- Update the best practice is to create an API-only user w/ the admin
role and access only to necessary SCIM API endpoints
- These doc updates require [this
bug](https://github.com/fleetdm/fleet/issues/48062) to be fixed because
the `/scim/*` API endpoints aren't exposed as API endpoints one can pick
when creating an API only user
- Document the `/scim/*` API endpoints
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added SCIM API endpoints for managing users and groups.
* Supported actions include listing, creating, viewing, replacing,
updating, and deleting SCIM users and groups.
* Added read-only endpoints for SCIM schemas, service provider
configuration, and resource types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Updated healthcheck command to support TLS configuration. accompanying
env.example sets FLEET_SERVER_TLS=true by default but our default test
in docker-compose.yml tests to http. Causes test to fail.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Closes https://github.com/fleetdm/fleet/issues/46927
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated service health monitoring to correctly probe the health
endpoint over HTTPS when TLS is enabled, and over HTTP when it is not.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- @noahtalerman: For Windows, I think we want to squeeze turning off MDM
and uninstalling fleetd into one script.
- Why? Because Fleet automatically turns on Windows MDM, two scripts
means Fleet could beat the IT admin and turn MDM back on before they
uninstall fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Windows fleetd uninstall now proactively detects and disables MDM
enrollment before removal to help ensure a cleaner device unenrollment.
* **Bug Fixes**
* Improved uninstall error reporting by surfacing the underlying failure
message and exiting with a clear non-zero code.
* **Chores**
* Updated fleet testing and workstation configurations: removed the
Windows uninstall/MDM-related steps from QA and workstation controls,
and added new Windows security/setup scripts plus additional
cross-platform post-install and extension installation tasks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
Adds a simple .sh script that can trigger a refetch locally from a host
if required.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the Linux script used to trigger Fleet refetch operations. It
now runs with stricter Bash safety, validates and trims the system
identifier before sending the request, and reports clear success/failure
status while returning the appropriate nonzero exit code on errors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- @noahtalerman: Landed on this terminology: "Fleet Desktop menu bar
icon" and "Fleet Desktop app"
- We were already calling Fleet Desktop a menu bar icon so I think this
is the smallest change
A bunch of little things I found while working on an unrelated PR awhile
back (handled here to reduce API design diff):
+ Fix broken link formatting
+ Finish up incomplete "Cancel batch script docs"
+ Fix ordering of "Get vulnerability" sections
+ Remove note about feature being GitOps-only (no longer true)
+ Add missing link to section contents
+ Add missing endpoint to `api_endpoints.yml`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added ability to cancel running batch script executions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
Setup experience is pretty hard to reason about through code alone, and
there isn't really any existing documentation for it outside of code
comments.
---------
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **`api_endpoints.yml`**
* Added new Fleet API documentation entries for creating configuration
profiles and updating setup experience.
* Added documentation for creating Android web apps.
* Expanded Android Enterprise coverage by adding a new “Get Android
Enterprise” entry (kept disabled).
* Added complete documentation for certificate authority management,
including list, retrieve, update, and delete.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introduce a query that lists local user accounts with a secure token,
which is necessary for FileVault access on macOS. This enhancement
provides visibility into user accounts that meet the criteria.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new inventory query for macOS users to identify those with
secure token protection enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fix the Fleet-maintained apps list being cut off by adding server-side
pagination and applying platform / "hide added apps" filters across the
full library. Introduces MaintainedAppListOptions (with Platform and
AvailableOnly) and changes the ListAvailableFleetMaintainedApps /
ListFleetMaintainedApps signatures. Datastore now paginates and counts
by distinct app name, fetches all platform rows for apps on a page, and
returns a count and pagination metadata; default client page size set to
500. Frontend no longer performs client-side filtering or local
status/platform state; it relies on the API and uses data.count for
totals. Docs, tests, mocks, and various call sites updated (including a
new test that verifies pagination, platform and availability filters).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fleet-maintained apps listing now paginates server-side (100 per page)
so entries near the end of the alphabet are reachable.
* Platform and “Hide added apps” filters are applied across the entire
library, not just the currently loaded subset.
* The displayed count now matches results by counting macOS and Windows
versions separately.
* **New Features**
* Listing now supports URL-driven platform and “available” filtering,
and the UI consistently reflects the active filter state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
For #32765
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Fleet software package management (add/update) and download for
software titles.
* Added Apple App Store app management, including listing, adding, and
linking apps to titles.
* Added Fleet-maintained app support for titles.
* Enabled host software uninstalls and retrieval of install/uninstall
results via `install_uuid`.
* Added ability to remove a title’s “available for install” status.
* **Bug Fixes**
* Updated software title icon labeling to indicate download.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This part of the document still references `macos_setup`. Should this be
changed to `setup_experience`?
May break older references, which should be updated.
- @noahtalerman: Field descriptions show only the new names. JSON
examples show both old and new keys for backwards compatibility.
- Part of the following issue:
- https://github.com/fleetdm/fleet/issues/41419
This is a doc change to further move the documentation away from PoC
wording, but also update with the changes that we are going to introduce
with https://github.com/fleetdm/fleet/issues/30871
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46637
- Updated the wording and flow of the guide
- Included links to new configuration profiles in the solutions folder
- Added alternative option for enrolling in to cloud management
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a Windows configuration profile to enable enrolling Google
Chrome into enterprise management.
* Included a template with a placeholder enrollment token for
administrators to replace when configuring device management.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Adds a `macos_applications` boolean query parameter to the list host
software endpoint (`GET /api/_version_/fleet/hosts/{id}/software`). When
true, results are restricted to apps installed at the top level of the
macOS /Applications folder, hiding helper apps, system apps,
command-line tools, and user-local apps. The filter applies only to
macOS hosts and is ignored on other platforms.
The filter is applied by pruning the in-memory software maps in
ListHostSoftware down to the title IDs that have a top-level
`/Applications` bundle, so the count and paginated queries stay
consistent and the filter applies uniformly across regular, VPP, and
in-house apps. Top-level is determined from
`host_software_installed_paths` via
`installed_path LIKE '/Applications/%' AND NOT LIKE '/Applications/%/%'
on source 'apps'`.
**Related issue:** Resolves#39017
Resolves#42818.
(I explicitly removed all checklist items.)
This is the least destructing approach to solve the issue.
Other approaches require like moving all Go code under a sub-directory
or keeping these docs/ directories free from invalid characters.
## Problem
[Publishing of Fleet's go
module](https://github.com/fleetdm/fleet/actions/runs/23857371168/job/69554220876)
is failing with the following error:
```
Run GOPROXY=proxy.golang.org go list -m github.com/fleetdm/fleet/v4@v4.83.0
go: github.com/fleetdm/fleet/v4@v4.83.0: reading https://proxy.golang.org/github.com/fleetdm/fleet/v4/@v/v4.83.0.info: 404 Not Found
server response:
not found: create zip: docs/solutions/windows/configuration-profiles/allow network connectivity during connected standby – [ACConnectivityInStandby_2, DCConnectivityInStandby_2].xml: malformed file path "docs/solutions/windows/configuration-profiles/allow network connectivity during connected standby – [ACConnectivityInStandby_2, DCConnectivityInStandby_2].xml": invalid char '–'
[Truncated: too long.]
```
## Summary
Root cause
The [publish go module
step](https://github.com/fleetdm/fleet/blob/main/.github/workflows/publish-go-module.yml)
asks proxy.golang.org to build a module zip for the v4.X.Y tag. That
build was failing on two independent, each-fatal issues — both stemming
from the monorepo carrying non-Go content that violates Go module zip
rules:
1. Invalid path characters — 35 tracked files with characters Go module
zips forbid: en-dash – in 32
docs/solutions/windows/configuration-profiles/*.xml files (the one in
your error), emoji 📜 in 2 handbook/company/legal/ files, and an
apostrophe in 1 website/assets/ image. This is the literal create zip: …
invalid char '–' error.
2. Source tree too large — 582 MiB tracked vs Go's hard 500 MiB limit;
website/ alone is 318.7 MiB.
## Fix
Added a go.mod to website/, docs/, and handbook/, turning each into a
nested module that x/mod/zip omits from the published v4 module — the
same pattern Fleet already uses under tools/. One move solves both: all
35 bad filenames live in those three dirs, and excluding them drops the
module to 207 MiB tracked → 112 MiB zipped.
Files created:
- website/go.mod, docs/go.mod, handbook/go.mod (module markers, each
with a comment explaining why)
Verified safe: no .go files and no //go:embed references in those dirs,
and go list ./... still resolves all 491 packages.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added standalone module configurations for documentation, handbook,
and website directories.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
