Allen Houchins
ebda171dad
**Related issue:** Resolves #49328 Adds Prisma Access Browser (Homebrew cask `prisma-access-browser`) as a macOS Fleet-maintained app. ## Notes for reviewers **Naming/slug:** This product already ships as a Windows FMA named **Prisma Browser** (`prisma-browser/windows`, added in #46409 — "Prisma Browser" is Palo Alto's current branding for what was Prisma Access Browser). The FMA library combines platforms into one row by slug token, so this entry uses `name: "Prisma Browser"` and `slug: "prisma-browser/darwin"` while keeping `token: "prisma-access-browser"` for the cask lookup (same token≠slug pattern as the `libreoffice`, `ollama`, and `zoom` inputs). Both platforms now show as a single "Prisma Browser" library row and share the existing Prisma icon, so no icon changes are needed. **Identity verified against the real installer** (downloaded the full pkg; SHA256 matches the cask): - `CFBundleIdentifier` = `com.talon-sec.Work` (from the pkg Distribution/PackageInfo), so the exists query matches osquery's `apps` table. - `CFBundleShortVersionString` = `150.49.5.129`, exactly the cask version before the comma, so the patched query's `bundle_short_version` comparison reconciles. - Installs `Prisma Access Browser.app` machine-wide to `/Applications` as root; requires macOS 12+. Not a bootstrapper. **Install script filename:** the cask's pkg artifact (`PrismaBrowser-universal.pkg`) doesn't match the URL basename, but the vendor serves that name via `Content-Disposition`, which is what the server stores (`FilenameFromResponse`) and what orbit names the downloaded installer on both download paths — so the auto-generated install script works without a custom script. **Installer URL** is pinned (version + hash in the path), so no latest-redirect SHA-drift risk. # Checklist for submitter ## Testing - [x] Verified installer identity fields (bundle ID, versions, SHA256) against the real pkg - [x] `go test ./ee/maintained-apps/... ./cmd/maintained-apps/...` passes; generated JSON validated - [ ] FMA validator run (CI) confirms install/uninstall on a macOS host
Welcome to the "source available" section of the Fleet codebase. Please note files and functionality under this directory are covered by the Fleet EE License, and require a valid Fleet subscription for production use. See the full license for details.