**Related issue:** N/A (dogfood GitOps change)
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually (YAML validated; will
verify install + patch policy on a Windows workstation after the GitOps
run applies)
## Details
Adds Okta Verify to Windows devices on the Workstations team following
the same pattern used for it on macOS, including the patch policy:
- Replaces the custom-package Okta Verify install
(`$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` + custom install/uninstall scripts)
with the `okta-verify/windows` Fleet-maintained app — `self_service:
true`, `setup_experience: true`, category Security, scoped to "x86-based
Windows hosts" (the FMA installer is x86-only).
- Adds a "Windows - Okta Verify up to date" patch policy with
`install_software: true` for automatic remediation, mirroring the macOS
policy.
- Adds the "x86 Windows hosts with Okta Verify installed" label that
scopes the patch policy to hosts that already have the app.
- Cleanup: deletes the now-orphaned custom package YAML and
`okta_verify_*.ps1` scripts. Follow-up (not in this PR — requires
`workflow` scope): remove the now-unused
`DOGFOOD_OKTA_VERIFY_WINDOWS_URL` env line from
`.github/workflows/dogfood-gitops.yml` and delete the GitHub secret.
Harmless in the meantime — the env var is exported but nothing consumes
it.
Hosts that installed Okta Verify from the old custom package are picked
up by the new label, and the patch policy will auto-update them to the
FMA version (currently 6.10.2.0) if they fall behind.
Allen Houchins
08c22ebe58