Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity
25,534 Commits 2 Branches 0 Tags
e32bcd594a67115891b02017b3fd47802b843550
Commit Graph
907 Commits
Author SHA1 Message Date
rahultoppurandLucas Manuel Rodriguez 06bc81106e Add socket_path to containerd tables (#47987) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48006.

Adds a new field `socket_path` in both `containerd_containers` and
`containerd_mounts`. We keep the previous default when no `socket_path`
is requested in the filter; otherwise, we honor the value passed from
the incoming query.

Test case:

Ran a `make fleetd-tables-linux`, started some containers, then used
osquery:

<img width="2494" height="1408" alt="Screenshot from 2026-06-22
12-48-43"
src="https://github.com/user-attachments/assets/ed65d16c-8aa8-4fc7-890e-4f200752e6e2"
/>


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added an optional `socket_path` column to `containerd_containers` and
`containerd_mounts`.
* Containerd queries can now target a specific socket path, and results
report the socket path used (defaulting to
`/run/containerd/containerd.sock` when not provided).

* **Documentation**
* Updated Fleet and table schemas with the new `socket_path` column and
example queries (including common k3s socket paths).

* **Tests**
* Added Linux-only coverage to verify default vs explicitly provided
`socket_path` behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lucas Manuel Rodriguez <lucarodriguez@gmail.com>
 2026-06-23 10:21:07 -03:00
dependabot[bot]andLucas Manuel Rodriguez 33cbc192b2 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#47959) 
Bumps
[github.com/containerd/containerd](https://github.com/containerd/containerd)
from 1.7.32 to 1.7.33.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/containerd/containerd/releases">github.com/containerd/containerd's
releases</a>.</em></p>
<blockquote>
<h2>containerd 1.7.33</h2>
<p>Welcome to the v1.7.33 release of containerd!</p>
<p>The thirty-third patch release for containerd 1.7 contains various
fixes
and updates including security patches.</p>
<h3>Security Updates</h3>
<ul>
<li>
<p><strong>containerd</strong></p>
<ul>
<li><a
href="https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"><strong>CVE-2026-53488</strong></a></li>
<li><a
href="https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq"><strong>CVE-2026-47262</strong></a></li>
</ul>
</li>
<li>
<p><strong>go-jose</strong></p>
<ul>
<li><a
href="https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"><strong>CVE-2026-34986</strong></a></li>
</ul>
</li>
</ul>
<p>Please try out the release binaries and report any issues at
<a
href="https://github.com/containerd/containerd/issues">https://github.com/containerd/containerd/issues</a>.</p>
<h3>Contributors</h3>
<ul>
<li>Samuel Karp</li>
<li>Chris Henzie</li>
<li>Akihiro Suda</li>
<li>Akhil Mohan</li>
<li>Ben Cressey</li>
<li>Davanum Srinivas</li>
<li>Sopho Merkviladze</li>
</ul>
<h3>Changes</h3>
<!-- raw HTML omitted -->
<ul>
<li>Prepare release notes for v1.7.33 (<a
href="https://redirect.github.com/containerd/containerd/pull/13631">#13631</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/7517e6737a6077dbdb5d403e693169cb8163549d"><code>7517e6737</code></a>
Prepare release notes for v1.7.33</li>
<li><a
href="https://github.com/containerd/containerd/commit/ab306518a326fe7e4c27f64a8cf62b7a0fb3e9c6"><code>ab306518a</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/d34cdafdaf51e1db435f1e0898f16d0da5038557"><code>d34cdafda</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/9ab2b7a894d15738f8323f69def272c29277b57f"><code>9ab2b7a89</code></a>
Bound user-database file reads in openBoundedUserFile</li>
<li><a
href="https://github.com/containerd/containerd/commit/1e9806f90d934f2e0180c279fa9f0019537f2704"><code>1e9806f90</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/4d8ba4d23561c9ec21b0113ddcfc22f41792b25e"><code>4d8ba4d23</code></a>
Do not propagate reserved labels from image configs</li>
</ul>
</li>
<li>update runc binary to v1.3.6 (<a
href="https://redirect.github.com/containerd/containerd/pull/13615">#13615</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/74c728c13487844c43620b14cc66dc05dca96836"><code>74c728c13</code></a>
update runc binary to v1.3.6</li>
</ul>
</li>
<li>update go to 1.26.4/1.25.11 (<a
href="https://redirect.github.com/containerd/containerd/pull/13579">#13579</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/947caa4b7469fd3b71ee62d0f7410b00252f5842"><code>947caa4b7</code></a>
update go to 1.26.4/1.25.11</li>
</ul>
</li>
<li>Configure udevd children-max for root-test (<a
href="https://redirect.github.com/containerd/containerd/pull/13564">#13564</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/e884e964e31c4fb61fcdc376a2fa3151ac245a65"><code>e884e964e</code></a>
Configure udevd children-max for root-test</li>
</ul>
</li>
<li>Clean up disk space in node e2e workflow (<a
href="https://redirect.github.com/containerd/containerd/pull/13552">#13552</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/b9e7568888325736b12c9f50271045bc618dc9b9"><code>b9e756888</code></a>
Clean up disk space in node e2e workflow</li>
</ul>
</li>
<li>Bump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8 (<a
href="https://redirect.github.com/containerd/containerd/pull/13467">#13467</a>)
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/4dfc1844e8cb46a6c04a8c57211ab50e1412ccc1"><code>4dfc1844e</code></a>
Bump go-jose to v3.0.5 to address CVE-2026-34986</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/containerd/containerd/commit/e8b1a9bc270f9952197c470b8bad573b03a3a608"><code>e8b1a9b</code></a>
Merge pull request <a
href="https://redirect.github.com/containerd/containerd/issues/13631">#13631</a>
from samuelkarp/prepare-1.7.33</li>
<li><a
href="https://github.com/containerd/containerd/commit/7517e6737a6077dbdb5d403e693169cb8163549d"><code>7517e67</code></a>
Prepare release notes for v1.7.33</li>
<li><a
href="https://github.com/containerd/containerd/commit/ab306518a326fe7e4c27f64a8cf62b7a0fb3e9c6"><code>ab30651</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/096289897c75f26f9b1e7a805acde329fa048a96"><code>0962898</code></a>
Merge pull request <a
href="https://redirect.github.com/containerd/containerd/issues/13615">#13615</a>
from k8s-infra-cherrypick-robot/cherry-pick-13606-t...</li>
<li><a
href="https://github.com/containerd/containerd/commit/74c728c13487844c43620b14cc66dc05dca96836"><code>74c728c</code></a>
update runc binary to v1.3.6</li>
<li><a
href="https://github.com/containerd/containerd/commit/d34cdafdaf51e1db435f1e0898f16d0da5038557"><code>d34cdaf</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/1e9806f90d934f2e0180c279fa9f0019537f2704"><code>1e9806f</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/containerd/containerd/commit/9ab2b7a894d15738f8323f69def272c29277b57f"><code>9ab2b7a</code></a>
Bound user-database file reads in openBoundedUserFile</li>
<li><a
href="https://github.com/containerd/containerd/commit/d805d96d67b205a40d3c12414ec306d19ec2d848"><code>d805d96</code></a>
Merge pull request <a
href="https://redirect.github.com/containerd/containerd/issues/13579">#13579</a>
from akhilerm/1.7-go1.26.4</li>
<li><a
href="https://github.com/containerd/containerd/commit/947caa4b7469fd3b71ee62d0f7410b00252f5842"><code>947caa4</code></a>
update go to 1.26.4/1.25.11</li>
<li>Additional commits viewable in <a
href="https://github.com/containerd/containerd/compare/v1.7.32...v1.7.33">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containerd/containerd&package-manager=go_modules&previous-version=1.7.32&new-version=1.7.33)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-06-22 09:23:41 -03:00
Dante CatalfamoCopilot Autofix powered by AILucas Manuel Rodriguez
 		1f6f218b1d Handle missing macOS bundle executable in executable_hashes table (#47532) 
**Related issue:** Resolves #45327

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Bug Fixes
* Fixed macOS detail query failures when application bundles declare
executable paths that don't exist on the system. Previously, missing
executables would cause queries to fail entirely. The system now handles
these gracefully by setting the SHA256 field to an empty value,
improving reliability of system queries.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
 2026-06-19 13:16:18 -03:00
Juan Fernandez d109d3954b Fix fleetd keychain error logs during first ABM enrollment 
Resolves #41338

A fleetd-base.pkg built with `fleetctl package
--use-system-configuration` shipped an empty /opt/orbit/secret.txt.
During ABM enrollment, before the configuration profile was available,
orbit read that empty file as an empty enroll secret, producing
confusing logs.
 2026-06-19 07:17:18 -04:00
Lucas Manuel Rodriguez 443d82dd15 Add self-heal mechanism in case of corruption in osquery or Fleet Desktop executables (#47818) 
Resolves #47552

Currently, a corruption in the download process is caught by our TUF
updater and will re-download.
So the main scenario we are covering here is a corruption in the
extraction process of the .tar.gz components.
I'm simulating this by modifying the executables in the hosts and
restarting (now with these changes it self-heals).

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Orbit now self-heals corrupt component binaries by detecting
executables that fail to run, removing the broken artifacts,
re-downloading, and re-verifying before continuing (including the
osqueryd and Fleet Desktop components).

* **Bug Fixes**
* Prevents endless crash loops caused by truncated or otherwise invalid
on-disk binaries.

* **Tests**
* Added coverage for exec verification and target cleanup/re-download,
including corruption, healthy binaries, and cross-platform behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-18 10:08:35 -03:00
Nico 2cb8509c21 Add daemon_reachable column to santa_status table (#47751) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46059

Added `daemon_reachable` and `error` columns to the `santa_status`
fleetd table so the table reports a row when the Santa daemon is
unreachable instead of silently returning zero rows.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

Reproduced the issue:
<img width="1476" height="255" alt="Screenshot 2026-06-17 at 11 12
55 AM"
src="https://github.com/user-attachments/assets/bf7f20c2-9e77-499d-9962-0996f5c57cb1"
/>
<img width="1644" height="632" alt="Screenshot 2026-06-17 at 11 14
34 AM"
src="https://github.com/user-attachments/assets/57c790b6-ccf2-4446-90a4-164cdcbacadd"
/>

Pushed a new orbit version with the fix to the TUF server:
<img width="689" height="58" alt="Screenshot 2026-06-17 at 11 34 25 AM"
src="https://github.com/user-attachments/assets/77b70d51-856f-4957-869e-1458540154dd"
/>

Ran the query again: we now return one row instead of no rows, and
`daemon_reachable = 0` is returned. Rest of the values are null.
<img width="2542" height="545" alt="Screenshot 2026-06-17 at 11 36
37 AM"
src="https://github.com/user-attachments/assets/6d71167e-9711-4284-9142-48629edbd9be"
/>

Approved the system extension and granted full disk access:
<img width="791" height="664" alt="Screenshot 2026-06-17 at 11 38 39 AM"
src="https://github.com/user-attachments/assets/3f4f91b0-d20a-4afc-93f9-347efe823beb"
/>

<img width="733" height="643" alt="Screenshot 2026-06-17 at 11 39 20 AM"
src="https://github.com/user-attachments/assets/596d3fb8-7b0e-4532-94d6-f5c28802f343"
/>\


Verified the state changed from `[activated waiting for user]` to
`[activated enabled]` and `santactl status` did not return errors:
<img width="1429" height="708" alt="Screenshot 2026-06-17 at 11 40
02 AM"
src="https://github.com/user-attachments/assets/f9402808-0755-478c-9c95-78aa2e5c65f4"
/>

Ran queries again and verified `daemon_reachable = 1`
<img width="2525" height="548" alt="Screenshot 2026-06-17 at 11 41
33 AM"
src="https://github.com/user-attachments/assets/bf65ec55-c719-48e1-9a29-4b38aa52a882"
/>
<img width="1656" height="528" alt="Screenshot 2026-06-17 at 11 42
34 AM"
src="https://github.com/user-attachments/assets/42b51b5b-9123-4919-beeb-b847a0a99668"
/>


## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added `daemon_reachable` to Santa status monitoring to clearly
indicate reachability (`1` reachable, `0` unreachable).
* Added an `error` column to expose the `santactl status` error when the
daemon is not reachable.

* **Bug Fixes**
* Updated Santa status behavior so daemon communication failures now
return exactly one row with `daemon_reachable = 0` (and `error`
populated) instead of returning no rows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 14:42:10 -03:00
Victor Lyuboslavsky dbe9a34342 Orbit re-enroll improvements (#47652) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #47650 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Improved authentication resilience by debouncing repeated unauthorized
responses and only triggering recovery after a grace period.
* Updated node-key handling to avoid treating empty key files as valid
and to prevent accidental deletion during short failures.
* Ensured node-key storage is written atomically to avoid partial or
empty credential files.

* **Tests**
* Added comprehensive test coverage for node re-enrollment behavior,
authentication grace-period timing, and atomic file write guarantees.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 17:50:27 +01:00
Nico 0ac698145b Reap sudo child processes in execuser on Linux to prevent zombies (#47664) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41796

Root cause: run() in orbit/pkg/execuser/execuser_linux.go called
cmd.Start() but never cmd.Wait(). On Linux a child that exits stays a
zombie until the parent reaps it, so every sudo … fleet-desktop
invocation leaked a zombie. When Fleet Desktop fails to start, orbit
respawns it in a loop (desktopRunner.Execute), so the zombies pile up.
 
Fix: reap the child in a background goroutine after Start(). run() still
returns immediately (orbit monitors the desktop process separately), so
behavior is unchanged otherwise.

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually

#### Reproduction steps

1. Start TUF server and create .deb package
```sh
SYSTEMS="linux-arm64" \
DEB_FLEET_URL=https://nicolasulmete.xyz \  # personal ngrok tunnel serving Fleet
DEB_TUF_URL=http://nicotuf.ngrok.io \            # personal ngrok tunnel serving TUF
GENERATE_DEB_ARM64=1 \
ENROLL_SECRET=<enroll-secret> \
FLEET_DESKTOP=1 \
TUF_PATH=$FLEET_REPO_DIR/test_tuf \
./tools/tuf/test/main.sh
```

2. Install .deb on a Ubuntu 25.10 ARM64 VM.
3. Push a failing fleet-desktop stub to trigger the respawn loop that
produces zombie processes:

```sh
export TUF_PATH=$FLEET_REPO_DIR/test_tuf
export FLEET_TARGETS_PASSPHRASE=p4ssphr4s3 FLEET_SNAPSHOT_PASSPHRASE=p4ssphr4s3 FLEET_TIMESTAMP_PASSPHRASE=p4ssphr4s3
source ./tools/tuf/test/load_orbit_version_vars.sh
STUB=$(mktemp -d)
mkdir -p "$STUB/fleet-desktop"
printf '#!/bin/sh\n[ "$1" = "--help" ] && exit 0\nexit 1\n' > "$STUB/fleet-desktop/fleet-desktop"
chmod +x "$STUB/fleet-desktop/fleet-desktop"
tar czf "$STUB/desktop.tar.gz" -C "$STUB" fleet-desktop
./build/fleetctl updates add --path "$TUF_PATH" --target "$STUB/desktop.tar.gz" --platform linux-arm64 --name desktop --version "$ORBIT_VERSION" -t "$ORBIT_MAJOR.$ORBIT_MINOR" -t "$ORBIT_MAJOR" -t stable
rm -rf "$STUB"
```

4. Watch zombie processes on the VM:

```sh
 watch -n5 'ORB=$(pgrep -x orbit); \
    echo "zombie sudo children: $(ps -eo ppid,stat,comm | awk -v o="$ORB" "\$1==o && \$2 ~ /Z/ && \$3==\"sudo\"" | wc -l)"; \
    echo "total sudo lines:     $(ps aux | grep -c "[s]udo")"'
```


https://github.com/user-attachments/assets/dfa4d766-3c8e-4eb0-9104-7219c421538f

#### Test fix

1. Switch to this branch, rebuild and push the new orbit binary (note
that we still have the stub fleet-desktop that always exits).

```sh
make build
export TUF_PATH=$FLEET_REPO_DIR/test_tuf
bash $FLEET_REPO_DIR/push-orbit-arm64.sh
```

Contents of `push-orbit-arm64.sh` is:

```sh
#!/bin/bash
set -e

source ./tools/tuf/test/load_orbit_version_vars.sh

GOOS=linux GOARCH=arm64 go build \
    -o orbit-linux-arm64 \
    -ldflags="-s -w -X github.com/fleetdm/fleet/v4/orbit/pkg/build.Version=$ORBIT_VERSION -X github.com/fleetdm/fleet/v4/orbit/pkg/build.Commit=$ORBIT_COMMIT" \
    ./orbit/cmd/orbit

./tools/tuf/test/push_target.sh linux-arm64 orbit orbit-linux-arm64 "$ORBIT_VERSION"
```

2. Verify on the VM that the update is detected and applied. Also, run
step 4's cmd from the reproduction steps and see the zombies being 0,
even though fleet-desktop is still continuously exiting.


https://github.com/user-attachments/assets/d0f96d85-5e94-4878-b413-67031add3c1e

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed an issue on Linux where repeated Fleet Desktop startup failures
could result in thousands of orphaned processes accumulating in the
background, degrading system performance.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-16 11:40:52 -03:00
github-actions[bot]andlucasmrod 2f62b913df Update versions of fleetd components in Fleet's TUF [automated] (#47631) 
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-06-15 15:57:39 -03:00
Gray WilliamsNoah TalermanNoah Talerman
 		eacca4e906 Linux disk encryption key escrow: Improve confirmation modal (#47097) 
- @noahtalerman: For the following quick win:
  - #46528

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Clarified the success message shown after disk encryption key escrow:
instructs users to close the window, go to the "My Device" page, and use
"Refetch" to clear the yellow notification banner.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Co-authored-by: Noah Talerman <noahtal@umich.edu>
 2026-06-12 10:07:08 +01:00
Lucas Manuel Rodriguez 8e4805b215 Add changes for fleetd v1.56.3 (#47451) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed agent handling of osquery command line flags. The system now
correctly preserves pre-packaged flagfiles when the flag setting is
unset, while continuing to clear flags when explicitly set to empty.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-12 05:02:12 -03:00
github-actions[bot]andlucasmrod f83394cd12 Update versions of fleetd components in Fleet's TUF [automated] (#47450) 
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-06-11 16:44:13 -03:00
Lucas Manuel Rodriguez 4991b3c685 Fix fleetd with pre-packaged osquery flags (#47305) 
Resolves #47285.

Final behavior (matches pre-1.56):
```
┌────────────────────┬─────────────────────────┬───────────────────────────────────────┐
│ command_line_flags │    wire config.Flags    │             Orbit action              │
├────────────────────┼─────────────────────────┼───────────────────────────────────────┤
│ Unset              │ omitted (nil, len == 0) │ Preserve osquery.flags — return early │
├────────────────────┼─────────────────────────┼───────────────────────────────────────┤
│ null               │ null (len == 4)         │ Clear (parses to empty map)           │
├────────────────────┼─────────────────────────┼───────────────────────────────────────┤
│ {}                 │ {} (len == 2)           │ Clear (parses to empty map)           │
├────────────────────┼─────────────────────────┼───────────────────────────────────────┤
│ {"verbose": true}  │ non-empty               │ Write flags                           │
└────────────────────┴─────────────────────────┴───────────────────────────────────────┘
```

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Preserve existing pre-packaged or user-provided osquery flagfiles when
the server omits flag configuration (no unintended clears or restarts).
* Treat an explicit empty flag payload (including JSON empty document or
JSON "null") as an instruction to clear flagfiles and queue a restart.

* **Tests**
* Expanded coverage to validate the preserve-vs-clear behavior for
unset, empty, and "null" flag payloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-10 17:13:26 -03:00
Lucas Manuel RodriguezVictor LyuboslavskyCopilot Autofix powered by AI
 		6d67565b14 Update Go to 1.26.4 (#47158) 
Resolves #47159.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated the Go toolchain to 1.26.4 across modules, Docker build
stages, and build/configuration records to standardize the toolchain
version used for builds and tooling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-09 12:55:10 -03:00
Dante Catalfamo 19ba1ed787 Initial pass on TPM-backed disk encryption support (#46457) 2026-06-08 16:35:20 -04:00
github-actions[bot]andlucasmrod bdbdaaa226 Update versions of fleetd components in Fleet's TUF [automated] (#47081) 
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-06-08 10:31:44 -03:00
Lucas Manuel Rodriguez c7ae13eb5b Bump version to 1.56.2 (#46836) 
Updated version to 1.56.2
 2026-06-04 15:52:07 -03:00
github-actions[bot]andlucasmrod e97eabc18a Update versions of fleetd components in Fleet's TUF [automated] (#46843) 
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-06-04 15:37:17 -03:00
Lucas Manuel Rodriguez dd3ab4fa14 Update patch version for fleetd (#46775) 2026-06-04 14:44:32 -03:00
Jordan MontgomeryandCopilot Autofix powered by AI 19d7dec0ed Fix orbit debug flag behavior (#46814) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46816

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed unexpected restarts when starting Orbit with `--debug` or
`ORBIT_DEBUG=1` environment variable while the server was not sending
debug flags.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-04 11:30:01 -04:00
Victor Lyuboslavsky e20cedc8a0 fleetd Windows MDM wake (push vs poll) (#46594) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46567 and Resolves #46737 

Solution for the agressive polling:
- no WNS (although we could add it later as another avenue for
notifications)
- fleetd advertises a sync capability, persisted as
`mdm_windows_enrollments.fleetd_sync_capable`
- The management session relaxes the DMClient poll
(`poll_schedule_relaxed`)
- When an MDM command is queued, `has_pending_commands` flips, the next
orbit check-in returns `WindowsMDMSyncRequest`, and fleetd runs
`deviceenroller` to deliver it immediately
- older fleetd versions keep the 1-minute poll

Docs: https://github.com/fleetdm/fleet/pull/46780

Changes to osquery_perf and any additional changes after loadtesting
will be done in a separate PR.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Timeouts are implemented and retries are limited to avoid infinite
loops

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* On-demand Windows MDM sync: servers can request immediate delivery of
queued MDM commands to Windows clients; Orbit triggers client-side sync
on Windows.

* **Enhancements**
  * Orbit throttles per-device on-demand sync to avoid excessive runs.
* Server reconciles and persists device poll schedule (fast vs relaxed)
and exposes consolidated host MDM state (awaiting-configuration +
has-pending-commands).

* **Tests**
* Added tests covering host config state, pending-command flows,
poll-schedule toggling, and on-demand sync behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-03 17:38:14 -05:00
github-actions[bot] cb1f2b8350 Update versions of fleetd components in Fleet's TUF [automated] (#46778) 2026-06-03 15:25:43 -05:00
Juan Fernandez b9e58d5a86 Remove debug log statement (#46753) 
Debug log statement introced in 45963 breaks Orbit's parse logic of
`fleet-desktop --version` output.
 2026-06-03 14:20:07 -04:00
Lucas Manuel RodriguezandCopilot Autofix powered by AI 06cfd32e89 Release fleetd v1.56.0 (#46746) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
  * Enhanced file-path validation for improved handling
  * Resolved Fleet Desktop startup issues on openSUSE Leap systems
  * Updated Orbit identifier token rotation behavior

* **New Features**
* Added Adobe plugins detection table to identify plug-ins on macOS and
Windows

* **Chores**
  * Updated Go version to 1.26.3

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-03 15:07:34 -03:00
github-actions[bot]andlucasmrod adde70832d Update versions of fleetd components in Fleet's TUF [automated] (#46747) 
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-06-03 14:25:01 -03:00
Sharon Katz 4221903eb2 Add exponential backoff to Fleet Desktop server polling (#45623) 
Closes #45624

Part 1 of #45553 -- see there for the full behavioral contract and
Oracle.

## Changes

- New `orbit/pkg/backoff` package: shared, stateful exponential backoff
tracker with jitter, thread-safe, per-path isolation. This package will
serve all agent components that need backoff (orbit API, fleetd paths,
and potentially osquery TLS), but for now only Fleet Desktop uses it. We
are introducing it incrementally to reduce risk.
- Integrated into Fleet Desktop's `checkToken` retry loop -- the exact
tight-retry path that caused the #44816 DB outage. The main
ping/DesktopSummary loop does not need backoff (Ping is unauthenticated
with no DB cost; DesktopSummary already runs at most every 5 min).
- On error: interval doubles each failure (1s, 2s, 4s, 8s, ...) capped
at 5 minutes
- On success: resets immediately to normal polling interval
- Each communication path tracks its own backoff independently

## Manual testing

### Automated tests (17 total, all pass with -race)

\`\`\`
go test ./orbit/pkg/backoff/ -v -race -count=1   # 17 tests, 0 failures
make lint-go-incremental                          # 0 issues
\`\`\`

- 14 logic tests (exponential doubling, cap, jitter, reset, per-path
isolation, concurrent access, overflow detection, garbage input
flooring)
- 3 real-time ticker tests (actual time.Ticker with wall-clock
measurements)

### Local TUF end-to-end test (macOS)

Set up local TUF server via \`tools/tuf/test/main.sh\` with
\`SYSTEMS=macos FLEET_DESKTOP=1 GENERATE_PKG=1\`. This builds orbit and
Desktop from this branch, generates \`fleet-osquery.pkg\` with local TUF
root keys. Installed the package on macOS, enrolled to a local Fleet
server.

**Test: corrupt token to simulate #44816 expired-token scenario**

Wrote invalid token to \`/opt/orbit/identifier\`, then watched Desktop
and orbit logs.

Desktop backoff (exponential doubling):
\`\`\`
11:57:21 ERR get device URL, backing off next_retry=2.044s (1s * 2^1 +
jitter)
11:57:29 ERR get device URL, backing off next_retry=4.061s (1s * 2^2 +
jitter)
11:57:39 ERR get device URL, backing off next_retry=8.744s (1s * 2^3 +
jitter)
\`\`\`

Orbit detects and rotates the token:
\`\`\`
11:57:42  INF token TTL expired, rotating token
\`\`\`

Desktop recovers instantly:
\`\`\`
11:57:48  DBG enabling tray items
\`\`\`

Previously Desktop would have retried every 5s indefinitely (#44816).
With backoff, retry intervals double each failure and recovery is
immediate on the first success.

### Build verification

\`\`\`
go build ./orbit/cmd/desktop/   # compiles clean
go build ./orbit/cmd/orbit/     # compiles clean
\`\`\`

---

# Checklist for submitter

- [x] Changes file added for user-visible changes in \`orbit/changes/\`.
- [x] Input data is properly validated, no SQL changes, no JS changes.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops (backoff caps at 5 min).
- [x] Added/updated automated tests (17 tests, all pass with \`-race\`).
- [x] QA'd all new/changed functionality manually (local TUF e2e on
macOS).

## fleetd/orbit/Fleet Desktop

- [x] If the change applies to only one platform, confirmed that
\`runtime.GOOS\` is used as needed to isolate changes (backoff is
platform-agnostic).
- [x] Verified that fleetd runs on macOS (local TUF install + e2e test).
Linux/Windows need QA.
- [ ] Verified auto-update works from the released version of component
to the new version.
 2026-06-02 15:31:32 -04:00
Juan Fernandez 18f1f10588 Make path traversal in Orbit more robust (#46570) 
Make path traversal in Orbit more robust.
 2026-06-02 07:33:09 -04:00
Juan Fernandez 0922a8bdb9 Fix Fleet Desktop KDE detection on hybrid Linux installs 
Fixes #45963 

isKDE() previously matched loginctl's Desktop metadata field, which can
falsely report KDE on hosts that have kde-plasma-desktop installed
alongside another, detect the live plasmashell process owned by the
logged-in GUI user instead.
 2026-06-01 12:25:12 -04:00
Nico 7290b27a56 Fix: My Device page not showing correct light/dark mode logo (#46063) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46034

## Testing

- [x] QA'd all new/changed functionality manually

### Before

My Device page was showing the light mode logo even when in dark mode.

<img width="1412" height="756" alt="Screenshot 2026-05-22 at 11 51
57 AM"
src="https://github.com/user-attachments/assets/9f098d96-b9d1-4618-b6f4-e7ee49629506"
/>

<img width="1340" height="708" alt="Screenshot 2026-05-22 at 11 35
59 AM"
src="https://github.com/user-attachments/assets/dfff3a53-e08b-4b7a-a3fc-97f33e0d691d"
/>

### After

My Device page correctly shows the logo for both modes

Light:
<img width="1434" height="725" alt="Screenshot 2026-05-22 at 11 48
51 AM"
src="https://github.com/user-attachments/assets/4d5913c5-5264-40ac-bbdf-21c271637898"
/>
<img width="1337" height="451" alt="Screenshot 2026-05-22 at 11 48
55 AM"
src="https://github.com/user-attachments/assets/1cd6193e-b910-46ea-8f89-0cd88ad07382"
/>

Dark (Fleet's default logo):
<img width="1127" height="644" alt="Screenshot 2026-05-22 at 11 48
08 AM"
src="https://github.com/user-attachments/assets/a55a0026-f301-4281-8419-83cc9a707bb7"
/>
<img width="1357" height="528" alt="Screenshot 2026-05-22 at 11 48
15 AM"
src="https://github.com/user-attachments/assets/471a604a-9524-4d5a-8af4-cfe09d2430fc"
/>



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Organization logos now adapt to dark or light mode, showing the
appropriate themed variant across the app.
* **Bug Fixes / Improvements**
* Device and host pages now pick the correct logo variant with sensible
fallbacks so logos display consistently when theme-specific images are
missing.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46063?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-22 13:09:10 -03:00
Lucas Manuel Rodriguez 1f496781a2 Rename and move testing_utils.go from schedule and orbit tests (#45609) 
Resolves #45220 (one of many small PRs, we are close)

## Testing

- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Refactored test infrastructure for scheduling components to use
centralized test utilities.

---

**Note:** This release contains no user-facing changes. All
modifications are internal testing and code organization improvements.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45609)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 13:23:58 -03:00
Juan Fernandez d45dbc6d11 Update Fleetd icon used in KDE (#41108) 
Fixes #41108

Use color version of icon on KDE to improve UX on
light/dark themes.
 2026-05-14 15:55:14 -04:00
Sharon Katz 7d26e7e475 Add adobe_plugins osquery extension table (#45208) 
Closes #45206

## Summary

- Adds a new `adobe_plugins` osquery extension table to fleetd (macOS +
Windows)
- Parses CEP (`CSXS/manifest.xml`) and UXP (`manifest.json`) manifests
for rich metadata
- Falls back to filesystem info for native plug-ins where no manifest
exists
- Supports a `scan_level` WHERE constraint: `standard` (default) or
`deep`

## Table schema

| Column | Type | Description |
| --- | --- | --- |
| `path` | TEXT | Full path to the plugin directory or file |
| `name` | TEXT | Plugin display name (from manifest or directory name)
|
| `version` | TEXT | Plugin version (from manifest) |
| `vendor` | TEXT | Plugin author/publisher (from manifest) |
| `bundle_id` | TEXT | Plugin bundle identifier (from manifest) |
| `host_application` | TEXT | Target app(s): Photoshop, Illustrator,
Premiere Pro, etc. |
| `extension_type` | TEXT | `CEP`, `UXP`, or `native` |
| `user` | TEXT | Username for user-scoped installs; empty for
system-wide |
| `platform` | TEXT | `darwin` or `windows` |
| `scan_level` | TEXT | WHERE constraint only — `standard` (default) or
`deep` |

## How I tested it

> **Note:** Manual testing was done by installing two real open-source
CEP extensions (downloaded from GitHub) on a macOS host without a full
Adobe CC installation. This validates the table logic, manifest parsing,
and osquery integration end-to-end against real-world manifest formats.
**QA should test against machines with full Adobe Creative Cloud
installations** (Photoshop, Premiere, Illustrator, etc.) to verify the
scan paths match what Adobe actually ships, and to exercise `scan_level
= 'deep'` with real native plug-in directories. Expect a few more dev
cycles after QA feedback.

### 1. Unit tests — 22 passing

```
$ go test ./orbit/pkg/table/adobe_plugins/... -v
--- PASS: TestParseCEPPlugin/valid_manifest
--- PASS: TestParseCEPPlugin/missing_manifest_falls_back_to_dir_name
--- PASS: TestParseCEPPlugin/malformed_manifest_falls_back_to_dir_name
--- PASS: TestParseUXPPlugin/valid_manifest
--- PASS: TestParseUXPPlugin/missing_manifest_falls_back_to_dir_name
--- PASS: TestParseUXPPlugin/manifest_with_id_but_no_name_uses_id
--- PASS: TestParseNativePlugin/* (5 subtests)
--- PASS: TestResolveHostApps/* (7 subtests)
--- PASS: TestScanEntry/* (2 subtests)
PASS
```

### 2. Cross-platform compilation

```
$ go build ./orbit/pkg/table/adobe_plugins/...                  # macOS ✅
$ GOOS=windows go build ./orbit/pkg/table/adobe_plugins/...     # Windows ✅
$ GOOS=linux go build ./orbit/pkg/table/adobe_plugins/...       # Linux stub ✅
$ go build ./orbit/cmd/fleetd_tables/                           # Full fleetd binary ✅
$ go vet ./orbit/pkg/table/adobe_plugins/...                    # Clean ✅
```

### 3. Manual end-to-end testing on macOS (osquery 5.23.0)

#### Setup

Built the fleetd extension binary, then installed two **real open-source
CEP extensions** from GitHub into the user-scoped scan path
(`~/Library/Application Support/Adobe/CEP/extensions/`):

1. **[adobe-discord-rpc](https://github.com/Kuredew/adobe-discord-rpc)**
— a real CEP extension targeting 11 Adobe apps. Has no `<Author>`
element (tests missing-vendor edge case). Complex manifest with many
host app codes.

2. **[cep-template](https://github.com/khanyuinc/cep-template)** — a CEP
starter template targeting After Effects only. Minimal manifest.

```bash
# Build extension
go build -o build/fleetd-tables-test ./orbit/cmd/fleetd_tables/

# Install real extensions
CEP_DIR="$HOME/Library/Application Support/Adobe/CEP/extensions"
mkdir -p "$CEP_DIR/adobe-discord-rpc/CSXS"
# downloaded CSXS/manifest.xml from GitHub into the directory
mkdir -p "$CEP_DIR/cep-template/CSXS"
# downloaded CSXS/manifest.xml from GitHub into the directory
```

#### Running the query

```bash
OSQUERYD="/opt/orbit/bin/osqueryd/macos-app/stable/osquery.app/Contents/MacOS/osqueryd"
$OSQUERYD -S --allow_unsafe --extensions_timeout=10 \
  --extensions_require=com.fleetdm.fleetd_tables.osquery_extension.v1 \
  --extension build/fleetd-tables-test \
  --json "SELECT * FROM adobe_plugins;"
```

#### Actual output (verbatim)

```json
[
  {
    "bundle_id": "com.kureichi.discordrpc",
    "extension_type": "CEP",
    "host_application": "After Effects, Photoshop, Premiere Pro, InCopy, Audition, Dreamweaver, Animate, InDesign, Illustrator, Prelude",
    "name": "adobe-discord-rpc",
    "path": "/Users/sharonkatz/Library/Application Support/Adobe/CEP/extensions/adobe-discord-rpc",
    "platform": "darwin",
    "scan_level": "",
    "user": "sharonkatz",
    "vendor": "",
    "version": "3.1.1"
  },
  {
    "bundle_id": "com.yourcompany",
    "extension_type": "CEP",
    "host_application": "After Effects",
    "name": "cep-template",
    "path": "/Users/sharonkatz/Library/Application Support/Adobe/CEP/extensions/cep-template",
    "platform": "darwin",
    "scan_level": "",
    "user": "sharonkatz",
    "vendor": "",
    "version": "1.0"
  }
]
```

#### osqueryi table output

```
+-------------------+---------+-------------------------+----------------------------------------------------------------------------------------------------------------+----------------+------------+
| name              | version | bundle_id               | host_application                                                                                               | extension_type | user       |
+-------------------+---------+-------------------------+----------------------------------------------------------------------------------------------------------------+----------------+------------+
| adobe-discord-rpc | 3.1.1   | com.kureichi.discordrpc | After Effects, Photoshop, Premiere Pro, InCopy, Audition, Dreamweaver, Animate, InDesign, Illustrator, Prelude | CEP            | sharonkatz |
| cep-template      | 1.0     | com.yourcompany         | After Effects                                                                                                  | CEP            | sharonkatz |
+-------------------+---------+-------------------------+----------------------------------------------------------------------------------------------------------------+----------------+------------+
```

#### What this verified

| Scenario | Result |
| --- | --- |
| Real CEP manifest with 11 host apps | ✅ All codes resolved (AEFT→After
Effects, PHSP/PHXS→Photoshop, PPRO→Premiere Pro, etc.) |
| Missing `<Author>` element | ✅ `vendor` is empty string, no crash |
| Minimal CEP manifest (single host) | ✅ `host_application=After
Effects`, version/bundle_id correct |
| User-scoped detection | ✅ `user=sharonkatz` populated |
| Schema registration | ✅ `.schema adobe_plugins` shows all 10 columns |
| No Adobe installed + no plugins | ✅ 0 rows, no error |
| Deep scan with no app bundles | ✅ 0 extra rows, no error |

### Windows

Not tested yet — Windows paths are implemented and cross-compile, but
need manual verification on a Windows host with Adobe CC.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
  * Added Adobe plugins osquery table for macOS and Windows platforms
  * Discovers and catalogs Adobe CEP, UXP, and native plugins
* Extracts plugin metadata including version, vendor, host applications,
and installation paths
  * Supports configurable scan depth for comprehensive plugin discovery

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45208)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 14:46:48 -04:00
Jordan MontgomeryandCopilot Autofix powered by AI bee5edaa0b Add server-side orbit debug logging enablement - currently only configurable as a duration-after-enrollment setting (#45367) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43997 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Configure Orbit to enable debug logging for a limited window on agent
enrollment; enrolled hosts receive debug/verbose behavior while the
window is active and it is reflected in agent config.

* **Chores**
* Added database column to record per-host debug-until timestamps and
datastore support to extend it safely.

* **Tests**
* Added integration and unit tests covering validation, enrollment
stamping, config generation, and runtime debug toggling.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45367)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-05-14 13:32:02 -04:00
Luke Heath f4b6b45997 Bump Go to 1.26.3 to clear stdlib CVEs (#45277) 2026-05-12 17:19:16 -05:00
Sharon KatzandMagnus Jensen 0276662545 Fix MDM SSO callback 'missing profile' error for Android enrollment (#45046) 
Closes #45024

## Summary

- Fixed the MDM SSO callback handler returning a `"missing profile:
missing profile"` error when an Android device enrolls via SSO (OTA
enrollment) on a Fleet instance that does **not** have Apple MDM
configured.
- Refactored all MDM SSO initiator magic strings (`"ota_enroll"`,
`"setup_experience"`, `"account_driven_enroll"`) into named constants
(`fleet.SSOInitiatorOTAEnroll`, etc.) to prevent typos and missed cases
— which is the class of bug that caused this issue.

## Code walkthrough

### The bug

The bug is in `ee/server/service/mdm.go` in
`mdmSSOHandleCallbackAuth()`.

**The flow:**
1. Android enrollment hits `/enroll?enroll_secret=xxx` → frontend calls
`InitiateMDMSSO` with initiator `"ota_enroll"`
(`server/service/frontend.go:248`)
2. User authenticates at the SAML IdP
3. The SSO callback arrives at `MDMSSOCallback` → calls
`mdmSSOHandleCallbackAuth`
4. After successful SAML auth, the function checks early-exit
conditions:
- Line 1133: account-driven enrollment (`originalURL ==
appleMDMAccountDrivenEnrollmentUrl`) → **no match** for OTA
- Line 1139: `Initiator != "setup_experience"` → **true** for
`"ota_enroll"` → enters the block
5. Line 1140: calls `getAutomaticEnrollmentProfile()` → returns `nil`
because **no Apple MDM is configured**
6. Line 1144–1146: `depProf == nil` → **returns `"missing profile"`
error**

Note that `MDMSSOCallback` (the caller) already has a guard at line 931
that correctly skips the Apple MDM verification for `/enroll?` paths:
```go
if !strings.HasPrefix(originalURL, "/enroll?") && ssoRequestData.Initiator != "setup_experience" {
    if err := svc.VerifyMDMAppleConfigured(ctx); err != nil { ... }
}
```

But `mdmSSOHandleCallbackAuth` was missing the equivalent guard — it
unconditionally tried to fetch the Apple DEP profile for any
non-`setup_experience` initiator.

### The fix

Adds an early return for OTA enrollments (where `originalURL` starts
with `/enroll?`), matching the existing pattern for account-driven
enrollments right above it. OTA enrollments don't use the Apple DEP
profile token.

### The refactor

Replaced all raw initiator string literals across the backend with named
constants defined in `server/fleet/app.go`:

| Constant | Value | Used by |
|---|---|---|
| `fleet.SSOInitiatorOTAEnroll` | `"ota_enroll"` | `/enroll` page
(Android, BYOD iPhone/iPad) |
| `fleet.SSOInitiatorSetupExperience` | `"setup_experience"` | Orbit
agent (macOS Setup Assistant) |
| `fleet.SSOInitiatorAccountDrivenEnroll` | `"account_driven_enroll"` |
Apple account-driven MDM enrollment |

Constants are in `server/fleet/` (not `server/sso/`) so orbit can import
them without pulling in Redis dependencies.

**Files changed:**
- `ee/server/service/mdm.go` — 6 string replacements (switch cases +
comparisons)
- `server/service/frontend.go` — 1 replacement
- `orbit/cmd/orbit/orbit.go` — 1 replacement
- `server/service/testing_client.go` — 1 replacement
- `server/service/integration_mdm_test.go` — 1 replacement

## Local reproduction

### Setup
1. Started dev server: `build/fleet serve --dev --dev_license`
2. Infrastructure: MySQL, Redis, SimpleSAML IdP via `docker compose up`
3. Created admin user and enroll secret
4. Configured MDM SSO (`entity_id: mdm.test.com`, SimpleSAML IdP at
`localhost:9080`)
5. Set `enable_end_user_authentication: true` directly in DB (API blocks
this without Apple MDM — matches customer state)
6. **Did NOT configure Apple MDM** — only SSO + EUA, simulating
Android-only instance

### Steps
1. `GET https://localhost:8080/enroll?enroll_secret=test_enroll_secret`
→ 303 redirect to SimpleSAML IdP
2. Completed SAML login programmatically (user: `sso_user`, pass:
`user123#`)
3. `POST https://localhost:8080/api/v1/fleet/mdm/sso/callback` with the
SAMLResponse

### Before fix
```
=== CALLBACK RESULT ===
Status: HTTP/2 303
Location: /mdm/sso/callback?error=true

=== SERVER LOGS ===
ts=2026-05-08T16:53:49Z level=error component=http method=POST
  uri=/api/v1/fleet/mdm/sso/callback took=12.148708ms
  err="missing profile: missing profile"
```

### After fix
```
=== CALLBACK RESULT ===
Status: HTTP/2 303
Location: /enroll?enroll_secret=test_enroll_secret&enrollment_reference=7c67326c-...&initiator=ota_enroll&profile_token=

=== SERVER LOGS ===
ts=2026-05-08T17:27:54Z level=info component=http method=POST
  uri=/api/v1/fleet/mdm/sso/callback took=15.973ms
```

No errors. Successful redirect back to the enrollment page with the
enrollment reference.

## Integration test

Added `TestOTAEnrollSSOWithoutAppleDEPProfile` which:
1. Configures SSO and creates a team with IdP enabled
2. **Deletes all Apple DEP enrollment profiles** to simulate an
Android-only instance
3. Runs the full OTA enrollment SSO flow (GET `/enroll` → SAML IdP login
→ callback)
4. Verifies the callback redirects to `/enroll?...` with
`enrollment_reference` and `initiator=ota_enroll` (not `?error=true`)

Confirmed the test **fails without the fix** (`err="missing profile:
missing profile"`) and **passes with the fix**.

Also added a `LoginOTAEnrollSSOUser` test helper that drives the
complete OTA SSO flow starting from `GET /enroll` through SAML IdP login
to the callback, using a single cookie jar.

## Test plan

- [ ] Verify Android SSO enrollment works on an instance with **only**
Android MDM configured (no Apple MDM)
- [ ] Verify Apple DEP enrollment with SSO still works (the DEP profile
path is unchanged)
- [ ] Verify Apple OTA enrollment with SSO still works (also uses
`/enroll?` path)
- [ ] Verify account-driven enrollment with SSO still works (has its own
early return)
- [ ] Verify setup experience SSO still works (uses `Initiator ==
"setup_experience"`)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Resolved a regression where OTA enrollment via SSO could return a
"missing profile" error on Android when Apple MDM is not configured; OTA
SSO now redirects correctly to the enrollment flow.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45046)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
 2026-05-12 12:42:16 -04:00
github-actions[bot]andlucasmrod d6e89babbd Update versions of fleetd components in Fleet's TUF [automated] (#45187) 
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-05-11 16:57:16 -03:00
Lucas Manuel Rodriguez c975e1353b Update desktop token even if fleet desktop is disabled (#45140) 
Missing changes file for:
https://github.com/fleetdm/fleet/pull/39533/changes.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Desktop security token rotation for identity verification now occurs
consistently, regardless of Fleet Desktop configuration status.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45140)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 11:52:35 -03:00
Jordan MontgomeryCopilot Autofix powered by AIcoderabbitai[bot]
 		99babf436a Don't write the secret.txt when the secret is the dummy placeholder value (#45041) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #44826

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results


## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified that fleetd runs on macOS, Linux and Windows

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Windows MSI builds now correctly exclude placeholder secret values
during installation, preventing unnecessary dummy configuration files
from being created.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
 2026-05-08 15:26:33 -04:00
Allen Houchinscopilot-swe-agent[bot]Noah Talerman
 		b84704f5d3 Always start token rotation (#39533) 
- @noahtalerman: For the following quick win:
  - https://github.com/fleetdm/fleet/issues/44681

---

Remove the fleet-desktop conditional so the token/device identifier
rotation is started unconditionally. This keeps the device identifier
(e.g. /opt/orbit/identifier) up to date for refetch-host, device auth,
and Fleet Desktop, and defers stopping the rotation as before.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #31421

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Bug Fixes**
* Device token rotation is now enabled for all runs, ensuring consistent
behavior across all scenarios.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
 2026-05-06 11:41:20 -05:00
Lucas Manuel RodriguezandCopilot Autofix powered by AI e9334bc666 Update changelog for fleetd 1.55.0 release (#44733) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved error handling for Windows registry enumeration to prevent
failures from malformed entries.

* **Chores**
* Removed debugging symbols from Orbit and Fleet Desktop executables for
optimized builds.
* Updated macadmins/osquery-extension dependency to v1.4.1, adding
network_quality table support.
  * Updated Go runtime to version 1.26.2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-05-05 19:18:08 -03:00
github-actions[bot]andlucasmrod 8e96771719 Update versions of fleetd components in Fleet's TUF [automated] (#44757) 
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-05-05 15:04:42 -03:00
github-actions[bot]andlucasmrod 8b073e3bf6 Update versions of fleetd components in Fleet's TUF [automated] (#44736) 
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-05-05 11:16:36 -03:00
Allen Houchins fa38063590 Fix Fleet Desktop not launching on OpenSUSE 16 (#44482) 
This pull request addresses a startup issue with Fleet Desktop on
openSUSE Leap 16 and similar Linux distributions. The main change is to
adjust how Fleet Desktop and key-escrow dialogs are launched to avoid
environment variable loss caused by login shell profile scripts. The fix
is scoped specifically to openSUSE Leap 16+ to avoid impacting other
distributions.

**Distribution-specific sudo invocation changes:**

* The `-i` (login shell) flag is now omitted from the `sudo` command
when launching Fleet Desktop and key-escrow dialogs on openSUSE Leap 16
and newer, preventing environment variables from being lost due to
profile script interference.
[[1]](diffhunk://#diff-633ab361af6795ef458233819e2806dfba4ca56f684866d956321825b8fd2e91R1)
[[2]](diffhunk://#diff-3e8315d9f12512bce490457c5d20bd7c5aebaa2a8e18b1abf50e504815dd7a9dR178-R193)
* For all other supported distributions, the previous behavior (using
`-i`) is preserved to maintain compatibility and avoid unnecessary
re-testing.

**Detection logic:**

* Introduced a new helper function `isOpenSUSELeap16Plus` in
`execuser_linux.go` to detect if the host is running openSUSE Leap 16 or
newer by parsing `/etc/os-release`. This ensures the workaround is only
applied where necessary.

---


**Related issue:** N/A — surfaced via field investigation on openSUSE
Leap 16 (arm64).

This PR addresses two distinct issues that together prevent Fleet
Desktop from working on openSUSE Leap 16, both validated end-to-end on a
real Leap 16 (arm64) host.

## 1. Launch reliability — drop `sudo -i`

`orbit/pkg/execuser/execuser_linux.go`

On Linux, Orbit launches Fleet Desktop with:

```
sudo -n -i -u <user> -H env WAYLAND_DISPLAY=… … FLEET_DESKTOP_DEVICE_IDENTIFIER_PATH=/opt/orbit/identifier … /…/fleet-desktop
```

The `-i` flag makes sudo "simulate initial login" — it runs the target
user's shell as a login shell and wraps the rest of the command in `bash
--login -c '<escaped>'`. That sources `/etc/profile` and every script in
`/etc/profile.d/*` before our `env KEY=val … fleet-desktop` line runs,
and shell metacharacters (`=`, `:`, `/`, `.`) get backslash-escaped
through the shell layer.

On **openSUSE Leap 16 (arm64)**, that indirection causes the inline
env-var assignments to not reach `fleet-desktop`, which exits
immediately with:

```
FTL missing URL environment FLEET_DESKTOP_DEVICE_IDENTIFIER_PATH
```

Orbit then respawns it every ~15 s in a tight kill-and-respawn loop, so
the tray icon never appears.

**Fix:** drop `-i` from the sudo invocation. We don't need a login
shell:
- `-H` already sets `HOME` to the target user.
- sudo's default `env_reset` sets `USER` / `LOGNAME` / `SHELL` / `MAIL`
and `PATH` to `secure_path`.
- All session vars (`WAYLAND_DISPLAY`, `DISPLAY`,
`DBUS_SESSION_BUS_ADDRESS`, `LD_LIBRARY_PATH`) and every
`FLEET_DESKTOP_*` var are already passed explicitly via `env KEY=val …`.

After the change, sudo `execve()`s `env` directly with no shell layer in
between, so `/etc/profile.d` sourcing and shell-escaping are out of the
picture.

The `runuser -l` /proc/keys-leak regression from PR #32309 does not
apply — that was specific to `runuser -l` creating session keyrings;
sudo without `-i` doesn't.

# Checklist for submitter

- [x] Changes file added:
`orbit/changes/fleet-desktop-linux-no-login-shell`
- [x] Input data is properly validated; untrusted data interpolated into
shell scripts/commands is validated against shell metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops (script's wait loop now bounded at 90s).
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes — N/A.

## Testing

Manual QA needed before merge:

- [x] **openSUSE Leap 16 (arm64)** — Fleet Desktop process starts, stays
running, env vars present, no FTL respawn loop. Done via `sudo` shim.
- [x] **openSUSE Leap 16 (arm64) — extension fallback** — manual tarball
install + schema compilation produces a working tray icon (matching what
the script automates).
- [ ] **Ubuntu 22.04 / 24.04** — regression check: Fleet Desktop tray
icon still appears, key-escrow zenity dialog still renders, AppIndicator
script still installs via the official path.
- [ ] **Fedora (recent)** — regression check: same as above.
- [ ] **Debian** — regression check: same as above.
- [ ] **openSUSE Tumbleweed** — confirm `InstallRemoteExtension` path
still works (no fallback path triggered).

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet —
pure launch-flag change plus a script update; no protocol or schema
impact.
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes — Go change is in
`execuser_linux.go`, only built on Linux. The script is Linux-only by
construction.
- [ ] Verified that fleetd runs on macOS, Linux and Windows — Linux
re-verification pending QA above; macOS/Windows code paths unchanged.
- [ ] Verified auto-update works from the released version of component
to the new version.

## Notes for reviewers

- The tray-icon visibility issue is an OS-side prerequisite (GNOME 3.26+
has no native tray), so the AppIndicator extension is required
regardless. Even after installing it, Wayland requires a logout/login to
pick up new extensions — this is documented behavior and not specific to
the fallback path.
 2026-05-01 23:26:56 -05:00
Carlo 5ac50a2dc9 Bound orbit retries on missing installer details to 5 mins (#44284) 
Fixes #44084
 2026-04-28 12:58:10 -04:00
Lucas Manuel Rodriguez d4c0834cba Bump macadmins/osquery-extension to v1.4.1 and add network_quality ta… (#44214) 
**Related issue:** Resolves #44202.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [X] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [X] Verified that fleetd runs on macOS, Linux and Windows
- [X] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added network quality table for macOS to monitor download and upload
speeds with results formatted in both kilobits and megabits per second
(requires macOS 12+)

* **Chores**
  * Updated MacAdmins osquery extension dependency to v1.4.1

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-27 14:52:27 -03:00
github-actions[bot]andlucasmrod e44070cb8a Update versions of fleetd components in Fleet's TUF [automated] (#44222) 
Automated change from [GitHub
action](https://github.com/fleetdm/fleet/actions/workflows/fleetd-tuf.yml).

Co-authored-by: lucasmrod <lucasmrod@users.noreply.github.com>
 2026-04-27 13:47:24 -03:00
Nico f5e9f7d05d Reopen SSO browser window if it hasn't been completed after an interval (#42645) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #38230 

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

Enrolled the host.
Closed initial SSO browser window.
Waited 5 minutes and completed SSO.


https://github.com/user-attachments/assets/e55409b0-9d9e-43c8-913a-837a0d58799c

<img width="1508" height="628" alt="Screenshot 2026-03-31 at 4 49 47 PM"
src="https://github.com/user-attachments/assets/0837d5d2-0e6b-4309-8b57-8dfb26d0b0ff"
/>
 2026-04-22 17:07:14 -03:00
Scott Gress df44a9342e Use Docker as default WiX runtime on macOS arm64 (#43715) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #43484

# Details

Apple Silicon Macs were being forced down the Wine+local-wix-dir path
because the fleetdm/wix:latest image was deemed unreliable on arm64 in
Jan 2024. Docker Desktop's amd64 emulation has matured since -- the
image builds both amd64 and arm64 MSIs on arm64 macOS successfully. This
PR:

- Drops the arm64-forces-Wine guard in BuildMSI so the Docker path is
the default on every macOS arch when --local-wix-dir isn't provided.
- Drops the macOS "Install wine and wix" + "Build MSI on macOS (using
local Wix)" CI steps. The ubuntu-latest matrix entry already exercises
the Docker path, and the install-wine.sh flow is brittle against Gcenx
release churn and homebrew-cask deprecation.
- Updates the install-wine.sh script to fail and output a message
indicating that Docker should be used, or else Wine installed manually.
```
============================================================
This script no longer installs Wine.
============================================================

Wine is no longer required to build Windows (.msi) packages on macOS.
fleetctl package now uses Docker by default on all macOS architectures.

RECOMMENDED: install Docker Desktop
  https://docs.docker.com/get-docker

If you cannot use Docker and still need to build MSIs with Wine on macOS
see the upstream WineHQ wiki for installation instructions:
  https://gitlab.winehq.org/wine/wine/-/wikis/MacOS

Automatic Wine installation via Homebrew is no longer attempted here
because the wine-stable cask is deprecated and upstream Wine releases
have caused repeated breakage.
```
- Retains the wix auto-download helper (downloadAndExtractZip,
extractZipFile, wixDownload) for backwards-compatibility when Docker
isn't detected, with a deprecation warning.

The Wine + --local-wix-dir path remains available for macOS users who
opt into it, but is no longer documented. See #43484.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] Added/updated automated tests
- Dropped MacOS packaging tests. The Ubuntu test already exercises the
Docker path that MacOS now uses.
- [X] QA'd all new/changed functionality manually
  - Built and installed both amd64 and arm64 .msi packages successfully

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* MSI packages on macOS now build using Docker by default, removing the
Wine dependency.

* **Documentation**
* Updated macOS setup guidance: Docker Desktop is now required for MSI
packaging instead of Wine.

* **Chores**
* Simplified Wine-related helper scripts and removed outdated
installation logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-21 10:53:46 -05:00
Lucas Manuel Rodriguez 682202444c Update go to 1.26.2 and update tooling to update it (#43771) 
Golang 1.26.2 has been released. It fixes some CVEs:
https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated Go toolchain to 1.26.2 across the repository and build
configs.
  * Updated Docker build images to use Go 1.26.2.
* Expanded the set of tracked modules for the Go version update so
additional module files are included in automated updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-20 13:40:57 -03:00
Konstantin SykulevandCopilot 2245359ad1 Orbit passes EUA token during enrollment (#43369) 
**Related issue:** Resolves #41379

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually

## fleetd/orbit/Fleet Desktop

- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added EUA token support to Orbit enrollment workflow
  * Introduced `--eua-token` CLI flag for Windows MDM enrollment
  * Windows MSI packages now support EUA_TOKEN property (Orbit v1.55.0+)

* **Tests**
* Added tests for EUA token handling in enrollment and Windows packaging

* **Documentation**
* Added changelog entry documenting EUA token inclusion in enrollment
requests

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-04-13 16:19:47 -05:00