[allenhouchins]

Related issue: Found in #56846 (darwin validator, run 41213361619, shard 5/33)

Problem

The macOS Citrix Workspace uninstall sometimes leaves /Library/Application Support/Citrix Workspace Updater/Citrix Workspace Updater.app (com.citrix.ReceiverUpdater, 26.09.0 / 700026.09.0.17) behind. The darwin validator then reports "App still present after uninstall", because it matches any app named like "Citrix Workspace". It also shows up on real Macs, for example in the osquery-perf software library.

Where the updater comes from

The pkg doesn't install that folder. I read the pkg's TOC, Distribution, PackageInfo, Bom and Scripts with HTTP range requests (1.5 MB of the 387 MB pkg):

• It has one component, com.citrix.ICAClient. Its payload goes to the staging tree /Library/Citrix Workspace/CitrixWorkspaceInstaller, and the postinstall moves the app into /Applications. The updater exists in the payload only inside the app bundle, at Contents/Frameworks/CitrixWorkspaceApps.framework/Versions/26.09.0.17/Helpers/CitrixWorkspaceApps/Citrix Workspace Updater.app.
• No payload, receipt or pkg script writes /Library/Application Support/Citrix Workspace Updater. So no pkgutil entry, in the cask or anywhere else, can cover it.
• For silent installs (installer -pkg, which is how Fleet installs it), the postinstall's configureMsTeamsVDIPlugin writes CWAInstallAUCmd = true to the user's com.citrix.receiver.nomas defaults. Its comment says ReceiverHelper reads that marker, behind a LaunchDarkly kill switch, and installs the Microsoft Teams VDI plugin through the Citrix Workspace updater service.

The failing run's harden-runner events show that sequence, right after the install:

Time (UTC)	Process
16:17:41	Install done, /Applications/Citrix Workspace.app detected
16:17:45	Citrix Workspace running
16:17:50	/Library/Application Support/Citrix Workspace Updater/Citrix Workspace Updater.app/.../Citrix Workspace Updater (pid 30319) contacts download.microsoft.com
16:17:52	A second /usr/sbin/installer (pid 30662) runs
16:17:54	Uninstall script starts; another updater process (pid 30683) is running from the same folder
16:18:12	The validator finds the updater there

So the updater is copied out of the app bundle at runtime and run as root, to install an add-on. Whether it happens before the uninstall depends on the feature flag, the network and timing. That's why the same app passed other full-catalog runs the same day.

Change

• New custom uninstall script, inputs/homebrew/scripts/citrix-workspace-uninstall.sh. It's the current generated script, byte for byte, plus one block after /Applications/Citrix Workspace.app and /Library/Citrix Workspace are removed:
  • It stops any process running from /Library/Application Support/Citrix Workspace Updater/, with TERM, then KILL after 5 seconds. The match is anchored to the start of the command line, so only processes running from that folder match.
  • Then it deletes the folder.
• At that point, the launchd jobs (including com.citrix.ctxworkspaceupdater and com.citrix.ReceiverUpdaterHelper) are booted out and their plists deleted, ReceiverHelper has been quit, and the app bundle the updater is copied from is gone. Nothing is left that could copy it back.
• I regenerated the output with the ingester. Only uninstall_script_ref and its script changed: same version (26.09.0), URL, SHA and install script.

Not in this PR: the Teams VDI plugin the updater may have installed by then. I couldn't confirm its pkg ID or install path without capturing it from a real run.

If #56846 merges first, this script's copy of trash() needs the same update, and vice versa.

Checklist for submitter

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.
  • The new block uses only a fixed path.
• Timeouts are implemented and retries are limited to avoid infinite loops
  • It waits at most 5 seconds before KILL.

Testing

• QA'd all new/changed functionality manually
  • I ran the new block on macOS against fake processes running from a scratch copy of the folder. One exited on TERM, one ignored TERM and was killed after 5 seconds, and one that only named the path as an argument was left running. The folder was removed.
  • go test ./ee/maintained-apps/... ./cmd/maintained-apps/... passes.
  • Not tested: a full install and uninstall on a Mac where the updater actually ran. This PR's darwin validation runs citrix-workspace, but the updater only runs sometimes, so a pass there doesn't prove the fix.

AI

AI: Claude Code (claude-opus-5-5)

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/citrix-workspace/darwin.json

=== Install Script (no changes) ===
=== Uninstall // 89403d3b -> b077b2e9 ===

--- /tmp/old.vGO4Gx	2026-10-31 18:00:24.922666133 +0000
+++ /tmp/new.vLpBeH	2026-10-31 18:00:24.923666122 +0000
@@ -305,6 +305,19 @@
 forget_pkg 'com.citrix.receiver.bcr'
 sudo rm -rf '/Applications/Citrix Workspace.app'
 sudo rm -rf '/Library/Citrix Workspace'
+# Citrix Workspace copies its updater here at runtime, outside any pkg
+# receipt, and runs it as root to install add-ons such as the Microsoft Teams
+# VDI plugin. Stop it after the app is gone so nothing can copy it back.
+updater_dir='/Library/Application Support/Citrix Workspace Updater'
+if pgrep -f "^$updater_dir/" >/dev/null 2>&1; then
+  sudo pkill -TERM -f "^$updater_dir/" || :
+  for _ in {1..5}; do
+    sleep 1
+    pgrep -f "^$updater_dir/" >/dev/null 2>&1 || break
+  done
+  sudo pkill -KILL -f "^$updater_dir/" || :
+fi
+sudo rm -rf "$updater_dir"
 trash "$LOGGED_IN_USER" '/Library/Logs/Citrix Workspace'
 trash "$LOGGED_IN_USER" '~/Library/Application Support/Citrix Receiver'
 trash "$LOGGED_IN_USER" '~/Library/Application Support/Citrix Workspace'

[Copilot]

🟡 Changes recommended

The new updater cleanup lacks automated regression coverage for updater absence, termination and escalation, directory removal, and avoiding unrelated processes.

1 open issue

• Add regression coverage for updater cleanup behavior · New

What changed in this PR

This PR updates Fleet’s Citrix Workspace maintained app to remove the updater copied outside the main app bundle at runtime, addressing leftover software after uninstall.

Changes:

• Adds updater process cleanup using TERM, up to five seconds of polling, and KILL before deleting its directory.
• Configures the custom uninstall script and regenerates the output manifest without changing installer metadata or installation behavior.

File	Description
ee/​maintained-apps/​outputs/​citrix-workspace/​darwin.json	Updates the embedded uninstall script and its reference.
ee/​maintained-apps/​inputs/​homebrew/​scripts/​citrix-workspace-uninstall.sh	Adds the custom uninstall script with runtime updater cleanup.
ee/​maintained-apps/​inputs/​homebrew/​citrix-workspace.json	Selects the custom uninstall script.

_{Review effort: Balanced}