FMA - Cryptomator - #46497
Conversation
GitHub Actions
Error
GitHub Actions
Error
GitHub Actions
Error
GitHub Actions
Inactive
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #46497 +/- ##
==========================================
- Coverage 66.81% 66.81% -0.01%
==========================================
Files 2805 2806 +1
Lines 223576 223578 +2
Branches 11481 11346 -135
==========================================
+ Hits 149380 149381 +1
- Misses 60640 60643 +3
+ Partials 13556 13554 -2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
GitHub Actions
Inactive
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
WalkthroughThis PR adds Cryptomator as a new maintained app across the full pipeline. It defines input manifests for Homebrew (macOS DMG installer) and Winget (Windows installer), creates platform-specific output metadata files with version detection SQL queries and embedded bash/PowerShell installation and uninstallation scripts, registers the app in the central app registry ( Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ee/maintained-apps/outputs/cryptomator/darwin.json`:
- Around line 9-12: The JSON entry hardcodes installer_url to the ARM-only asset
"Cryptomator-1.19.2-arm64.dmg" (key: installer_url) which will be delivered to
Intel Macs; either change installer_url to the Intel asset
"Cryptomator-1.19.2-x64.dmg" and update the corresponding sha256, or create
separate maintained-app outputs for macOS x64 and arm64 (duplicating entries
with distinct installer_url and sha256 values); ensure
install_script_ref/uninstall_script_ref remain correct for each entry.
In `@ee/maintained-apps/outputs/cryptomator/windows.json`:
- Line 21: The Start-Process invocation that launches msiexec.exe (the line
creating $installProcess via Start-Process msiexec.exe) should not include the
-Verb RunAs; remove the -Verb RunAs argument from the Start-Process call so the
MSI is launched without triggering a UAC elevation prompt in non-interactive
SYSTEM contexts, leaving the remaining arguments (-ArgumentList, -PassThru,
-Wait) and the use of $installProcess unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 327c6e2e-6de3-4b74-8622-f66fc9e0324c
⛔ Files ignored due to path filters (1)
website/assets/images/app-icon-cryptomator-60x60@2x.pngis excluded by!**/*.png
📒 Files selected for processing (7)
ee/maintained-apps/inputs/homebrew/cryptomator.jsonee/maintained-apps/inputs/winget/cryptomator.jsonee/maintained-apps/outputs/apps.jsonee/maintained-apps/outputs/cryptomator/darwin.jsonee/maintained-apps/outputs/cryptomator/windows.jsonfrontend/pages/SoftwarePage/components/icons/Cryptomator.tsxfrontend/pages/SoftwarePage/components/icons/index.ts
| "installer_url": "https://github.com/cryptomator/cryptomator/releases/download/1.19.2/Cryptomator-1.19.2-arm64.dmg", | ||
| "install_script_ref": "ce55df3b", | ||
| "uninstall_script_ref": "aefd9bb2", | ||
| "sha256": "e978a2da545d8aaca1192faf6dadf4c51bdf5e9bdc232a227618401c0b833f9a", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
For Cryptomator release 1.19.2 on macOS, is Cryptomator-1.19.2-arm64.dmg Apple-Silicon-only, and is there a separate x64 or universal DMG that should be used for Intel Macs?
💡 Result:
Yes, Cryptomator-1.19.2-arm64.dmg is specifically for Apple Silicon (ARM64) Macs [1][2]. Cryptomator does not provide a single universal binary DMG; instead, it provides separate installation files for different architectures [1][3]. For Intel-based Macs, you should use the Cryptomator-1.19.2-x64.dmg file [3][2]. You can find these download options on the official Cryptomator downloads page [1][4].
Citations:
- 1: https://cryptomator.org/downloads/mac/
- 2: https://www.fileeagle.com/software/1527/Cryptomator-Free-Edtion
- 3: https://github.com/cryptomator/cryptomator/releases/tag/1.19.2
- 4: https://cryptomator.org/downloads/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ls -R ee/maintained-apps/outputs/cryptomator 2>/dev/null || true
echo "---- darwin.json ----"
sed -n '1,160p' ee/maintained-apps/outputs/cryptomator/darwin.json
echo "---- find cryptomator entries ----"
rg -n "\"cryptomator\"" ee/maintained-apps/outputs/apps.json ee/maintained-apps/outputs -S || true
echo "---- apps.json excerpt ----"
rg -n "cryptomator" ee/maintained-apps/outputs/apps.json -n --context 5 -S || trueRepository: fleetdm/fleet
Length of output: 6926
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "---- look for cryptomator x64/arm64 assets ----"
rg -n "Cryptomator-1\.19\.2-(arm64|x64)\.dmg" -S ee/maintained-apps/outputs || true
rg -n "Cryptomator-.*-(arm64|x64)\.dmg" -S ee/maintained-apps/outputs || true
echo "---- look for darwin-arch platforms / architecture fields ----"
rg -n "\"platform\"\\s*:\\s*\"darwin" ee/maintained-apps/outputs/apps.json
rg -n "darwin-(arm64|x64)" ee/maintained-apps/outputs/apps.json ee/maintained-apps/outputs -S || true
rg -n "architecture|arch" ee/maintained-apps/outputs -S || true
echo "---- sample other macOS DMGs and how they handle arch ----"
rg -n "installer_url\"\\s*:\\s*\"https://github.com/.+\\.(arm64|x64)\\.dmg\"" -S ee/maintained-apps/outputs || true
rg -n "arm64\\.dmg" -S ee/maintained-apps/outputs || true
rg -n "x64\\.dmg" -S ee/maintained-apps/outputs || trueRepository: fleetdm/fleet
Length of output: 45084
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "maintained-apps" -S . || true
rg -n "installer_url" -S . || true
rg -n "INSTALLER_PATH" -S . || true
rg -n "bundle_identifier" -S . || true
rg -n "arm64|x86_64|i386|uname -m|sysctl.*machdep.cpu|PROCESSOR_ARCH" -S . || trueRepository: fleetdm/fleet
Length of output: 50371
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "---- search maintainedapps runtime selection logic ----"
rg -n "maintainedapps|fleet-maintained|fleet_maintained_apps" server/mdm/maintainedapps -S || true
echo "---- search for macOS architecture handling in maintainedapps ----"
rg -n "arm64|x86_64|i386|universal|archType|CPUArchitecture|PROCESSOR_ARCH|uname -m|machdep" server/mdm/maintainedapps server -S --glob='*.go' --glob='*.js' --glob='*.ts' || true
echo "---- search for installer_url selection / manifest parsing ----"
rg -n "installer_url|INSTALLER_PATH|darwin.json|slug.*darwin|version.*queries" server/mdm/maintainedapps server -S --glob='*.go' --glob='*.ts' --glob='*.js' || trueRepository: fleetdm/fleet
Length of output: 46953
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "---- where fleet_maintained_apps / fleet_library_apps are used ----"
rg -n "fleet_maintained_apps|fleet_library_apps" server -S --glob='*.go' || true
echo "---- where installer_url is read/used in the maintained-apps MDM code ----"
rg -n "installer_url" server/mdm/maintainedapps server/service -S --glob='*.go' || true
echo "---- look for OS/CPU architecture used when building FMA install commands ----"
rg -n "Arch\\b|arch\\b|CPUType\\b|cpu_type\\b|uname -m|arm64|x86_64|arm64e" server/mdm/maintainedapps server/service -S --glob='*.go' || trueRepository: fleetdm/fleet
Length of output: 37510
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ls -R server/mdm/maintainedapps
echo "---- inspect server/mdm/maintainedapps/sync.go ----"
sed -n '1,220p' server/mdm/maintainedapps/sync.go
echo "---- inspect server/mdm/maintainedapps/maintainedapps.go (or similar) ----"
for f in server/mdm/maintainedapps/*.go; do
echo "FILE: $f"
sed -n '1,220p' "$f"
done
echo "---- inspect DB schema/model for fleet_maintained_apps and related installers ----"
sed -n '1,260p' server/datastore/mysql/maintained_apps.go
sed -n '1,260p' server/datastore/mysql/software_installers.goRepository: fleetdm/fleet
Length of output: 50369
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "---- find FMAManifestFile types and Platform() method ----"
rg -n "type FMAManifestFile|func \\(.*\\) Platform\\(" ee/maintained-apps -S --glob='*.go'
rg -n "type Version|InstallerURL|InstallScript|UninstallScript|Slug = app\\.Slug" ee/maintained-apps -S --glob='*.go'
echo "---- where Hydrate() is called ----"
rg -n "Hydrate\\(" -S ee/maintained-apps server | head -n 200
echo "---- locate CPUType/arch usage in maintained app install flow ----"
rg -n "CPUType|cpu_type" -S server/mdm server/service server/datastore | rg -n "maintained|fleet_maintained|software.*fleet_maintained|FMA|patch.*maintained" || true
rg -n "fleet_maintained|MaintainedApp|FMA" -S server | rg -n "CPUType|cpu_type|arm64|x86_64|arch" || true
echo "---- locate InstallerURL usage when building installs ----"
rg -n "InstallerURL" -S server | head -n 200
rg -n "InstallerURL" -S ee/maintained-apps server/mdm server/service server/datastore --glob='*.go' | head -n 200
echo "---- locate functions that hydrate FMA into installer records ----"
rg -n "software_installer|install_script|uninstall_script|PatchQuery|UpgradeCode|AutomaticInstallQuery" -S server/mdm/maintainedapps server/datastore server/service | head -n 200Repository: fleetdm/fleet
Length of output: 45692
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "---- inspect ee/maintained-apps/maintained_apps.go (Platform() logic) ----"
sed -n '1,140p' ee/maintained-apps/maintained_apps.go
echo "---- search for any other cryptomator macOS artifacts in outputs ----"
rg -n "cryptomator/(darwin|.*arm.*|.*x64.*)" ee/maintained-apps/outputs/apps.json ee/maintained-apps/outputs -S || true
rg -n "Cryptomator-1\\.19\\.2-(arm64|x64|universal)\\.dmg" ee/maintained-apps/outputs -S || true
ls -R ee/maintained-apps/outputs/cryptomatorRepository: fleetdm/fleet
Length of output: 3519
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "---- find software_installers table schema and any arch column ----"
rg -n "CREATE TABLE software_installers|software_installers \\(|arch" server/datastore/mysql/migrations/tables -S --glob='*.go' --glob='*.sql' || true
echo "---- check software installer selection SQL for arch ----"
rg -n "software_installers.*arch|arch.*software_installers|cpu_type.*software_installers|cpu.*installer" server/datastore/mysql -S --glob='*.go' || true
echo "---- inspect software_installer model fields for arch ----"
rg -n "type SoftwareInstaller|Arch|arch" server -S --glob='*.go' | head -n 200Repository: fleetdm/fleet
Length of output: 50369
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "---- inspect software_installers table definition (platform columns) ----"
sed -n '1,220p' server/datastore/mysql/migrations/tables/20240515200020_AddSoftwareInstallerTables.go
echo "---- find how software installers are selected for hosts (arch vs platform) ----"
rg -n "software_installers.*platform|platform.*software_installers|fleet_maintained_app_id|fma\\.platform" server/datastore/mysql -S --glob='*.go'
echo "---- inspect policies/automatic install queries that join host to installers ----"
rg -n "fleet_maintained_app|fleet_maintained_apps|FMA|MaintainedApp" server/datastore/mysql/policies.go server/datastore/mysql -S --glob='*.go' | head -n 50
echo "---- search for host CPUType/arch used in FMA software installer targeting ----"
rg -n "CPUType|cpu_type|arm64|x86_64|arch.*(host|operating_systems)" server/datastore/mysql -S --glob='*.go' | head -n 80Repository: fleetdm/fleet
Length of output: 32629
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "host_compatible_platforms|compatible_platforms|software_installers\\.platform" server/datastore/mysql/software.go -n
# show relevant sections around the matches
sed -n '4880,5020p' server/datastore/mysql/software.go 2>/dev/null || true
sed -n '5200,5400p' server/datastore/mysql/software.go 2>/dev/null || true
sed -n '5900,6060p' server/datastore/mysql/software.go 2>/dev/null || trueRepository: fleetdm/fleet
Length of output: 19922
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "func \\(.*\\) FleetPlatform\\(|FleetPlatform\\(" -S server pkg ee || trueRepository: fleetdm/fleet
Length of output: 5534
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1040,1125p' server/service/hosts.goRepository: fleetdm/fleet
Length of output: 2525
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1040,1125p' server/fleet/hosts.go
sed -n '1125,1185p' server/fleet/hosts.goRepository: fleetdm/fleet
Length of output: 3902
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "func PlatformFromHost\\(" -S server/fleet/hosts.go server/fleet/*.go
sed -n '1185,1260p' server/fleet/hosts.go
sed -n '1260,1335p' server/fleet/hosts.goRepository: fleetdm/fleet
Length of output: 6613
Avoid shipping the ARM-only Cryptomator DMG to all macOS hosts.
ee/maintained-apps/outputs/cryptomator/darwin.json hardcodes installer_url to Cryptomator-1.19.2-arm64.dmg for the single cryptomator/darwin (platform-only) maintained-app entry. Fleet selects FMAs by host.FleetPlatform() / software_installers.platform (no CPU arch), so Intel (x86_64) Macs will still receive the ARM64 installer and fail. Use the Intel asset (Cryptomator-1.19.2-x64.dmg) or split the maintained-app output by macOS architecture.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/cryptomator/darwin.json` around lines 9 - 12, The
JSON entry hardcodes installer_url to the ARM-only asset
"Cryptomator-1.19.2-arm64.dmg" (key: installer_url) which will be delivered to
Intel Macs; either change installer_url to the Intel asset
"Cryptomator-1.19.2-x64.dmg" and update the corresponding sha256, or create
separate maintained-app outputs for macOS x64 and arm64 (duplicating entries
with distinct installer_url and sha256 values); ensure
install_script_ref/uninstall_script_ref remain correct for each entry.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
3 participants
Summary by CodeRabbit