Add Podman Desktop Fleet-maintained app for Windows

[allenhouchins]

Related issue: Resolves #49737

Adds Podman Desktop (RedHat.Podman-Desktop, v1.28.3) as a Windows Fleet-maintained app. It pairs with the existing podman-desktop/darwin FMA under the same catalog name, so the two group together in the FMA library and share the existing icon.

What changed

• ee/maintained-apps/inputs/winget/podman-desktop.json — input manifest (x64, machine scope, exe/NSIS)
• ee/maintained-apps/inputs/winget/scripts/podman-desktop_install.ps1 / _uninstall.ps1 — custom install/uninstall scripts
• ee/maintained-apps/outputs/podman-desktop/windows.json — generated output
• ee/maintained-apps/outputs/apps.json — new Windows catalog entry; also reworded the existing macOS description to the standard "<App> is a(n)…" format for consistency

Identity verification (verified, not guessed)

Podman Desktop ships as an electron-builder NSIS installer, and the winget metadata does not match what osquery sees on a host. I decompressed the NSIS header and traced electron-builder's source to confirm the registry identity:

• DisplayName = Podman Desktop 1.28.3 → unique_identifier: "Podman Desktop" with fuzzy_match_name (matches the version-suffixed name).
• Publisher = Podman Desktop — derived from the package's author.name (COMPANY_NAME → registry Publisher), not the winget locale's RedHat. Using "RedHat" would have made the exists query silently never match on real hosts.
• SHA256 matches the winget manifest exactly; version 1.28.3 equals the registry DisplayVersion, so the patch policy reconciles cleanly.

Silent install uses /S /ALLUSERS; uninstall does a registry lookup with the defensive three-shape UninstallString parser and mirrors /S /ALLUSERS, following the proven another-redis-desktop-manager electron-builder machine-scope pattern.

Reviewer notes

• x64 only. The winget manifest also has an arm64 installer, but the repo has no arm64 FMA inputs yet (x64 is the established convention). A separate arm64 slug can be added later.
• Installer URL is a pinned GitHub release asset (not a "latest" redirect), so the SHA is stable until the FMA auto-updater bumps the version.
• No shared Go code changed — only FMA input/output data.

Checklist for submitter

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

Testing

• Generated the output via go run cmd/maintained-apps/main.go --slug="podman-desktop/windows" --debug; verified exists/patched queries, pinned SHA matches the winget manifest, and apps.json is valid JSON.
• QA'd install/uninstall on a Windows host (will be exercised by the FMA validator).

Summary by CodeRabbit

• New Features
  • Added Podman Desktop to the maintained app catalog for Windows and macOS.
  • Added support for downloading and silently installing Podman Desktop on Windows.
  • Added reliable silent uninstallation, including stopping running app processes.
  • Added version metadata, categories, integrity verification, and app descriptions for Podman Desktop.

[Copilot]

Pull request overview

Adds Podman Desktop as a Windows Fleet-maintained app (FMA) using WinGet metadata and custom PowerShell install/uninstall scripts, plus generated outputs and catalog updates so it appears in the FMA library alongside the existing macOS entry.

Changes:

• Added WinGet input manifest for podman-desktop/windows (x64, machine-scope, exe/NSIS) and custom install/uninstall scripts.
• Added generated Windows output JSON (queries, pinned installer URL, SHA256, embedded script refs).
• Updated the global app catalog (apps.json) to include the Windows entry and standardized the existing macOS description wording.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
ee/maintained-apps/outputs/podman-desktop/windows.json	Generated Windows FMA output with queries, pinned installer URL, SHA256, and script refs.
ee/maintained-apps/outputs/apps.json	Adds the Windows Podman Desktop catalog entry and rewords the macOS description for consistency.
ee/maintained-apps/inputs/winget/scripts/podman-desktop_uninstall.ps1	Custom uninstall script that locates the ARP entry and runs the uninstaller silently for all users.
ee/maintained-apps/inputs/winget/scripts/podman-desktop_install.ps1	Custom install script running the NSIS installer silently with all-users scope.
ee/maintained-apps/inputs/winget/podman-desktop.json	WinGet input manifest defining identity (unique_identifier/publisher) and script paths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8e547ef1-7290-4231-9990-46543077b067

📥 Commits

Reviewing files that changed from the base of the PR and between 1a1b6e7 and 53ea8a0.

📒 Files selected for processing (5)

• ee/maintained-apps/inputs/winget/podman-desktop.json
• ee/maintained-apps/inputs/winget/scripts/podman-desktop_install.ps1
• ee/maintained-apps/inputs/winget/scripts/podman-desktop_uninstall.ps1
• ee/maintained-apps/outputs/apps.json
• ee/maintained-apps/outputs/podman-desktop/windows.json

---

Walkthrough

Adds Podman Desktop as a maintained Windows application using Winget metadata and version 1.28.3 package details. Introduces silent, machine-scope PowerShell installation and registry-based uninstallation scripts with exit-code handling. Registers the Windows app in the application catalog and embeds the installation and uninstallation script references in the maintained-app output.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 49737-new-fma-podman-for-windows

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

ee/maintained-apps/inputs/winget/podman-desktop.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

ee/maintained-apps/outputs/apps.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

ee/maintained-apps/outputs/podman-desktop/windows.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}