Skip to content

Initial changes for returning x509 cert instead of PKCS7 envelope#44541

Draft
JordanMontgomery wants to merge 2 commits intomainfrom
JM-44533
Draft

Initial changes for returning x509 cert instead of PKCS7 envelope#44541
JordanMontgomery wants to merge 2 commits intomainfrom
JM-44533

Conversation

@JordanMontgomery
Copy link
Copy Markdown
Member

Related issue: Resolves #

Checklist for submitter

If some of the following don't apply, delete the relevant line.

  • Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
    See Changes files for more information.

  • Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

  • Timeouts are implemented and retries are limited to avoid infinite loops

  • If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

For unreleased bug fixes in a release candidate, one of:

  • Confirmed that the fix is not expected to adversely impact load test results
  • Alerted the release DRI if additional load testing is needed

Database migrations

  • Checked schema for all modified table for columns that will auto-update timestamps during migration.
  • Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects.
  • Ensured the correct collation is explicitly set for character columns (COLLATE utf8mb4_unicode_ci).

New Fleet configuration settings

  • Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for GitOps-enabled settings:

  • Verified that the setting is exported via fleetctl generate-gitops
  • Verified the setting is documented in a separate PR to the GitOps documentation
  • Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional)
  • Verified that any relevant UI is disabled when GitOps mode is enabled

fleetd/orbit/Fleet Desktop

  • Verified compatibility with the latest released version of Fleet (see Must rule)
  • If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
  • Verified that fleetd runs on macOS, Linux and Windows
  • Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

@qodo-free-for-open-source-projects
Copy link
Copy Markdown

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: test-go (fleetctl, mysql:8.0.44) / test

Failed stage: Run Go Tests [❌]

Failed test name: TestIntegrationsVulnerabilityDataStream

Failure summary:

The action failed because the Go integration test cmd/fleetctl/integrationtest/vuln
TestIntegrationsVulnerabilityDataStream failed.
The test depends on downloading Ubuntu OVAL
vulnerability definitions from Canonical, but the network/download step was unsuccessful:
- Requests
to https://security-metadata.canonical.com/oval/com.ubuntu.focal.usn.oval.xml.bz2 timed out (dial
tcp ...:443: i/o timeout).
- Requests to
https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2 repeatedly
returned HTTP 503.
This resulted in Error downloading Oval definitions at
cmd/fleetctl/integrationtest/vuln/vulnerability_data_stream_test.go:44, causing make test-go to exit
non-zero (make[1]: *** [Makefile:278: .run-go-tests] Error 1, make: *** [Makefile:393: test-go]
Error 2).

Relevant error logs:
1:  ##[group]Runner Image Provisioner
2:  Hosted Compute Agent
...

1654:  �[36;1mattempt=1�[0m
1655:  �[36;1m�[0m
1656:  �[36;1mwhile [ $attempt -le $max_attempts ]; do�[0m
1657:  �[36;1m  echo "Attempt $attempt of $max_attempts"�[0m
1658:  �[36;1m�[0m
1659:  �[36;1m  # Try to connect to MySQL�[0m
1660:  �[36;1m  if wait_for_mysql "mysql_test"; then�[0m
1661:  �[36;1m    # If MySQL is ready, try to connect to MySQL replica�[0m
1662:  �[36;1m    if wait_for_mysql "mysql_replica_test"; then�[0m
1663:  �[36;1m      # Both are ready, we're done�[0m
1664:  �[36;1m      echo "All MySQL connections successful"�[0m
1665:  �[36;1m      exit 0�[0m
1666:  �[36;1m    fi�[0m
1667:  �[36;1m  fi�[0m
1668:  �[36;1m�[0m
1669:  �[36;1m  # If we get here, at least one connection failed�[0m
1670:  �[36;1m  echo "Failed to connect to MySQL on attempt $attempt"�[0m
1671:  �[36;1m�[0m
1672:  �[36;1m  if [ $attempt -lt $max_attempts ]; then�[0m
1673:  �[36;1m    echo "Restarting containers and trying again..."�[0m
1674:  �[36;1m    restart_containers�[0m
1675:  �[36;1m  else�[0m
1676:  �[36;1m    echo "Maximum attempts reached. Failing the job."�[0m
1677:  �[36;1m    exit 1�[0m
...

1748:  gotestsum --format=testdox --jsonfile=/tmp/test-output.json -- -tags full,fts5,netgo -run=  -v -race=false -timeout=20m  -parallel 8 -coverprofile=coverage.txt -covermode=atomic -coverpkg=github.com/fleetdm/fleet/v4/... ././cmd/fleetctl/... 
1749:  go: downloading github.com/stretchr/testify v1.11.1
1750:  go: downloading github.com/urfave/cli/v2 v2.27.7
1751:  go: downloading github.com/AbGuthrie/goquery/v2 v2.0.1
1752:  go: downloading github.com/go-git/go-git/v5 v5.18.0
1753:  go: downloading github.com/beevik/etree v1.6.0
1754:  go: downloading github.com/briandowns/spinner v1.23.1
1755:  go: downloading github.com/google/go-github/v37 v37.0.0
1756:  go: downloading github.com/gosuri/uilive v0.0.4
1757:  go: downloading github.com/manifoldco/promptui v0.9.0
1758:  go: downloading github.com/mitchellh/go-ps v1.0.0
1759:  go: downloading github.com/olekukonko/tablewriter v0.0.5
1760:  go: downloading github.com/sethvargo/go-password v0.3.0
1761:  go: downloading github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
1762:  go: downloading github.com/patrickmn/go-cache v2.1.0+incompatible
1763:  go: downloading github.com/hashicorp/go-multierror v1.1.1
1764:  go: downloading github.com/VividCortex/mysqlerr v0.0.0-20170204212430-6c6b55f8796f
...

2013:  �[32m✓�[0m Apply specs deprecated keys app config windows updates.grace period days not a number (0.47s)
2014:  �[32m✓�[0m Apply specs deprecated keys app config windows updates.grace period days out of range (0.57s)
2015:  �[32m✓�[0m Apply specs deprecated keys config with FIM values for agent options (#869 9) (0.49s)
2016:  �[32m✓�[0m Apply specs deprecated keys config with blank required org name (0.52s)
2017:  �[32m✓�[0m Apply specs deprecated keys config with blank required server url (0.47s)
2018:  �[32m✓�[0m Apply specs deprecated keys config with invalid agent options command-line flags (0.50s)
2019:  �[32m✓�[0m Apply specs deprecated keys config with invalid agent options data type in dry-run (0.50s)
2020:  �[32m✓�[0m Apply specs deprecated keys config with invalid agent options data type with force (0.51s)
2021:  �[32m✓�[0m Apply specs deprecated keys config with invalid agent options in dry-run (0.58s)
2022:  �[32m✓�[0m Apply specs deprecated keys config with invalid key type (0.78s)
2023:  �[32m✓�[0m Apply specs deprecated keys config with invalid value for agent options command-line flags (0.45s)
2024:  �[32m✓�[0m Apply specs deprecated keys config with unknown key (0.55s)
2025:  �[32m✓�[0m Apply specs deprecated keys config with valid agent options command-line flags (1.01s)
2026:  �[32m✓�[0m Apply specs deprecated keys dry-run set with unsupported spec (0.52s)
2027:  �[32m✓�[0m Apply specs deprecated keys dry-run set with various specs, appconfig warning for legacy (0.62s)
2028:  �[32m✓�[0m Apply specs deprecated keys dry-run set with various specs, no errors (0.47s)
2029:  �[32m✓�[0m Apply specs deprecated keys empty config (0.66s)
...

2032:  �[32m✓�[0m Apply specs deprecated keys invalid agent options dry-run (0.57s)
2033:  �[32m✓�[0m Apply specs deprecated keys invalid agent options field type (0.59s)
2034:  �[32m✓�[0m Apply specs deprecated keys invalid agent options field type in overrides (0.83s)
2035:  �[32m✓�[0m Apply specs deprecated keys invalid agent options for existing team (0.90s)
2036:  �[32m✓�[0m Apply specs deprecated keys invalid agent options for new team (0.36s)
2037:  �[32m✓�[0m Apply specs deprecated keys invalid agent options force (0.41s)
2038:  �[32m✓�[0m Apply specs deprecated keys invalid known key's value type for team cannot be forced (0.80s)
2039:  �[32m✓�[0m Apply specs deprecated keys invalid team agent options command-line flag (0.47s)
2040:  �[32m✓�[0m Apply specs deprecated keys invalid top-level key for team (0.66s)
2041:  �[32m✓�[0m Apply specs deprecated keys macos updates deadline set but minimum version empty (0.37s)
2042:  �[32m✓�[0m Apply specs deprecated keys macos updates minimum version set but deadline empty (0.59s)
2043:  �[32m✓�[0m Apply specs deprecated keys macos updates.deadline with incomplete date (0.53s)
2044:  �[32m✓�[0m Apply specs deprecated keys macos updates.deadline with invalid date (0.70s)
2045:  �[32m✓�[0m Apply specs deprecated keys macos updates.deadline with timestamp (0.53s)
2046:  �[32m✓�[0m Apply specs deprecated keys macos updates.minimum version with build version (0.52s)
2047:  �[32m✓�[0m Apply specs deprecated keys missing required failing policies destination url (0.38s)
2048:  �[32m✓�[0m Apply specs deprecated keys missing required host status days count (0.42s)
...

2056:  �[32m✓�[0m Apply specs deprecated keys team config macos settings.enable disk encryption true (0.44s)
2057:  �[32m✓�[0m Apply specs deprecated keys team config macos settings.enable disk encryption with invalid value type (0.49s)
2058:  �[32m✓�[0m Apply specs deprecated keys team config macos settings.enable disk encryption without a value (0.49s)
2059:  �[32m✓�[0m Apply specs deprecated keys unknown key for team can be forced (0.42s)
2060:  �[32m✓�[0m Apply specs deprecated keys valid team agent options command-line flag (0.41s)
2061:  �[32m✓�[0m Apply specs deprecated keys windows updates unset valid (0.46s)
2062:  �[32m✓�[0m Apply specs deprecated keys windows updates valid (0.45s)
2063:  �[32m✓�[0m Apply specs deprecated keys windows updates.deadline days but grace period empty (0.46s)
2064:  �[32m✓�[0m Apply specs deprecated keys windows updates.deadline days not a number (0.60s)
2065:  �[32m✓�[0m Apply specs deprecated keys windows updates.deadline days out of range (0.55s)
2066:  �[32m✓�[0m Apply specs deprecated keys windows updates.grace period days but deadline empty (0.62s)
2067:  �[32m✓�[0m Apply specs deprecated keys windows updates.grace period days not a number (0.43s)
2068:  �[32m✓�[0m Apply specs deprecated keys windows updates.grace period days out of range (0.40s)
2069:  �[32m✓�[0m Apply specs dry-run set with unsupported spec (0.44s)
2070:  �[32m✓�[0m Apply specs dry-run set with various specs, appconfig warning for legacy (0.38s)
2071:  �[32m✓�[0m Apply specs dry-run set with various specs, no errors (0.51s)
2072:  �[32m✓�[0m Apply specs empty config (0.35s)
...

2075:  �[32m✓�[0m Apply specs invalid agent options dry-run (0.55s)
2076:  �[32m✓�[0m Apply specs invalid agent options field type (0.58s)
2077:  �[32m✓�[0m Apply specs invalid agent options field type in overrides (0.46s)
2078:  �[32m✓�[0m Apply specs invalid agent options for existing team (0.41s)
2079:  �[32m✓�[0m Apply specs invalid agent options for new team (0.41s)
2080:  �[32m✓�[0m Apply specs invalid agent options force (0.47s)
2081:  �[32m✓�[0m Apply specs invalid known key's value type for team cannot be forced (0.46s)
2082:  �[32m✓�[0m Apply specs invalid team agent options command-line flag (0.38s)
2083:  �[32m✓�[0m Apply specs invalid top-level key for team (0.41s)
2084:  �[32m✓�[0m Apply specs macos updates deadline set but minimum version empty (0.53s)
2085:  �[32m✓�[0m Apply specs macos updates minimum version set but deadline empty (0.40s)
2086:  �[32m✓�[0m Apply specs macos updates.deadline with incomplete date (0.46s)
2087:  �[32m✓�[0m Apply specs macos updates.deadline with invalid date (0.49s)
2088:  �[32m✓�[0m Apply specs macos updates.deadline with timestamp (0.47s)
2089:  �[32m✓�[0m Apply specs macos updates.minimum version with build version (0.54s)
2090:  �[32m✓�[0m Apply specs missing required failing policies destination url (0.43s)
2091:  �[32m✓�[0m Apply specs missing required host status days count (0.44s)
...

2177:  �[32m✓�[0m Filename functions (0.00s)
2178:  �[32m✓�[0m Filename functions outfile name builds a file name using the name provided + current time (0.00s)
2179:  �[32m✓�[0m Filename functions outfile name with ext builds a file name using the name and extension provided + current time (0.00s)
2180:  �[32m✓�[0m FleetctlUpgradePacks empty packs (0.39s)
2181:  �[32m✓�[0m FleetctlUpgradePacks no pack (0.37s)
2182:  �[32m✓�[0m FleetctlUpgradePacks non empty (0.48s)
2183:  �[32m✓�[0m FleetctlUpgradePacks not admin (0.48s)
2184:  �[32m✓�[0m Format XML (0.00s)
2185:  �[32m✓�[0m Format XML XML with attributes (0.00s)
2186:  �[32m✓�[0m Format XML basic XML (0.00s)
2187:  �[32m✓�[0m Format XML empty XML (0.00s)
2188:  �[32m✓�[0m Format XML invalid XML (0.00s)
2189:  �[32m✓�[0m Format XML nested XML (0.00s)
2190:  �[32m✓�[0m Generate MDM apple (0.89s)
2191:  �[32m✓�[0m Generate MDM apple BM (0.47s)
2192:  �[32m✓�[0m Generate MDM apple CSR API call fails (0.36s)
2193:  �[32m✓�[0m Generate MDM apple successful run (0.53s)
2194:  �[32m✓�[0m Generate MDMVPP tokens (0.00s)
2195:  �[32m✓�[0m Generate MDMVPP tokens get VPP tokens error (0.00s)
2196:  �[32m✓�[0m Generate MDMVPP tokens multiple tokens with different teams (0.00s)
...

2208:  �[32m✓�[0m Generate org settings insecure (0.00s)
2209:  �[32m✓�[0m Generate org settings masked google calendar api key (0.00s)
2210:  �[32m✓�[0m Generate policies (0.00s)
2211:  �[32m✓�[0m Generate queries (0.00s)
2212:  �[32m✓�[0m Generate software (0.00s)
2213:  �[32m✓�[0m Generate software auto update schedule (0.00s)
2214:  �[32m✓�[0m Generate software script packages (0.00s)
2215:  �[32m✓�[0m Generate team settings (0.00s)
2216:  �[32m✓�[0m Generate team settings insecure (0.00s)
2217:  �[32m✓�[0m Generated org settings no SSO (0.00s)
2218:  �[32m✓�[0m Generated org settings okta conditional access not included (0.00s)
2219:  �[32m✓�[0m Get MDM command results (0.48s)
2220:  �[32m✓�[0m Get MDM command results command flag required (0.00s)
2221:  �[32m✓�[0m Get MDM command results command not found (0.01s)
2222:  �[32m✓�[0m Get MDM command results command results empty (0.01s)
2223:  �[32m✓�[0m Get MDM command results command results error (0.01s)
2224:  �[32m✓�[0m Get MDM command results darwin command results (0.00s)
2225:  �[32m✓�[0m Get MDM command results host specific results (0.00s)
2226:  �[32m✓�[0m Get MDM command results windows command results (0.00s)
2227:  �[32m✓�[0m Get MDM commands (0.58s)
2228:  �[32m✓�[0m Get apple BM (1.77s)
2229:  �[32m✓�[0m Get apple BM free license (0.39s)
2230:  �[32m✓�[0m Get apple BM premium license, multiple tokens (0.35s)
2231:  �[32m✓�[0m Get apple BM premium license, no token (0.49s)
2232:  �[32m✓�[0m Get apple BM premium license, single token (0.54s)
2233:  �[32m✓�[0m Get apple MDM (0.37s)
2234:  �[32m✓�[0m Get carve (0.42s)
2235:  �[32m✓�[0m Get carve with error (0.36s)
2236:  �[32m✓�[0m Get carves (0.37s)
...

2262:  �[32m✓�[0m Get queries as observer (0.44s)
2263:  �[32m✓�[0m Get queries as observer global observer (0.01s)
2264:  �[32m✓�[0m Get queries as observer observer of multiple teams (0.01s)
2265:  �[32m✓�[0m Get queries as observer team observer (0.01s)
2266:  �[32m✓�[0m Get query (0.59s)
2267:  �[32m✓�[0m Get software titles (0.42s)
2268:  �[32m✓�[0m Get software versions (0.48s)
2269:  �[32m✓�[0m Get teams (0.86s)
2270:  �[32m✓�[0m Get teams YAML and apply (0.59s)
2271:  �[32m✓�[0m Get teams by name (0.40s)
2272:  �[32m✓�[0m Get teams expired license (0.48s)
2273:  �[32m✓�[0m Get teams not expired license (0.37s)
2274:  �[32m✓�[0m Get user roles (0.49s)
2275:  �[32m✓�[0m Git ops ABM (5.81s)
2276:  �[32m✓�[0m Git ops ABM backwards compat (0.55s)
2277:  �[32m✓�[0m Git ops ABM both keys errors (0.47s)
2278:  �[32m✓�[0m Git ops ABM deprecated config with two tokens in the db fails (0.65s)
2279:  �[32m✓�[0m Git ops ABM new key all valid (0.61s)
2280:  �[32m✓�[0m Git ops ABM new key multiple elements (0.59s)
2281:  �[32m✓�[0m Git ops ABM no team is supported (0.46s)
2282:  �[32m✓�[0m Git ops ABM non existent org name fails (0.72s)
2283:  �[32m✓�[0m Git ops ABM not provided teams defaults to no team (0.45s)
2284:  �[32m✓�[0m Git ops ABM renamed new key all valid (0.68s)
2285:  �[32m✓�[0m Git ops ABM using an undefined team errors (0.63s)
2286:  �[32m✓�[0m Git ops EULA setting (4.85s)
...

2289:  �[32m✓�[0m Git ops EULA setting not a PDF file (0.59s)
2290:  �[32m✓�[0m Git ops EULA setting relative path to working dir to pdf file (no existing EULA uploaded) (0.61s)
2291:  �[32m✓�[0m Git ops EULA setting relative path to yaml file to pdf file (no existing EULA uploaded) (0.62s)
2292:  �[32m✓�[0m Git ops EULA setting uploading the same EULA again (0.60s)
2293:  �[32m✓�[0m Git ops EULA setting valid new pdf file (different EULA already uploaded) (0.57s)
2294:  �[32m✓�[0m Git ops EULA setting valid pdf file (no existing EULA uploaded) (0.50s)
2295:  �[32m✓�[0m Git ops MDM auth settings (0.57s)
2296:  �[32m✓�[0m Git ops SMTP settings (0.60s)
2297:  �[32m✓�[0m Git ops SSO server URL (0.61s)
2298:  �[32m✓�[0m Git ops SSO settings (0.57s)
2299:  �[32m✓�[0m Git ops android certificates add (0.59s)
2300:  �[32m✓�[0m Git ops android certificates change (0.83s)
2301:  �[32m✓�[0m Git ops android certificates delete all (0.80s)
2302:  �[32m✓�[0m Git ops android certificates delete one (0.55s)
2303:  �[32m✓�[0m Git ops app store app auto update (0.48s)
2304:  �[32m✓�[0m Git ops app store app auto update invalid auto-update window triggers error and does not call update software title auto update config (0.01s)
2305:  �[32m✓�[0m Git ops app store app auto update no auto update settings and no existing schedule does not call update software title auto update config (0.01s)
...

2308:  �[32m✓�[0m Git ops apple OS updates (0.84s)
2309:  �[32m✓�[0m Git ops apple OS updates ios updates (0.07s)
2310:  �[32m✓�[0m Git ops apple OS updates ios updates changed deadline triggers bulk set pending MDM host profiles (0.02s)
2311:  �[32m✓�[0m Git ops apple OS updates ios updates changed minimum version triggers bulk set pending MDM host profiles (0.03s)
2312:  �[32m✓�[0m Git ops apple OS updates ios updates same values do not trigger bulk set pending MDM host profiles (0.02s)
2313:  �[32m✓�[0m Git ops apple OS updates ipados updates (0.06s)
2314:  �[32m✓�[0m Git ops apple OS updates ipados updates changed deadline triggers bulk set pending MDM host profiles (0.02s)
2315:  �[32m✓�[0m Git ops apple OS updates ipados updates changed minimum version triggers bulk set pending MDM host profiles (0.02s)
2316:  �[32m✓�[0m Git ops apple OS updates ipados updates same values do not trigger bulk set pending MDM host profiles (0.02s)
2317:  �[32m✓�[0m Git ops apple OS updates macos updates (0.08s)
2318:  �[32m✓�[0m Git ops apple OS updates macos updates changed deadline triggers bulk set pending MDM host profiles (0.04s)
2319:  �[32m✓�[0m Git ops apple OS updates macos updates changed minimum version triggers bulk set pending MDM host profiles (0.02s)
2320:  �[32m✓�[0m Git ops apple OS updates macos updates same values do not trigger bulk set pending MDM host profiles (0.03s)
2321:  �[32m✓�[0m Git ops basic global and no team (0.63s)
2322:  �[32m✓�[0m Git ops basic global and no team basic global and no-team.yml (0.06s)
2323:  �[32m✓�[0m Git ops basic global and no team both global and no-team.yml define controls -- should fail (0.01s)
2324:  �[32m✓�[0m Git ops basic global and no team controls only defined in no-team.yml (0.05s)
2325:  �[32m✓�[0m Git ops basic global and no team global DOES NOT define controls -- should fail (0.01s)
2326:  �[32m✓�[0m Git ops basic global and no team global and no-team.yml DO NOT define controls -- should fail (0.02s)
2327:  �[32m✓�[0m Git ops basic global and no team global defines software -- should fail (0.01s)
2328:  �[32m✓�[0m Git ops basic global and no team no-team provided without global -- should fail (0.01s)
2329:  �[32m✓�[0m Git ops basic global and no team no-team.yml defines policy with calendar events enabled -- should fail (0.01s)
2330:  �[32m✓�[0m Git ops basic global and no team unassigned provided without global -- should fail (0.01s)
2331:  �[32m✓�[0m Git ops basic global and team (0.63s)
...

2336:  �[32m✓�[0m Git ops custom settings global macos custom settings valid deprecated.yml (0.59s)
2337:  �[32m✓�[0m Git ops custom settings global macos windows custom settings valid.yml (0.84s)
2338:  �[32m✓�[0m Git ops custom settings global windows custom settings invalid label mix 2 .yml (0.42s)
2339:  �[32m✓�[0m Git ops custom settings global windows custom settings invalid label mix.yml (0.52s)
2340:  �[32m✓�[0m Git ops custom settings global windows custom settings unknown label.yml (0.48s)
2341:  �[32m✓�[0m Git ops custom settings team macos custom settings valid deprecated.yml (0.63s)
2342:  �[32m✓�[0m Git ops custom settings team macos windows custom settings invalid labels mix 2 .yml (0.65s)
2343:  �[32m✓�[0m Git ops custom settings team macos windows custom settings invalid labels mix.yml (0.47s)
2344:  �[32m✓�[0m Git ops custom settings team macos windows custom settings unknown label.yml (0.59s)
2345:  �[32m✓�[0m Git ops custom settings team macos windows custom settings valid.yml (0.53s)
2346:  �[32m✓�[0m Git ops exception enforcement (0.43s)
2347:  �[32m✓�[0m Git ops exception enforcement free tier (0.52s)
2348:  �[32m✓�[0m Git ops exceptions preserve omitted keys (0.54s)
2349:  �[32m✓�[0m Git ops features (0.52s)
2350:  �[32m✓�[0m Git ops filename validation (0.00s)
2351:  �[32m✓�[0m Git ops fleet failing policies webhook policy IDs (0.57s)
2352:  �[32m✓�[0m Git ops fleet webhooks and tickets enabled (0.58s)
...

2507:  �[32m✓�[0m Run api command get scripts full path missing (0.00s)
2508:  �[32m✓�[0m Run api command get scripts team (0.00s)
2509:  �[32m✓�[0m Run api command get scripts team no cache (0.00s)
2510:  �[32m✓�[0m Run api command get typo (0.00s)
2511:  �[32m✓�[0m Run api command upload script (0.00s)
2512:  �[32m✓�[0m Run script command (0.60s)
2513:  �[32m✓�[0m Run script command disabled scripts globally (0.00s)
2514:  �[32m✓�[0m Run script command host not found (0.01s)
2515:  �[32m✓�[0m Run script command invalid file type (0.00s)
2516:  �[32m✓�[0m Run script command invalid hashbang (0.00s)
2517:  �[32m✓�[0m Run script command invalid utf 8 (0.00s)
2518:  �[32m✓�[0m Run script command missing one of script-path and script-nqme (0.00s)
2519:  �[32m✓�[0m Run script command output truncated (0.01s)
2520:  �[32m✓�[0m Run script command posix shell hashbang (0.01s)
2521:  �[32m✓�[0m Run script command script empty (0.00s)
2522:  �[32m✓�[0m Run script command script failed (0.01s)
2523:  �[32m✓�[0m Run script command script killed (0.01s)
...

2559:  �[32m✓�[0m User create force password reset (0.47s)
2560:  �[32m✓�[0m User delete (0.49s)
2561:  �[32m✓�[0m User is observer (0.00s)
2562:  �[32m✓�[0m User is observer global maintainer (0.00s)
2563:  �[32m✓�[0m User is observer global observer (0.00s)
2564:  �[32m✓�[0m User is observer global observer+ (0.00s)
2565:  �[32m✓�[0m User is observer team maintainer (0.00s)
2566:  �[32m✓�[0m User is observer team observer (0.00s)
2567:  �[32m✓�[0m User is observer team observer and maintainer (0.00s)
2568:  �[32m✓�[0m User is observer team observer+ (0.00s)
2569:  �[32m✓�[0m User is observer user without roles (0.00s)
2570:  github.com/fleetdm/fleet/v4/cmd/fleetctl/integrationtest/vuln:
2571:  �[31m✖�[0m Integrations vulnerability data stream (406.59s)
2572:  github.com/fleetdm/fleet/v4/cmd/fleetctl/integrationtest/preview:
2573:  �[32m✓�[0m Integrations preview (469.28s)
2574:  �[32m✓�[0m Preview fails on invalid license key (0.00s)
2575:  github.com/fleetdm/fleet/v4/cmd/fleetctl/integrationtest/gitops:
2576:  �[32m✓�[0m Git ops VPP (4.52s)
2577:  �[32m✓�[0m Git ops VPP all teams is supported (0.64s)
2578:  �[32m✓�[0m Git ops VPP new key all valid (0.70s)
2579:  �[32m✓�[0m Git ops VPP new key multiple elements (0.69s)
2580:  �[32m✓�[0m Git ops VPP no team is supported (0.73s)
2581:  �[32m✓�[0m Git ops VPP non existent location fails (0.54s)
2582:  �[32m✓�[0m Git ops VPP not provided teams defaults to no team (0.66s)
2583:  �[32m✓�[0m Git ops VPP using an undefined team errors (0.55s)
2584:  �[32m✓�[0m Git ops existing team VPP apps with missing team (0.62s)
...

2664:  �[32m✓�[0m Git ops team software installers team software installer with display name.yml (1.54s)
2665:  �[32m✓�[0m Integrations enterprise gitops (292.41s)
2666:  �[32m✓�[0m Integrations enterprise gitops test CA integrations (5.50s)
2667:  �[32m✓�[0m Integrations enterprise gitops test FMA labels include all (7.32s)
2668:  �[32m✓�[0m Integrations enterprise gitops test IPA software installers (11.25s)
2669:  �[32m✓�[0m Integrations enterprise gitops test JSON configuration profile escaping (1.48s)
2670:  �[32m✓�[0m Integrations enterprise gitops test add manual labels (2.01s)
2671:  �[32m✓�[0m Integrations enterprise gitops test configuration profile escaping (0.72s)
2672:  �[32m✓�[0m Integrations enterprise gitops test delete CA with certificate templates (7.34s)
2673:  �[32m✓�[0m Integrations enterprise gitops test delete mac OS setup (6.31s)
2674:  �[32m✓�[0m Integrations enterprise gitops test deleting no team YAML (3.30s)
2675:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience (125.23s)
2676:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience all VPP with setup experience (1.53s)
2677:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience no team VPP (1.33s)
2678:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience no team installers (61.01s)
2679:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience packages fail (61.16s)
2680:  �[32m✓�[0m Integrations enterprise gitops test env substitution in profiles (1.65s)
...

2701:  �[32m✓�[0m Integrations enterprise gitops test omitted top level keys global (2.88s)
2702:  �[32m✓�[0m Integrations enterprise gitops test remove custom settings from default YAML (3.10s)
2703:  �[32m✓�[0m Integrations enterprise gitops test special case teams VPP apps (4.56s)
2704:  �[32m✓�[0m Integrations enterprise gitops test special case teams VPP apps all teams (2.85s)
2705:  �[32m✓�[0m Integrations enterprise gitops test special case teams VPP apps no team (1.52s)
2706:  �[32m✓�[0m Integrations enterprise gitops test unset configuration profile labels (5.85s)
2707:  �[32m✓�[0m Integrations enterprise gitops test unset software installer labels (9.83s)
2708:  �[32m✓�[0m Integrations enterprise starter library (5.25s)
2709:  �[32m✓�[0m Integrations enterprise starter library test apply starter library premium (3.85s)
2710:  �[32m✓�[0m Integrations gitops (2.63s)
2711:  �[32m✓�[0m Integrations gitops test fleet gitops (0.61s)
2712:  �[32m✓�[0m Integrations gitops test fleet gitops DDM fleet vars requires premium (0.18s)
2713:  �[32m✓�[0m Integrations gitops test fleet gitops with fleet secrets (0.46s)
2714:  �[32m✓�[0m Integrations starter library (1.65s)
2715:  �[32m✓�[0m Integrations starter library test apply starter library free (0.30s)
2716:  === �[31mFailed�[0m
2717:  === �[31mFAIL�[0m: cmd/fleetctl/integrationtest/vuln TestIntegrationsVulnerabilityDataStream (406.59s)
2718:  nettest.go:33: network test start: TestIntegrationsVulnerabilityDataStream
2719:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.focal.usn.oval.xml.bz2: do request: Get "https://security-metadata.canonical.com/oval/com.ubuntu.focal.usn.oval.xml.bz2": dial tcp 185.125.190.46:443: i/o timeout. Retrying in 716.655675ms
2720:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 462.865251ms
2721:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 644.670288ms
2722:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 1.593272606s
2723:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 997.709594ms
2724:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 3.263172903s
2725:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 1.965128129s
2726:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 8.498255123s
2727:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 11.838854334s
2728:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 7.130020412s
2729:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 23.453955759s
2730:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 28.211875096s
2731:  Download failed on https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: unexpected status code 503. Retrying in 24.309187086s
2732:  vulnerability_data_stream_test.go:44: 
2733:  Error Trace:	/home/runner/work/fleet/fleet/cmd/fleetctl/integrationtest/vuln/vulnerability_data_stream_test.go:44
2734:  Error:      	Received unexpected error:
2735:  Error downloading Oval definitions: downloadDefinitions: download and extract url https://security-metadata.canonical.com/oval/com.ubuntu.oracular.usn.oval.xml.bz2: download and write file: unexpected status code 503
2736:  Test:       	TestIntegrationsVulnerabilityDataStream
2737:  nettest.go:36: network test done: TestIntegrationsVulnerabilityDataStream
2738:  DONE 806 tests, 1 failure in 624.360s
2739:  make[1]: *** [Makefile:278: .run-go-tests] Error 1
2740:  make[1]: Leaving directory '/home/runner/work/fleet/fleet'
2741:  make: *** [Makefile:393: test-go] Error 2
2742:  ##[error]Process completed with exit code 2.
2743:  ##[group]Run actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a
2744:  with:
2745:  name: fleetctl-mysql8.0.44-coverage
2746:  path: ./coverage.txt
2747:  if-no-files-found: error
2748:  compression-level: 6
...

2760:  With the provided path, there will be 1 file uploaded
2761:  Artifact name is valid!
2762:  Root directory input is valid!
2763:  Beginning upload of artifact content to blob storage
2764:  Uploaded bytes 2830602
2765:  Finished uploading artifact content to blob storage!
2766:  SHA256 hash of uploaded artifact zip is ba4954dacfd20a85bfceaee2e49ea367d81dae60a08062a79def96e7fbd1be0b
2767:  Finalizing artifact upload
2768:  Artifact fleetctl-mysql8.0.44-coverage.zip successfully finalized. Artifact ID 6739790313
2769:  Artifact fleetctl-mysql8.0.44-coverage has been successfully uploaded! Final size is 2830602 bytes. Artifact ID is 6739790313
2770:  Artifact download URL: https://github.com/fleetdm/fleet/actions/runs/25187578098/artifacts/6739790313
2771:  ##[group]Run c1grep() { grep "$@" || test $? = 1; }
2772:  �[36;1mc1grep() { grep "$@" || test $? = 1; }�[0m
2773:  �[36;1mc1grep -oP 'FAIL: .*$' /tmp/gotest.log > /tmp/summary.txt�[0m
2774:  �[36;1mc1grep 'test timed out after' /tmp/gotest.log >> /tmp/summary.txt�[0m
2775:  �[36;1mc1grep 'fatal error:' /tmp/gotest.log >> /tmp/summary.txt�[0m
2776:  �[36;1mc1grep -A 10 'panic: runtime error: ' /tmp/gotest.log >> /tmp/summary.txt�[0m
2777:  �[36;1mc1grep ' FAIL\t' /tmp/gotest.log >> /tmp/summary.txt�[0m
2778:  �[36;1mGO_FAIL_SUMMARY=$(head -n 5 /tmp/summary.txt | sed ':a;N;$!ba;s/\n/\\n/g')�[0m
2779:  �[36;1mecho "GO_FAIL_SUMMARY=$GO_FAIL_SUMMARY"�[0m
2780:  �[36;1mif [[ -z "$GO_FAIL_SUMMARY" ]]; then�[0m
2781:  �[36;1m  GO_FAIL_SUMMARY="unknown, please check the build URL"�[0m
2782:  �[36;1mfi�[0m
2783:  �[36;1mGO_FAIL_SUMMARY=$GO_FAIL_SUMMARY envsubst < .github/workflows/config/slack_payload_template.json > ./payload.json�[0m
2784:  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
2785:  env:
2786:  RACE_ENABLED: false
2787:  GO_TEST_TIMEOUT: 20m
2788:  DOCKER_COMMAND: docker compose -f docker-compose.yml -f docker-compose-redis-cluster.yml up -d mysql_test mysql_replica_test redis redis-cluster-1 redis-cluster-2 redis-cluster-3 redis-cluster-4 redis-cluster-5 redis-cluster-6 redis-cluster-setup s3 saml_idp mailhog mailpit smtp4dev_test
2789:  RUN_TESTS_ARG: 
2790:  CI_TEST_PKG: fleetctl
2791:  NEED_DOCKER: 1
2792:  ARTIFACT_PREFIX: fleetctl-mysql8.0.44
2793:  GOTOOLCHAIN: local
2794:  ##[endgroup]
2795:  GO_FAIL_SUMMARY=
2796:  ##[group]Run actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a
2797:  with:
2798:  name: fleetctl-mysql8.0.44-test-log
2799:  path: /tmp/gotest.log
2800:  if-no-files-found: error
2801:  compression-level: 6

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 30, 2026

Codecov Report

❌ Patch coverage is 82.60870% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.78%. Comparing base (f70a02a) to head (67be925).
⚠️ Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
ee/server/service/request_certificate.go 82.60% 2 Missing and 2 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #44541      +/-   ##
==========================================
- Coverage   66.79%   66.78%   -0.01%     
==========================================
  Files        2637     2637              
  Lines      212132   212155      +23     
  Branches     9437     9437              
==========================================
+ Hits       141688   141691       +3     
- Misses      57578    57591      +13     
- Partials    12866    12873       +7     
Flag Coverage Δ
backend 68.56% <82.60%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant