Update Fleet-maintained apps - #45897
Conversation
Generated automatically with cmd/maintained-apps.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
WalkthroughThis PR updates macOS maintained-app metadata for four applications in the Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
ee/maintained-apps/outputs/whatsapp/darwin.json (1)
12-12:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy liftChecksum verification is disabled for WhatsApp downloads.
The
sha256field is set to"no_check", which disables cryptographic integrity verification for automated downloads. This exposes the installation process to MITM attacks, corrupted downloads, or supply-chain compromise.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ee/maintained-apps/outputs/whatsapp/darwin.json` at line 12, The JSON entry uses "sha256": "no_check", disabling integrity verification; replace the "no_check" value with the actual SHA-256 checksum of the WhatsApp darwin binary (or implement a verification step that fetches the artifact, computes its SHA-256, and stores that hex string into the "sha256" field) so automated downloads perform cryptographic integrity checks; locate the "sha256" field in the darwin.json for WhatsApp and update it with the correct checksum string (or wire in the checksum-generating tool that writes the checksum into that "sha256" field).
🧹 Nitpick comments (1)
ee/maintained-apps/outputs/whatsapp/darwin.json (1)
9-9: Generic installer URL may not match the specified version.The
installer_urlis a generic endpoint that likely redirects to the latest release, but there's no guarantee it will download version26.20.20as specified on Line 4. This creates a risk that the installed version won't match the declared version in the metadata, which could cause thepatchedquery on Line 7 to behave incorrectly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ee/maintained-apps/outputs/whatsapp/darwin.json` at line 9, The installer_url currently points to a generic redirecting endpoint ("installer_url") which may not return the declared "version" 26.20.20 and can make the "patched" check unreliable; update the JSON to use the exact versioned download URL (or the direct artifact URL that contains 26.20.20) so the installer and metadata match, or alternatively add a deterministic verification step (e.g., include an exact checksum or explicit "resolved_url" field) so the "patched" query can validate the downloaded file against version 26.20.20; locate and change the "installer_url" entry in darwin.json and, if adding verification, add fields for checksum/resolved_url and ensure any code that uses "patched" reads those fields.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@ee/maintained-apps/outputs/whatsapp/darwin.json`:
- Line 12: The JSON entry uses "sha256": "no_check", disabling integrity
verification; replace the "no_check" value with the actual SHA-256 checksum of
the WhatsApp darwin binary (or implement a verification step that fetches the
artifact, computes its SHA-256, and stores that hex string into the "sha256"
field) so automated downloads perform cryptographic integrity checks; locate the
"sha256" field in the darwin.json for WhatsApp and update it with the correct
checksum string (or wire in the checksum-generating tool that writes the
checksum into that "sha256" field).
---
Nitpick comments:
In `@ee/maintained-apps/outputs/whatsapp/darwin.json`:
- Line 9: The installer_url currently points to a generic redirecting endpoint
("installer_url") which may not return the declared "version" 26.20.20 and can
make the "patched" check unreliable; update the JSON to use the exact versioned
download URL (or the direct artifact URL that contains 26.20.20) so the
installer and metadata match, or alternatively add a deterministic verification
step (e.g., include an exact checksum or explicit "resolved_url" field) so the
"patched" query can validate the downloaded file against version 26.20.20;
locate and change the "installer_url" entry in darwin.json and, if adding
verification, add fields for checksum/resolved_url and ensure any code that uses
"patched" reads those fields.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 62ff234a-cb36-484f-ac0b-2209aa787e1a
📒 Files selected for processing (4)
ee/maintained-apps/outputs/arc/darwin.jsonee/maintained-apps/outputs/grammarly-desktop/darwin.jsonee/maintained-apps/outputs/raycast/darwin.jsonee/maintained-apps/outputs/whatsapp/darwin.json
|
Closing in favor of #45904. |
2 participants
Automated ingestion of latest Fleet-maintained app data.
Summary by CodeRabbit