Add OpenVPN Connect as a macOS FMA

[allenhouchins]

Add OpenVPN Connect to maintained apps: create a Homebrew input manifest and add an apps.json entry. Add a darwin output with version 3.8.1 (installer URL, sha256) plus install/uninstall script refs that handle quitting/relaunching and cleanup. Add frontend icon component and register it in the icon map, and include the app icon asset. Default category set to Productivity.

Summary by CodeRabbit

• New Features
  • Added OpenVPN Connect (v3.8.1) as a supported application for macOS with automated installation and management.
  • Integrated application icon for UI visibility.

[github-actions]

Script Diff Results

ee/maintained-apps/inputs/homebrew/openvpn-connect.json

ERROR: Could not retrieve previous version of file (file may not exist in previous commit)

ee/maintained-apps/outputs/openvpn-connect/darwin.json

ERROR: Could not retrieve previous version of file (file may not exist in previous commit)

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 66.81%. Comparing base (f5c59ae) to head (53f21e3).
⚠️ Report is 17 commits behind head on main.

Files with missing lines	Patch %	Lines
...s/SoftwarePage/components/icons/OpenvpnConnect.tsx	50.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #45174   +/-   ##
=======================================
  Coverage   66.80%   66.81%           
=======================================
  Files        2722     2724    +2     
  Lines      219000   219021   +21     
  Branches    10627    10627           
=======================================
+ Hits       146305   146329   +24     
+ Misses      59529    59526    -3     
  Partials    13166    13166           

Flag	Coverage Δ
frontend	55.31% <50.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Script Diff Results

ee/maintained-apps/inputs/homebrew/openvpn-connect.json

ERROR: Could not retrieve previous version of file (file may not exist in previous commit)

ee/maintained-apps/outputs/openvpn-connect/darwin.json

ERROR: Could not retrieve previous version of file (file may not exist in previous commit)

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/openvpn-connect/darwin.json

=== Install // 66c63c32 -> c8881523 ===

--- /tmp/old.KmUkPO	2026-05-12 02:13:02.022737935 +0000
+++ /tmp/new.yIGvNR	2026-05-12 02:13:02.022737935 +0000
@@ -1,16 +1,41 @@
 #!/bin/bash
 
-# variables
-APPDIR="/Applications/"
-TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
-# functions
+# Custom install script for OpenVPN Connect on macOS.
+#
+# The Homebrew cask "openvpn-connect" downloads a .dmg that contains both
+# x86_64 and arm64 .pkg installers at the root of the mounted volume:
+#
+#   OpenVPN_Connect_<ver>(<build>)_x86_64_Installer_signed.pkg
+#   OpenVPN_Connect_<ver>(<build>)_arm64_Installer_signed.pkg
+#
+# We only ship FMAs for Apple Silicon (arm64) on macOS, so this script:
+#   1. Mounts the DMG.
+#   2. Locates the arm64 .pkg via a glob (parentheses in the file name make
+#      hard-coding the path brittle across versions).
+#   3. Quits the app if it's running and tracks state for relaunch.
+#   4. Runs `installer -pkg ... -target /` against the mounted pkg, which is
+#      the same operation Homebrew performs for `pkg "..."` artifacts.
+#   5. Detaches the DMG.
+#   6. Forces LaunchServices to register the installed .app bundle.
+#
+# The LaunchServices step is required because OpenVPN Connect 3.8+ installs
+# into a wrapper directory (/Applications/OpenVPN Connect/OpenVPN Connect.app)
+# rather than placing the .app directly under /Applications/. osquery's `apps`
+# table only directory-scans the top level of /Applications/ and otherwise
+# relies on LaunchServices to discover nested apps; without an explicit
+# `lsregister` the freshly installed app may not show up immediately.
+
+set -u
+
+APPDIR="/Applications"
+BUNDLE_ID="org.openvpn.client.app"
+LSREGISTER="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister"
 
 quit_and_track_application() {
   local bundle_id="$1"
   local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
-  # check if the application is running
   local app_running
   app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
   if [[ "$app_running" != "true" ]]; then
@@ -26,13 +51,11 @@
     return
   fi
 
-  # App was running, mark it for relaunch
   eval "export $var_name=1"
   echo "Application '$bundle_id' was running; will relaunch after installation."
 
   echo "Quitting application '$bundle_id'..."
 
-  # try to quit the application within the timeout period
   local quit_success=false
   SECONDS=0
   while (( SECONDS < timeout_duration )); do
@@ -51,13 +74,11 @@
   fi
 }
 
-
 relaunch_application() {
   local bundle_id="$1"
   local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local was_running
 
-  # Check if the app was running before installation
   eval "was_running=\$$var_name"
   if [[ "$was_running" != "1" ]]; then
     return
@@ -72,11 +93,6 @@
 
   echo "Relaunching application '$bundle_id'..."
 
-  # Launch the app in the logged-in user's GUI session. Apps launched by root
-  # won't register with the user's Dock/GUI, so run 'open' as the console user.
-  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
-  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
-  # LSOpenURLsWithRole() failures even when 'open' exits 0.
   local open_status=0
   if [[ $EUID -eq 0 ]]; then
     local console_uid
@@ -93,13 +109,70 @@
   fi
 }
 
+if [ -z "${INSTALLER_PATH:-}" ] || [ ! -f "$INSTALLER_PATH" ]; then
+  echo "Missing or invalid INSTALLER_PATH"
+  exit 1
+fi
+
+MOUNT_POINT=$(mktemp -d /tmp/openvpn_connect_dmg.XXXXXX)
+cleanup() {
+  hdiutil detach "$MOUNT_POINT" >/dev/null 2>&1 || true
+  rmdir "$MOUNT_POINT" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+if ! hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH" >/dev/null; then
+  echo "Failed to mount DMG at $INSTALLER_PATH"
+  exit 1
+fi
+
+# Locate the arm64 installer pkg. We only support Apple Silicon for this FMA,
+# so deliberately skip the x86_64 pkg shipped in the same DMG. Use a glob so
+# parentheses and version/build numbers in the file name don't have to be
+# hard-coded here.
+PKG=""
+for candidate in "$MOUNT_POINT"/*_arm64_Installer_signed.pkg; do
+  if [ -e "$candidate" ]; then
+    PKG="$candidate"
+    break
+  fi
+done
+
+if [ -z "$PKG" ] || [ ! -e "$PKG" ]; then
+  echo "Could not find an arm64 OpenVPN Connect installer pkg in the DMG. Contents:"
+  ls -la "$MOUNT_POINT"
+  exit 1
+fi
+
+echo "Installing $PKG..."
+
+quit_and_track_application "$BUNDLE_ID"
+
+if ! sudo installer -pkg "$PKG" -target /; then
+  echo "installer -pkg failed for $PKG"
+  exit 1
+fi
+
+cleanup
+trap - EXIT
+
+# OpenVPN Connect 3.8+ places the .app inside a wrapper directory rather than
+# directly under /Applications/. osquery's apps table doesn't recurse into
+# /Applications/, so it depends on LaunchServices to find nested .app bundles.
+# Force-register the installed app with LaunchServices so it shows up in
+# osquery's `apps` table immediately.
+if [ -x "$LSREGISTER" ]; then
+  if [ -d "$APPDIR/OpenVPN Connect/OpenVPN Connect.app" ]; then
+    "$LSREGISTER" -f "$APPDIR/OpenVPN Connect/OpenVPN Connect.app" >/dev/null 2>&1 || true
+  elif [ -d "$APPDIR/OpenVPN Connect.app" ]; then
+    "$LSREGISTER" -f "$APPDIR/OpenVPN Connect.app" >/dev/null 2>&1 || true
+  else
+    # As a last resort, recursively register anything OpenVPN Connect-shaped
+    # under /Applications/ so LaunchServices and osquery can find it.
+    "$LSREGISTER" -R -f "$APPDIR/OpenVPN Connect" >/dev/null 2>&1 || true
+  fi
+fi
+
+relaunch_application "$BUNDLE_ID"
 
-# extract contents
-MOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)
-hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH"
-sudo cp -R "$MOUNT_POINT"/* "$TMPDIR"
-hdiutil detach "$MOUNT_POINT"
-# install pkg files
-quit_and_track_application 'org.openvpn.client.app'
-sudo installer -pkg "$TMPDIR/OpenVPN_Connect_3_8_1(5790)_arm64_Installer_signed.pkg" -target /
-relaunch_application 'org.openvpn.client.app'
+echo "OpenVPN Connect installed"

=== Uninstall Script (no changes) ===

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/openvpn-connect/darwin.json

=== Install // 66c63c32 -> c8881523 ===

--- /tmp/old.zio3JX	2026-05-12 02:42:28.754785051 +0000
+++ /tmp/new.3jZkQv	2026-05-12 02:42:28.754785051 +0000
@@ -1,16 +1,41 @@
 #!/bin/bash
 
-# variables
-APPDIR="/Applications/"
-TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
-# functions
+# Custom install script for OpenVPN Connect on macOS.
+#
+# The Homebrew cask "openvpn-connect" downloads a .dmg that contains both
+# x86_64 and arm64 .pkg installers at the root of the mounted volume:
+#
+#   OpenVPN_Connect_<ver>(<build>)_x86_64_Installer_signed.pkg
+#   OpenVPN_Connect_<ver>(<build>)_arm64_Installer_signed.pkg
+#
+# We only ship FMAs for Apple Silicon (arm64) on macOS, so this script:
+#   1. Mounts the DMG.
+#   2. Locates the arm64 .pkg via a glob (parentheses in the file name make
+#      hard-coding the path brittle across versions).
+#   3. Quits the app if it's running and tracks state for relaunch.
+#   4. Runs `installer -pkg ... -target /` against the mounted pkg, which is
+#      the same operation Homebrew performs for `pkg "..."` artifacts.
+#   5. Detaches the DMG.
+#   6. Forces LaunchServices to register the installed .app bundle.
+#
+# The LaunchServices step is required because OpenVPN Connect 3.8+ installs
+# into a wrapper directory (/Applications/OpenVPN Connect/OpenVPN Connect.app)
+# rather than placing the .app directly under /Applications/. osquery's `apps`
+# table only directory-scans the top level of /Applications/ and otherwise
+# relies on LaunchServices to discover nested apps; without an explicit
+# `lsregister` the freshly installed app may not show up immediately.
+
+set -u
+
+APPDIR="/Applications"
+BUNDLE_ID="org.openvpn.client.app"
+LSREGISTER="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister"
 
 quit_and_track_application() {
   local bundle_id="$1"
   local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
-  # check if the application is running
   local app_running
   app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
   if [[ "$app_running" != "true" ]]; then
@@ -26,13 +51,11 @@
     return
   fi
 
-  # App was running, mark it for relaunch
   eval "export $var_name=1"
   echo "Application '$bundle_id' was running; will relaunch after installation."
 
   echo "Quitting application '$bundle_id'..."
 
-  # try to quit the application within the timeout period
   local quit_success=false
   SECONDS=0
   while (( SECONDS < timeout_duration )); do
@@ -51,13 +74,11 @@
   fi
 }
 
-
 relaunch_application() {
   local bundle_id="$1"
   local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local was_running
 
-  # Check if the app was running before installation
   eval "was_running=\$$var_name"
   if [[ "$was_running" != "1" ]]; then
     return
@@ -72,11 +93,6 @@
 
   echo "Relaunching application '$bundle_id'..."
 
-  # Launch the app in the logged-in user's GUI session. Apps launched by root
-  # won't register with the user's Dock/GUI, so run 'open' as the console user.
-  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
-  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
-  # LSOpenURLsWithRole() failures even when 'open' exits 0.
   local open_status=0
   if [[ $EUID -eq 0 ]]; then
     local console_uid
@@ -93,13 +109,70 @@
   fi
 }
 
+if [ -z "${INSTALLER_PATH:-}" ] || [ ! -f "$INSTALLER_PATH" ]; then
+  echo "Missing or invalid INSTALLER_PATH"
+  exit 1
+fi
+
+MOUNT_POINT=$(mktemp -d /tmp/openvpn_connect_dmg.XXXXXX)
+cleanup() {
+  hdiutil detach "$MOUNT_POINT" >/dev/null 2>&1 || true
+  rmdir "$MOUNT_POINT" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+if ! hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH" >/dev/null; then
+  echo "Failed to mount DMG at $INSTALLER_PATH"
+  exit 1
+fi
+
+# Locate the arm64 installer pkg. We only support Apple Silicon for this FMA,
+# so deliberately skip the x86_64 pkg shipped in the same DMG. Use a glob so
+# parentheses and version/build numbers in the file name don't have to be
+# hard-coded here.
+PKG=""
+for candidate in "$MOUNT_POINT"/*_arm64_Installer_signed.pkg; do
+  if [ -e "$candidate" ]; then
+    PKG="$candidate"
+    break
+  fi
+done
+
+if [ -z "$PKG" ] || [ ! -e "$PKG" ]; then
+  echo "Could not find an arm64 OpenVPN Connect installer pkg in the DMG. Contents:"
+  ls -la "$MOUNT_POINT"
+  exit 1
+fi
+
+echo "Installing $PKG..."
+
+quit_and_track_application "$BUNDLE_ID"
+
+if ! sudo installer -pkg "$PKG" -target /; then
+  echo "installer -pkg failed for $PKG"
+  exit 1
+fi
+
+cleanup
+trap - EXIT
+
+# OpenVPN Connect 3.8+ places the .app inside a wrapper directory rather than
+# directly under /Applications/. osquery's apps table doesn't recurse into
+# /Applications/, so it depends on LaunchServices to find nested .app bundles.
+# Force-register the installed app with LaunchServices so it shows up in
+# osquery's `apps` table immediately.
+if [ -x "$LSREGISTER" ]; then
+  if [ -d "$APPDIR/OpenVPN Connect/OpenVPN Connect.app" ]; then
+    "$LSREGISTER" -f "$APPDIR/OpenVPN Connect/OpenVPN Connect.app" >/dev/null 2>&1 || true
+  elif [ -d "$APPDIR/OpenVPN Connect.app" ]; then
+    "$LSREGISTER" -f "$APPDIR/OpenVPN Connect.app" >/dev/null 2>&1 || true
+  else
+    # As a last resort, recursively register anything OpenVPN Connect-shaped
+    # under /Applications/ so LaunchServices and osquery can find it.
+    "$LSREGISTER" -R -f "$APPDIR/OpenVPN Connect" >/dev/null 2>&1 || true
+  fi
+fi
+
+relaunch_application "$BUNDLE_ID"
 
-# extract contents
-MOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)
-hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH"
-sudo cp -R "$MOUNT_POINT"/* "$TMPDIR"
-hdiutil detach "$MOUNT_POINT"
-# install pkg files
-quit_and_track_application 'org.openvpn.client.app'
-sudo installer -pkg "$TMPDIR/OpenVPN_Connect_3_8_1(5790)_arm64_Installer_signed.pkg" -target /
-relaunch_application 'org.openvpn.client.app'
+echo "OpenVPN Connect installed"

=== Uninstall Script (no changes) ===

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/openvpn-connect/darwin.json

=== Install // 66c63c32 -> c8881523 ===

--- /tmp/old.Cj9YjE	2026-05-12 02:43:04.404710391 +0000
+++ /tmp/new.qbMlwF	2026-05-12 02:43:04.405710390 +0000
@@ -1,16 +1,41 @@
 #!/bin/bash
 
-# variables
-APPDIR="/Applications/"
-TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
-# functions
+# Custom install script for OpenVPN Connect on macOS.
+#
+# The Homebrew cask "openvpn-connect" downloads a .dmg that contains both
+# x86_64 and arm64 .pkg installers at the root of the mounted volume:
+#
+#   OpenVPN_Connect_<ver>(<build>)_x86_64_Installer_signed.pkg
+#   OpenVPN_Connect_<ver>(<build>)_arm64_Installer_signed.pkg
+#
+# We only ship FMAs for Apple Silicon (arm64) on macOS, so this script:
+#   1. Mounts the DMG.
+#   2. Locates the arm64 .pkg via a glob (parentheses in the file name make
+#      hard-coding the path brittle across versions).
+#   3. Quits the app if it's running and tracks state for relaunch.
+#   4. Runs `installer -pkg ... -target /` against the mounted pkg, which is
+#      the same operation Homebrew performs for `pkg "..."` artifacts.
+#   5. Detaches the DMG.
+#   6. Forces LaunchServices to register the installed .app bundle.
+#
+# The LaunchServices step is required because OpenVPN Connect 3.8+ installs
+# into a wrapper directory (/Applications/OpenVPN Connect/OpenVPN Connect.app)
+# rather than placing the .app directly under /Applications/. osquery's `apps`
+# table only directory-scans the top level of /Applications/ and otherwise
+# relies on LaunchServices to discover nested apps; without an explicit
+# `lsregister` the freshly installed app may not show up immediately.
+
+set -u
+
+APPDIR="/Applications"
+BUNDLE_ID="org.openvpn.client.app"
+LSREGISTER="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister"
 
 quit_and_track_application() {
   local bundle_id="$1"
   local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local timeout_duration=10
 
-  # check if the application is running
   local app_running
   app_running=$(osascript -e "application id \"$bundle_id\" is running" 2>/dev/null)
   if [[ "$app_running" != "true" ]]; then
@@ -26,13 +51,11 @@
     return
   fi
 
-  # App was running, mark it for relaunch
   eval "export $var_name=1"
   echo "Application '$bundle_id' was running; will relaunch after installation."
 
   echo "Quitting application '$bundle_id'..."
 
-  # try to quit the application within the timeout period
   local quit_success=false
   SECONDS=0
   while (( SECONDS < timeout_duration )); do
@@ -51,13 +74,11 @@
   fi
 }
 
-
 relaunch_application() {
   local bundle_id="$1"
   local var_name="APP_WAS_RUNNING_$(echo "$bundle_id" | tr '.-' '__')"
   local was_running
 
-  # Check if the app was running before installation
   eval "was_running=\$$var_name"
   if [[ "$was_running" != "1" ]]; then
     return
@@ -72,11 +93,6 @@
 
   echo "Relaunching application '$bundle_id'..."
 
-  # Launch the app in the logged-in user's GUI session. Apps launched by root
-  # won't register with the user's Dock/GUI, so run 'open' as the console user.
-  # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace
-  # and GUI session — 'sudo -u' alone doesn't do this, which can cause
-  # LSOpenURLsWithRole() failures even when 'open' exits 0.
   local open_status=0
   if [[ $EUID -eq 0 ]]; then
     local console_uid
@@ -93,13 +109,70 @@
   fi
 }
 
+if [ -z "${INSTALLER_PATH:-}" ] || [ ! -f "$INSTALLER_PATH" ]; then
+  echo "Missing or invalid INSTALLER_PATH"
+  exit 1
+fi
+
+MOUNT_POINT=$(mktemp -d /tmp/openvpn_connect_dmg.XXXXXX)
+cleanup() {
+  hdiutil detach "$MOUNT_POINT" >/dev/null 2>&1 || true
+  rmdir "$MOUNT_POINT" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+if ! hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH" >/dev/null; then
+  echo "Failed to mount DMG at $INSTALLER_PATH"
+  exit 1
+fi
+
+# Locate the arm64 installer pkg. We only support Apple Silicon for this FMA,
+# so deliberately skip the x86_64 pkg shipped in the same DMG. Use a glob so
+# parentheses and version/build numbers in the file name don't have to be
+# hard-coded here.
+PKG=""
+for candidate in "$MOUNT_POINT"/*_arm64_Installer_signed.pkg; do
+  if [ -e "$candidate" ]; then
+    PKG="$candidate"
+    break
+  fi
+done
+
+if [ -z "$PKG" ] || [ ! -e "$PKG" ]; then
+  echo "Could not find an arm64 OpenVPN Connect installer pkg in the DMG. Contents:"
+  ls -la "$MOUNT_POINT"
+  exit 1
+fi
+
+echo "Installing $PKG..."
+
+quit_and_track_application "$BUNDLE_ID"
+
+if ! sudo installer -pkg "$PKG" -target /; then
+  echo "installer -pkg failed for $PKG"
+  exit 1
+fi
+
+cleanup
+trap - EXIT
+
+# OpenVPN Connect 3.8+ places the .app inside a wrapper directory rather than
+# directly under /Applications/. osquery's apps table doesn't recurse into
+# /Applications/, so it depends on LaunchServices to find nested .app bundles.
+# Force-register the installed app with LaunchServices so it shows up in
+# osquery's `apps` table immediately.
+if [ -x "$LSREGISTER" ]; then
+  if [ -d "$APPDIR/OpenVPN Connect/OpenVPN Connect.app" ]; then
+    "$LSREGISTER" -f "$APPDIR/OpenVPN Connect/OpenVPN Connect.app" >/dev/null 2>&1 || true
+  elif [ -d "$APPDIR/OpenVPN Connect.app" ]; then
+    "$LSREGISTER" -f "$APPDIR/OpenVPN Connect.app" >/dev/null 2>&1 || true
+  else
+    # As a last resort, recursively register anything OpenVPN Connect-shaped
+    # under /Applications/ so LaunchServices and osquery can find it.
+    "$LSREGISTER" -R -f "$APPDIR/OpenVPN Connect" >/dev/null 2>&1 || true
+  fi
+fi
+
+relaunch_application "$BUNDLE_ID"
 
-# extract contents
-MOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)
-hdiutil attach -plist -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$INSTALLER_PATH"
-sudo cp -R "$MOUNT_POINT"/* "$TMPDIR"
-hdiutil detach "$MOUNT_POINT"
-# install pkg files
-quit_and_track_application 'org.openvpn.client.app'
-sudo installer -pkg "$TMPDIR/OpenVPN_Connect_3_8_1(5790)_arm64_Installer_signed.pkg" -target /
-relaunch_application 'org.openvpn.client.app'
+echo "OpenVPN Connect installed"

=== Uninstall Script (no changes) ===

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 79c38f5b-6f57-41c1-9562-e3666b202f7f

📥 Commits

Reviewing files that changed from the base of the PR and between fe16654 and 53f21e3.

⛔ Files ignored due to path filters (1)

• website/assets/images/app-icon-openvpn-connect-60x60@2x.png is excluded by !**/*.png

📒 Files selected for processing (6)

• ee/maintained-apps/inputs/homebrew/openvpn-connect.json
• ee/maintained-apps/inputs/homebrew/scripts/openvpn-connect-install.sh
• ee/maintained-apps/outputs/apps.json
• ee/maintained-apps/outputs/openvpn-connect/darwin.json
• frontend/pages/SoftwarePage/components/icons/OpenvpnConnect.tsx
• frontend/pages/SoftwarePage/components/icons/index.ts

---

Walkthrough

This PR adds OpenVPN Connect as a managed application to Fleet. It introduces a Homebrew input metadata file specifying the app's bundle identifier and installer type, a comprehensive Bash installer script for macOS that handles DMG mounting, app lifecycle management (detecting and relaunching the running app), LaunchServices registration, and cleanup. The app is registered in the output app registry and receives a macOS-specific definition file with version metadata and embedded install/uninstall script definitions. The frontend receives a new SVG icon component and its integration into the software icon mapping for UI display.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch allenhouchins-add-openvpn-connect

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Adds OpenVPN Connect as a Fleet-maintained app (FMA) for macOS, wiring it into both the maintained-apps catalog and the Software page UI so it can be distributed and displayed with the correct metadata and icon.

Changes:

• Added Homebrew input manifest + custom macOS install script for OpenVPN Connect.
• Added generated maintained-app outputs (darwin version metadata + install/uninstall script refs) and registered the app in apps.json.
• Added a new Software page icon component and registered it in the software-name-to-icon map.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
frontend/pages/SoftwarePage/components/icons/OpenvpnConnect.tsx	Adds the OpenVPN Connect icon component used by the Software page.
frontend/pages/SoftwarePage/components/icons/index.ts	Registers the new icon in the icon map and imports it.
ee/maintained-apps/outputs/openvpn-connect/darwin.json	Adds the generated macOS output metadata, installer URL/SHA, and install/uninstall script refs.
ee/maintained-apps/outputs/apps.json	Registers OpenVPN Connect in the maintained apps catalog list.
ee/maintained-apps/inputs/homebrew/scripts/openvpn-connect-install.sh	Adds a custom DMG+PKG install script with quit/relaunch and LaunchServices registration.
ee/maintained-apps/inputs/homebrew/openvpn-connect.json	Adds the Homebrew input manifest for OpenVPN Connect.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.