Add SF Symbols as a macOS FMA - #46738
Conversation
GitHub Actions
Inactive
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #46738 +/- ##
==========================================
- Coverage 66.91% 66.91% -0.01%
==========================================
Files 2833 2834 +1
Lines 224964 224966 +2
Branches 11620 11517 -103
==========================================
+ Hits 150526 150527 +1
- Misses 60781 60783 +2
+ Partials 13657 13656 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
GitHub Actions
Inactive
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis pull request adds SF Symbols as a Fleet-maintained app across three functional areas. The app configuration layer defines SF Symbols in Homebrew input format (bundle ID Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ee/maintained-apps/outputs/sf-symbols/darwin.json`:
- Around line 9-12: The JSON entry for SF-Symbols-7.dmg currently uses "sha256":
"no_check", which disables tamper detection; compute the actual SHA256 of the
DMG at the installer_url
("https://devimages-cdn.apple.com/design/resources/download/SF-Symbols-7.dmg")
and replace the "no_check" value with that hex hash in the sha256 field so Fleet
can verify downloads; keep the existing install_script_ref and
uninstall_script_ref unchanged and ensure the SHA is the full lowercase hex
string.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: fc5ad774-686f-44e6-9b73-fc4a28d37ad1
⛔ Files ignored due to path filters (1)
website/assets/images/app-icon-sf-symbols-60x60@2x.pngis excluded by!**/*.png
📒 Files selected for processing (5)
ee/maintained-apps/inputs/homebrew/sf-symbols.jsonee/maintained-apps/outputs/apps.jsonee/maintained-apps/outputs/sf-symbols/darwin.jsonfrontend/pages/SoftwarePage/components/icons/SfSymbols.tsxfrontend/pages/SoftwarePage/components/icons/index.ts
| "installer_url": "https://devimages-cdn.apple.com/design/resources/download/SF-Symbols-7.dmg", | ||
| "install_script_ref": "36b578c4", | ||
| "uninstall_script_ref": "de35f8cd", | ||
| "sha256": "no_check", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Download and compute SHA256 for SF Symbols 7.2 DMG
curl -L "https://devimages-cdn.apple.com/design/resources/download/SF-Symbols-7.dmg" -o /tmp/sf-symbols.dmg
shasum -a 256 /tmp/sf-symbols.dmg | awk '{print $1}'
rm /tmp/sf-symbols.dmgRepository: fleetdm/fleet
Length of output: 1209
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Show the exact snippet from the referenced JSON
echo "=== darwin.json lines 1-40 ==="
nl -ba ee/maintained-apps/outputs/sf-symbols/darwin.json | sed -n '1,40p'
# 2) Find where sha256/no_check is referenced in the repo
echo
echo "=== occurrences of sha256/no_check ==="
rg -n --hidden --no-ignore -S '"sha256"' ee | head -n 200
rg -n --hidden --no-ignore -S '"no_check"' . | head -n 200
# 3) Trace download/verification logic (search for sha256 handling)
echo
echo "=== download/verification logic mentioning sha256 ==="
rg -n --hidden --no-ignore -S 'sha256' . | head -n 200Repository: fleetdm/fleet
Length of output: 149
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== darwin.json (lines 1-30) ==="
sed -n '1,30p' ee/maintained-apps/outputs/sf-symbols/darwin.json
echo
echo "=== darwin.json (lines 5-15) ==="
sed -n '5,15p' ee/maintained-apps/outputs/sf-symbols/darwin.json
echo
echo "=== occurrences of \"no_check\" ==="
rg -n --hidden --no-ignore -S '"no_check"' . | head -n 200
echo
echo "=== occurrences of \"sha256\" ==="
rg -n --hidden --no-ignore -S '"sha256"' . | head -n 200
echo
echo "=== occurrences of \"no_check\" and download/verify code paths ==="
rg -n --hidden --no-ignore -S 'no_check|sha256' ee | head -n 200Repository: fleetdm/fleet
Length of output: 50369
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== maintained_apps.go: noCheckHash logic ==="
sed -n '1,220p' ee/server/service/maintained_apps.go
echo
echo "=== software_installers.go: compute SHA when no_check ==="
sed -n '2920,3100p' ee/server/service/software_installers.go
echo
echo "=== software_installers.go: where no_check is interpreted ==="
rg -n --hidden --no-ignore -S 'noCheckHash|no_check' ee/server/service/software_installers.go | head -n 200Repository: fleetdm/fleet
Length of output: 16195
Avoid "sha256": "no_check" for SF-Symbols-7.dmg if you want tamper detection on download.
- Fleet treats
sha256: "no_check"as “skip comparing the downloaded bytes against an expected hash” (it still computes a SHA256 from what was downloaded and uses it for storage/idempotency). - If this URL is stable for the declared version, replace
"no_check"with the actual SHA256 so Fleet will reject mismatched/modified installers.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ee/maintained-apps/outputs/sf-symbols/darwin.json` around lines 9 - 12, The
JSON entry for SF-Symbols-7.dmg currently uses "sha256": "no_check", which
disables tamper detection; compute the actual SHA256 of the DMG at the
installer_url
("https://devimages-cdn.apple.com/design/resources/download/SF-Symbols-7.dmg")
and replace the "no_check" value with that hex hash in the sha256 field so Fleet
can verify downloads; keep the existing install_script_ref and
uninstall_script_ref unchanged and ensure the SHA is the full lowercase hex
string.
2c8dcd7
3 participants
Summary by CodeRabbit