Skip to content

Update Fleet-maintained apps - #50847

Merged
allenhouchins merged 2 commits into
mainfrom
fma-2608091605
Aug 9, 2026
Merged

Update Fleet-maintained apps#50847
allenhouchins merged 2 commits into
mainfrom
fma-2608091605

Conversation

@fleet-release

@fleet-release fleet-release commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

  • Updates
    • Updated BetterMouse, Chatbox, DevKnife, Firefox Nightly, Krisp, Marked, MarkEdit, OK JSON, Python 3.14, Reqable, and Stats to newer releases.
    • Refreshed download links, version detection, installer packages, and verification checksums.
    • Updated Krisp’s macOS package for the latest Apple silicon release.
    • Changed OK JSON installation packages from ZIP to DMG on macOS and Homebrew.
    • Preserved supported installation and uninstallation workflows.

Generated automatically with cmd/maintained-apps.
@github-actions

github-actions Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Script Diff Results

ee/maintained-apps/outputs/bettermouse/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/chatbox/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/devknife/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/firefox@nightly/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/krisp/darwin.json

=== Install // 8eee0d6d -> c1b9cece ===

--- /tmp/old.PBLE2Z	2026-08-09 16:11:29.929131963 +0000
+++ /tmp/new.FGMtBD	2026-08-09 16:11:29.930131913 +0000
@@ -96,5 +96,5 @@
 
 # install pkg files
 quit_and_track_application 'ai.krisp.krispMac'
-sudo installer -pkg "$TMPDIR/krisp_3.14.6_arm64.pkg" -target / || exit $?
+sudo installer -pkg "$TMPDIR/Krisp_3.15.4_arm64.pkg" -target / || exit $?
 relaunch_application 'ai.krisp.krispMac'

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/marked-app/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/markedit/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/ok-json/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/python-3.14/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/reqable/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/stats/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

@coderabbitai

coderabbitai Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Walkthrough

Updated maintained-app definitions for BetterMouse, Chatbox, DevKnife, Firefox Nightly, Krisp, Marked, MarkEdit, OK JSON, Python, Reqable, and Stats. The changes update release versions or builds, patch queries, installer URLs, archive formats, and SHA-256 checksums. Krisp and OK JSON also reference updated installation scripts.

Possibly related PRs

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description states the general purpose but omits the required issue, checklist, and testing sections. Add the required template sections, provide the related issue or mark it not applicable, and complete the relevant checklist and testing items.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the update to Fleet-maintained app data.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fma-2608091605

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ee/maintained-apps/outputs/krisp/darwin.json`:
- Around line 10-11: Update the Krisp installer selection represented by
installer_url and install_script_ref to gate the arm64 package behind Apple
Silicon detection, ensuring Intel macOS hosts do not receive
Krisp_3.15.4_arm64.pkg; use an architecture-appropriate or universal installer
path for unsupported hosts.

In `@ee/maintained-apps/outputs/ok-json/darwin.json`:
- Line 10: Update the ok-json installer configuration to use an install script
compatible with the DMG referenced by installer_url. Replace install_script_ref
"4f7c5083" with a DMG-aware script that mounts the image via hdiutil, copies OK
JSON.app from the mounted volume, and unmounts it afterward.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7a75ed45-e632-4242-8785-fe7f99920aea

📥 Commits

Reviewing files that changed from the base of the PR and between 6ae6d11 and 0277a33.

📒 Files selected for processing (11)
  • ee/maintained-apps/outputs/bettermouse/darwin.json
  • ee/maintained-apps/outputs/chatbox/windows.json
  • ee/maintained-apps/outputs/devknife/darwin.json
  • ee/maintained-apps/outputs/firefox@nightly/darwin.json
  • ee/maintained-apps/outputs/krisp/darwin.json
  • ee/maintained-apps/outputs/marked-app/darwin.json
  • ee/maintained-apps/outputs/markedit/darwin.json
  • ee/maintained-apps/outputs/ok-json/darwin.json
  • ee/maintained-apps/outputs/python-3.14/windows.json
  • ee/maintained-apps/outputs/reqable/darwin.json
  • ee/maintained-apps/outputs/stats/darwin.json

Comment on lines +10 to +11
"installer_url": "https://cdn.krisp.ai/mp/mn/3.15/mac/Krisp_3.15.4_arm64.pkg",
"install_script_ref": "c1b9cece",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 8 \
  'krisp/darwin|Krisp_3\.15\.4_arm64\.pkg|arm64|x86_64|uname -m|architecture' \
  ee/maintained-apps/inputs/homebrew/krisp.json \
  ee/maintained-apps/outputs/krisp/darwin.json

Repository: fleetdm/fleet

Length of output: 14923


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== candidate maintained-apps files =="
python3 - <<'PY'
import json, pathlib
base = pathlib.Path('ee/maintained-apps')
for p in sorted(base.rglob('*.json')):
    try:
        data=json.loads(p.read_text())
    except Exception:
        continue
    if isinstance(data, dict):
        if 'slug' in data and 'krisp' in str(data.get('slug','')):
            print(p, json.dumps({k:v for k,v in data.items() if k in {'slug','architecture','required_install_script_platform','installer_format'}}, indent=2, sort_keys=True))
PY

echo
echo "== version selection logic references =="
rg -n -C 6 '"versions"\s*:|architecture|required_install_script_platform|installer_url|install_script_ref|platform' ee/maintained-apps -g '*.go' -g '*.json' || true

echo
echo "== exact installer metadata in tracked JSON =="
python3 - <<'PY'
import json, pathlib
p=pathlib.Path('ee/maintained-apps/outputs/krisp/darwin.json')
data=json.loads(p.read_text())
print(json.dumps(data, indent=2, sort_keys=True))
PY

Repository: fleetdm/fleet

Length of output: 50370


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== focused architecture/platform selector references =="
rg -n -C 5 'architecture|required_install_script_platform|app_architecture|installer_url|install_script_ref' --glob '*.go' --glob '*.json' ee | head -n 500

echo
echo "== app selection files =="
git ls-files ee | rg '(^ee/.*app.*\.go$|^ee/.*software.*\.go$|^ee/.*maintained|apps\.json|darwin\.json|homebrew)' | head -n 200

echo
echo "== crisps for architecture keys in json files =="
python3 - <<'PY'
import json, pathlib
for p in pathlib.Path('ee/maintained-apps').rglob('*.json'):
    text = p.read_text(errors='ignore')
    if 'architecture' in text or 'required_install_script_platform' in text or 'Krisp_3.15.4_arm64.pkg' in text:
        print(p)
        try:
            data=json.loads(text)
        except Exception as e:
            print('parse error:', e)
            continue
        print(json.dumps(data, indent=2, sort_keys=True)[:2000])
PY

Repository: fleetdm/fleet

Length of output: 50369


Add Apple Silicon support before selecting this installer.

ee/maintained-apps/outputs/krisp/darwin.json installs Krisp_3.15.4_arm64.pkg directly, from a package that does not filter by CPU architecture. This can direct Intel macOS hosts to the same arm64 installer without a universal Mac package or architecture gating.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/krisp/darwin.json` around lines 10 - 11, Update
the Krisp installer selection represented by installer_url and
install_script_ref to gate the arm64 package behind Apple Silicon detection,
ensuring Intel macOS hosts do not receive Krisp_3.15.4_arm64.pkg; use an
architecture-appropriate or universal installer path for unsupported hosts.

Comment thread ee/maintained-apps/outputs/ok-json/darwin.json
Upstream switched the OK JSON download from a .zip to a .dmg, but the
FMA input still declared installer_format "zip", so the generated
install script ran unzip against a dmg and failed.

Set installer_format to "dmg" and regenerate ok-json/darwin.
@github-actions

github-actions Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Script Diff Results

ee/maintained-apps/outputs/bettermouse/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/chatbox/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/devknife/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/firefox@nightly/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/krisp/darwin.json

=== Install // 8eee0d6d -> c1b9cece ===

--- /tmp/old.W6t3B6	2026-08-09 16:59:42.459704043 +0000
+++ /tmp/new.lFaqyw	2026-08-09 16:59:42.459704043 +0000
@@ -96,5 +96,5 @@
 
 # install pkg files
 quit_and_track_application 'ai.krisp.krispMac'
-sudo installer -pkg "$TMPDIR/krisp_3.14.6_arm64.pkg" -target / || exit $?
+sudo installer -pkg "$TMPDIR/Krisp_3.15.4_arm64.pkg" -target / || exit $?
 relaunch_application 'ai.krisp.krispMac'

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/marked-app/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/markedit/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/ok-json/darwin.json

=== Install // 4f7c5083 -> 239cd7a4 ===

--- /tmp/old.PhNAKv	2026-08-09 16:59:42.576705527 +0000
+++ /tmp/new.2V4WdS	2026-08-09 16:59:42.576705527 +0000
@@ -95,7 +95,10 @@
 
 
 # extract contents
-unzip "$INSTALLER_PATH" -d "$TMPDIR"
+MOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)
+yes | hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH" || exit 1
+sudo cp -R "$MOUNT_POINT"/* "$TMPDIR"
+hdiutil detach "$MOUNT_POINT" || true
 # copy to the applications folder
 quit_and_track_application 'net.shinystone.OKJSON'
 if [ -d "$APPDIR/OK JSON.app" ]; then

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/python-3.14/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/reqable/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/stats/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ee/maintained-apps/outputs/ok-json/darwin.json`:
- Line 20: Make the DMG extraction flow fail-safe before replacing the installed
app: check the result of sudo cp -R and verify that "$TMPDIR/OK JSON.app" exists
before proceeding to quit or move the current installation, exiting on failure.
Add a cleanup function around MOUNT_POINT that only detaches an existing mounted
path, register it for normal exit and interruption signals, and avoid leaving
the DMG mounted when hdiutil detach fails.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 23fb91af-1571-44a4-bac4-11f6a778fea7

📥 Commits

Reviewing files that changed from the base of the PR and between 0277a33 and b94c25f.

📒 Files selected for processing (2)
  • ee/maintained-apps/inputs/homebrew/ok-json.json
  • ee/maintained-apps/outputs/ok-json/darwin.json

],
"refs": {
"4f7c5083": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# extract contents\nunzip \"$INSTALLER_PATH\" -d \"$TMPDIR\"\n# copy to the applications folder\nquit_and_track_application 'net.shinystone.OKJSON'\nif [ -d \"$APPDIR/OK JSON.app\" ]; then\n\tsudo mv \"$APPDIR/OK JSON.app\" \"$TMPDIR/OK JSON.app.bkp\" || exit $?\nfi\nif ! sudo cp -R \"$TMPDIR/OK JSON.app\" \"$APPDIR\"; then\n\t# remove the partial copy so a failed install isn't inventoried as the new\n\t# version, then restore the previous version if there was one\n\tsudo rm -rf \"$APPDIR/OK JSON.app\"\n\tif [ -d \"$TMPDIR/OK JSON.app.bkp\" ]; then\n\t\tsudo mv \"$TMPDIR/OK JSON.app.bkp\" \"$APPDIR/OK JSON.app\"\n\tfi\n\texit 1\nfi\nrelaunch_application 'net.shinystone.OKJSON'\n",
"239cd7a4": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# extract contents\nMOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)\nyes | hdiutil attach -plist -nobrowse -readonly -mountpoint \"$MOUNT_POINT\" \"$INSTALLER_PATH\" || exit 1\nsudo cp -R \"$MOUNT_POINT\"/* \"$TMPDIR\"\nhdiutil detach \"$MOUNT_POINT\" || true\n# copy to the applications folder\nquit_and_track_application 'net.shinystone.OKJSON'\nif [ -d \"$APPDIR/OK JSON.app\" ]; then\n\tsudo mv \"$APPDIR/OK JSON.app\" \"$TMPDIR/OK JSON.app.bkp\" || exit $?\nfi\nif ! sudo cp -R \"$TMPDIR/OK JSON.app\" \"$APPDIR\"; then\n\t# remove the partial copy so a failed install isn't inventoried as the new\n\t# version, then restore the previous version if there was one\n\tsudo rm -rf \"$APPDIR/OK JSON.app\"\n\tif [ -d \"$TMPDIR/OK JSON.app.bkp\" ]; then\n\t\tsudo mv \"$TMPDIR/OK JSON.app.bkp\" \"$APPDIR/OK JSON.app\"\n\tfi\n\texit 1\nfi\nrelaunch_application 'net.shinystone.OKJSON'\n",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Make DMG extraction fail-safe before replacing the installed app.

The script ignores the result of sudo cp -R "$MOUNT_POINT"/* "$TMPDIR". If the copy fails after creating a partial OK JSON.app, the later copy can install that incomplete bundle. Check the extraction result and verify "$TMPDIR/OK JSON.app" before moving the existing application.

Also register an exit and signal cleanup handler. The current hdiutil detach "$MOUNT_POINT" || true can leave the DMG mounted when the script is interrupted or detachment fails.

Proposed fix
+cleanup() {
+  hdiutil detach "$MOUNT_POINT" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT INT TERM
+
-if sudo cp -R "$MOUNT_POINT"/* "$TMPDIR"
+if ! sudo cp -R "$MOUNT_POINT"/* "$TMPDIR" ||
+   [[ ! -d "$TMPDIR/OK JSON.app" ]]; then
+  exit 1
+fi
-hdiutil detach "$MOUNT_POINT" || true

Ensure the cleanup function does not attempt to detach an unmounted path.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/ok-json/darwin.json` at line 20, Make the DMG
extraction flow fail-safe before replacing the installed app: check the result
of sudo cp -R and verify that "$TMPDIR/OK JSON.app" exists before proceeding to
quit or move the current installation, exiting on failure. Add a cleanup
function around MOUNT_POINT that only detaches an existing mounted path,
register it for normal exit and interruption signals, and avoid leaving the DMG
mounted when hdiutil detach fails.

@github-actions

github-actions Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Closing in favor of #50848.

@github-actions

github-actions Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Script Diff Results

ee/maintained-apps/outputs/bettermouse/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/chatbox/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/devknife/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/firefox@nightly/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/krisp/darwin.json

=== Install // 8eee0d6d -> c1b9cece ===

--- /tmp/old.yPAST9	2026-08-09 20:36:59.639082746 +0000
+++ /tmp/new.cbavo3	2026-08-09 20:36:59.640082768 +0000
@@ -96,5 +96,5 @@
 
 # install pkg files
 quit_and_track_application 'ai.krisp.krispMac'
-sudo installer -pkg "$TMPDIR/krisp_3.14.6_arm64.pkg" -target / || exit $?
+sudo installer -pkg "$TMPDIR/Krisp_3.15.4_arm64.pkg" -target / || exit $?
 relaunch_application 'ai.krisp.krispMac'

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/marked-app/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/markedit/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/ok-json/darwin.json

=== Install // 4f7c5083 -> 239cd7a4 ===

--- /tmp/old.oh8IEa	2026-08-09 20:36:59.733084806 +0000
+++ /tmp/new.Tp9xqw	2026-08-09 20:36:59.733084806 +0000
@@ -95,7 +95,10 @@
 
 
 # extract contents
-unzip "$INSTALLER_PATH" -d "$TMPDIR"
+MOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)
+yes | hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH" || exit 1
+sudo cp -R "$MOUNT_POINT"/* "$TMPDIR"
+hdiutil detach "$MOUNT_POINT" || true
 # copy to the applications folder
 quit_and_track_application 'net.shinystone.OKJSON'
 if [ -d "$APPDIR/OK JSON.app" ]; then

=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/python-3.14/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/reqable/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/stats/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

@allenhouchins
allenhouchins merged commit e45c5d6 into main Aug 9, 2026
30 checks passed
@allenhouchins
allenhouchins deleted the fma-2608091605 branch August 9, 2026 20:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants