Allen Houchins
1a1b6e786a
**Related issue:** Resolves #49738 Adds **Box Tools** as a Fleet-maintained app for **Windows** (winget `Box.BoxTools`) and **macOS** (Homebrew cask `box-tools`). ## Windows details (verified against the real installer) - Installer: `BoxToolsInstaller-AdminInstall.msi` (machine-wide admin MSI, `ALLUSERS=1`), x64. - MSI Property table verified with msitools: `ProductName` = `Box Tools`, `Manufacturer` = `Box`, `ProductVersion` = `4.32.0.1324` — all match the winget manifest, so `unique_identifier: "Box Tools"` and the generated exists query (`name = 'Box Tools' AND publisher = 'Box'`) match what osquery reports from the registry. No `program_publisher` override needed. - The winget manifest has no `Scope`, so `installer_scope: "machine"` is set in the input (confirmed by `ALLUSERS=1`). - ProductCode/UpgradeCode match the manifest; standard auto-generated machine-MSI install + upgrade-code uninstall scripts. - Downloaded SHA256 matches the manifest SHA (`9f5958...c5066`). - No sibling-name collision with the existing Box Drive FMA (its DisplayName is `Box`; matching is exact). ## macOS details Box Tools on macOS is **per-user only**: the cask installs the app bundles to `~/Library/Application Support/Box/Box Edit/`, Box's admin `.pkg` forbids the local system domain (`enable_localSystem="false"`), and [Box's large-scale deployment docs](https://support.box.com/hc/en-us/articles/360043695834-Large-Scale-Deployments-Box-Tools) instruct running the installer as the console user (multi-user Macs are not a supported configuration). Because the install location is outside osquery's `apps` directory scan paths, detection relies on osquery's LaunchServices enumeration (`_LSCopyAllApplicationURLs` in `genApps`), which surfaces the bundles regardless of location — verified against a live install where all four Box Tools bundles are LaunchServices-registered at the per-user path and appear in the `apps` table. - `unique_identifier: com.Box.Box-Edit` (verified `CFBundleIdentifier` of `Box Edit.app` in the DMG). - **Custom install script** (the cask's app artifacts are all `target:`-style, which the script generator skips, so the auto-generated script would be a no-op): resolves the console user (falling back to `lastUserName` when run while logged out), quits the Box apps, copies the four app bundles from the DMG's `Install Box Tools.app/Contents/Resources/` into the user's `~/Library/Application Support/Box/Box Edit/` (replicating the cask/pkg payload exactly), chowns them, and registers them with LaunchServices in both root and user contexts so inventory and box.com pick them up without a first manual launch. - **Custom uninstall script**: quits/kills the Box Tools processes and removes `Box Edit` from every local user's home. The parent `Box` directory is shared with Box Drive, so it is only removed if left empty. - The cask uses `sha256 :no_check` (rolling `currentrelease` URL) — the established FMA convention for such casks (same as Google Chrome/VS Code darwin); the server pins the hash of what it downloads at add time. - Cask version is `4.32` while `CFBundleShortVersionString` is `4.32.0`; the validator's prefix matching and the patched query's `version_compare` both treat these as consistent. ## Shared caveat ⚠️ Both installer URLs are rolling `currentrelease` links. On Windows the pinned SHA will drift when Box ships a new build until the FMA auto-update ingests the new manifest; macOS uses `no_check` per the cask. ## Icon Generated from the official 512×512 Box Tools icon shipped inside the vendor DMG via `tools/software/icons/generate-icons.sh` (frontend `BoxTools.tsx` + map entry, website `app-icon-box-tools-60x60@2x.png`). Both platforms share the icon via the common `name`/slug. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Verified installer identity fields (MSI Property table, Info.plist bundle identifiers/versions) with msitools/PlistBuddy against the live installers; Windows output SHA matches the winget manifest. - [x] Verified on a live macOS install that the per-user Box Tools bundles are LaunchServices-registered and visible to osquery's `apps` table. - [ ] FMA validation CI (Windows + macOS runners) to confirm install/uninstall/detection. - [ ] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Box Tools support for both Windows and macOS. * Added Box Tools install, upgrade, and uninstall handling for the maintained app catalog. * Published Box Tools metadata to the software catalog (including platform-specific entries and version targeting). * Added a Box Tools icon to the software interface for improved name matching. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
11 lines
261 B
JSON
11 lines
261 B
JSON
{
|
|
"name": "Box Tools",
|
|
"slug": "box-tools/windows",
|
|
"package_identifier": "Box.BoxTools",
|
|
"unique_identifier": "Box Tools",
|
|
"installer_arch": "x64",
|
|
"installer_type": "msi",
|
|
"installer_scope": "machine",
|
|
"default_categories": ["Productivity"]
|
|
}
|