Remove Yubikey Manager as a macOS FMA - #50109
Merged
Merged
Conversation
The yubico-yubikey-manager cask was removed from homebrew-cask on 2026-07-28 after being disabled on 2025-07-27 because it is discontinued upstream (replaced by yubico-authenticator). The brew API 404s for the token, so the maintained-apps ingester panics with "app not found in brew API". Freezing the app in #50054 did not help, since fetchCask runs before the frozen flag is applied. Removes the Homebrew input, the darwin output, and the darwin apps.json entry, and retargets the bare /software-catalog/yubico-yubikey-manager redirect to the Windows page so the URL keeps resolving. Also drops the macOS-only "Requires Rosetta 2" sentence from the Windows entry's description. The Windows FMA, shared icon, and website image are kept.
Contributor
Script Diff Resultsee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.jsonError: File 'ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json' does not existee/maintained-apps/outputs/yubico-yubikey-manager/darwin.jsonError: File 'ee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json' does not exist |
Contributor
There was a problem hiding this comment.
Pull request overview
Removes the macOS Fleet-maintained app (FMA) for Yubikey Manager after the upstream Homebrew cask was removed (brew API now 404s), which was causing the scheduled maintained-apps update workflow to panic. Keeps the Windows FMA intact and adjusts the website redirect so the bare catalog URL resolves to the remaining Windows entry.
Changes:
- Deleted the Homebrew input and macOS output JSON for
yubico-yubikey-managerto prevent Homebrew ingestion panics on 404. - Removed the
yubico-yubikey-manager/darwinentry fromapps.jsonand corrected the remaining Windows description to drop the macOS-only Rosetta text. - Retargeted
/software-catalog/yubico-yubikey-managerwebsite redirect from-darwinto-windows.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| website/config/routes.js | Redirects the bare Yubikey Manager catalog route to the Windows identifier (yubico-yubikey-manager-windows). |
| ee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json | Removes the macOS output payload so static-content build/ingestion no longer references a removed Homebrew cask. |
| ee/maintained-apps/outputs/apps.json | Drops the macOS app entry and updates the remaining Windows description. |
| ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json | Removes the Homebrew input definition so the Homebrew ingester no longer attempts to fetch a missing cask. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
2 tasks
fleet-release
approved these changes
Jul 29, 2026
fleet-release
approved these changes
Jul 29, 2026
Contributor
Script Diff Resultsee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.jsonError: File 'ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json' does not existee/maintained-apps/outputs/yubico-yubikey-manager/darwin.jsonError: File 'ee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json' does not exist |
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
WalkthroughRemoved the Homebrew input and macOS output metadata for Yubico YubiKey Manager, including its macOS version and embedded installation scripts. Updated the Windows app description to remove the “Requires Rosetta 2” text while retaining the end-of-life messaging and link. Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
allenhouchins
added a commit
that referenced
this pull request
Jul 29, 2026
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** N/A — found while removing the macOS Yubikey Manager FMA (#50109) Two Windows Fleet-maintained apps describe themselves as macOS software in `ee/maintained-apps/outputs/apps.json`, because the entries were copy-pasted from their macOS counterparts. This copy is customer-facing: it shows in the Fleet UI's software catalog and on `fleetdm.com/software-catalog/<slug>`. - `proxyman/windows` — "Proxyman is a high-performance **macOS** app that enables developers to view HTTP/HTTPS requests and responses." → drops "macOS". (The `proxyman/darwin` description keeps it; it's accurate there.) - `wechat/windows` — name "**WeChat for Mac**" and "**WeChat for Mac** is a free messaging and calling application." → "WeChat". The winget input (`inputs/winget/wechat.json`) already declares `"name": "WeChat"`, so this also makes `apps.json` agree with its own input. The `wechat/darwin` entry keeps "WeChat for Mac", which is the actual macOS product name. Renaming the Windows entry needs a matching icon key. `getMatchedSoftwareIcon` matches on the lowercased app name and requires an exact match or a whole-word prefix (`matchLoosePrefixToKey`: `s === key || s.startsWith(key + " ")`), so the existing `"wechat for mac"` key would **not** match a name of "WeChat" and the app would fall back to the generic package icon. Added a `wechat: Wechat` key alongside it (both point at the same component; the `"wechat for mac"` key stays for macOS and for hosts reporting that name in inventory). No server-side impact: `UpsertMaintainedApp` keys on `slug` and updates `name` in place, and `ReconcileMaintainedAppSoftwareNames` only renames `darwin` titles, so the Windows rename doesn't touch existing software titles. Website icons resolve from the slug (`build-static-content.js` builds `app-icon-<slug>-60x60@2x.png`), not the name, so `app-icon-wechat-60x60@2x.png` is unaffected. Descriptions here mirror upstream cask/winget copy, so these are minimal factual corrections rather than a voice rewrite. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually: - `apps.json` still parses; 1378 apps; verified the four `proxyman`/`wechat` entries read as intended and the `darwin` ones are untouched. - Traced the icon lookup by hand: name "wechat" now hits the new exact-match key; "wechat for mac" still hits the original. - Swept every non-darwin entry in `apps.json` for macOS-only phrasing (`Rosetta`, `macOS`, `Mac`, `Apple`) — these two were the only genuine mismatches. `duo-desktop/windows` (lists macOS, Windows, and Linux) and `imazing-profile-editor/windows` (edits Apple configuration profiles) are correct as written. Note: `node_modules` isn't installed in my working copy, so ESLint/Prettier weren't run locally — the added line is a one-line map entry matching the surrounding style. CI will confirm.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
ee/maintained-apps/outputs/apps.json:9508
- The description includes an HTML link with target="_blank" but no rel="noopener noreferrer". Because app descriptions are rendered unescaped in website/views/pages/docs/app-details.ejs (<%- thisApp.description %>), this can allow reverse-tabnabbing if the link target is compromised.
"description": "YubiKey Manager is an application for configuring any YubiKey. YubiKey Manager won't get security updates or bug fixes. It's End of Life: <a target=\"_blank\" href=\"https://www.yubico.com/support/download/yubikey-manager/\">https://www.yubico.com/support/download/yubikey-manager</a>"
ee/maintained-apps/outputs/apps.json:9508
- PR description says /software-catalog/yubico-yubikey-manager was retargeted from -darwin to -windows to avoid a 404 after removing the macOS FMA, but website/config/routes.js still redirects this path to /software-catalog/yubico-yubikey-manager-darwin (see website/config/routes.js:1139). This will continue to send users to a page that no longer exists once the darwin entry is removed.
"name": "Yubikey Manager",
"slug": "yubico-yubikey-manager/windows",
"platform": "windows",
"unique_identifier": "YubiKey Manager",
"description": "YubiKey Manager is an application for configuring any YubiKey. YubiKey Manager won't get security updates or bug fixes. It's End of Life: <a target=\"_blank\" href=\"https://www.yubico.com/support/download/yubikey-manager/\">https://www.yubico.com/support/download/yubikey-manager</a>"
This was referenced Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue: N/A — fixes the failing scheduled "Update Fleet-maintained apps" workflow
The
yubico-yubikey-managercask was removed from homebrew-cask on 2026-07-28 (Homebrew/homebrew-cask@7ffabaa) after being disabled on 2025-07-27because: :discontinued, replacement_cask: "yubico-authenticator"— Yubico discontinuedyubikey-manager-qt(the 1.2.5 installer this FMA pinned) in favor of Yubico Authenticator. The brew API now returns 404 for the token, so the maintained-apps ingester panics:Freezing the app in #50054 did not resolve this:
fetchCaskruns before thefrozenflag is applied, so the ingester still fetches the cask and fails on the 404. This is the follow-up that PR called out.Removes Yubikey Manager as a macOS Fleet-maintained app, following the same pattern as #50050 (Nocturnal), #46541 (Messenger), and #47420 (Dell Display Manager):
ee/maintained-apps/inputs/homebrew/yubico-yubikey-manager.json— Homebrew inputee/maintained-apps/outputs/yubico-yubikey-manager/darwin.json— macOS output dataee/maintained-apps/outputs/apps.json— theyubico-yubikey-manager/darwinentrywebsite/config/routes.js— the bare/software-catalog/yubico-yubikey-managerredirect pointed at-darwin, which would now 404; retargeted to-windowsThe Windows FMA is unaffected and continues to update, so these are deliberately kept:
ee/maintained-apps/inputs/winget/yubico-yubikey-manager.jsonand its install/uninstall scriptsee/maintained-apps/outputs/yubico-yubikey-manager/windows.jsonyubico-yubikey-manager/windowsentry inapps.jsonfrontend/pages/SoftwarePage/components/icons/YubikeyManager.tsxand its"yubikey manager"mapping inindex.tswebsite/assets/images/app-icon-yubico-yubikey-manager-60x60@2x.pngAlso drops "Requires Rosetta 2." from the Windows entry's description in
apps.json. Rosetta is macOS-only; the sentence was copy-pasted from the macOS entry, and with macOS gone the Windows page is what/software-catalog/yubico-yubikey-managernow resolves to. Descriptions inapps.jsonare hand-maintained —updateAppsListFileincmd/maintained-apps/main.goonly appends entries whose slug it doesn't already find, so it won't overwrite the edit.Checklist for submitter
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Testing
go run ./cmd/maintained-apps -slug yubico-yubikey-manager/darwinexits 0 with no panic and writes no files (before this change, the same run panicked on the brew 404).apps.jsonstill parses and holds 1377 apps; the only remainingyubico-yubikey-managerentry is/windows.yubico-yubikey-manager: remaining hits are the winget input, its two script paths, the windowsapps.jsonentry, and the retargeted website redirect.No automated tests added — this is a data-file removal with no new code paths.
Summary by CodeRabbit