Amphetamine app display name is obtained from LoginHelper instead of correct app name

[GrayW]

Fleet versions 4.83.0

• Discovered: 4.83.0
• Reproduced:

Web browser and operating system: macOS

---

💥  Actual behavior

When a VPP app (Amphetamine) is added from the App Store and is made availble for Self Service, it is displayed with the name AmphetamineLoginHelper instead of Amphetamine. Fleet appears to be resolving the app name from the helper bundle located at Contents/Library/LoginItems rather than from the main app.

🛠️ To fix

When there's a duplicate bundle ID, check for the word "helper" in the title and use the one that doesn't contain "helper".

🧑‍💻  Steps to reproduce

These steps:

• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Add a VPP app (Amphetamine) from the App Store via the Fleet MDM VPP flow.
2. Make app available to hosts via self service.
3. Navigate to self service on a macOS host where the app is available.
4. Observe the app name displayed — it shows AmphetamineLoginHelper instead of Amphetamine.

🕯️ More info (optional)

• Unable to test reproduce as I have no access to VPP on test instances available.

[marko-lisica]

Assigned this to #g-security-compliance because this looks like an ingestion issue.

[mostlikelee]

@marko-lisica looks like the bug is when pulling VPP metadata when adding the app, should be for #g-software

[marko-lisica]

@mostlikelee Fleet gets com.if.Amphetamine bundle ID from VPP metadata API, which seems to be correct. I think the problem here is that osquery somehow gets AmphetamineLoginHelper instead of the .app bundle.

This is Info.plist from Amphetamine when installed on Mac:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>BuildMachineOSBuild</key>
	<string>23B81</string>
	<key>CFBundleDevelopmentRegion</key>
	<string>en</string>
	<key>CFBundleExecutable</key>
	<string>Amphetamine</string>
	<key>CFBundleIconFile</key>
	<string>AppIcon</string>
	<key>CFBundleIconName</key>
	<string>AppIcon</string>
	<key>CFBundleIdentifier</key>
	<string>com.if.Amphetamine</string>
	<key>CFBundleInfoDictionaryVersion</key>
	<string>6.0</string>
	<key>CFBundleName</key>
	<string>Amphetamine</string>
	<key>CFBundlePackageType</key>
	<string>APPL</string>
	<key>CFBundleShortVersionString</key>
	<string>5.3.2</string>
	<key>CFBundleSupportedPlatforms</key>
	<array>
		<string>MacOSX</string>
	</array>
	<key>CFBundleVersion</key>
	<string>9416</string>
	<key>DTCompiler</key>
	<string>com.apple.compilers.llvm.clang.1_0</string>
	<key>DTPlatformBuild</key>
	<string></string>
	<key>DTPlatformName</key>
	<string>macosx</string>
	<key>DTPlatformVersion</key>
	<string>14.0</string>
	<key>DTSDKBuild</key>
	<string>23A334</string>
	<key>DTSDKName</key>
	<string>macosx14.0</string>
	<key>DTXcode</key>
	<string>1501</string>
	<key>DTXcodeBuild</key>
	<string>15A507</string>
	<key>ITSAppUsesNonExemptEncryption</key>
	<false/>
	<key>LSApplicationCategoryType</key>
	<string>public.app-category.utilities</string>
	<key>LSMinimumSystemVersion</key>
	<string>10.13</string>
	<key>LSUIElement</key>
	<true/>
	<key>NSAppleScriptEnabled</key>
	<true/>
	<key>NSBluetoothAlwaysUsageDescription</key>
	<string>To be able to automatically start or stop a Trigger session with a Bluetooth criterion, Amphetamine must be granted access to Bluetooth.</string>
	<key>NSHumanReadableCopyright</key>
	<string>Copyright © 2014 William C. Gustafson. All rights reserved.</string>
	<key>NSLocationAlwaysAndWhenInUseUsageDescription</key>
	<string>To get your WiFi network's name, Amphetamine must be granted access to Location Services.</string>
	<key>NSLocationAlwaysUsageDescription</key>
	<string>To get your WiFi network's name, Amphetamine must be granted access to Location Services.</string>
	<key>NSLocationDefaultAccuracyReduced</key>
	<true/>
	<key>NSLocationWhenInUseUsageDescription</key>
	<string>To get your WiFi network's name, Amphetamine must be granted access to Location Services.</string>
	<key>NSMainNibFile</key>
	<string>MainMenu</string>
	<key>NSPrincipalClass</key>
	<string>NSApplication</string>
	<key>NSSupportsAutomaticGraphicsSwitching</key>
	<true/>
	<key>OSAScriptingDefinition</key>
	<string>Amphetamine.sdef</string>
</dict>
</plist>

[marko-lisica]

@mostlikelee, for some reason, there are 2 versions reported. Fleet collects both the Amphetamine.app bundle and the login helper.

[marko-lisica]

I will add this back to g-security-compliance if you still think it should be software. Please move it back.