Update Fleet-maintained apps - #50413
Closed
fleet-release wants to merge 1 commit into
Closed
Conversation
Generated automatically with cmd/maintained-apps.
fleet-release
temporarily deployed
to
Docker Hub
August 3, 2026 04:08 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
|
Closing in favor of #50414. |
Contributor
WalkthroughUpdated maintained application manifests. macOS entries now reference revised uninstall scripts that remove additional application data and support files. Firefox Nightly, NetNewsWire, and ocenaudio metadata now target newer releases with updated URLs, version queries, and checksums. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ee/maintained-apps/outputs/dockside/darwin.json`:
- Line 19: Prevent per-user cleanup from running when LOGGED_IN_USER is empty,
root, or loginwindow by validating it immediately after deriving it and before
any trash calls. Apply this guard to the trash invocation flow in
ee/maintained-apps/outputs/dockside/darwin.json:19-19,
ee/maintained-apps/outputs/exifcleaner/darwin.json:20-20,
ee/maintained-apps/outputs/franz/darwin.json:20-20,
ee/maintained-apps/outputs/linearmouse/darwin.json:19-19,
ee/maintained-apps/outputs/safe-exam-browser/darwin.json:19-19,
ee/maintained-apps/outputs/smultron/darwin.json:20-20,
ee/maintained-apps/outputs/stats/darwin.json:19-19,
ee/maintained-apps/outputs/teleport-connect/darwin.json:20-20, and
ee/maintained-apps/outputs/zappy/darwin.json:20-20; otherwise preserve the
existing trash cleanup behavior.
In `@ee/maintained-apps/outputs/ocenaudio/windows.json`:
- Around line 4-12: Update the installer_url in the ocenaudio manifest to use a
versioned or publisher-provided immutable download URL for version 3.20.2,
replacing the generic ocenaudio_windows64.exe endpoint; keep the existing
version and sha256 aligned with that immutable artifact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 42067522-08fe-410a-b80e-9977a0cb0f25
📒 Files selected for processing (12)
ee/maintained-apps/outputs/dockside/darwin.jsonee/maintained-apps/outputs/exifcleaner/darwin.jsonee/maintained-apps/outputs/firefox@nightly/darwin.jsonee/maintained-apps/outputs/franz/darwin.jsonee/maintained-apps/outputs/linearmouse/darwin.jsonee/maintained-apps/outputs/netnewswire/darwin.jsonee/maintained-apps/outputs/ocenaudio/windows.jsonee/maintained-apps/outputs/safe-exam-browser/darwin.jsonee/maintained-apps/outputs/smultron/darwin.jsonee/maintained-apps/outputs/stats/darwin.jsonee/maintained-apps/outputs/teleport-connect/darwin.jsonee/maintained-apps/outputs/zappy/darwin.json
| ], | ||
| "refs": { | ||
| "262fd2cc": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nsudo rm -rf \"$APPDIR/Dockside.app\"\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.hachipoo.Dockside.plist'\n", | ||
| "b1324861": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nsudo rm -rf \"$APPDIR/Dockside.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/8T2DC9NRXS.group.com.hachipoo.Dockside'\ntrash $LOGGED_IN_USER '~/Library/Application Scripts/com.hachipoo.Dockside.Dockside*'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.hachipoo.Dockside'\ntrash $LOGGED_IN_USER '~/Library/Containers/com.hachipoo.Dockside.Dockside*'\ntrash $LOGGED_IN_USER '~/Library/Group Containers/8T2DC9NRXS.group.com.hachipoo.Dockside'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.hachipoo.Dockside'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.hachipoo.Dockside.plist'\n", |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Expect no unquoted LOGGED_IN_USER calls.
if rg -n 'trash \$LOGGED_IN_USER' ee/maintained-apps/outputs; then
echo "Found unquoted LOGGED_IN_USER arguments."
exit 1
fi
# Confirm the corrected form exists.
rg -n 'trash "\$LOGGED_IN_USER"' ee/maintained-apps/outputsRepository: fleetdm/fleet
Length of output: 50370
Handle missing LOGGED_IN_USER before calling trash.
Each of these Darwin uninstall scripts derives LOGGED_IN_USER with awk, then passes it unquoted to trash. When no console user exists, LOGGED_IN_USER becomes empty and the script targets /Users/.Trash or fails before per-user cleanup runs. Add an explicit check before running trash, or handle empty/root/loginwindow cases.
ee/maintained-apps/outputs/dockside/darwin.json#L19-L19ee/maintained-apps/outputs/exifcleaner/darwin.json#L20-L20ee/maintained-apps/outputs/franz/darwin.json#L20-L20ee/maintained-apps/outputs/linearmouse/darwin.json#L19-L19ee/maintained-apps/outputs/safe-exam-browser/darwin.json#L19-L19ee/maintained-apps/outputs/smultron/darwin.json#L20-L20ee/maintained-apps/outputs/stats/darwin.json#L19-L19ee/maintained-apps/outputs/teleport-connect/darwin.json#L20-L20ee/maintained-apps/outputs/zappy/darwin.json#L20-L20
📍 Affects 9 files
ee/maintained-apps/outputs/dockside/darwin.json#L19-L19(this comment)ee/maintained-apps/outputs/exifcleaner/darwin.json#L20-L20ee/maintained-apps/outputs/franz/darwin.json#L20-L20ee/maintained-apps/outputs/linearmouse/darwin.json#L19-L19ee/maintained-apps/outputs/safe-exam-browser/darwin.json#L19-L19ee/maintained-apps/outputs/smultron/darwin.json#L20-L20ee/maintained-apps/outputs/stats/darwin.json#L19-L19ee/maintained-apps/outputs/teleport-connect/darwin.json#L20-L20ee/maintained-apps/outputs/zappy/darwin.json#L20-L20
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/dockside/darwin.json` at line 19, Prevent per-user
cleanup from running when LOGGED_IN_USER is empty, root, or loginwindow by
validating it immediately after deriving it and before any trash calls. Apply
this guard to the trash invocation flow in
ee/maintained-apps/outputs/dockside/darwin.json:19-19,
ee/maintained-apps/outputs/exifcleaner/darwin.json:20-20,
ee/maintained-apps/outputs/franz/darwin.json:20-20,
ee/maintained-apps/outputs/linearmouse/darwin.json:19-19,
ee/maintained-apps/outputs/safe-exam-browser/darwin.json:19-19,
ee/maintained-apps/outputs/smultron/darwin.json:20-20,
ee/maintained-apps/outputs/stats/darwin.json:19-19,
ee/maintained-apps/outputs/teleport-connect/darwin.json:20-20, and
ee/maintained-apps/outputs/zappy/darwin.json:20-20; otherwise preserve the
existing trash cleanup behavior.
Comment on lines
+4
to
+12
| "version": "3.20.2", | ||
| "queries": { | ||
| "exists": "SELECT 1 FROM programs WHERE name = 'ocenaudio' AND publisher = 'Ocenaudio Team';", | ||
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'ocenaudio' AND publisher = 'Ocenaudio Team' AND version_compare(version, '3.20.1') < 0);" | ||
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name = 'ocenaudio' AND publisher = 'Ocenaudio Team' AND version_compare(version, '3.20.2') < 0);" | ||
| }, | ||
| "installer_url": "https://www.ocenaudio.com/downloads/index.php/ocenaudio_windows64.exe", | ||
| "install_script_ref": "ebf8794b", | ||
| "uninstall_script_ref": "7264fb50", | ||
| "sha256": "c9a31c8fd00c8d5e2b0417c1aea105b72bb095a87a4433574805c16bfc98d8be", | ||
| "sha256": "c4322adbce034f9e90a576b353d48ed46056552eaaa76b2703d08da5c4e0e037", |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
manifest="ee/maintained-apps/outputs/ocenaudio/windows.json"
url=$(jq -er '.versions[0].installer_url' "$manifest")
expected=$(jq -er '.versions[0].sha256' "$manifest")
tmp=$(mktemp)
trap 'rm -f "$tmp"' EXIT
effective_url=$(curl -fsSL -o "$tmp" -w '%{url_effective}' "$url")
actual=$(sha256sum "$tmp" | awk '{print $1}')
printf 'effective URL: %s\nexpected SHA-256: %s\nactual SHA-256: %s\n' \
"$effective_url" "$expected" "$actual"
test "$actual" = "$expected"Repository: fleetdm/fleet
Length of output: 199
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
manifest="ee/maintained-apps/outputs/ocenaudio/windows.json"
url="$(jq -er '.versions[0].installer_url' "$manifest")"
expected="$(jq -er '.versions[0].sha256' "$manifest")"
echo "manifest installer_url=$url"
echo "manifest sha256=$expected"
# Show the final redirect URL and SHA-256 without relying on sha256sum.
response="$(curl -fsSL -o /tmp/ocenaudio-installer.exe -w '%{url_effective}' "$url")"
python3 - <<'PY'
import subprocess, pathlib, sys
p = pathlib.Path('/tmp/ocenaudio-installer.exe')
if not p.exists():
print(f"missing downloaded file")
sys.exit(2)
result = subprocess.run(["shasum", "-a", "256", p], text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
print(result.stdout.strip())
PY
redirect_url="$(python3 - <<'PY'
import json, pathlib, re
print(pathlib.Path('/tmp/ocenaudio-installer.exe').read_bytes().decode(errors='replace')[:1] and '')
PY
# not used; curl -w value is enough for redirect)"
actual="$(python3 - <<'PY'
import subprocess
print(subprocess.run(["shasum", "-a", "256", "/tmp/ocenaudio-installer.exe"], text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE).stdout.strip().split()[0])
PY
)"
printf 'effective URL: %s\nexpected SHA-256: %s\nactual SHA-256: %s\n' "$response" "$expected" "$actual"
test "$actual" = "$expected"Repository: fleetdm/fleet
Length of output: 845
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
curl -fsSL -o "$tmp" -w '%{url_effective}\n' 'https://www.ocenaudio.com/downloads/index.php/ocenaudio_windows64.exe'
printf '\nFile bytes: %s\n' "$(wc -c < "$tmp")"
python3 - <<'PY'
import hashlib, pathlib, sys
data = pathlib.Path(sys.argv[1]).read_bytes()
print(hashlib.sha256(data).hexdigest())
PY "$tmp"Repository: fleetdm/fleet
Length of output: 406
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
curl -fsSL -o "$tmp" -w '%{url_effective}\n' 'https://www.ocenaudio.com/downloads/index.php/ocenaudio_windows64.exe'
python3 /dev/stdin <<'PY' "$tmp"
import hashlib, pathlib, sys
path = pathlib.Path(sys.argv[1])
data = path.read_bytes()
print("effective_url", open(sys.stdin.fileno(), encoding="utf-8").read().strip().splitlines()[-2] if open(sys.stdin.fileno(), encoding="utf-8").read().strip() else "")
print("bytes", len(data))
print("sha256", hashlib.sha256(data).hexdigest())
PY
jq -r '.versions[0] | "manifest_url=\(.installer_url)\nmanifest_sha256=\(.sha256)"' ee/maintained-apps/outputs/ocenaudio/windows.jsonRepository: fleetdm/fleet
Length of output: 296
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
curl -fsSL -o "$tmp" -w '%{url_effective}\n' 'https://www.ocenaudio.com/downloads/index.php/ocenaudio_windows64.exe'
python3 - "$tmp" <<'PY'
import hashlib, pathlib, sys
data = pathlib.Path(sys.argv[1]).read_bytes()
print("cached_url=", open("/tmp/coderabbit-shell-logs/shell-output-*.log", encoding="utf-8").read()[:0])
print("bytes", len(data))
print(hashlib.sha256(data).hexdigest())
PYRepository: fleetdm/fleet
Length of output: 398
🌐 Web query:
ocenaudio downloads ocenaudio_windows64.exe sha256 3.20.2
💡 Result:
The SHA256 checksum for the ocenaudio_windows64.exe installer for version 3.20.0 is ADA197609BB284DE1362C0E09628B2B22A2A07D4F22E6D358163D2FF43857870 [1][2]. Please note the following regarding your query: 1. Version Context: Current official download documentation indicates that version 3.20.1 is the latest stable release [3][4], succeeding version 3.20.0 [1]. 2. Availability: The specific SHA256 checksum ADA197609BB284DE1362C0E09628B2B22A2A07D4F22E6D358163D2FF43857870 is associated with the 3.20.0 release of ocenaudio_windows64.exe [1][2]. There is no official public documentation providing a specific SHA256 checksum for version 3.20.2, as it does not appear to be a generally released version as of August 3, 2026. If you are attempting to verify an installer file, ensure you are downloading from the official ocenaudio website to maintain file integrity [5][6].
Citations:
- 1: https://gist.github.com/choco-bot/c56f07dd1ff34b359a1094fd17754645
- 2: https://wapt.tranquil.it/store/en/details/tis-ocenaudio_3.20.0-1_x64_windows_PROD.wapt
- 3: https://www.ocenaudio.com/download?version=v3.11.9
- 4: https://www.ocenaudio.com/download?version=v3.11.8
- 5: https://www.ocenaudio.com/download
- 6: https://www.ocenaudio.com/en/download
Use a versioned or published immutable ocenaudio installer URL.
The manifest pins 3.20.2, but the download URL still uses the generic ocenaudio_windows64.exe endpoint. This endpoint resolves to a release-specific file without a URL version component, so a later upstream replacement would bypass the pinned sha256. Switch to a permanent versioned URL or use a publisher-provided immutable checksumed archive.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/ocenaudio/windows.json` around lines 4 - 12,
Update the installer_url in the ocenaudio manifest to use a versioned or
publisher-provided immutable download URL for version 3.20.2, replacing the
generic ocenaudio_windows64.exe endpoint; keep the existing version and sha256
aligned with that immutable artifact.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated ingestion of latest Fleet-maintained app data.
Summary by CodeRabbit
Updates
Bug Fixes