fix(adhoc-sweep-fixes): CU-86akj32d7 40 review findings across 40 files

cmd/maintained-apps/validate/darwin.go

@@ -176,6 +176,87 @@ func checkVersionMatch(expectedVersion, foundVersion, foundBundledVersion string
 	return false
 }
 
+// appVersionMatcher is a strategy for determining whether a found app result
+// satisfies the version requirement for a specific bundle identifier. Each
+// matcher encapsulates one vendor-specific quirk so that new quirks can be
+// added, tested, and reasoned about independently of appExists' main loop.
+type appVersionMatcher func(ctx context.Context, logger *slog.Logger, appVersion string, result AppResult) bool
+
+// appVersionMatchers maps bundle identifiers to their special-case version
+// matching strategy. Bundle identifiers not present here fall back to the
+// default checkVersionMatch behavior in appExists.
+var appVersionMatchers = map[string]appVersionMatcher{
+	// OneDrive auto-updates immediately after installation, so the installed version
+	// might be newer than the installer version. For OneDrive, we only verify that
+	// the app exists rather than checking the version.
+	"com.microsoft.OneDrive": func(ctx context.Context, logger *slog.Logger, appVersion string, result AppResult) bool {
+		logger.InfoContext(ctx, "OneDrive detected - skipping version check due to auto-update behavior")
+		return true
+	},
+
+	// GPG Suite's installer version (e.g., "2023.3") doesn't match the app bundle version
+	// (e.g., "1.12" with bundled version "1800"). We only verify that the app exists
+	// rather than checking the version.
+	"org.gpgtools.gpgkeychain": func(ctx context.Context, logger *slog.Logger, appVersion string, result AppResult) bool {
+		logger.InfoContext(ctx, "GPG Suite detected - skipping version check due to version mismatch between installer and app bundle")
+		return true
+	},
+
+	// Adobe DNG Converter's version format includes build number in parentheses
+	// (e.g., "18.0 (2389)") which doesn't match the installer version (e.g., "18.0")
+	// Check if the version starts with the expected version to handle this case
+	"com.adobe.DNGConverter": func(ctx context.Context, logger *slog.Logger, appVersion string, result AppResult) bool {
+		if strings.HasPrefix(result.Version, appVersion+" ") || strings.HasPrefix(result.Version, appVersion+"(") {
+			logger.InfoContext(ctx, "Adobe DNG Converter detected - version matches with build number")
+			return true
+		}
+		return false
+	},
+
+	// Ableton Live's version format includes a build identifier in parentheses
+	// (e.g., "12.4.1 (2026-05-20_fbe5fe99c9)") which doesn't match the installer
+	// version (e.g., "12.4.1"). Check if the version starts with the expected
+	// version to handle this case.
+	"com.ableton.live": func(ctx context.Context, logger *slog.Logger, appVersion string, result AppResult) bool {
+		if strings.HasPrefix(result.Version, appVersion+" ") || strings.HasPrefix(result.Version, appVersion+"(") {
+			logger.InfoContext(ctx, "Ableton Live detected - version matches with build identifier")
+			return true
+		}
+		return false
+	},
+
+	// WhatsApp: Homebrew sometimes reports a newer version than what's actually available.
+	// If version doesn't match but app is installed, fall back to existence-only validation.
+	"net.whatsapp.WhatsApp": func(ctx context.Context, logger *slog.Logger, appVersion string, result AppResult) bool {
+		if !checkVersionMatch(appVersion, result.Version, result.BundledVersion) {
+			logger.InfoContext(ctx, "WhatsApp detected - version mismatch but app is installed, falling back to existence-only validation")
+			return true
+		}
+		return false
+	},
+
+	// Logi Tune: the installer URL always serves the latest release, while the Homebrew
+	// cask version lags behind (its livecheck scrapes a Logitech support article that is
+	// updated less often than the download). The installed version is therefore newer
+	// than the manifest version. If version doesn't match but app is installed, fall
+	// back to existence-only validation.
+	"com.logitech.logitune": func(ctx context.Context, logger *slog.Logger, appVersion string, result AppResult) bool {
+		if !checkVersionMatch(appVersion, result.Version, result.BundledVersion) {
+			logger.InfoContext(ctx, "Logi Tune detected - version mismatch but app is installed, falling back to existence-only validation")
+			return true
+		}
+		return false
+	},
+}
+
+// AppResult represents a single row returned by the osquery apps query in appExists.
+type AppResult struct {
+	Name           string `json:"name"`
+	Path           string `json:"path"`
+	Version        string `json:"bundle_short_version"`
+	BundledVersion string `json:"bundle_version"`
+}
+
 func appExists(ctx context.Context, logger *slog.Logger, appName, uniqueAppIdentifier, appVersion, appPath string) (bool, error) {
 	execTimeout, cancel := context.WithTimeout(ctx, 30*time.Second)
 	defer cancel()
@@ -211,18 +292,13 @@ func appExists(ctx context.Context, logger *slog.Logger, appName, uniqueAppIdent
 		return false, fmt.Errorf("executing osquery command: %w", err)
 	}
 
-	type AppResult struct {
-		Name           string `json:"name"`
-		Path           string `json:"path"`
-		Version        string `json:"bundle_short_version"`
-		BundledVersion string `json:"bundle_version"`
-	}
 	var results []AppResult
 	if err := json.Unmarshal(output, &results); err != nil {
 		return false, fmt.Errorf("parsing osquery JSON output: %w", err)
 	}
 
 	if len(results) > 0 {
+		matcher := appVersionMatchers[uniqueAppIdentifier]
 		for _, result := range results {
 			software := &fleet.Software{
 				Name:             result.Name,
@@ -236,64 +312,10 @@ func appExists(ctx context.Context, logger *slog.Logger, appName, uniqueAppIdent
 
 			logger.InfoContext(ctx, fmt.Sprintf("Found app: '%s' at %s, Version: %s, Bundled Version: %s", result.Name, result.Path, result.Version, result.BundledVersion))
 
-			// OneDrive auto-updates immediately after installation, so the installed version
-			// might be newer than the installer version. For OneDrive, we only verify that
-			// the app exists rather than checking the version.
-			if uniqueAppIdentifier == "com.microsoft.OneDrive" {
-				logger.InfoContext(ctx, "OneDrive detected - skipping version check due to auto-update behavior")
+			if matcher != nil && matcher(ctx, logger, appVersion, result) {
 				return true, nil
 			}
 
-			// GPG Suite's installer version (e.g., "2023.3") doesn't match the app bundle version
-			// (e.g., "1.12" with bundled version "1800"). We only verify that the app exists
-			// rather than checking the version.
-			if uniqueAppIdentifier == "org.gpgtools.gpgkeychain" {
-				logger.InfoContext(ctx, "GPG Suite detected - skipping version check due to version mismatch between installer and app bundle")
-				return true, nil
-			}
-
-			// Adobe DNG Converter's version format includes build number in parentheses
-			// (e.g., "18.0 (2389)") which doesn't match the installer version (e.g., "18.0")
-			// Check if the version starts with the expected version to handle this case
-			if uniqueAppIdentifier == "com.adobe.DNGConverter" {
-				if strings.HasPrefix(result.Version, appVersion+" ") || strings.HasPrefix(result.Version, appVersion+"(") {
-					logger.InfoContext(ctx, "Adobe DNG Converter detected - version matches with build number")
-					return true, nil
-				}
-			}
-
-			// Ableton Live's version format includes a build identifier in parentheses
-			// (e.g., "12.4.1 (2026-05-20_fbe5fe99c9)") which doesn't match the installer
-			// version (e.g., "12.4.1"). Check if the version starts with the expected
-			// version to handle this case.
-			if uniqueAppIdentifier == "com.ableton.live" {
-				if strings.HasPrefix(result.Version, appVersion+" ") || strings.HasPrefix(result.Version, appVersion+"(") {
-					logger.InfoContext(ctx, "Ableton Live detected - version matches with build identifier")
-					return true, nil
-				}
-			}
-
-			// WhatsApp: Homebrew sometimes reports a newer version than what's actually available.
-			// If version doesn't match but app is installed, fall back to existence-only validation.
-			if uniqueAppIdentifier == "net.whatsapp.WhatsApp" {
-				if !checkVersionMatch(appVersion, result.Version, result.BundledVersion) {
-					logger.InfoContext(ctx, "WhatsApp detected - version mismatch but app is installed, falling back to existence-only validation")
-					return true, nil
-				}
-			}
-
-			// Logi Tune: the installer URL always serves the latest release, while the Homebrew
-			// cask version lags behind (its livecheck scrapes a Logitech support article that is
-			// updated less often than the download). The installed version is therefore newer
-			// than the manifest version. If version doesn't match but app is installed, fall
-			// back to existence-only validation.
-			if uniqueAppIdentifier == "com.logitech.logitune" {
-				if !checkVersionMatch(appVersion, result.Version, result.BundledVersion) {
-					logger.InfoContext(ctx, "Logi Tune detected - version mismatch but app is installed, falling back to existence-only validation")
-					return true, nil
-				}
-			}
-
 			// Check various version matching strategies
 			if checkVersionMatch(appVersion, result.Version, result.BundledVersion) {
 				return true, nil

cmd/osquery-perf/softwaredb/softwaredb.go

@@ -369,14 +369,18 @@ func generateDatabaseFromSQL(dbPath, sqlPath string) error {
 	if err != nil {
 		return fmt.Errorf("creating database: %w", err)
 	}
-	defer db.Close()
 
 	// Execute the SQL file
 	if _, err := db.Exec(string(sqlContent)); err != nil {
+		db.Close()         // Close the handle before removing the file so cleanup is reliable on all platforms (notably Windows)
 		os.Remove(dbPath) // Clean up partial database
 		return fmt.Errorf("executing SQL file: %w", err)
 	}
 
+	if err := db.Close(); err != nil {
+		return fmt.Errorf("closing database: %w", err)
+	}
+
 	log.Printf("✅ Successfully created database from %s", sqlPath)
 	return nil
 }

docker-compose-redis-cluster.yml

@@ -8,12 +8,18 @@ services:
       cluster_network:
         ipv4_address: 172.20.0.30
     depends_on:
-      - redis-cluster-1
-      - redis-cluster-2
-      - redis-cluster-3
-      - redis-cluster-4
-      - redis-cluster-5
-      - redis-cluster-6
+      redis-cluster-1:
+        condition: service_healthy
+      redis-cluster-2:
+        condition: service_healthy
+      redis-cluster-3:
+        condition: service_healthy
+      redis-cluster-4:
+        condition: service_healthy
+      redis-cluster-5:
+        condition: service_healthy
+      redis-cluster-6:
+        condition: service_healthy
 
   redis-cluster-1:
     image: ${FLEET_REDIS_IMAGE:-redis:6.2}
@@ -25,6 +31,11 @@ services:
     networks:
       cluster_network:
         ipv4_address: 172.20.0.31
+    healthcheck:
+      test: ["CMD", "redis-cli", "-p", "7001", "ping"]
+      interval: 2s
+      timeout: 2s
+      retries: 15
 
   redis-cluster-2:
     image: ${FLEET_REDIS_IMAGE:-redis:6.2}
@@ -36,6 +47,11 @@ services:
     networks:
       cluster_network:
         ipv4_address: 172.20.0.32
+    healthcheck:
+      test: ["CMD", "redis-cli", "-p", "7002", "ping"]
+      interval: 2s
+      timeout: 2s
+      retries: 15
 
   redis-cluster-3:
     image: ${FLEET_REDIS_IMAGE:-redis:6.2}
@@ -47,6 +63,11 @@ services:
     networks:
       cluster_network:
         ipv4_address: 172.20.0.33
+    healthcheck:
+      test: ["CMD", "redis-cli", "-p", "7003", "ping"]
+      interval: 2s
+      timeout: 2s
+      retries: 15
 
   redis-cluster-4:
     image: ${FLEET_REDIS_IMAGE:-redis:6.2}
@@ -58,6 +79,11 @@ services:
     networks:
       cluster_network:
         ipv4_address: 172.20.0.34
+    healthcheck:
+      test: ["CMD", "redis-cli", "-p", "7004", "ping"]
+      interval: 2s
+      timeout: 2s
+      retries: 15
 
   redis-cluster-5:
     image: ${FLEET_REDIS_IMAGE:-redis:6.2}
@@ -69,6 +95,11 @@ services:
     networks:
       cluster_network:
         ipv4_address: 172.20.0.35
+    healthcheck:
+      test: ["CMD", "redis-cli", "-p", "7005", "ping"]
+      interval: 2s
+      timeout: 2s
+      retries: 15
 
   redis-cluster-6:
     image: ${FLEET_REDIS_IMAGE:-redis:6.2}
@@ -80,6 +111,11 @@ services:
     networks:
       cluster_network:
         ipv4_address: 172.20.0.36
+    healthcheck:
+      test: ["CMD", "redis-cli", "-p", "7006", "ping"]
+      interval: 2s
+      timeout: 2s
+      retries: 15
 
 networks:
   cluster_network:

ee/cis/macos-26/test/scripts/CIS_5.11_pass.sh

@@ -1,5 +1,19 @@
 #!/bin/bash
 # CIS 5.11 - Ensure Logging Is Enabled for Sudo
 # Adds Defaults log_allowed to a sudoers.d file.
-echo 'Defaults log_allowed' | /usr/bin/sudo /usr/bin/tee /etc/sudoers.d/CIS_5_11_sudoconfiguration > /dev/null
+TMPFILE=$(/usr/bin/mktemp)
+echo 'Defaults log_allowed' > "$TMPFILE"
+if ! /usr/bin/sudo /usr/sbin/visudo -c -f "$TMPFILE" > /dev/null; then
+    echo "Error: sudoers syntax validation failed for CIS_5_11_sudoconfiguration" >&2
+    /bin/rm -f "$TMPFILE"
+    exit 1
+fi
+/usr/bin/sudo /bin/cp "$TMPFILE" /etc/sudoers.d/CIS_5_11_sudoconfiguration
+/bin/rm -f "$TMPFILE"
 /usr/bin/sudo /bin/chmod 0440 /etc/sudoers.d/CIS_5_11_sudoconfiguration
+if ! /usr/bin/sudo /usr/sbin/visudo -c -f /etc/sudoers.d/CIS_5_11_sudoconfiguration > /dev/null; then
+    echo "Error: installed sudoers file failed validation, removing" >&2
+    /usr/bin/sudo /bin/rm -f /etc/sudoers.d/CIS_5_11_sudoconfiguration
+    exit 1
+fi
+

ee/fleetd-chrome/src/background.ts

@@ -104,6 +104,10 @@ const enroll = async () => {
     enroll_secret: FLEET_ENROLL_SECRET,
   });
 
+  if (!enroll_secret) {
+    throw new Error("enroll_secret is empty, refusing to enroll");
+  }
+
   let host_identifier = host_details.system_info.hardware_serial;
   if (!host_identifier) {
     host_identifier = host_details.system_info.uuid;
@@ -297,3 +301,4 @@ chrome.alarms.onAlarm.addListener(async ({ name }) => {
       console.error(`unknown alarm ${name}`);
   }
 });
+

ee/fleetd-chrome/src/tables/system_info.ts

@@ -17,11 +17,11 @@ export default class TableSystemInfo extends Table {
   getComputerName(hostname: string, hwSerial: string): string {
     const prefix = "Chromebook";
 
-    if (!!hostname?.length) {
+    if (!!hostname?.trim().length) {
       return hostname;
     }
 
-    if (!!hwSerial?.length) {
+    if (!!hwSerial?.trim().length) {
       return `${prefix} ${hwSerial}`;
     }
 

frontend/pages/ManageControlsPage/Scripts/helpers.tsx

@@ -34,8 +34,12 @@ export const getWhen = (summary: IScriptBatchSummaryV2) => {
       }
       return (
         <>
-          <Icon name="pending-outline" color="ui-fleet-black-50" size="small" />
-          Started{" "}
+          <Icon
+            name={canceled ? "close-filled" : "pending-outline"}
+            color="ui-fleet-black-50"
+            size="small"
+          />
+          {canceled ? "Canceled" : "Started"}{" "}
           <HumanTimeDiffWithFleetLaunchCutoff
             timeString={started_at}
             tooltipPosition="right"
@@ -84,3 +88,4 @@ export const getWhen = (summary: IScriptBatchSummaryV2) => {
       return null;
   }
 };
+

frontend/pages/ManageControlsPage/Variables/Variables.tests.tsx

@@ -154,8 +154,8 @@ describe("Custom variables", () => {
     );
     const deleteVariableHandler = http.delete(
       baseUrl("/custom_variables/:id"),
-      async ({ request }) => {
-        const id = request.url.split("/").pop();
+      async ({ params }) => {
+        const id = params.id as string;
         if (!id) {
           throw new Error("Variable ID not found in request URL");
         }

infrastructure/dogfood/terraform/aws-tf-module/templates/mysql_ca_tls_retrieval.sh.tpl

@@ -1,7 +1,8 @@
 #!/bin/bash
+set -euo pipefail
 apk add coreutils openssl
 
-wget --quiet  https://truststore.pki.rds.amazonaws.com/${aws_region}/${aws_region}-bundle.pem -O ${aws_region}-bundle.dl.pem
+wget --quiet --fail https://truststore.pki.rds.amazonaws.com/${aws_region}/${aws_region}-bundle.pem -O ${aws_region}-bundle.dl.pem
 csplit -z -k -f cert. -b '%02d.pem' ${aws_region}-bundle.dl.pem '/-----BEGIN CERTIFICATE-----/' '{*}'
 
 for filename in cert.*;
@@ -12,3 +13,4 @@ do
     mv $${filename} ${container_path}/${aws_region}.pem
   fi 
 done
+