Repository navigation
Freeze the macOS Yubikey Manager FMA - #50054
Merged
Merged
Conversation
Git Extensions, SonicWall NetExtender, Spyder, TightVNC, Yarn, and Zoom Outlook Plugin. Each app's detection identity was verified against its real registry DisplayName; Git Extensions (Git Extensions 7.2.0.92) and Spyder (Spyder 6) use fuzzy name matching, the rest match exactly. All six pass the FMA CI validator (install -> detect -> uninstall) on the SYSTEM-context Windows runner.
Aligns the uninstall registry-key match with the detection query by requiring Publisher = 'Spyder Project Contributors and others' so a fuzzy *Spyder* DisplayName match can't select an unrelated product (e.g. Datacolor SpyderX). Regeneration also picked up upstream 6.1.5.
The winget manifest's AppsAndFeaturesEntries records the publisher the installer actually writes to Add/Remove Programs as 'Spyder-IDE'; the locale manifest's 'Spyder Project Contributors and others' is the package publisher. The input's program_publisher override was set to the latter, so the generated exists/patched queries could never match an installed Spyder, and the publisher predicate added to the uninstall script in 7be1c39 found no registry key ('Uninstaller for Spyder not found', CI run 30365815905). The validator's own lookup queries programs by name only, so it does not exercise the manifest exists query; the uninstall step does exercise the publisher predicate, so CI now covers this value.
Pins the macOS Fleet-maintained app for Yubikey Manager at its current output version, 1.2.5, by setting "frozen": true on the Homebrew input. The frozen flag makes cmd/maintained-apps skip overwriting outputs/yubico-yubikey-manager/darwin.json and makes the validate command skip the app, so the published version and installer URL stop moving. The Windows FMA (inputs/winget/yubico-yubikey-manager.json) is unchanged.
fleet-release
approved these changes
Jul 28, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates Fleet-maintained app metadata and the Software page icon catalog. Although the title/description focus on freezing the macOS Yubikey Manager Homebrew FMA, the diff also introduces several new Windows Fleet-maintained apps (inputs/outputs/apps catalog) and adds matching frontend icons/mappings.
Changes:
- Set
"frozen": truefor the Homebrewyubico-yubikey-managerinput. - Add new Windows FMAs (Winget inputs + generated outputs +
apps.jsonentries) for Git Extensions, SonicWall NetExtender, Spyder, TightVNC, Yarn, and Zoom Outlook Plugin. - Add frontend icon components and icon map entries for the newly added software titles.
Reviewed changes
Copilot reviewed 22 out of 27 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| frontend/pages/SoftwarePage/components/icons/ZoomOutlookPlugin.tsx | Adds a new Software page icon component for Zoom Outlook Plugin. |
| frontend/pages/SoftwarePage/components/icons/Yarn.tsx | Adds a new Software page icon component for Yarn. |
| frontend/pages/SoftwarePage/components/icons/Tightvnc.tsx | Adds a new Software page icon component for TightVNC. |
| frontend/pages/SoftwarePage/components/icons/SonicwallNetextender.tsx | Adds a new Software page icon component for SonicWall NetExtender. |
| frontend/pages/SoftwarePage/components/icons/GitExtensions.tsx | Adds a new Software page icon component for Git Extensions. |
| frontend/pages/SoftwarePage/components/icons/index.ts | Registers new icons and maps additional software-name keys to icon components. |
| ee/maintained-apps/outputs/zoom-outlook-plugin/windows.json | Adds generated Windows output metadata and install/uninstall refs for Zoom Outlook Plugin. |
| ee/maintained-apps/outputs/yarn/windows.json | Adds generated Windows output metadata and install/uninstall refs for Yarn. |
| ee/maintained-apps/outputs/tightvnc/windows.json | Adds generated Windows output metadata and install/uninstall refs for TightVNC. |
| ee/maintained-apps/outputs/spyder/windows.json | Adds generated Windows output metadata and embedded install/uninstall refs for Spyder. |
| ee/maintained-apps/outputs/sonicwall-netextender/windows.json | Adds generated Windows output metadata and install/uninstall refs for SonicWall NetExtender. |
| ee/maintained-apps/outputs/git-extensions/windows.json | Adds generated Windows output metadata and install/uninstall refs for Git Extensions. |
| ee/maintained-apps/outputs/apps.json | Adds catalog entries for the newly introduced Windows FMAs. |
| ee/maintained-apps/inputs/winget/zoom-outlook-plugin.json | Adds Winget input definition for Zoom Outlook Plugin (Windows). |
| ee/maintained-apps/inputs/winget/yarn.json | Adds Winget input definition for Yarn (Windows). |
| ee/maintained-apps/inputs/winget/tightvnc.json | Adds Winget input definition for TightVNC (Windows). |
| ee/maintained-apps/inputs/winget/spyder.json | Adds Winget input definition for Spyder (Windows), including custom script paths. |
| ee/maintained-apps/inputs/winget/sonicwall-netextender.json | Adds Winget input definition for SonicWall NetExtender (Windows). |
| ee/maintained-apps/inputs/winget/git-extensions.json | Adds Winget input definition for Git Extensions (Windows). |
| ee/maintained-apps/inputs/winget/scripts/spyder_uninstall.ps1 | Adds a custom uninstall script for Spyder (Windows). |
| ee/maintained-apps/inputs/winget/scripts/spyder_install.ps1 | Adds a custom install script for Spyder (Windows). |
| ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json | Marks the Homebrew Yubikey Manager input as frozen. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
4
to
+8
| "unique_identifier": "com.yubico.ykman", | ||
| "token": "yubico-yubikey-manager", | ||
| "installer_format": "pkg", | ||
| "default_categories": ["Productivity"] | ||
| "default_categories": ["Productivity"], | ||
| "frozen": true |
| } | ||
| ], | ||
| "refs": { | ||
| "6335aa0a": "$softwareName = \"Spyder\"\n$softwareNameLike = \"*$softwareName*\"\n# Registry publisher from the winget manifest's AppsAndFeaturesEntries, which\n# differs from the package Publisher (\"Spyder Project Contributors and others\").\n$publisher = \"Spyder-IDE\"\n$uninstallArgs = \"/S\"\n\n$machineKey = 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'\n$machineKey32on64 = 'HKLM:\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'\n$exitCode = 0\n\ntry {\n [array]$uninstallKeys = Get-ChildItem -Path @($machineKey, $machineKey32on64) -ErrorAction SilentlyContinue |\n ForEach-Object { Get-ItemProperty $_.PSPath }\n\n $foundUninstaller = $false\n foreach ($key in $uninstallKeys) {\n if ($key.DisplayName -like $softwareNameLike -and $key.Publisher -eq $publisher) {\n $foundUninstaller = $true\n $uninstallCommand = if ($key.QuietUninstallString) { $key.QuietUninstallString } else { $key.UninstallString }\n if ($uninstallCommand -match '^\\s*\"([^\"]+)\"\\s*(.*)$') {\n $uninstallCommand = $Matches[1]; if ($Matches[2]) { $uninstallArgs = \"$($Matches[2]) $uninstallArgs\".Trim() }\n } elseif ($uninstallCommand -match '(?i)^\\s*(.+?\\.exe)\\s*(.*)$') {\n $uninstallCommand = $Matches[1]; if ($Matches[2]) { $uninstallArgs = \"$($Matches[2]) $uninstallArgs\".Trim() }\n }\n Write-Host \"Uninstall command: $uninstallCommand\"; Write-Host \"Uninstall args: $uninstallArgs\"\n $processOptions = @{ FilePath = $uninstallCommand; PassThru = $true; Wait = $true }\n if ($uninstallArgs -ne '') { $processOptions.ArgumentList = $uninstallArgs }\n $process = Start-Process @processOptions\n $exitCode = $process.ExitCode; Write-Host \"Uninstall exit code: $exitCode\"; break\n }\n }\n if (-not $foundUninstaller) { Write-Host \"Uninstaller for '$softwareName' not found.\"; Exit 1 }\n} catch { Write-Host \"Error: $_\"; Exit 1 }\n\nExit $exitCode\n", |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #50054 +/- ##
==========================================
+ Coverage 67.97% 67.98% +0.01%
==========================================
Files 3922 3928 +6
Lines 250031 250094 +63
Branches 13300 13330 +30
==========================================
+ Hits 169952 170036 +84
+ Misses 64777 64756 -21
Partials 15302 15302
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
fleet-release
previously approved these changes
Jul 28, 2026
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
fleet-release
previously approved these changes
Jul 28, 2026
fleet-release
approved these changes
Jul 28, 2026
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughUpdates the YubiKey Manager Homebrew manifest with a Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json:8
- PR description/title indicate this change is only freezing the macOS yubico-yubikey-manager Homebrew input, but this PR also adds multiple new Windows FMAs (winget inputs, outputs, apps.json entries) and frontend icon components/mappings. This makes the PR scope unclear to reviewers and contradicts the stated intent.
"default_categories": ["Productivity"],
"frozen": true
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
ee/maintained-apps/inputs/winget/scripts/spyder_uninstall.ps1:34
- This Spyder uninstall behavior change is unrelated to the PR's stated purpose (freezing the macOS Yubikey Manager FMA). Please either split this into a separate PR or update the PR title/description to clearly include the Spyder uninstall fix so reviewers/release notes match the actual changeset.
$exitCode = $process.ExitCode; Write-Host "Uninstall exit code: $exitCode"; break
}
}
if (-not $foundUninstaller) { Write-Host "Uninstaller for '$softwareName' not found."; Exit 0 }
} catch { Write-Host "Error: $_"; Exit 1 }
2 tasks done
allenhouchins
added a commit
that referenced
this pull request
Jul 29, 2026
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow The `yubico-yubikey-manager` cask was removed from homebrew-cask on 2026-07-28 ([Homebrew/homebrew-cask@7ffabaa](Homebrew/homebrew-cask@7ffabaa)) after being disabled on 2025-07-27 `because: :discontinued, replacement_cask: "yubico-authenticator"` — Yubico discontinued `yubikey-manager-qt` (the 1.2.5 installer this FMA pinned) in favor of Yubico Authenticator. The brew API now returns 404 for the token, so the maintained-apps ingester panics: ``` {"level":"INFO","msg":"ingesting homebrew app","name":"Yubikey Manager"} panic: ingesting homebrew app: app not found in brew API ``` Freezing the app in #50054 did not resolve this: `fetchCask` runs before the `frozen` flag is applied, so the ingester still fetches the cask and fails on the 404. This is the follow-up that PR called out. Removes Yubikey Manager as a **macOS** Fleet-maintained app, following the same pattern as #50050 (Nocturnal), #46541 (Messenger), and #47420 (Dell Display Manager): - `ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json` — Homebrew input - `ee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json` — macOS output data - `ee/maintained-apps/outputs/apps.json` — the `yubico-yubikey-manager/darwin` entry - `website/config/routes.js` — the bare `/software-catalog/yubico-yubikey-manager` redirect pointed at `-darwin`, which would now 404; retargeted to `-windows` The **Windows** FMA is unaffected and continues to update, so these are deliberately kept: - `ee/maintained-apps/inputs/winget/yubico-yubikey-manager.json` and its install/uninstall scripts - `ee/maintained-apps/outputs/yubico-yubikey-manager/windows.json` - the `yubico-yubikey-manager/windows` entry in `apps.json` - `frontend/pages/SoftwarePage/components/icons/YubikeyManager.tsx` and its `"yubikey manager"` mapping in `index.ts` - `website/assets/images/app-icon-yubico-yubikey-manager-60x60@2x.png` Also drops "Requires Rosetta 2." from the Windows entry's description in `apps.json`. Rosetta is macOS-only; the sentence was copy-pasted from the macOS entry, and with macOS gone the Windows page is what `/software-catalog/yubico-yubikey-manager` now resolves to. Descriptions in `apps.json` are hand-maintained — `updateAppsListFile` in `cmd/maintained-apps/main.go` only appends entries whose slug it doesn't already find, so it won't overwrite the edit. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually: - `go run ./cmd/maintained-apps -slug yubico-yubikey-manager/darwin` exits 0 with no panic and writes no files (before this change, the same run panicked on the brew 404). - `apps.json` still parses and holds 1377 apps; the only remaining `yubico-yubikey-manager` entry is `/windows`. - Grepped the repo for `yubico-yubikey-manager`: remaining hits are the winget input, its two script paths, the windows `apps.json` entry, and the retargeted website redirect. No automated tests added — this is a data-file removal with no new code paths.
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue: N/A
Pins the macOS Fleet-maintained app for Yubikey Manager at its current output version,
1.2.5, by setting"frozen": trueon the Homebrew input.ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json— added"frozen": trueThe flag is read by the ingester into the manifest (
homebrew/ingester.go) and then consumed in two places:cmd/maintained-apps/main.goskips overwritingoutputs/yubico-yubikey-manager/darwin.jsonwhen the output file already exists, so the published version, installer URL, SHA256, and patch-policy query stop moving.cmd/maintained-apps/validate/main.goskips the app entirely during validation.frozenis taggedjson:"-"on the manifest struct, so it does not appear in the output JSON — that file is intentionally left untouched by this PR.The Windows FMA (
inputs/winget/yubico-yubikey-manager.json) is deliberately not frozen and continues to update.Note for reviewers
While preparing this change I found that the
yubico-yubikey-managercask has been removed from homebrew-cask:The full cask list now contains only
pallotron-yubiswitch,yubico-authenticator, andyubihsm2-sdk, and the token is not present ininputs/homebrew/custom-tap/either. This matches upstream: Yubico discontinuedyubikey-manager-qt(the 1.2.5 installer this FMA pins) in favor of Yubico Authenticator.Freezing does not resolve that 404. The ingester fetches cask metadata before the frozen flag is applied, so the scheduled "Update Fleet-maintained apps" workflow is still expected to fail for this app with:
Fully resolving that would mean removing the macOS FMA, the way #50050 did for Nocturnal (input, output,
apps.jsonentry, frontend icon + mapping, website PNG). This PR is scoped to the freeze only, per the request; the removal can be a follow-up if that is the direction we want.Checklist for submitter
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Testing
frozenflag through the ingester into both the output-write skip and the validation skip. No automated tests were added; this is a single data-file flag with no new code paths.Summary by CodeRabbit
Bug Fixes
Chores