Allen Houchins
568fc0edb8
**Related issue:** Resolves #49737 Adds **Podman Desktop** (`RedHat.Podman-Desktop`, v1.28.3) as a Windows Fleet-maintained app. It pairs with the existing `podman-desktop/darwin` FMA under the same catalog name, so the two group together in the FMA library and share the existing icon. ## What changed - `ee/maintained-apps/inputs/winget/podman-desktop.json` — input manifest (x64, machine scope, `exe`/NSIS) - `ee/maintained-apps/inputs/winget/scripts/podman-desktop_install.ps1` / `_uninstall.ps1` — custom install/uninstall scripts - `ee/maintained-apps/outputs/podman-desktop/windows.json` — generated output - `ee/maintained-apps/outputs/apps.json` — new Windows catalog entry; also reworded the existing macOS description to the standard "`<App>` is a(n)…" format for consistency ## Identity verification (verified, not guessed) Podman Desktop ships as an **electron-builder NSIS** installer, and the winget metadata does **not** match what osquery sees on a host. I decompressed the NSIS header and traced electron-builder's source to confirm the registry identity: - **DisplayName** = `Podman Desktop 1.28.3` → `unique_identifier: "Podman Desktop"` with `fuzzy_match_name` (matches the version-suffixed name). - **Publisher** = `Podman Desktop` — derived from the package's `author.name` (`COMPANY_NAME` → registry `Publisher`), **not** the winget locale's `RedHat`. Using "RedHat" would have made the exists query silently never match on real hosts. - **SHA256** matches the winget manifest exactly; version `1.28.3` equals the registry `DisplayVersion`, so the patch policy reconciles cleanly. Silent install uses `/S /ALLUSERS`; uninstall does a registry lookup with the defensive three-shape UninstallString parser and mirrors `/S /ALLUSERS`, following the proven `another-redis-desktop-manager` electron-builder machine-scope pattern. ## Reviewer notes - **x64 only.** The winget manifest also has an arm64 installer, but the repo has no arm64 FMA inputs yet (x64 is the established convention). A separate arm64 slug can be added later. - Installer URL is a **pinned GitHub release** asset (not a "latest" redirect), so the SHA is stable until the FMA auto-updater bumps the version. - No shared Go code changed — only FMA input/output data. ## Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Generated the output via `go run cmd/maintained-apps/main.go --slug="podman-desktop/windows" --debug`; verified exists/patched queries, pinned SHA matches the winget manifest, and `apps.json` is valid JSON. - [ ] QA'd install/uninstall on a Windows host (will be exercised by the FMA validator).
Welcome to the "source available" section of the Fleet codebase. Please note files and functionality under this directory are covered by the Fleet EE License, and require a valid Fleet subscription for production use. See the full license for details.