 Adds the schema for custom DDM activations (parent story #48222). - Creates `mdm_apple_ddm_activations` — stores the activation JSON as-is (`mediumtext`, so the generated `token` column hashes the exact stored bytes) with a `declaration_uuid` FK to `mdm_apple_declarations` that cascades on delete. - Extends `mdm_configuration_profile_variables` with `apple_ddm_activation_uuid` so activations can carry Fleet variables (needed by #49970). - Adds `activation_updated_at` to `host_mdm_apple_declarations` so a changed activation regenerates the declaration's effective token, mirroring `variables_updated_at` / `assets_updated_at`. - Drops `mdm_apple_declaration_activation_references` — created with the original DDM tables in `20240327115530_AddDDMTables.go`, never written to by any code path, so it is empty in every deployment. ### Deviations from the SQL in #49966 The `declaration_uuid` FK is the one addition, [confirmed with @MagnusHJensen](https://github.com/fleetdm/fleet/issues/49966): it keeps the 1:1 lifecycle enforced by the database rather than requiring cleanup in every delete path. `configuration_identifier` is kept alongside it for validation and DDM serving. Its unique key doubles as the FK's backing index. The rest are corrections needed for the specced SQL to work, all following the precedent in `20260409153715_AddDDMVariablesSupport.go`: - `ck_mdm_configuration_profile_variables_exactly_one` is dropped and re-added to count the new column. That constraint requires exactly one owner column to be non-null; adding a seventh without updating it means any row setting `apple_ddm_activation_uuid` sums to 0, fails the check, and is rejected. - `UNIQUE (apple_ddm_activation_uuid, fleet_variable_id)` added to match the six existing owner columns. That table's write path is `INSERT ... ON DUPLICATE KEY UPDATE`, which needs a unique key to collide on. - `activation_updated_at` is `DATETIME(6)`, not `TIMESTAMP(6)` — its siblings are `datetime(6)` and `EffectiveDDMToken` formats them into the token string, so `TIMESTAMP`'s session-timezone conversion on read would change tokens and re-push declarations to every host. - `team_id` gets `DEFAULT '0'` to match `mdm_apple_declarations`, where 0 is Unassigned. ### Note for #49970 `declaration_uuid` is `NOT NULL`, so the upload path must populate it in addition to `configuration_identifier`. The declaration UUID prefix has no separator (`MDMAppleDeclarationUUIDPrefix = "d"`, 1 char + 36-char UUID = the full `varchar(37)`). # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. No changes file: this sub-task adds schema only and ships no user-visible behavior. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually `TestUp_20260729115013` covers: the stale table is present before and gone after; pre-existing `mdm_configuration_profile_variables` rows survive the check constraint replacement (that `ADD CONSTRAINT` revalidates every existing row); an activation attaches to a declaration and gets its generated token; the 1:1 unique key and the FK both reject bad inserts; a variable row binds to an activation (the case the old constraint would have rejected); the constraint still rejects two-owner and zero-owner rows; and deleting the declaration cascades to the activation and through it to the activation's variable rows. Also ran the full migrations suite (`MYSQL_TEST=1 go test ./server/datastore/mysql/migrations/...`) to confirm no other migration is disturbed, and verified the regenerated `schema.sql` diff contains only changes from this migration. ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). Neither modified table has an `ON UPDATE CURRENT_TIMESTAMP` column, so no rows have their timestamps touched. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added support for Apple DDM custom activations. * Added activation-specific tokens and timestamps to support reliable declaration updates. * Enabled configuration variables to be associated with a specific activation. * Added validation to prevent duplicate or invalid activation associations. * Activations and related settings are now automatically removed when their declaration is deleted. * Tests * Added coverage for activation creation, uniqueness, validation, associations, token generation, and cascading cleanup. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-31 14:36:15 +05:30
Carlo	a442d7af3a	Python script-only packages: follow-on QA fixes (#50143 ) Related issues: Resolves #50068, Resolves #50106, Resolves #50107, Resolves #50108, Resolves #50110, Resolves #50114 Follow-on fixes from QA of #41470 (Python script-only packages): - Software-installer validation errors are action-neutral, so the Add and Edit flows each show the correct single verb, and the unsupported-file error names a content/format mismatch instead of blaming the extension (#50068, #50107). - `.py` packages accept `setup_experience_platform` (`darwin`/`linux`), matching `.sh` (#50106). - A failed-to-run install script (exit code `-1`) now renders a diagnostic instead of empty output, and orbit surfaces the underlying execve error (#50108). - The install-rejection message for `.sh`/`.py` packages says "macOS and Linux hosts" instead of "linux" (#50110). - Orbit writes each script's temp file with an extension matching its shebang (`.py`/`.sh`/`.ps1`), so tracebacks reference the right file type (#50114). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes. - [x] Verified compatibility with the latest released version of Fleet (orbit-only change; the server↔agent `SoftwareInstallDetails` contract is unchanged). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved installer validation and rejection messaging for unsupported/invalid package contents (including correcting “add” vs “edit” wording and avoiding duplicated phrasing). * Added clearer diagnostics when install scripts fail to start (including empty output cases). * Corrected handling of script-only packages so Python scripts use the proper script type/extension, reducing misleading tracebacks. * Updated platform availability messaging so `.sh`/`.py` packages display macOS+Linux support. * New Features * Python script-only packages can now specify macOS and Linux setup experience platforms. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-30 14:40:24 -04:00
Carlo	294a172d11	Clarify maintained app download timeout errors (#50104 ) Related issue: Resolves #48416 When adding a Fleet-maintained app, a large-installer download that's canceled or times out now returns a clear message pointing at the likely proxy/load-balancer timeout, instead of a raw `context canceled`. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Improved error messages when adding Fleet-maintained apps times out or is canceled during large installer downloads. * Added clearer guidance for configuring server, proxy, and load balancer timeouts. * Properly handles additional timeout and upstream cancellation responses, including HTTP 408, 499, and 504. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-30 14:39:56 -04:00
Juan Fernandez	b06cbde1de	Exclude non-existent host IDs from host transfer activity The host transfer endpoint recorded raw requested host IDs in the transferred_hosts activity verbatim, letting an authorized user inject fabricated IDs into the audit trail. Derive the activity's host IDs and names only from hosts that actually exist, and skip the activity when none exist.	2026-07-30 13:59:43 -04:00
Juan Fernandez	e5b0f313f9	Fix password reset accepting case-mutated tokens Reset tokens are base64url (case-sensitive) but the password_reset_requests.token column used case-insensitive utf8mb4_unicode_ci, so a case-mutated token copy still matched. Switch the column to utf8mb4_bin for byte-exact comparison.	2026-07-30 13:59:24 -04:00
George Karr	8a65ecf20b	Bound Android device reconciliation pagination loop (#49615 )	2026-07-30 12:08:17 -05:00
Nico	dcefd13130	Stop leaking live query campaign existence via the websocket results stream (#50210 ) # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Standardized websocket error responses when requested campaigns are unavailable. * Prevented campaign existence from being inferred through differing error messages. * Improved consistency for both nonexistent campaigns and campaigns inaccessible to the current user. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-30 12:01:39 -03:00
Tim Lee Tim Lee Juan Fernandez	c83ecc2231	Match Windows software with version in name to FMA software title Resolves #44406 Windows programs report a version in their name (e.g. `Granola 7.373.2`), so each version created its own `software_title` and never linked to the Fleet-maintained app installer's title (`Granola`), hiding the uninstall action. macOS handles this via `bundle_identifier`; Windows had no join key. - Give matching Windows programs the canonical FMA name at ingestion (name-prefix match), so all versions collapse onto the title the installer owns. `software.name` is unchanged. - Merge already-mismatched versioned titles onto the canonical title in `ReconcileMaintainedAppSoftwareNames` (runs on FMA sync; no migration needed). --------- Co-authored-by: Tim Lee <timlee@fleetdm.com> Co-authored-by: Juan Fernandez <juan@fleetdm.com>	2026-07-30 09:49:52 -04:00
Lucas Manuel Rodriguez	1397531199	Authorize packs before returning them in query responses (#50148 ) - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Query responses now include pack details only when the requester has permission to view them. * Prevented pack metadata from being disclosed across fleets when query names overlap. * Corrected target selection labels and empty-state messaging for fleet-based targets. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 13:35:47 -03:00
Jonathan Katz	1a0f0101cc	Fix gitops not updating FMA installer (#50000 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49811 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Fixed Fleet-maintained app updates when a rebuilt installer keeps the same version. * Rebuilt installers now update their files, hashes, filenames, and install scripts correctly. * Prevented installers from being incorrectly skipped when their contents differ despite matching versions. * Tests * Added coverage for same-version installer rebuilds and team-specific caching behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 10:00:16 -04:00
Magnus Jensen	e6118b4cc5	extra error message checks and correct escaping in error message (#50136 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #40074 unreleased bug <img width="539" height="141" alt="image" src="https://github.com/user-attachments/assets/1ac8e2c2-236d-4567-a200-0eb35cce46e7" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Improved configuration profile validation for unescaped special characters in Apple payloads. * Error messages now consistently indicate when characters like `&` and `<` must be XML-escaped. * Updated error examples to show properly escaped guidance. * Expanded test coverage to verify the standardized XML-escaping error for additional failing scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 14:58:08 +02:00
Lucas Manuel RodriguezandCopilot Autofix powered by AI	9c2ef14947	Scrub device policy responses in Fleet Desktop (#50094 ) - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Security Improvements * Updated device-authenticated policy and host-detail responses to omit policy author identity fields and any raw SQL/query data. * Device policy endpoints now return a device-safe policy representation consistently. * Bug Fixes * Prevented administrative policy information from appearing in device-authenticated host details and policy listings. * Tests * Strengthened integration coverage to verify device-safe responses (required user-facing fields present; sensitive fields absent). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-29 09:34:31 -03:00
Nico	f5ca4b5b0d	Add Android support for custom host vitals (#49696 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49421 Custom host vitals (`$FLEET_HOST_VITAL_<id>`) already worked in scripts and Apple/Windows configuration profiles, but Android configuration profiles and managed app configuration explicitly rejected them at upload to keep parity with `$FLEET_SECRET_`. This left admins unable to inject per-host vitals (e.g. an asset tag) into Android MDM configuration the same way they can for every other platform. For more context, prior PRs: - https://github.com/fleetdm/fleet/pull/49334 - https://github.com/fleetdm/fleet/pull/49586 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually - Created an "Asset tag" host vital. - Enrolled an Android device. - Initially the test profile showed as "Failed" because no value was set for the vital. - Set a value for the vital, saw that it went from Enforcing to Verified. <img width="1446" height="510" alt="Screenshot 2026-07-24 at 8 57 46 AM" src="https://github.com/user-attachments/assets/c0e2348c-e521-48f3-85cd-6f884689b2cd" /> <img width="1520" height="936" alt="Screenshot 2026-07-24 at 8 56 56 AM" src="https://github.com/user-attachments/assets/169b9545-ec7a-429b-8f45-0e2740f61c77" /> <img width="1607" height="1136" alt="Screenshot 2026-07-24 at 8 57 30 AM" src="https://github.com/user-attachments/assets/a8213745-b224-4a36-a54d-32152a15c377" /> Also tested the rejection cases: - trying to upload a profile with an invalid custom host vital id (either a non-numeric value, a numeric but non-existent ID, and referencing a vital as a JSON key instead of a value) - deleting a vital referenced in a profile https://github.com/user-attachments/assets/e8b4acde-ddf4-41c0-b00a-5ab4945d0bc2 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit New Features * Android app configurations and profiles now support custom host vital placeholders (`$FLEET_HOST_VITAL_<id>`). * Custom host vital values are expanded per device during Android delivery. * Managed Android profiles/configurations are automatically resent when a referenced vital value changes. * Bug Fixes * Added validation for malformed, missing, or undefined vital references during Android app association and profile/config uploads. * Prevented deletion of vitals referenced by Android profiles. * Improved error handling and delivery failure details when a device lacks a required vital value. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 08:22:57 -03:00
Rajendra Kadam	5983f9de40	Require Fleet MDM enrollment before escrowing macOS disk encryption key (#50042 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48965 ## Description Fleet was escrowing a macOS disk encryption key — and logging an "escrowed a disk encryption key" activity — for hosts that aren't enrolled in Fleet's MDM (e.g. still managed by Jamf, or with a leftover `/var/db/FileVaultPRK.dat`). Because Fleet never installed its FileVault escrow profile on such a host, the stored key is unusable: the cron marks it `decryptable = 0` and `GET /hosts/:id/encryption_key` returns 422, so "Show disk encryption key" never appears. The result is a misleading activity and a dead key row. Root cause: the macOS key ingestion (`directIngestDiskEncryptionKeyFileDarwin` and its `file_lines` fallback) gated only on the disk being encrypted and disk encryption being enabled for the host's team — it never checked Fleet MDM enrollment. The Windows/orbit key path (`SetOrUpdateDiskEncryptionKey`) already performs this check. - `server/service/osquery_utils/queries.go` — added an `IsHostConnectedToFleetMDM` guard to both macOS ingestion functions, skipping archival (no key stored, no activity) when the host isn't connected to Fleet MDM. Mirrors the existing Windows path. Prevention only — this stops new bad escrows; it does not delete keys previously escrowed for non-enrolled hosts. ## Testing - Unit (`queries_test.go`): added a "host not connected to Fleet MDM" case asserting neither ingestion function escrows when the host isn't Fleet-MDM-connected, and initialized the `IsHostConnectedToFleetMDM` mock so existing cases still pass. - Integration (`integration_mdm_test.go`): `TestMDMAppleHostDiskEncryptionWithDisabledEncryptionSetting` was creating an orbit-only host (no Fleet MDM) and expecting escrow to succeed — i.e. relied on the bug. Switched it to a Fleet-MDM-enrolled host (`createHostThenEnrollMDM`), which is now required for escrow. Passes. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements). ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- covered by automated integration test; live no-device repro is impractical, flagged for reviewer --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Bug Fixes* - FileVault recovery keys are now archived/escrowed only for macOS hosts that are connected to Fleet MDM. - Hosts without an active Fleet MDM connection no longer attempt to archive encryption keys. - Disk-encryption key archival now cleanly reports MDM connectivity errors when checks fail. - Tests - Added/updated coverage to verify both connected and disconnected host scenarios, including ensuring no archival occurs when MDM is not connected. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 14:01:35 +05:30
Victor Lyuboslavsky	ffc85a42ae	Add Windows admin account config (#49863 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #48720 Subtask of https://github.com/fleetdm/fleet/issues/43488 This PR only adds the Windows config, and doesn't mess with macOS configs. # Checklist for submitter - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Verified that the setting is exported via `fleetctl generate-gitops` - [x] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [x] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added managed local account settings for Windows to app and team configuration, including GitOps support. * Exposed an explicit enabled/disabled toggle in configuration output and Fleet controls. * Added licensing and Windows MDM prerequisites for enabling the setting. * Bug Fixes * Managed local account enable/disable actions are now correctly persisted and declaratively applied. * Activity feed messages now display platform-specific (macOS vs Windows) wording. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 12:10:33 -05:00
Andrew Mellor	f1228c873d	47713 auld software update assets migration (#50036 ) Related issue: Resolves #47713 - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added support for tracking available Apple OS update assets and supported devices. * Added per-host Apple OS update targets, deadlines, and resolution status. * Added configuration options for host target OS versions and deadlines. * Database * Updated the MySQL schema and migration seed data to include the new tables and fleet variables, and to reflect updated migration/status metadata. * Tests * Added migration tests to validate table creation, constraints, defaults, and upsert behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 15:42:04 +01:00
Rajendra Kadam	f2662ccaf5	Default setup experience account type to admin when serving team config (#50034 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49346 ## Description A fleet created before the managed local account keys existed (e.g. in 4.84.0) and never edited since has no `end_user_local_account_type` or `enable_managed_local_account` in its stored config. `GET /teams/:id` served these as `null`, so the Setup experience → Users card showed no account-type selection and a wrongly checked, greyed-out "Create hidden admin" box. - `server/fleet/teams.go` — `Team.MarshalJSON` now falls back to `"admin"` / `false` for these keys when they're unset, mirroring the existing `AppConfig.MarshalJSON` fallback that already covers the global ("No team") config. This is the one serve path that was missing the default; the save path (`TeamConfig.Value()`) already applied it, which is why only untouched pre-4.84.0 fleets were affected. Serve-time fallback only — no stored data is modified and the account-provisioning logic is untouched. > Note for reviewers: `Team.MarshalJSON` is also the serialization used by `fleetctl get teams` / GitOps, which had the same `null` bug. With this change those now emit `end_user_local_account_type: admin` and `enable_create_local_admin_account: false` for teams that previously showed `null` — matching what the global config already emits. The get→apply roundtrip stays idempotent because the save path already writes these defaults. Team goldens updated accordingly. ## Testing - Automated: `TestTeamMarshalJSONMacOSSetupDefaults` (`server/fleet`) — a team with the keys unset marshals to `"admin"` / `false`, and explicitly set values still round-trip. Updated the `fleetctl` team goldens (`TestGetTeams`, `TestApplyMacosSetup`, `TestApplyMacosSetupDeprecatedKeys`) to reflect the defaulted output. - Manual: simulated a 4.84.0 fleet by removing both keys from a team's stored `config` JSON. On `main` the Users card showed no selected radio and a checked, greyed hidden-admin box; on this branch the same fleet shows Admin selected and the box unchecked, matching what global "No team" already renders. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements). ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * macOS device setup now applies correct defaults when managed local account settings are missing from existing team configurations. * The end-user local account type now defaults to admin and managed local account creation defaults to disabled (false) unless explicitly configured. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 20:04:41 +05:30
Rajendra KadamandMagnus Jensen	0504e5949e	Add host_id and host_serial to Apple mdm_enrolled activity (#49969 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49777 ## Description Adds `host_id` and `host_serial` to the Apple `mdm_enrolled` activity so IT admins can build automations on top of it, and surfaces the activity on the individual host's activity timeline. - `server/fleet/activities.go` — added `HostID` to `ActivityTypeMDMEnrolled` and a `HostIDs()` method (mirrors the existing `ActivityTypeMDMUnenrolled` pattern), so the activity is linked to the host and appears on its timeline. - `server/mdm/lifecycle/lifecycle.go` — populate `host_id` for macOS/iOS/iPadOS enrollments. Account-driven user (BYOD) enrollments have no hardware serial, so they report the enrollment ID as `host_serial` too, keeping `host_serial` populated for automations regardless of enrollment type. - Frontend — new `MdmEnrolledActivityItem` component, registered in the host past-activity component map (and the `IHostPastActivityType` union), renders the now-host-linked `mdm_enrolled` activity on the host details Activity card. There's no Figma, so the copy mirrors the sibling `mdm_unenrolled` item (e.g. "Mobile device management (MDM) was turned on for this host"). `host_id` uses `omitempty`, so Windows (`microsoft_mdm.go`) enrollments keep their existing activity payload unchanged — Windows is intentionally out of scope, handled in #47874, which also owns the audit-log documentation update for the shared field. > For reviewer: the ADUE `host_serial = enrollment_id` behavior comes from the issue's test plan. It means `host_serial` and `enrollment_id` carry the same value for BYOD. Flagging in case Product would rather leave `host_serial` empty for ADUE and have automations read `enrollment_id`. ## Testing - Automated: `TestMDMEnrolledActivityHostIDAndSerial` (`server/mdm/lifecycle`) covers device enrollment (`host_serial` = hardware serial) and ADUE (`host_serial` = enrollment ID), both asserting `host_id`/`HostIDs()`. Also verified `server/datastore/mysql` `TestMDMEnrollment`, `server/activity/internal/mysql` `TestListActivities`, and `server/service` `TestMDMTokenUpdate` pass. - Live (simulated) manual macOS enrollment* via `osquery-perf`: the `mdm_enrolled` activity recorded `host_id` + `host_serial`, and an `activity_host_past` row linked it to the host (confirmed it shows on the host timeline). - Frontend: `MdmEnrolledActivityItem.tests.tsx` covers the rendered copy for macOS/iOS/Android and the actor/no-actor variants; also visually confirmed the activity renders on a host's Activity card in the running app. `yarn jest`, `eslint`, and `tsc` pass. - Updated the MDM integration tests (`integration_mdm_test.go`, `integration_mdm_dep_test.go`, `integration_vpp_install_test.go`) whose activity-detail and host-feed assertions changed now that `mdm_enrolled` carries `host_id` and appears on the host timeline (feed assertions now filter by activity type). - Pending on-device QA (next week): DEP/ADE macOS and account-driven user enrollment (iOS/iPadOS) on real hardware, per the issue's test plan. - Regression: Windows `mdm_enrolled` payload is unchanged (`host_id` is omitted when zero); both platforms' `mdm_unenrolled` are unaffected. # Screenshot for the frontend change <img width="706" height="382" alt="Screenshot 2026-07-28 at 11 16 57 AM" src="https://github.com/user-attachments/assets/8f57d129-f819-4399-8754-18b397a49db8" /> # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually <!-- manual macOS verified via simulator; DEP + real-device ADUE pending next week --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * New Features * Added support for rendering “MDM enrolled” in the host activity feed with platform- and actor-aware messaging. * Bug Fixes * Updated Apple “MDM enrolled” activity details to include the correct host identifier and serial/enrollment identifiers. * Ensured host-scoped activity behavior applies only when the host is known (host id present). * Tests * Expanded regression and integration coverage for “MDM enrolled” activity details and feed contents, including VPP-related assertion stability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Magnus Jensen <magnus@fleetdm.com>	2026-07-28 14:27:42 +05:30
Steven Palmesano Copilot Autofix powered by AI Lucas Manuel Rodriguez	bf3e1bab99	Add Apple marketing names to backend, frontend, and an osquery table (#46482 ) Related issue: Resolves https://github.com/fleetdm/fleet/issues/46818 and https://github.com/fleetdm/fleet/issues/48524. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Host lists and Host details now show human‑readable Apple hardware marketing names (macOS, iOS, iPadOS) where available (e.g., "MacBook Pro (16‑inch, 2021)"), replacing raw model identifiers. * Hardware model displays fall back to the original model identifier for non‑Apple or unmapped devices. * Bug Fixes / CSV * Exported host CSVs now align with the UI by using the marketing name for Apple devices when available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>	2026-07-27 22:26:30 -03:00
Magnus Jensen	4c36caa453	pass validation for fleets gitops files for DDM assets (#49991 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49979 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. (Unreleased bug) - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Bug Fixes * Prevented Fleet Free from attempting to apply premium-only Apple DDM assets. * Improved macOS DDM asset reconciliation so explicitly empty settings can clear previously configured assets. * Ensured GitOps and team configurations consistently recognize and validate macOS asset settings. * Restricted DDM asset processing to Premium deployments with configured and enabled MDM. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 20:23:54 +02:00
Victor Lyuboslavsky	19efda2d1b	Windows SCEP profiles now fail with non-printable chars (#49887 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #47492 Windows cert profile fails if challenge uses non-printable characters. <img width="987" height="329" alt="image" src="https://github.com/user-attachments/assets/04dc7c78-8e3e-41c8-823e-cb4a961a91eb" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * Bug Fixes * Windows SCEP profiles now fail with a clear error when the certificate authority challenge includes characters not supported by Windows ASN.1 PrintableString. * Prevents misleading “Verified” status when no certificate is installed. * Preserves valid challenge values, including leading/trailing spaces. * Improves Windows error tooltips by showing raw certificate-install error details. * Tests * Added coverage for invalid/valid Windows SCEP challenge scenarios and the updated error tooltip behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 12:49:14 -05:00
Andrew Mellor	d06a4c222c	47700 abm token invalid errors (#49770 ) Related issue: Resolves #47700 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually. _Not able to do for all code paths yet_* <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * New Features * Added `token_invalid` for Apple Business Manager tokens, automatically tracked based on Apple responses. * Enhanced host DEP assignment API responses with a structured `dep_device_error` field to classify why device details couldn’t be retrieved. * Bug Fixes * Improved error handling for DEP device lookup, distinguishing invalid/rejected tokens, expired terms, not-found devices, server/API errors, and unavailable/unspecified failures. * Added regression and unit test coverage for ABM token invalidation and DEP device error classification. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 10:35:27 +01:00
Jordan Montgomery	89f67544b4	Add support for fleet vars in scripts(controls scripts, software scripts/script-only packages and setup experience scripts) (#49781 ) <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> Related issue: Resolves #49511 and #46837 as a whole # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit New Features * Added support for Fleet built-in variables in host scripts, software installer scripts, setup-experience scripts, and maintained-app installer scripts. * Variables are resolved per host at execution time; saved content remains unexpanded. * Bug Fixes * Requests now validate Fleet variables up-front, with clear script-specific error messages for unsupported variables. * Added improved messaging when variable resolution fails during execution. * Enforced Fleet Premium licensing for script/installer flows that use Fleet variables. * Documentation * Documented supported variables and Premium requirements, including usage examples. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 11:24:42 +02:00
Sharon Katzandcopilot-swe-agent[bot]	5c127e5fe4	Fix software ingestion lock convoys and unbatched deletes (#49894 ) Related issue: Resolves #49805, Resolves #48719 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT ` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually --- ## Context A customer (~2,500 hosts, v4.89.1) had their DB writer slammed with `DELETE FROM host_software_installed_paths` statements carrying 30,000+ IDs each. These never completed, required repeated manual intervention, and the table grew from 14.5M to 14.8M rows in 2 days. This is #49805. While investigating, Victor linked #48719, a related `software_titles` INSERT lock convoy issue seen in load tests. Both are in the same software ingestion code path (`server/datastore/mysql/software.go`), so this PR fixes both. ## Root cause ### #49805: Unbatched DELETEs on `host_software_installed_paths` When a host's software changes, Fleet computes a delta and deletes stale rows from `host_software_installed_paths`. The function `deleteHostSoftwareInstalledPaths()` issued a single* `DELETE FROM host_software_installed_paths WHERE id IN (?)` with all IDs expanded by `sqlx.In()`. With 30,000+ IDs and 14.8M rows in the table, these massive statements held row locks for minutes, timed out, and never completed. On the next agent check-in, the same (or larger) DELETE was retried, creating a feedback loop where the table grew unboundedly. Notably, the INSERT function for the same table (`insertHostSoftwareInstalledPaths`) already batched at 500 rows. The DELETE simply lacked the same treatment. ### #48719: INSERT IGNORE lock convoys on `software_titles` (related) When a host reports software that Fleet hasn't seen before, `preInsertSoftwareInventory()` runs `INSERT IGNORE INTO software_titles (...)` inside a `withRetryTxx` transaction. For homogeneous fleets (many hosts sharing the same software catalog, typical for imaged corporate Windows machines), hundreds of concurrent goroutines try to INSERT IGNORE the same title rows simultaneously. Even though `INSERT IGNORE` is a no-op when the row already exists, InnoDB still acquires row/gap locks on the unique index for the duration of the enclosing transaction. With many goroutines holding or waiting on the same index locks, the DB enters a "lock convoy" where sessions serialize on locks they don't actually need. In load tests (40 Fleet instances, 100K hosts, 141 identical Windows software items), this produced 690 average active sessions on the writer and 85s fleet-wide p99. The existing read-first check (`getIncomingSoftwareChecksumsToExistingTitles`) prevents the convoy at steady state. But on cold start (empty `software_titles`, e.g. after cleanup purges orphaned titles), the check finds nothing and all goroutines race to INSERT the same titles. ## How I reproduced it Started MySQL via `docker compose up -d mysql_test`, created a git worktree. ### #49805 `TestHostSoftwareInstalledPathsDeleteExplosion`: Created a host with 500 software items and installed paths, then replaced all software with an entirely new set. This triggers `deleteHostSoftwareInstalledPaths()` with all 500 old IDs in a single unbatched DELETE statement. At 500 IDs the local test completes quickly, but the structure confirms the problem: at 30K+ IDs on production Aurora with 14M rows, these never finish. ### #48719 `TestSoftwareTitlesInsertIgnoreLockConvoy`: Created 50 hosts, each reporting 100 identical software items (simulating a homogeneous fleet). Used a barrier to release all 50 goroutines simultaneously, then measured two phases: 1. Cold start (empty `software_titles`): All 50 hosts concurrently call `ds.UpdateHostSoftware()`. 2. Steady state (titles exist): Same 50 hosts re-ingest. Before fix: \| Metric \| Cold start \| Steady state \| \|--------\|-----------\|-------------\| \| Wall time \| 3.0s \| 38ms \| \| Avg per-host \| 1,981ms \| 29ms \| \| Convoy factor \| 79x \| \| The 79x slowdown confirms the lock convoy. ## How I fixed it ### #49805: Batch the DELETE at 500 Changed `deleteHostSoftwareInstalledPaths()` from a single `DELETE ... WHERE id IN (all IDs)` to a loop that processes 500 IDs per batch, matching the existing INSERT batching pattern in the same file. ### #48719: Three-layer defense against lock convoys Layer 1 - Move title INSERT IGNORE outside the transaction. Previously, `INSERT IGNORE INTO software_titles` ran inside `withRetryTxx`, so locks were held for the full transaction duration. Now each title INSERT is executed via `ds.writer(ctx).ExecContext()` outside any transaction, auto-committing independently and holding locks for microseconds. Layer 2 - singleflight per title key. Added a `singleflight.Group` on the `Datastore` struct. For each title, only one goroutine actually executes the INSERT; concurrent goroutines wait and share the result. Layer 3 - In-process cache (`sync.Map`). After a title is inserted, its key is stored in `knownSoftwareTitleKeys`. Subsequent ingestions check the cache first and skip the INSERT entirely. `CleanupSoftwareTitles` clears the cache when it deletes orphaned titles. The three layers work together: the cache handles the common case (title already known), singleflight handles the cold-start race (only one INSERT per title), and auto-commit ensures even the winning INSERT holds locks for microseconds. ## How I tested that it works ### New reproduction tests - `TestSoftwareTitlesInsertIgnoreLockConvoy`: 50 concurrent hosts, 100 identical software items. Measures cold-start convoy factor and verifies all 100 titles are created. - `TestHostSoftwareInstalledPathsDeleteExplosion`: Full software replacement path with 500 items per host, including concurrent hosts. ### Existing test suite Ran all existing software tests including: - `UpdateHostSoftware`, `UpdateHostSoftwareDeadlock`, `PreInsertSoftwareInventory` - `SoftwareTitleUpgradeCodeDriftMatch`, `UpdateHostSoftwareSameBundleIDDifferentNames` - `CleanupSoftwareTitles` (validates cache invalidation works correctly) - `SaveHost`, `SyncHostsSoftware`, and ~80 other subtests All pass. ### After-fix measurements \| Metric \| Before fix \| After fix \| \|--------\|-----------\|-----------\| \| Cold-start wall (50 hosts) \| ~3.0s \| ~1.4s \| \| Cold-start avg per-host \| ~1,981ms \| ~594ms \| \| Steady-state wall \| ~38ms \| ~7ms \| \| Titles created correctly \| 100/100 \| 100/100 \| The remaining cold-start time is from other pipeline operations (`INSERT IGNORE INTO software`, host_software linking), not from `software_titles`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Performance Improvements - Improved software inventory ingestion under large, concurrent workloads, including more efficient handling of repeated software-title inserts. - Reduced lock contention when many devices report the same titles at the same time. - Batched deletions of installed software-path records to speed up large updates. - Bug Fixes - Ensured deterministic, collation-safe software-title deduplication to prevent incorrect or stale title mapping. - Strengthened orphan cleanup behavior so caches are cleared when orphan titles are removed. - Tests - Added stress/regression tests for software-title insert contention and large installed-path delete workloads. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-24 15:46:14 -04:00
RachelElysia	09fea47ce4	Fleet UI: Handle long fleet names across the Fleets UI (#49216 ) ## Issue Closes #47290 Also implements the "Cap free-text `maxLength` to the backend column length" pattern established in [#49041 (patterns.md thread)](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691). ## Description Fleet name inputs had no `maxLength` cap and no service-layer length check, so a name >255 chars failed with a raw MySQL `Data too long` error, and several UI surfaces didn't handle long names gracefully. This PR fixes all four manifestations called out in the bug, plus a related label-overflow case on the host details page, and hardens adjacent name inputs across the app. Frontend fixes for #47290: - Create/Rename fleet name inputs now cap at 255 characters (matches `teams.name varchar(255)`). - Fleets table Name column uses `LinkCell` with `tooltipTruncate` + `className="w400"` so long names truncate with an ellipsis and full-name tooltip instead of overflowing across the Hosts/Users columns. - Fleet-detail page header (`.team-details__team-header`): h1 gets `overflow: hidden; text-overflow: ellipsis; white-space: nowrap;`, `__team-details` gets `min-width: 0; flex: 1`, and `.action-buttons` gets `flex-shrink: 0` + `white-space: nowrap` on buttons so Manage enroll secrets / Rename / Delete no longer wrap to a second line when the fleet name is long. - Manage enroll secrets modal body — `__description` gets `overflow-wrap: anywhere; min-width: 0` so a long `<b>{fleet name}</b>` wraps within the modal instead of spilling out the right edge. Backend fixes for #47290: - New `fleet.MaxTeamNameLength = 255` constant. - `NewTeam`, `ModifyTeam`, and `ApplyTeamSpecs` now return `fleet.NewInvalidArgumentError("name", "may not exceed 255 characters")` instead of surfacing a raw `Data too long` MySQL error. Covers UI, API, and GitOps entry points. Broader consistency pass (per [#49041 thread](https://github.com/fleetdm/fleet/pull/49041/files#r3572648691)): - New shared `MAX_ENTITY_CHAR_LENGTH = 255` constant in `frontend/utilities/constants.tsx`. - Refactored 8 existing files that had ad-hoc `NAME_MAX_LENGTH = 255` / `MAX_LABEL_NAME_LENGTH = 255` locals to use it. - Slotted it into 16 additional `InputField` name/description inputs that were missing a cap (API user, custom variable, certificate, label name + description, pack name + description, and all 5 CA forms — CustomEST, CustomSCEP, Smallstep, Digicert, Hydrant). - Pruned dead FE length validators that can no longer fire now that the DOM cap enforces the limit (certificate modal, custom variable modal, both label helpers, both category modals). Unusual/shorter caps (e.g. `varchar(64)`, custom business rules) still keep their inline validators — silent truncation is only appropriate for the common 255-char norm. Bonus: fixed the long-label overflow on the host details Labels card by capping the pill button `max-width` at 300px. ## Screenrecording https://github.com/user-attachments/assets/b917b72e-7437-4d0c-a1a1-c49b4b1c28ba https://github.com/user-attachments/assets/3a3efbb2-09d8-4f47-9fd4-f158b3453b9e https://github.com/user-attachments/assets/73e5e022-dc93-4381-82b3-be9549d050e6 Latest - max width 300px long label: <img width="1106" height="262" alt="Screenshot 2026-07-23 at 11 29 24 AM" src="https://github.com/user-attachments/assets/741fddbd-f78d-4578-a025-bddf64a81c25" /> ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually Test coverage: - `CreateFleetModal.tests.tsx`, `RenameFleetModal.tests.tsx` — new case per file asserting the name input's `maxLength === 255`. - `AddCertificateModal.tests.tsx`, `Variables.tests.tsx` — the existing "shows too-long error when pasting 256 chars" tests are now unreachable via the DOM cap; converted to `maxLength === 255` assertions. - `ee/server/service/teams_test.go` — `TestNewTeamNameValidation`, `TestModifyTeamNameValidation`, and `TestApplyTeamSpecsNameValidation` each get two new cases (accepts at the limit, rejects one over with the expected error message). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * Bug Fixes * Limited fleet, team, and other user-entered names and descriptions to 255 characters. * Replaced database errors for oversized names with clear validation messages. * Prevented long fleet and label names from overflowing tables, headers, modals, and host details. * Improved modal and dropdown layouts for long text. * Tests * Added coverage for character limits, boundary values, and multibyte names. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-24 11:22:06 -04:00
Juan Fernandez	aeb56916ee	Block host enrollment with empty enroll secrets VerifyEnrollSecret matched by exact string, so an empty enroll_secret matched any stored empty secret and issued a valid node key. Guard the shared chokepoint: reject empty/whitespace secrets before matching, closing all enrollment paths (osquery, Orbit, Apple MDM, Android). Add a migration to delete pre-existing empty secrets.	2026-07-24 10:29:46 -04:00

1 2 3 4 5 ...