dependabot[bot]andLucas Manuel Rodriguez
3d4cf0dfee
- [X] QA'd all new/changed functionality manually Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.3 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> <h2>Release 1.81.1</h2> <h1>Security</h1> <ul> <li>xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per <a href="https://github.com/grpc/proposal/blob/master/A41-xds-rbac.md">gRFC A41</a>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9111">#9111</a>) <ul> <li>Special Thanks: <a href="https://github.com/al4an444"><code>@al4an444</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9081">#9081</a>)</li> </ul> <h2>Release 1.81.0</h2> <h1>Behavior Changes</h1> <ul> <li>balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8808">#8808</a>)</li> </ul> <h1>Dependencies</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a> Change version to 1.82.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a> Cherry-pick commits (<a href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a> Change version to 1.82.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.79.3...v1.82.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Fleet Tools Directory
This directory contains development, testing, and operational tools for Fleet. The tools span a wide range of purposes including API testing, load testing, MDM functionality, database management, release automation, and more. Each tool is designed to help with specific aspects of Fleet development, testing, or operations.
If you add a new tool to this directory, please update this README with the tool's purpose and usage.
Overview
Tools are organized into functional categories:
- api/: API interaction and testing
- loadtest/: Performance and load testing
- tuf/: Update system (The Update Framework)
- mdm/: Mobile Device Management (Apple, Windows, Android, migrations)
- software/: Software and vulnerability management
- osquery/: osquery testing and development
- Root-level tools are generally single-purpose utilities
Common Requirements
- Many tools require Fleet server running locally (default:
https://localhost:8080) - Database tools assume MySQL running (default:
localhost:3306, user:fleet, password:insecure) - Docker is required for many packaging and testing tools
- See individual tool READMEs for detailed documentation and requirements
- Tools in subdirectories (like
mdm/,tuf/,loadtest/) often have their own READMEs - MDM tools often require
-server-private-keyflag to decrypt MDM assets from the database - Integration tests (Jira, Zendesk) require environment variables for credentials
Getting Help
For detailed usage of specific tools:
- Check for a README in the tool's directory
- Run the tool with
-hor--helpflag - Examine the source code for usage comments at the top of main.go files
- Many tools have extensive comments explaining their purpose and usage
Common Workflows
Local Development
# Start test osqueryd instances
cd tools/osquery && docker-compose up
# Seed test data (users/teams/policies/profiles/etc.) — see tools/dibble/README.md
make dibble && ./tools/dibble/dibble
# Serve files locally
go run ./tools/file-server 8081 ./my-files
# Take database snapshot before testing
go run ./tools/snapshot s
# Restore database after testing
go run ./tools/snapshot r
# Backup database
./tools/backup_db/backup.sh
Testing
# Run osquery load tests
./tools/loadtest/osquery/gnuplot_osqueryd_cpu_memory.sh
# Collect CloudWatch metrics for a load test environment, then compare runs
./tools/loadtest/metrics/collect-metrics.sh --workspace 486loadtest --category baseline
./tools/loadtest/metrics/compare-metrics.sh --filter loadtest --depth 4 --unique
# Test webhooks
go run ./tools/webhook 8082
# Check community issues
./tools/oncall/oncall.sh issues
# Test rate limiting
go run ./tools/desktop-rate-limit -fleet_url https://localhost:8080
MDM Testing
# Export MDM assets
go run ./tools/mdm/assets export -key=mykey -dir=./assets
# Import MDM assets
go run ./tools/mdm/assets import -key=mykey -dir=./assets -name=scep_challenge -value="challenge"
# Send APNS push notification
go run ./tools/mdm/apple/apnspush -mysql localhost:3306 -server-private-key <key> <UUID>
# Query Apple Business
go run ./tools/mdm/apple/applebmapi -mysql localhost:3306 -server-private-key <key> -org-name "My Org"
# Generate app manifest from pkg
go run ./tools/mdm/apple/appmanifest -pkg-file app.pkg -pkg-url https://example.com/app.pkg
# Decrypt disk encryption key (FileVault/BitLocker)
go run ./tools/mdm/decrypt-disk-encryption-key -cert file.crt -key file.key -value-to-decrypt <base64>
# Test Jamf migration
go run ./tools/mdm/migration/jamf -username admin -password secret -url https://jamf.example.com -port 4648
Android Management
# Android management API operations (requires FLEET_DEV_ANDROID_GOOGLE_SERVICE_CREDENTIALS env var)
go run ./tools/android -command list-devices -enterprise_id <id>
go run ./tools/android -command get-device -enterprise_id <id> -device_id <id>
Release Management
# Create release candidate (minor)
./tools/release/publish_release.sh -m
# Create release candidate (patch)
./tools/release/publish_release.sh
# Check TUF channel versions
go run tools/tuf/status/tuf-status.go channel-version -channel stable
# Release to TUF edge
./tools/tuf/releaser.sh # See tuf/README.md for required env vars
API Testing
# Set up environment
export FLEET_ENV_PATH=./tools/api/env
# Test API endpoints
./tools/api/fleet/me
./tools/api/fleet/reports/list
./tools/api/fleet/reports/create 'my_report' 'SELECT * FROM processes;'
Integration Testing
# Test Jira integration (requires JIRA_PASSWORD env var)
go run ./tools/jira-integration \
-jira-url https://example.atlassian.net \
-jira-username admin@example.com \
-jira-project-key FLEET \
-cve CVE-2024-1234 \
-hosts-count 5
# Test Zendesk integration (requires ZENDESK_TOKEN env var)
go run ./tools/zendesk-integration \
-zendesk-url https://example.zendesk.com \
-zendesk-email admin@example.com \
-zendesk-group-id 12345 \
-cve CVE-2024-1234
Database Management
# Generate database schema
go run ./tools/dbutils/schema_generator.go ./schema.sql
# Bump migration timestamp (when PR migration is older than main)
go run ./tools/bump-migration -source-migration 20240101120000_MyMigration.go -regen-schema
GitHub Management
# Search issues
./tools/github-manage/gm issues --search "is:open label:bug"
# View project items
./tools/github-manage/gm project 58 --limit 50
# View estimated tickets
./tools/github-manage/gm estimated mdm --limit 25
GitOps Migration
# Migrate software YAML files to Fleet 4.74.0+ format
./tools/gitops-migrate/migrate.sh it-and-security/fleets/
Software & Vulnerability Testing
# Seed vulnerable software
go run ./tools/software/vulnerabilities/seed_vuln_data.go \
--ubuntu 1 --macos 1 --windows 1 --linux-kernels 1
# Parse VEX document
go run ./tools/vex-parser <path-to-vex-file.json>
Code Quality Tools
# Check cloner implementations
go run ./tools/cloner-check --check
# Update cloner implementations
go run ./tools/cloner-check --update
# Generate osquery agent options (macOS only)
go run ./tools/osquery-agent-options ./output.go
Script Execution Testing
# Test Orbit script execution locally
go run ./tools/run-scripts -exec-id my-test-id -content 'echo "Hello, world!"'
# Test with multiple scripts
go run ./tools/run-scripts -scripts-count 10
# Test with scripts disabled
go run ./tools/run-scripts -scripts-disabled -content 'echo "Test"'
Quick Reference Table
| Tool | Purpose | Usage |
|---|---|---|
| API & Integration | ||
api/ |
Fleet API testing scripts using curl + jq | export FLEET_ENV_PATH=./env && ./tools/api/fleet/me |
jira-integration/ |
Test Jira ticket creation | JIRA_PASSWORD=<pwd> go run ./tools/jira-integration -jira-url <url> -jira-username <user> -jira-project-key <key> -cve CVE-2024-1234 |
webhook/ |
Test webhook integrations | go run ./tools/webhook 8082 |
zendesk-integration/ |
Test Zendesk ticket creation | ZENDESK_TOKEN=<token> go run ./tools/zendesk-integration -zendesk-url <url> -zendesk-email <email> -zendesk-group-id <id> -cve CVE-2024-1234 |
| Database & Data | ||
backup_db/ |
Database backup scripts | ./tools/backup_db/backup.sh and ./tools/backup_db/restore.sh |
branch_snapshot.sh |
Auto backup/restore DB on git branch checkout | Link to .git/hooks/post-checkout |
dbutils/ |
Database schema generator | go run ./tools/dbutils/schema_generator.go <dumpfile> |
mysql-replica-testing/ |
MySQL replica testing | See mysql-replica-testing/README.md |
mysql-tests/ |
MySQL testing configs | Docker configs for MySQL testing |
redis-stress/ |
Redis stress testing — cluster-aware write (steady SET load) and race (SET-then-GET visibility race detection) modes |
go run ./tools/redis-stress write -addr 127.0.0.1:7001 -workers 5 -duration 1m or go run ./tools/redis-stress race -addr 127.0.0.1:7001 -workers 50 -iterations 2000 — see redis-stress/README.md |
redis-tests/ |
Redis testing configs | ElastiCache and general Redis test configs |
snapshot/ |
Database snapshot/restore tool | go run ./tools/snapshot s or go run ./tools/snapshot r |
| Development Tools | ||
app/ |
Prometheus config for local dev | See prometheus.yml |
ci/ |
CI helper tools (golangci-lint rules) | rules.go - ruleguard custom linting rules |
desktop/ |
Fleet Desktop development tool | go run ./tools/desktop - builds Desktop app |
dialog/ |
Test zenity/kdialog dialogs on Linux | go run ./tools/dialog -dialog zenity |
file-server/ |
Serve local directory via HTTP | go run ./tools/file-server 8081 /path/to/dir |
hangar/ |
Desktop control panel for the Fleet dev environment (Go + Wails, macOS) — run fleet serve, manage branches / DB / fleetctl / GitOps / osquery-perf from one window |
cd tools/hangar && task dev - See hangar/README.md |
oncall/ |
Find community issues/PRs | ./tools/oncall/oncall.sh issues or ./tools/oncall/oncall.sh prs |
| Infrastructure | ||
apm-elastic/ |
Elastic APM config | See apm-elastic/README.md |
calendar/ |
Calendar integration tools | See calendar/README.md |
fdm/ |
FleetDM developer tools | fdm <command> - Wrapper for Fleet make targets |
fleet-docker/ |
Fleet Docker configs | Docker configuration for Fleet |
github-manage/ |
GitHub management automation | ./gm issues --search "is:open" or ./gm project 58 - See README |
github-releases/ |
GitHub release tools | go run ./tools/github-releases --last-minor-releases <n> or --all-cpes |
gitops-migrate/ |
GitOps YAML migration | ./tools/gitops-migrate/migrate.sh <fleets_dir> - See README |
mailpit/ |
Local email testing | Mailpit SMTP server for local dev (uses auth.txt config) |
open/ |
Test "open" package | go run ./tools/open -url <url> - Opens URL in default browser |
percona/ |
Percona testing | Percona MySQL testing configs - See percona/test/README.md |
sentry-self-hosted/ |
Self-hosted Sentry | See sentry-self-hosted/README.md |
smtp4dev/ |
Local SMTP testing | SMTP4Dev server with TLS certs for email testing |
signoz/ |
SigNoz for traces, metrics, and logs | See signoz/README.md |
telemetry/ |
Jaeger + Prometheus for tracing | docker compose up - See telemetry/README.md |
terraform/ |
Terraform provider for fleet | make install && make apply - See terraform/README.md |
| MDM Tools | ||
android/ |
Android management API tool | go run ./tools/android -command <cmd> -enterprise_id <id> -device_id <id> |
mdm/apple/applebmapi/ |
Query Apple Business API | go run ./tools/mdm/apple/applebmapi -mysql localhost:3306 -server-private-key <key> -org-name <org> |
mdm/apple/appmanifest/ |
Generate app manifest XML from .pkg | go run ./tools/mdm/apple/appmanifest -pkg-file app.pkg -pkg-url https://example.com/app.pkg |
mdm/apple/apnspush/ |
Send APNS push to enrolled devices | go run ./tools/mdm/apple/apnspush -mysql localhost:3306 -server-private-key <key> <HOST_UUID> |
mdm/apple/loadtest/ |
MDM load testing (deprecated — see dibble for seeding teams + profiles) | go run ./tools/mdm/apple/loadtest |
mdm/apple/macos-vm-auto-enroll/ |
Auto-enroll macOS VMs in MDM | ./tools/mdm/apple/macos-vm-auto-enroll/macos-vm-auto-enroll.sh |
mdm/apple/setupexperience/ |
Test setup experience flows | go run ./tools/mdm/apple/setupexperience |
mdm/assets/ |
Export/import MDM assets (SCEP, APNS, etc.) | go run ./tools/mdm/assets export -key=<key> -dir=<dir> or import |
mdm/decrypt-disk-encryption-key/ |
Decrypt FileVault/BitLocker keys | go run ./tools/mdm/decrypt-disk-encryption-key -cert file.crt -key file.key -value-to-decrypt <base64> |
mdm/make_cfg_profiles.sh |
Generate configuration profiles | ./tools/mdm/make_cfg_profiles.sh |
mdm/migration/echo/ |
Echo MDM migration tools | go run ./tools/mdm/migration/echo |
mdm/migration/jamf/ |
Jamf to Fleet migration webhook | go run ./tools/mdm/migration/jamf -username <user> -password <pwd> -url <jamf_url> |
mdm/migration/kandji/ |
Kandji migration tools | go run ./tools/mdm/migration/kandji |
mdm/migration/mdmproxy/ |
MDM proxy for migration testing | ./tools/mdm/migration/mdmproxy/entrypoint.sh |
mdm/migration/micromdm/ |
MicroMDM migration tools | See mdm/migration/micromdm/README.md |
mdm/migration/simplemdm/ |
SimpleMDM migration tools | go run ./tools/mdm/migration/simplemdm |
mdm/windows/bitlocker/ |
BitLocker key management | Go utilities for BitLocker |
mdm/windows/programmatic-enrollment/ |
Windows MDM enrollment | go run ./tools/mdm/windows/programmatic-enrollment |
windows-mdm-enroll/ |
Windows MDM enrollment | Enrollment utilities for Windows |
| Other Utilities | ||
bump-migration/ |
Bump migration timestamp | go run ./tools/bump-migration -source-migration <file> [-regen-schema] |
cis/ |
CIS benchmark tools | python tools/cis/CIS-Benchmark-diff.py |
cloner-check/ |
Verify fleet.Cloner implementations | go run ./tools/cloner-check --check or --update |
luks/luks/ |
LUKS key escrow tool (Linux only) | go run ./tools/luks/luks - Adds escrow key to LUKS partition |
luks/lvm/ |
Find root disk for LVM (Linux only) | go run ./tools/luks/lvm - Detects root partition path |
makefile-support/ |
Makefile helper utilities | ./tools/makefile-support/makehelp.sh - Generate help text |
osquery-agent-options/ |
Generate osquery agent options struct | go run ./tools/osquery-agent-options <output-file> - macOS only |
run-scripts/ |
Test Orbit script execution | go run ./tools/run-scripts -exec-id <id> -content 'echo "Hello"' |
| Packaging & Installers | ||
bomutils-docker/ |
Docker image for BOM utils (macOS pkg) | Docker build for BOM utilities |
team-builder/ |
Bulk fleet (formerly "team") creation + installer generation (deprecated for plain seeding — see dibble) | ./build_teams.sh -s teams.txt -u fleet.example.com |
wix-docker/ |
Docker image for WiX (Windows MSI) | Docker build for WiX toolset |
| Release & Distribution | ||
fleetctl-docker/ |
Docker image for fleetctl packaging | docker run fleetdm/fleetctl package --type=pkg |
fleetctl-npm/ |
NPM package for fleetctl | See fleetctl-npm/README.md |
fleetd-linux/ |
Linux fleetd packaging | Packaging scripts for Linux fleetd |
release/ |
Fleet release automation | ./tools/release/publish_release.sh -m - See release/README.md |
sign-fleetctl/ |
Code signing for fleetctl | Signing utilities for fleetctl binaries |
tuf/ |
TUF repository management for fleetd updates | ./tools/tuf/releaser.sh - See tuf/README.md |
tuf/migrate/ |
TUF migration tools | Migration scripts for TUF updates |
tuf/status/ |
Query TUF repository status | go run tools/tuf/status/tuf-status.go channel-version -channel stable |
tuf/test/ |
TUF testing scripts | ./tools/tuf/test/main.sh - See tuf/test/README.md |
| Security & Auth | ||
app-sso-platform/ |
Test app_sso_platform table (macOS) | go run ./tools/app-sso-platform <extensionID> <realm> |
inspect-cert/ |
Certificate inspection | Certificate inspection utilities |
msal/ |
Microsoft Entra Device ID sample app | Obj-C reference app for MSAL |
saml/ |
SAML SSO testing config | Edit users.php for test users |
| Software & Vulnerabilities | ||
custom-package-parser/ |
Parse custom software packages | See custom-package-parser/README.md |
nvd/ |
NVD (National Vulnerability Database) tools | See nvd/nvdvuln/README.md |
software/icons/ |
Software icon management | See software/icons/README.md |
software/packages/ |
Software package utilities | See software/packages/README.md |
software/vulnerabilities/ |
Seed vulnerable software for dev (deprecated — use dibble vulns) |
go run ./tools/software/vulnerabilities/seed_vuln_data.go --ubuntu 1 --macos 1 --windows 1 |
software/vulnerabilities/performance_test/ |
Vuln performance testing (seeder/ deprecated — use dibble vulns) |
See software/vulnerabilities/performance_test/README.md |
vex-parser/ |
Parse OpenVEX documents | go run ./tools/vex-parser <vex-file> |
| Testing & Load Testing | ||
desktop-rate-limit/ |
Test Fleet Desktop rate limiting | go run ./tools/desktop-rate-limit -fleet_url https://localhost:8080 |
kubequery/ |
Kubequery + Fleet config | kubectl apply -f kubequery-fleet.yml |
dibble/ |
One-stop seeder: users, teams, policies, reports, labels, scripts, profiles, software, enroll-secrets, vulns | make dibble && ./tools/dibble/dibble |
loadtest/fleetd_labels/ |
Apply manual labels for load testing (deprecated — use dibble labels) |
go run ./tools/loadtest/fleetd_labels |
loadtest/metrics/ |
Collect & compare AWS CloudWatch metrics for load test environments | ./tools/loadtest/metrics/collect-metrics.sh --workspace <ws> — see loadtest/metrics/README.md |
loadtest/osquery/ |
Load test osquery on macOS/Windows/Linux | See loadtest/osquery/README.md |
loadtest/scripts_and_profiles/ |
Load test scripts and profiles (deprecated — use dibble scripts + profiles) |
go run ./tools/loadtest/scripts_and_profiles |
loadtest/unified_queue/ |
Load test unified queue story (see dibble for seeding the prerequisite software/scripts) | See loadtest/unified_queue/README.md |
osquery/ |
Containerized osqueryd testing | docker-compose up - See osquery/README.md |
osquery-testing/ |
osquery integration tests | docker-compose up in directory |
test-certs/ |
Fake certificate chain for TLS testing | See test-certs/README.md |
test-orbit-mtls/ |
Test Orbit mTLS | Scripts for mTLS testing |
test_extensions/ |
Test osquery extensions (hello_world) | ./tools/test_extensions/hello_world/build.sh |
| Testing Data | ||
seed_data/ |
Seed test data | Test data seeding scripts |
testdata/ |
Test fixtures and data | Static test fixtures |