**Related issue:** Resolves#49738
Adds **Box Tools** as a Fleet-maintained app for **Windows** (winget
`Box.BoxTools`) and **macOS** (Homebrew cask `box-tools`).
## Windows details (verified against the real installer)
- Installer: `BoxToolsInstaller-AdminInstall.msi` (machine-wide admin
MSI, `ALLUSERS=1`), x64.
- MSI Property table verified with msitools: `ProductName` = `Box
Tools`, `Manufacturer` = `Box`, `ProductVersion` = `4.32.0.1324` — all
match the winget manifest, so `unique_identifier: "Box Tools"` and the
generated exists query (`name = 'Box Tools' AND publisher = 'Box'`)
match what osquery reports from the registry. No `program_publisher`
override needed.
- The winget manifest has no `Scope`, so `installer_scope: "machine"` is
set in the input (confirmed by `ALLUSERS=1`).
- ProductCode/UpgradeCode match the manifest; standard auto-generated
machine-MSI install + upgrade-code uninstall scripts.
- Downloaded SHA256 matches the manifest SHA (`9f5958...c5066`).
- No sibling-name collision with the existing Box Drive FMA (its
DisplayName is `Box`; matching is exact).
## macOS details
Box Tools on macOS is **per-user only**: the cask installs the app
bundles to `~/Library/Application Support/Box/Box Edit/`, Box's admin
`.pkg` forbids the local system domain (`enable_localSystem="false"`),
and [Box's large-scale deployment
docs](https://support.box.com/hc/en-us/articles/360043695834-Large-Scale-Deployments-Box-Tools)
instruct running the installer as the console user (multi-user Macs are
not a supported configuration).
Because the install location is outside osquery's `apps` directory scan
paths, detection relies on osquery's LaunchServices enumeration
(`_LSCopyAllApplicationURLs` in `genApps`), which surfaces the bundles
regardless of location — verified against a live install where all four
Box Tools bundles are LaunchServices-registered at the per-user path and
appear in the `apps` table.
- `unique_identifier: com.Box.Box-Edit` (verified `CFBundleIdentifier`
of `Box Edit.app` in the DMG).
- **Custom install script** (the cask's app artifacts are all
`target:`-style, which the script generator skips, so the auto-generated
script would be a no-op): resolves the console user (falling back to
`lastUserName` when run while logged out), quits the Box apps, copies
the four app bundles from the DMG's `Install Box
Tools.app/Contents/Resources/` into the user's `~/Library/Application
Support/Box/Box Edit/` (replicating the cask/pkg payload exactly),
chowns them, and registers them with LaunchServices in both root and
user contexts so inventory and box.com pick them up without a first
manual launch.
- **Custom uninstall script**: quits/kills the Box Tools processes and
removes `Box Edit` from every local user's home. The parent `Box`
directory is shared with Box Drive, so it is only removed if left empty.
- The cask uses `sha256 :no_check` (rolling `currentrelease` URL) — the
established FMA convention for such casks (same as Google Chrome/VS Code
darwin); the server pins the hash of what it downloads at add time.
- Cask version is `4.32` while `CFBundleShortVersionString` is `4.32.0`;
the validator's prefix matching and the patched query's
`version_compare` both treat these as consistent.
## Shared caveat
⚠️ Both installer URLs are rolling `currentrelease` links. On Windows
the pinned SHA will drift when Box ships a new build until the FMA
auto-update ingests the new manifest; macOS uses `no_check` per the
cask.
## Icon
Generated from the official 512×512 Box Tools icon shipped inside the
vendor DMG via `tools/software/icons/generate-icons.sh` (frontend
`BoxTools.tsx` + map entry, website `app-icon-box-tools-60x60@2x.png`).
Both platforms share the icon via the common `name`/slug.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Verified installer identity fields (MSI Property table, Info.plist
bundle identifiers/versions) with msitools/PlistBuddy against the live
installers; Windows output SHA matches the winget manifest.
- [x] Verified on a live macOS install that the per-user Box Tools
bundles are LaunchServices-registered and visible to osquery's `apps`
table.
- [ ] FMA validation CI (Windows + macOS runners) to confirm
install/uninstall/detection.
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Box Tools support for both Windows and macOS.
* Added Box Tools install, upgrade, and uninstall handling for the
maintained app catalog.
* Published Box Tools metadata to the software catalog (including
platform-specific entries and version targeting).
* Added a Box Tools icon to the software interface for improved name
matching.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Allen Houchins
1a1b6e786a
