fleetd-base.msi can't be updated because the sha256 checksum is hardcoded in Fleet

[roperzh]

Fleet version: 4.49.4

---

💥  Actual behavior

With #18194 we are able to ship updated fleetd-base.msi installers with each fleetd release, however we had to rollback the changes because the sha256 checksum of the file is hardcoded in Fleet.

🧑‍💻  Steps to reproduce

See #19105

🕯️ More info (optional)

The checksum is hardcoded here:

fleet/server/service/microsoft_mdm.go

Lines 1352 to 1355 in ae24e6e

	<Validation>
	<FileHash>9F89C57D1B34800480B38BD96186106EB6418A82B137A0D56694BF6FFA4DDF1A</FileHash>
	</Validation>
	<Enforcement>

Documentation about the CSP is here: https://learn.microsoft.com/en-us/windows/client-management/mdm/enterprisedesktopappmanagement-csp

The fix will need to be backward compatible so that older versions of Fleet don't break.

[getvictor]

@getvictor:
We also have a race condition. The base-fleetd file may be updated after the SHA was sent/downloaded to the device. We need a solution. Maybe MDM can check if install happened. If not, resend the command?

@roperzh
good catch, the challenge there is that the MDM protocol always returns an "OK" for software installs, and then tries to actually install the software asynchronously afterwards.

without osquery on the host, getting the installed software is a bit challenging (we currently don't have any way to "ingest" data using the MDM protocol, IF we can even get that data)

maybe some heuristic, like "if you're not osquery enrolled after 15 minutes we retry"

[lukeheath]

@roperzh As part of this effort, would you please include contributor docs explaining the manifest usage? Thanks!

[roperzh]

This is currently blocked by #19182, I left #19182 (comment) outlining what we need.

[roperzh]

un-assigning myself from this as it can't be currently worked on.

[roperzh]

This is not blocked anymore, and it's ready to test. No special setup needed.

[PezHub]

checked the logs after turning on MDM for macOS and Windows hosts and verified the versions of orbit and osquery are the latest.

*I'll need to test this for Azure enrolled hosts once it makes it over to Dogfood.

[fleet-release]

Updating fleet's core,
Checksum adapts like leaves,
Old versions endure.