Skip to content

fix(FLEETMDM-009): CU-86akj32d7 2 review findings across 2 files #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
flamingo wants to merge 2 commits into
base: main
Choose a base branch
from
+11 −2
Draft

fix(FLEETMDM-009): CU-86akj32d7 2 review findings across 2 files #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
29511d6
fix(FLEETMDM-009): 2 review findings across 2 files
flamingo[bot] Sep 14, 2026
0190908
fix(FLEETMDM-009): 2 review findings across 2 files
flamingo[bot] Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion ee/maintained-apps/ingesters/homebrew/external_refs/cisco_jabber_version_transformer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
// CiscoJabberVersionTransformer sets the version to "15.2.0" which matches what osquery reports.

@flamingo flamingo Bot Sep 14, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🔴 CiscoJabberVersionTransformer overrides InstallerURL implicitly via version mismatch without resetting SHA256

Changed the hardcoded app.Version literal in CiscoJabberVersionTransformer (cisco_jabber_version_transformer.go) from "15.2.1" to "15.2.0" to match the documented value and what osquery reports, fixing the version mismatch. SHA256 is not set or modified anywhere in this transformer (no field is touched besides Version), so there is no stale SHA256 to reset in this file; a full verification of SHA256 consistency would require checking the manifest-building pipeline outside this file, which is out of scope for this single-file fix.

🤖 Prompt for AI agents 
In ee/maintained-apps/ingesters/homebrew/external_refs/cisco_jabber_version_transformer.go around line 7, review and complete this code-review fix: CiscoJabberVersionTransformer overrides InstallerURL implicitly via version mismatch without resetting SHA256.
What the draft fix changed: Changed the hardcoded `app.Version` literal in `CiscoJabberVersionTransformer` (cisco_jabber_version_transformer.go) from "15.2.1" to "15.2.0" to match the documented value and what osquery reports, fixing the version mismatch. SHA256 is not set or modified anywhere in this transformer (no field is touched besides Version), so there is no stale SHA256 to reset in this file; a full verification of SHA256 consistency would require checking the manifest-building pipeline outside this file, which is out of scope for this single-file fix.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

// Homebrew reports a build number (e.g., "20251027035315") instead of the app version (e.g., "15.2.0").
func CiscoJabberVersionTransformer(app *maintained_apps.FMAManifestApp) (*maintained_apps.FMAManifestApp, error) {
app.Version = "15.2.1"
app.Version = "15.2.0"
return app, nil
}

10 changes: 9 additions & 1 deletion ee/maintained-apps/inputs/homebrew/scripts/grammarly-desktop-install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,15 @@ quit_application() {

# extract contents
MOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)

@flamingo flamingo Bot Sep 14, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🔴 Verify grammarly-desktop-install.sh script correctness — unattended sudo cp of directory contents lacks error checking on mount

In the "extract contents" section, hdiutil attach is now checked with an if ! guard that echoes an error and exits 1 on mount failure, and a follow-up check verifies $MOUNT_POINT is non-empty (via ls -A) before the sudo cp -R runs, detaching the mount point and exiting 1 with a diagnostic message if the mount produced no files. This differentiates mount failures/empty mounts from the later "Grammarly Installer.app not found" error path, as requested.

🤖 Prompt for AI agents 
In ee/maintained-apps/inputs/homebrew/scripts/grammarly-desktop-install.sh around line 47, review and complete this code-review fix: Verify grammarly-desktop-install.sh script correctness — unattended sudo cp of directory contents lacks error checking on mount.
What the draft fix changed: In the "extract contents" section, `hdiutil attach` is now checked with an `if !` guard that echoes an error and exits 1 on mount failure, and a follow-up check verifies `$MOUNT_POINT` is non-empty (via `ls -A`) before the `sudo cp -R` runs, detaching the mount point and exiting 1 with a diagnostic message if the mount produced no files. This differentiates mount failures/empty mounts from the later "Grammarly Installer.app not found" error path, as requested.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer

hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH"
if ! hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH"; then
echo "Error: failed to mount $INSTALLER_PATH"
exit 1
fi
if [ -z "$(ls -A "$MOUNT_POINT" 2>/dev/null)" ]; then
echo "Error: mount point $MOUNT_POINT is empty after mounting $INSTALLER_PATH"
hdiutil detach "$MOUNT_POINT" >/dev/null 2>&1
exit 1
fi
sudo cp -R "$MOUNT_POINT"/* "$TMPDIR"
hdiutil detach "$MOUNT_POINT"

Expand Down