Skip to content

v0.1.3 - beta 1

Latest
Latest

Choose a tag to compare

View all tags
@headmin headmin released this 04 May 07:23
v0.1.3
3eaa099
This commit was signed with the committer’s verified signature.
headmin Henry Stamerjohann
SSH Key Fingerprint: 556Bdoy+RUMtQwn4RD5m4PX3OSSyWR54OM4MWq6+Tiw
Verified
Learn about vigilant mode.

Highlights

Patch policy support (Fleet 4.84.0)

  • New policy fields: type, fleet_maintained_app_slug, version, install_software (boolean), run_script
  • RequiredFieldsRule now exempts type: patch from the query requirement
  • New PatchPolicyRule couples type: patch ↔ fleet_maintained_app_slug and install_software: true ↔ type: patch

Per-fleet webhook validation

  • Split webhook schema into org and per-fleet variants; vulnerabilities_webhook is correctly rejected under settings.webhook_settings/team_settings.webhook_settings (org-only per Fleet docs)
  • webhooks_and_tickets_enabled now correctly accepted at the policy level (was previously rejected as unknown)

host_vitals labels

  • criteria schema validates vital against the registered Fleet vitals (end_user_idp_group, end_user_idp_department)
  • and/or composites are flagged with Fleet's exact error message ("And/Or criteria not supported in host vitals labels yet")
  • LabelMembershipRule now scans standalone label files (top-level sequence) gated on file path

Default.yml automation guard

  • New PolicyAutomationLocationRule: flags run_script / install_software / calendar_events_enabled on policies in default.yml (these are fleet-only per Fleet docs)

Git hook integration

  • flint check --hook-mode — runs all rules but always exits 0 (non-blocking)
  • flint hooks install [--strict] [--json] [--force] — generates .git/hooks/pre-commit. Modes:
    • default: non-blocking, text output
    • --strict: errors block the commit; --no-verify to bypass
    • --json: structured diagnostics for CI piping
    • --strict --json: blocking + JSON
  • flint hooks uninstall — removes (refuses non-flint hooks)

MDM controls additions

  • apple_require_hardware_attestation (controls)
  • require_all_software_macos, require_all_software_windows, enable_managed_local_account, end_user_local_account_type (setup_experience)
  • agent_options.path for external lib agent options files

Schema correctness

  • Removed labels_include_all from policy schema (per Fleet Go source: policies support only labels_include_any/labels_exclude_any; labels_include_all is for profiles + software)
  • Hover fallback now uses segment-boundary matching (no more false hits like webhook → failing_policies_webhook)
  • Added team/fleet policy fields (renameto pair)

Artifacts

  • flint-0.1.3.pkg — signed and notarized macOS installer (Apple Notary: Accepted)
  • flint-0.1.3-darwin-arm64.tar.gz — signed binary tarball (used by Sublime plugin auto-update)
  • flint-0.1.3-macos-arm64.zip — signed binary zip
  • flint — bare signed binary
  • checksums.txt — SHA256 for the above

Compatibility

macOS Apple Silicon only. Intel macOS is not supported.

Assets 14
Loading