This pull request makes a minor update to the configuration for
company-owned mobile devices. The change enables the `setup_experience`
option for the Okta Verify app in the
`it-and-security/teams/company-owned-mobile-devices.yml` file.
This PR adds the Fleet-maintained Okta Verify app for Windows
(`okta-verify/windows`) to the **Windows apps section** of
`fleet_maintained_apps` in `it-and-security/teams/workstations.yml`.
The entry is placed as the first entry in the `# Windows apps` section
(directly after the `okta-verify/darwin` entry), following the pattern
of other Windows entries like `slack/windows` and
`google-chrome/windows`.
The entry is configured with:
- `self_service: true` — available for users to install via Fleet's
self-service
- `setup_experience: true` — installed during the setup experience
- `labels_include_any: ["x86-based Windows hosts"]` — scoped to Windows
hosts
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1771862144290659?thread_ts=1771860980.970249&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Kilo Code <kilo@fleetdm.com>
This pull request makes a minor update to the `okta-verify.json`
configuration file, changing the default category for Okta Verify from
"Communication" to "Productivity".
Corrected spelling of 'neccessary' to 'necessary' in vendor collateral
instructions.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
This pull request adds support for managing the Okta Verify app on
Windows via the maintained apps system. It introduces new ingestion
logic for handling WiX Burn installers, adds input and output
definitions for Okta Verify, and provides install/uninstall scripts
tailored for EXE-based (Burn) installers. The changes also ensure Okta
Verify is properly listed and categorized in the maintained apps
outputs.
**Okta Verify Windows app support:**
* Added a new input definition for Okta Verify on Windows, including
installer details and categorization in
`ee/maintained-apps/inputs/winget/okta-verify.json`.
* Added install (`okta_verify_install.ps1`) and uninstall
(`okta_verify_uninstall.ps1`) PowerShell scripts for Okta Verify,
supporting silent installation/uninstallation for EXE/Burn installers.
[[1]](diffhunk://#diff-fa86938dc330e2678c50210585ea8885283546dc370017fd6f3996f12af284b9R1-R27)
[[2]](diffhunk://#diff-944cc7275484b5010c66369e563c3d09a618d67295da5221e945aebc42b033dcR1-R96)
* Added Okta Verify Windows app entry to the maintained apps output
(`apps.json`) and created a detailed output file with version, installer
URL, scripts, and detection query in `outputs/okta-verify/windows.json`.
[[1]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1145-R1151)
[[2]](diffhunk://#diff-0c852c8b0817f497526b3eb76c2074cece7ed002f5ffa6a2ea7771affdd90f52R1-R21)
**Improvements to installer ingestion logic:**
* Updated the Winget ingester to recognize "burn" (WiX Burn
bootstrapper) as an installer type and normalize it to "exe" for
processing, ensuring correct handling of Burn-based installers.
[[1]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R488)
[[2]](diffhunk://#diff-eb6c4ae7be41e61a2292c4240de750809d40c0686fb01f80f52df056ebc9c2a8R223-R227)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40054
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Updated internal logging infrastructure across Mobile Device
Management (MDM) service modules to improve code consistency and
maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Remove "Department: Information Technology" label from the Okta Verify
macOS configuration profile and replace the per-app labels_include_any
on okta-verify/darwin with setup_experience: true.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40054
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- present in a previous PR
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Updated logging infrastructure throughout the application to use Go's
standard library logging system. This replaces the previous logging
implementation with an improved, standardized approach. Logging output
format may appear slightly different, but all diagnostic and operational
logging capabilities remain fully intact and functional.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
# qacheck
Scans a GitHub Project v2 for items in ✔️Awaiting QA
that are missing or have an unchecked QA confirmation checklist.
## Build
export GITHUB_TOKEN=...
go mod tidy
go build -o qacheck .
## Run
./qacheck -org fleetdm -project 71
./qacheck -org fleetdm -project 97
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Fixes#34068 Adds automatic retries (up to 3 attempts) for failed software installs from host details, self-service, and setup experience across all installer types.
Updated the README to include new marketing and enablement assets, case
studies, articles, guides, and release notes, reflecting the latest
information and resources available for the marketing department.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40124
# Details
Implements the proposal in
https://docs.google.com/document/d/16qe6oVLKK25nA9GEIPR9Gw_IJ342_wlJRdnWEMmWdas/edit?tab=t.0#heading=h.nlw4agv1xs3g
Allows doing e.g.
```go
logger.WarnContext(logCtx, "The `team_id` param is deprecated, use `fleet_id` instead", "log_topic", "deprecated-field-names")
```
or
```go
if logging.TopicEnabled("deprecated-api-params") {
logging.WithLevel(ctx, slog.LevelWarn)
logging.WithExtras(
ctx,
"deprecated_param",
queryTagValue,
"deprecation_warning",
fmt.Sprintf("'%s' is deprecated, use '%s'", queryTagValue, renameTo),
)
}
```
Topics can be disabled at the app level, and enabled/disabled at the
command-line level.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
No logs have this in prod yet, but I added some manually in a branch and
verified that I could enable/disable them via CLI options and env vars,
including enabling topics that were disabled on the server. Tested for
both server and `fleetctl gitops`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added per-topic logging control to enable or disable logging for
specific topics via configuration and CLI flags.
* Added context-aware logging methods (ErrorContext, WarnContext,
InfoContext, DebugContext) to support contextual logging.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
On the fleetdm.com/pricing page FAQ section, the text listed "Lear" as
one of the notable companies using Fleet. This PR replaces "Lear" with
"MrBeast", which is already featured in the logo carousel on the
homepage and other pages across the site.
### Changes
- In `website/views/pages/pricing.ejs`: Updated the FAQ answer text to
replace "Lear" with "MrBeast" in the list of notable Fleet customers
(Epic Games, Cisco, Stripe, Fastly, MrBeast, and more).
### Context
- MrBeast logo (`logo-mr-beast-90x32@2x.png`) is already present in the
logo carousel component used across the site
- This change makes the pricing page FAQ consistent with the logo
carousel branding
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1771625802869279)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#39858
~~Also implements the idea from this comment:
https://github.com/fleetdm/fleet/issues/37802#issuecomment-3715729822~~
Decided to move the FMA name overriding idea to another PR.
## Changes
- `getOrGenerateSoftwareInstallerTitleID` now attempts to find existing
titles by name or by upgrade code if possible. It will update the
upgrade code if possible.
- also updated `addSoftwareTitleToMatchingSoftware` to match _only_ by
upgrade code if the installer has an upgrade code
These are the assumptions (and tests mostly) I made:
| installer | existing title | result |
|------------------|-----------------------------------|----------------------------------------------------------------------------|
| no upgrade code | same name, no upgrade code | uses existing |
| no upgrade code | same name, has upgrade code | uses existing,
existing upgrade code stays |
| has upgrade code | same name, no upgrade code | uses existing,
existing title is updated with the incoming upgrade code |
| has upgrade code | same name, different upgrade code | new title is
created with same name |
| has upgrade code | same name, same upgrade code | uses existing |
| has upgrade code | different name, same upgrade code | uses existing,
~~existing title's name is updated~~ |
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
- Tested having the title `7-Zip 23.01 (x64)` with an upgrade code in
the db, added 7-Zip FMA, title became the existing `7-Zip 23.01 (x64)`
title with the same upgrade code.
- Trying to add it again fails with the correct error message
Because Fleet is not uncommonly referred to IT departments from the
CISO, and so that's how IT admins hear about it. Security engineers
often already know about Fleet, and if it's for the CISO, it's obviously
for them too!
## Issue
Closes#39699
## Description
- `display_name` is super far reaching and was not caught as needing
updates in several places by design nor dev (original ticket made me
deep dive in the code looking for more missed instances and I found
several)
Fixes:
- during setup experience, if a critical software fails, it shows the
display_name instead of the default name
- when viewing the versions modal from fleet desktop, it shows the
display_name instead of the default name as the modal title (screenshot
below)
- when getting an error message from changing the package type when
editing software, it shows the display_name instead of the default name
(screenshot below)
- ORIGINAL REQUEST: when editing auto updates for an ipados/ios
software, it shows the display_name instead of the default name
(screenshot below)
## Screenshots of fixes
<img width="1296" height="483" alt="Screenshot 2026-02-20 at 3 30 26 PM"
src="https://github.com/user-attachments/assets/d3a8659d-1fcf-4384-8670-202c5681ed72"
/>
<img width="1383" height="485" alt="Screenshot 2026-02-20 at 3 36 18 PM"
src="https://github.com/user-attachments/assets/619467dc-5d18-4edf-98ee-116558fa945e"
/>
<img width="1378" height="381" alt="Screenshot 2026-02-20 at 3 41 38 PM"
src="https://github.com/user-attachments/assets/13550024-bd61-4c09-a136-f3a237f01aaf"
/>
## Testing
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40054
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- Included in previous PR
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Migrated logging infrastructure from external framework to standard
library structured logging, enabling improved context-aware operations
and error tracking across vulnerability detection and synchronization
workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds a new `### Publish sprint demo video` section to the marketing
handbook, directly before the existing `### Upload to YouTube` section.
After each sprint demo, the marketing team should do a quick
post-production pass to fix inconsistent audio levels caused by
different presenters' microphone setups. This entry documents that
responsibility and links to [Kapwing](https://www.kapwing.com) — a free,
browser-based video editor — as the recommended tool for applying audio
compression before publishing.
## Changes
- **`handbook/marketing/README.md`**: Added new `### Publish sprint demo
video` section with step-by-step instructions for downloading the
recording, applying audio compression via Kapwing, and then following
the existing YouTube upload process.
---
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1771607714082859)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Allen Houchins
