DDM profiles are taking a long time to verify after editing

[allenhouchins]

Fleet version: 4.66.0

Web browser and operating system: macOS

---

💥  Actual behavior

It is taking an unusually long time for DDM profiles to go from verifying to verified. Often well beyond an hour.

🧑‍💻  Steps to reproduce

1. Create a DDM profile, deploy it to a device, and observe status in Fleet UI
2. Once it is verified, update the profile with a new setting and re-deploy (via GitOps)
3. Observe that the profile takes a long time to go from verifying to verified

🕯️ More info (optional)

Clicking resend on a mobileconfig configuration profile results in a responsive status (seconds/minutes) of going from verifying to verified. DDM configuration profiles do not.

More info in this Slack thread: https://fleetdm.slack.com/archives/C03C41L5YEL/p1744048572372529

🛠️ To fix

Product designer @marko-lisica:

The profile should be verified after the declaration profile is edited (via GitOps) as soon as we get status response from the host. AFAIK host automatically sends a status report when the declaration is added or edited.

QA Testplan

Changes involve inserting, updating, and verifying DDM profiles. Multiple DDM profiles should be tested on multiple hosts, using both UI flow and GitOps flow.

Loadtesting is needed for adding/updating DDM profiles to catch any performance regression.

[marko-lisica]

Slack thread screenshot (so we don't loose information)

[marko-lisica]

1. Create a DDM profile, deploy it to a device, and observe status in Fleet UI
2. Once it is verified, update the profile with a new setting and re-deploy (or click resend)
3. Observe that the profile takes a long time to go from verifying to verified

@noahtalerman @allenhouchins "(or click resend)" this part confuses me. We have a story to disable Resend button for declaration profiles, as that's not possible. I think we should remove that from the repro steps.

If I understand, the problem here is, when the declaration profile is updated (additional password requirement added), it doesn't verify, which should be because the profile is different, and the host should send a DDM status report back as soon as something is changed.