<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37189
- [x] QA'd all new/changed functionality manually
This pull request adds support for the CrashPlan backup and recovery
software to the maintained apps ecosystem for both macOS (Homebrew) and
Windows (Winget). It introduces new metadata, installation and
uninstallation scripts, and integrates CrashPlan into the application's
UI, including a dedicated icon.
**CrashPlan app support:**
- Added CrashPlan metadata for Homebrew (`crashplan.json`) and Winget
(`crashplan.json`), specifying identifiers, installer details, and
default categories.
[[1]](diffhunk://#diff-65666812266569e4f2198de5e97a2a0a2e02974e5b134dac13e9bd9fecc3109bR1-R8)
[[2]](diffhunk://#diff-c8f7deea2ce492ea0903ba3fcfdcf7a6df342b935c284dca8564f449f1247f39R1-R10)
- Included CrashPlan in the aggregated app listings (`apps.json`) for
both macOS and Windows platforms, with descriptions.
**Installer and uninstaller scripts:**
- Added versioned output and installation/uninstallation scripts for
CrashPlan on macOS (`crashplan/darwin.json`) and Windows
(`crashplan/windows.json`), including download URLs, SHA256 hashes, and
detection queries.
[[1]](diffhunk://#diff-13c8cfd39d6d7d8faabce6b6d7f6566275a4c7d09c37ca9cc9726e09c89cc60bR1-R21)
[[2]](diffhunk://#diff-5f7d9507b93b3c61d2035dd964d399e666e308be0cf46be8c358702c57b6927bR1-R22)
**UI integration:**
- Introduced a new CrashPlan SVG icon component (`CrashPlan.tsx`) and
mapped it in the software icon index for use in the UI.
[[1]](diffhunk://#diff-508f123066743b5b4f4de19a92f3aa6c1055e8cda2a5a9e8f57c99aed29df681R1-R14)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR7)
[[3]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR282)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35007
# Details
This PR implements a new `StreamHosts` service method and utilizes this
method in `listHostsEndpoint`. The purpose of this method is to allow
the "list hosts" endpoint to stream a JSON response down one host at a
time (more or less), so that the entire JSON payload doesn't have to sit
in memory all at once. The response can be very large when software and
users are populated using the optional `populate_software` and
`populate_users` querystring options.
**Notes:**
* The `ListHosts` database method currently returns the entire result
set at once. The assumption with this iteration is that it was
populating the extra data in each host that was pushing the response to
untenable sizes. If we're still seeing OOM issues after this PR, we can
refactor to also use an iterator to stream rows from the database.
* The `listHostsEndpoint` method calls `StreamHosts` to get a host
iterator, but also creates its own iterator to supply to the response,
because we (sometimes) need to populate `Labels` on each host response
object. The `StreamHosts` method only returns `Host`s not
`HostResponse`s, hence the need for the wrapper.
* A new response type `StreamHostsResponse` was created because other
methods utilize the existing `ListHostsResponse`. We could keep just
`ListHostsResponse` and toggle how it responds based on whether an
iterator is provided, but keeping the types separate is simpler to
reason about and test.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [ ] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Hosts listing API now streams results incrementally for faster initial
responses and better performance on large inventories or complex
queries.
* Host details (optional labels, software and MDM info) are
progressively enriched and delivered as available, allowing partial
results while remaining data loads.
* Streaming provides clearer partial-error reporting so partial results
can be returned even when some enrichments fail.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request makes a minor update to the product maturity
assessment documentation. The macOS platform maturity indicator has been
changed from the duck emoji (🦆) to the chick emoji (🐥) for all listed
quarters.
- Updated the macOS maturity status in the product maturity table from 🦆
to 🐥 for all quarters in
`handbook/company/product-maturity-assessment.md`.
This pull request enhances the icon mapping logic for software names in
the `SoftwarePage` component, specifically ensuring that the Microsoft
Company Portal app is correctly associated with its icon, even when
referenced by its package name.
**Icon mapping improvements:**
* Added `"microsoft.companyportal"` to the `SOFTWARE_NAME_TO_ICON_MAP`
so that this package name is mapped to the `IntuneCompanyPortal` icon.
* Updated the `matchStrictNameSourceToIcon` function to explicitly
return the `IntuneCompanyPortal` icon when the software name is exactly
`"microsoft.companyportal"`.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35515Resolves#35494
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Jahziel Villasana-Espinoza <jahziel@fleetdm.com>
When Windows OS update settings (deadline_days and grace_period_days)
are configured via GitOps YAML, the configuration is saved but the
Windows Update CSP profiles are never deployed to enrolled devices.
Root cause: The GitOps code path (editTeamFromSpec) was missing the
deployment trigger that exists in the UI path (ModifyTeam).
This fix adds the missing deployment logic following the same pattern
used by macOS/iOS/iPadOS updates:
1. Track when Windows updates are edited (mdmWindowsUpdatesEdited flag)
2. After SaveTeam(), trigger CSP deployment via
mdmWindowsEnableOSUpdates() or mdmWindowsDisableOSUpdates() based on
whether deadline is set
The fix ensures GitOps and UI paths behave consistently for Windows OS
update management.
Fixes: Windows Update CSP deployment via GitOps
Related: ee/server/service/teams.go lines 379-408 (UI implementation)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#37137
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
This pull request adds a new icon component import to the icon index
file. The change is minor and simply makes the `CompanyPortal` icon
available for use in the application.
This pull request adds support for managing 7-Zip as a maintained
Windows application. The changes include configuration for installation
and uninstallation, workflow updates to handle 7-Zip specifically in CI,
and a new icon for the frontend. These updates ensure that 7-Zip can be
detected, installed, uninstalled, and visually represented in the
software management system.
**Windows workflow and detection updates:**
- Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes related to 7-Zip, set a `has_7zip` output variable, and add a
step to remove pre-installed 7-Zip versions before proceeding with
further app verification. This prevents conflicts with pre-existing
installations during CI runs.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR91)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR117-R124)
[[4]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR164-R227)
**7-Zip application configuration:**
- Added `ee/maintained-apps/inputs/winget/7-zip.json` to define 7-Zip as
a maintained app with metadata such as slug, package identifier,
installer type, and categories.
- Added `ee/maintained-apps/outputs/7-zip/windows.json` with version
info, installation and uninstallation scripts, SHA256, and upgrade code
for 7-Zip, enabling automated install/uninstall flows.
- Updated `ee/maintained-apps/outputs/apps.json` to include 7-Zip in the
list of available apps, with a description and unique identifier for
display and selection.
**Frontend icon support:**
- Added a new React SVG icon component for 7-Zip at
`frontend/pages/SoftwarePage/components/icons/7Zip.tsx`.
- Registered the 7-Zip icon in the icon index and mapped it in
`SOFTWARE_NAME_TO_ICON_MAP` to display the icon for 7-Zip in the UI.
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR7)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR224)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#32920
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
This pull request makes a minor update to the icon imports on the
Software Page by removing the unused `CompanyPortal` import from the
`icons/index.ts` file.
This pull request adds support for two new macOS applications, Calibre
and Dash, to the maintained apps system. The changes include the
necessary metadata, installation and uninstallation scripts, and icon
assets, as well as updates to the main app listing.
**New Application Support**
* Added input metadata for Calibre in `homebrew/calibre.json`, including
identifiers, installer format, and categories.
* Added input metadata for Dash in `homebrew/dash.json`, including
identifiers, installer format, and categories.
**App Catalog Updates**
* Updated `outputs/apps.json` to include Calibre with a description and
identifiers.
* Updated `outputs/apps.json` to include Dash with a description and
identifiers.
**Installer and Uninstaller Scripts**
* Added versioned output and install/uninstall scripts for Calibre in
`outputs/calibre/darwin.json`.
* Added versioned output and install/uninstall scripts for Dash in
`outputs/dash/darwin.json`.
**Frontend Icon Assets**
* Added a new React SVG icon component for Calibre in `Calibre.tsx`.
This pull request adds support for the AppCleaner application to the
maintained apps system, including its metadata, installation, and
uninstallation scripts. The changes define how AppCleaner should be
recognized, installed, and uninstalled on macOS, and make it available
in the maintained apps catalog.
**AppCleaner integration:**
* Added a new input definition for AppCleaner in `appcleaner.json`,
specifying its metadata such as name, unique identifier, installer
format, and default category.
* Added a new output definition for AppCleaner in
`appcleaner/darwin.json`, including version information, SQL query for
existence, installer URL, SHA256 checksum, and detailed install and
uninstall scripts.
* Updated `apps.json` to include AppCleaner in the list of maintained
applications, making it available for discovery and installation via the
maintained apps system.
Updated formatting and links for CrowdStrike installation instructions,
ensuring consistency in naming and image references.
---------
Co-authored-by: Ian Littman <iansltx@gmail.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#35495
- Updates `generate-gitops` to export android app configurations in
relative files
- Updates backend to set the android app configurations state to what
yaml files specify
- If an existing configuration was not included, it will be set to `{}`
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
- Updating feature prioritization criteria
- Use `P-` labels for high-priority customer requests
- Remove 💝 Customer requests (prioritized) project: From a Product
Design perspective, I think we get little to no value from maintaining
that project.
- @noahtalerman: I'm also going to delete the `~customer request` label.
That's the label we used to put issues on this project.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to #34704(no subtask created though)
Overall changelog for the issue covers this
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] QA'd all new/changed functionality manually
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
This pull request adds support for managing Adobe DNG Converter on
macOS. The main changes include introducing metadata and
installation/uninstallation scripts for this application, updating the
app registry, and improving version detection logic to handle Adobe’s
unique versioning format.
**Support for Adobe DNG Converter:**
* Added a new input definition for Adobe DNG Converter in
`homebrew/adobe-dng-converter.json`, specifying its identifiers,
installer format, and default category.
* Generated an output manifest in
`outputs/adobe-dng-converter/darwin.json` with version info, download
URL, SHA256, and detailed install/uninstall scripts for managing the app
lifecycle.
* Registered Adobe DNG Converter in the main `apps.json` registry,
including a description, unique identifier, and platform.
**Improvements to version detection:**
* Updated the `appExists` function in `darwin.go` to correctly detect
Adobe DNG Converter even when the installed version string includes a
build number in parentheses, improving reliability of version checks.
Resolves#37104
## Testing
- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Label validation now enforces team-context constraints for policies,
queries, and MDM profiles.
* Global policies now verify label validity before creation.
* **Bug Fixes**
* Improved label association verification in team-specific
configurations.
* **Tests**
* Added comprehensive test coverage for team label associations,
including label scoping validation and team deletion scenarios.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ian Littman <iansltx@gmail.com>
### Summary
This PR adds support for `.zip` files as Windows Fleet Managed Apps
(FMAs). Zip files on Windows are treated similarly to `.exe` files and
require custom install/uninstall scripts, typically used for AppX/MSIX
packages that are distributed as zip archives.
### Changes
**Backend:**
- Added `.zip` as a supported Windows package type in
`SoftwareInstallerPlatformFromExtension`
- Updated validation to require install/uninstall scripts for zip files
(similar to `.exe` files)
- Added `addZipPackageMetadata` function to handle zip file metadata
extraction
- Updated error messages to include `.zip` in the list of supported file
types
- Enhanced `appExists` validation to detect provisioned AppX packages
(packages that are provisioned for all users but don't show up in the
programs table until a user logs in)
- Added version normalization logic to handle version string differences
(e.g., "11.2.1495.0" vs "11.2.1495")
- Updated winget ingester to recognize zip files and default to user
scope for MSIX/zip installers
**Frontend:**
- Added `.zip` to `windowsPackageTypes` in `package_type.ts`
- Updated `PackageAdvancedOptions` component to require
install/uninstall scripts for zip files
- Added validation rules for zip files in `PackageForm/helpers.tsx`
- Updated help text and tooltips to indicate script requirements for zip
packages
- Updated `software_install_scripts.ts` to include zip in default script
handling
**Maintained Apps:**
- Added Microsoft Company Portal as a maintained app example using zip
files
- Created install/uninstall PowerShell scripts that:
- Extract zip files containing AppX packages
- Provision packages for all future users (works in headless
environments)
- Install packages for the current user
- Handle both provisioned and installed package detection
**Tests:**
- Updated integration tests to include `.zip` in supported file type
error messages
- Updated unit tests for `SoftwareInstallerPlatformFromExtension` and
`SofwareInstallerSourceFromExtensionAndName`
### Use Case
This enables distribution of Windows AppX/MSIX packages that are
packaged as zip files (common for Microsoft Store apps like Company
Portal). The implementation handles both provisioned packages (for all
users) and user-installed packages, ensuring detection works in both
headless and interactive environments.
### Testing
- Updated existing tests to include zip file support
- Added Microsoft Company Portal as a maintained app example with full
install/uninstall scripts
---
**Note:** This PR follows the same pattern as `.exe` file support,
requiring custom install/uninstall scripts since zip files can contain
various content types that need custom handling.
Fixing the following warning:
```
$ make fleet
[...]
# github.com/shoenig/go-m1cpu
../../gopath/pkg/mod/github.com/shoenig/go-m1cpu@v0.1.6/cpu.go:75:17: warning: variable length array folded to constant array as an extension [-Wgnu-folding-constant]
../../gopath/pkg/mod/github.com/shoenig/go-m1cpu@v0.1.6/cpu.go:77:16: warning: variable length array folded to constant array as an extension [-Wgnu-folding-constant]
```
PS: This warning happens when building fleet because we need to decouple
the client code from `server/service`... (hopefully to be done as part
of https://github.com/fleetdm/fleet/issues/36087)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36544
- Removes outdated comment
- Send empty categories key instead of nothing to edit package API, so
that categories will be deleted instead of ignored.
# Checklist for submitter
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Ian Littman <iansltx@gmail.com>
Dante Catalfamo