[allenhouchins]

Related issue: Came up in review of #56085 (Logitech G HUB FMA), where CodeRabbit flagged that /Users/Shared/LGHUB isn't removed when no one is logged in. The cause is in the shared generator, so it's fixed here for every macOS FMA.

Problem

Fleet runs FMA uninstall scripts as root at any time, including at the login window. The generated zap cleanup was:

LOGGED_IN_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ { print $3 }')
trash $LOGGED_IN_USER '/Users/Shared/LGHUB'

• At the login window, LOGGED_IN_USER is loginwindow, so trash() moved every path into /Users/loginwindow/.Trash. That folder doesn't exist, so the mv failed and app files outside home folders (e.g. /Users/Shared/<app>, /Library/Application Support/<app>, /Library/LaunchDaemons/<app>.plist) were left behind.
• When LOGGED_IN_USER was empty, the unquoted variable disappeared and the arguments shifted. The path became logged_in_user, target_file was empty, and nothing was removed.

968 macOS outputs use trash, and 106 of their trash calls are system paths rather than ~ paths.

Fix

• Generated calls quote the user: trash "$LOGGED_IN_USER" '<path>'.
• In trash(), when the console user is empty, root or loginwindow:
  • ~ paths are skipped with Not logged into a non-root GUI; skipping <path>., which matches the wording of the quit and relaunch helpers.
  • All other paths are deleted with rm -rf. Glob paths still expand through compgen -G and each match is removed.
  • The only paths deleted are the app-specific entries in the cask's zap stanza, such as /Users/Shared/GOG.com or /Library/Application Support/TeamViewer. When someone is logged in, these same paths are already moved to their Trash. I checked all 106 absolute paths in the outputs, and none is a shared parent folder like /Users/Shared or /Library. The shallowest are /Library/Tailscale, /etc/anydesk and /Applications/Omnissa Horizon Client.app.
• With a real console user, nothing changes: paths are still moved to that user's Trash.
• quit_application and relaunch_application are byte-identical to before.

Exit status: cleanup stays best-effort

A failed removal prints Failed to remove <path>. (or Failed to move <path> to the Trash.) and does not change the script's exit status. Reasons:

• trash comes from the cask's zap stanza and runs after the app bundle and pkg files are already gone. Those earlier steps keep their own exit handling. Failing the uninstall because of leftover data would report a failed uninstall for an app that's no longer installed, and retrying wouldn't help.
• Before this change, the exit status was effectively random. trash() returned the last mv's status, so a failure only counted when the failing path happened to be the script's last statement. Now trash() always returns 0, and the logged-in path gets the same || echo treatment, so the result no longer depends on path order.

Outputs

• Non-frozen outputs: updated by applying the generator's change to each existing uninstall script, then recomputing sha256(script)[:8] and sorting refs. I didn't commit a raw go run ./cmd/maintained-apps because it also pulls whatever upstream version bumps landed since the last bot run. Instead I ran the generator (macOS ingester) in a scratch worktree and compared the results:

  • 950 outputs are byte-identical.
  • 12 differ only by an upstream version bump (Arc, Brave, Claude, and others). Their uninstall scripts are identical.
  • 3 same-version casks have new upstream zap entries (Blender, Dayflow, Notesnook).
  • The 13 frozen outputs differ because the generator never rewrites them.

  So outside of upstream drift, the generator produces exactly these uninstall scripts. The next bot run picks up the drift.

• Frozen outputs (13): hand-edited the same way, since ingest never rewrites them. Evernote's frozen script carried an older trash() without glob support; it now has the current helper.

• Custom uninstall scripts that embed their own trash() (Camtasia, CleanMyMac, Cycling '74 Max, ForkLift, GPG Suite, Homebrew, KiCad, Microsoft Word, Teleport) now carry the generator's copy verbatim, with the call sites quoted. Five of these had the pre-glob version, so glob zap paths that never matched before now do. Examples: GPG Suite's ~/Library/Preferences/org.gpgtools.* and Word's ~/Library/Application Support/CrashReporter/Microsoft Word_*.plist.

The only change in every output is the uninstall script and its ref.

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

  • Paths are still passed through shellSingleQuote; the only new interpolation is the quoted "$LOGGED_IN_USER".

Testing

• Added/updated automated tests
  • TestUninstallScriptTrashWithoutGUIUser runs a generated uninstall script in bash with scutil stubbed. It covers loginwindow, an empty user, root and a normal user, each against a ~ path, a ~ glob, an absolute directory, and an absolute glob with spaces. It also checks that a failing rm as the script's last command still exits 0. The test fails on main and passes here, under both /bin/bash 3.2 and Homebrew bash 5.
  • TestCustomUninstallScriptsUseCurrentTrash fails if a custom uninstall script's trash() drifts from the generator's copy or calls it with an unquoted user.
  • go test ./ee/maintained-apps/... ./cmd/maintained-apps/... passes.
• QA'd all new/changed functionality manually

AI

AI: Claude Code (claude-opus-5-5)

[allenhouchins]

Combined into #56457 with the other macOS FMA uninstall changes (#56016, #56314, #56333, #56336, #56454). Closing in favor of that PR.