Skip to content

Update Fleet-maintained apps - #47895

Merged
allenhouchins merged 1 commit into
mainfrom
fma-2606190930
Jun 19, 2026
Merged

Update Fleet-maintained apps#47895
allenhouchins merged 1 commit into
mainfrom
fma-2606190930

Conversation

@fleet-release

@fleet-release fleet-release commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

  • Updates
    • Updated application version metadata for 13 maintained apps across Windows and macOS platforms, including: Adobe Creative Cloud, AWS CLI, BetterTouchTool, Citrix Workspace, Codex App, Devin Desktop, Dockside, Figma, Garmin Express, GDevelop, Microsoft Teams, Signal, and Warp. Each update includes version bumps and corresponding installer artifacts to ensure current releases are properly tracked and available for deployment.

Generated automatically with cmd/maintained-apps.

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

Tip: disable this comment in your organization's Code Review settings.

@github-actions

Copy link
Copy Markdown
Contributor

Script Diff Results

ee/maintained-apps/outputs/adobe-creative-cloud/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/aws-cli/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/bettertouchtool/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/citrix-workspace/darwin.json

=== Install // d0785661 -> fe7ba180 ===

--- /tmp/old.BC3cvK	2026-06-19 09:34:34.982962446 +0000
+++ /tmp/new.boHyaz	2026-06-19 09:34:34.982962446 +0000
@@ -96,5 +96,5 @@
 
 # install pkg files
 quit_and_track_application 'com.citrix.receiver.nomas'
-sudo installer -pkg "$TMPDIR/CitrixWorkspaceAppUniversal26.03.10.40.pkg" -target /
+sudo installer -pkg "$TMPDIR/CitrixWorkspaceAppUniversal26.03.0.49.pkg" -target /
 relaunch_application 'com.citrix.receiver.nomas'

=== Uninstall // a1c686b5 -> ed152120 ===

--- /tmp/old.w5fJJq	2026-06-19 09:34:35.027963020 +0000
+++ /tmp/new.toJXiy	2026-06-19 09:34:35.028963032 +0000
@@ -210,7 +210,6 @@
 remove_launchctl_service 'com.citrix.devicetrust.launchagent'
 remove_launchctl_service 'com.citrix.ReceiverHelper'
 remove_launchctl_service 'com.citrix.ReceiverUninstallHelper'
-remove_launchctl_service 'com.citrix.ReceiverUpdaterHelper'
 remove_launchctl_service 'com.citrix.safariadapter'
 remove_launchctl_service 'com.citrix.ServiceRecords'
 remove_launchctl_service 'com.citrix.UninstallMonitor'
@@ -232,8 +231,6 @@
 forget_pkg 'com.citrix.ICAClientcwa'
 remove_pkg_files 'com.citrix.ICAClienthdx'
 forget_pkg 'com.citrix.ICAClienthdx'
-remove_pkg_files 'com.citrix.receiver.bcr'
-forget_pkg 'com.citrix.receiver.bcr'
 trash $LOGGED_IN_USER '~/Library/Application Support/Citrix Receiver'
 trash $LOGGED_IN_USER '~/Library/Application Support/Citrix Workspace'
 trash $LOGGED_IN_USER '~/Library/Application Support/Citrix'

ee/maintained-apps/outputs/codex-app/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/devin-desktop/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/dockside/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/figma/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/garmin-express/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/gdevelop/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/microsoft-teams/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/signal/windows.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

ee/maintained-apps/outputs/warp/darwin.json

=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===

@coderabbitai

coderabbitai Bot commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Walkthrough

This PR updates version metadata for 14 Fleet-maintained application entries across macOS and Windows. For each app, the version string, queries.patched SQL version comparison threshold, installer_url, and sha256 checksum are updated to match the new release. The affected apps are: Adobe Creative Cloud (6.10.0.252.3), AWS CLI (2.35.8), BetterTouchTool (6.591), Citrix Workspace (26.03.0), Codex (26.616.31447), Devin Desktop (3.2.23), Dockside (2.9.12), Figma (126.6.9), Garmin Express (7.29.1), GDevelop (5.6.272), Microsoft Teams, Signal (8.15.0), and Warp (0.2026.06.17.09.49.01). Citrix Workspace additionally replaces its install_script_ref and uninstall_script_ref with new scripts that target the 26.03.0.49 package and add post-install application relaunch handling.

Possibly related PRs

  • fleetdm/fleet#47849: Directly modifies the same ee/maintained-apps/outputs/aws-cli/windows.json file by bumping version, queries.patched threshold, installer_url, and sha256 for the AWS CLI installer.
  • fleetdm/fleet#47886: Updates the same maintained-apps JSON entries including ee/maintained-apps/outputs/codex-app/darwin.json, bumping version targets and synchronizing queries.patched/installer_url/sha256.
  • fleetdm/fleet#47570: Touches the same ee/maintained-apps/outputs/aws-cli/windows.json and ee/maintained-apps/outputs/codex-app/darwin.json files with the same pattern of queries.patched/version/installer_url/sha256 updates.
🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 inconclusive)

Check name Status Explanation Resolution
Title check ❓ Inconclusive The title 'Update Fleet-maintained apps' is vague and generic, using a broad verb without specifying what aspects of the apps were updated (versions, configurations, metadata, etc.). Clarify the title to indicate the specific type of update (e.g., 'Update Fleet-maintained app versions' or 'Bump versions for Fleet-maintained apps').
Description check ❓ Inconclusive The description lacks substantive detail about the changes. While the template provides extensive guidance, the PR description only states 'Automated ingestion of latest Fleet-maintained app data' without explaining what was updated or why. Expand the description to explain which apps were updated, what specific metadata changed (e.g., version bumps from X to Y), and any relevant context about these automated updates.
✅ Passed checks (3 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fma-2606190930

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ee/maintained-apps/outputs/citrix-workspace/darwin.json`:
- Line 20: The bash script in the fe7ba180 string value currently calls
relaunch_application immediately after the sudo installer command without
checking if the installation succeeded. Capture the exit status of the sudo
installer -pkg command and verify it completed successfully before proceeding to
call relaunch_application. If the installer fails, the script should preserve
and propagate that failure status rather than allowing the subsequent
relaunch_application call to potentially mask the installation error.

In `@ee/maintained-apps/outputs/warp/darwin.json`:
- Around line 9-12: The sha256 field in the Warp darwin.json configuration is
set to "no_check", which disables integrity verification for the installer.
Replace the "no_check" value with the actual SHA256 checksum of the Warp.dmg
file referenced in the installer_url to enable artifact verification. Compute or
obtain the correct SHA256 hash for the specific installer version
(v0.2026.06.17.09.49.stable_01) and update the sha256 field accordingly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4dd6b654-f739-4e5c-9b97-8f89e2f13dd4

📥 Commits

Reviewing files that changed from the base of the PR and between 97f28d6 and 24d5151.

📒 Files selected for processing (13)
  • ee/maintained-apps/outputs/adobe-creative-cloud/windows.json
  • ee/maintained-apps/outputs/aws-cli/windows.json
  • ee/maintained-apps/outputs/bettertouchtool/darwin.json
  • ee/maintained-apps/outputs/citrix-workspace/darwin.json
  • ee/maintained-apps/outputs/codex-app/darwin.json
  • ee/maintained-apps/outputs/devin-desktop/darwin.json
  • ee/maintained-apps/outputs/dockside/darwin.json
  • ee/maintained-apps/outputs/figma/windows.json
  • ee/maintained-apps/outputs/garmin-express/darwin.json
  • ee/maintained-apps/outputs/gdevelop/windows.json
  • ee/maintained-apps/outputs/microsoft-teams/windows.json
  • ee/maintained-apps/outputs/signal/windows.json
  • ee/maintained-apps/outputs/warp/darwin.json

"a1c686b5": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n local PKGID=\"$1\"\n local FUNC=\"$2\"\n if [[ \"$PKGID\" == *\"*\" ]]; then\n local prefix=\"${PKGID%\\*}\"\n echo \"Expanding wildcard for PKGID: $PKGID\"\n for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n echo \"Processing $receipt\"\n \"$FUNC\" \"$receipt\"\n done\n else\n \"$FUNC\" \"$PKGID\"\n fi\n}\n\nforget_pkg() {\n local PKGID=\"$1\"\n expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n local PKGID=\"$1\"\n sudo pkgutil --forget \"$PKGID\"\n}\n\nquit_application() {\n local bundle_id=\"$1\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nremove_launchctl_service() {\n local service=\"$1\"\n local booleans=(\"true\" \"false\")\n local plist_status\n local paths\n local should_sudo\n\n echo \"Removing launchctl service ${service}\"\n\n for should_sudo in \"${booleans[@]}\"; do\n plist_status=$(launchctl list \"${service}\" 2>/dev/null)\n\n if [[ $plist_status == \\{* ]]; then\n if [[ $should_sudo == \"true\" ]]; then\n sudo launchctl remove \"${service}\"\n else\n launchctl remove \"${service}\"\n fi\n sleep 1\n fi\n\n paths=(\n \"/Library/LaunchAgents/${service}.plist\"\n \"/Library/LaunchDaemons/${service}.plist\"\n )\n\n # if not using sudo, prepend the home directory to the paths\n if [[ $should_sudo == \"false\" ]]; then\n for i in \"${!paths[@]}\"; do\n paths[i]=\"${HOME}${paths[i]}\"\n done\n fi\n\n for path in \"${paths[@]}\"; do\n if [[ -e \"$path\" ]]; then\n if [[ $should_sudo == \"true\" ]]; then\n sudo rm -f -- \"$path\"\n else\n rm -f -- \"$path\"\n fi\n fi\n done\n done\n}\n\nremove_pkg_files() {\n local PKGID=\"$1\"\n expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n local PKGID=\"$1\"\n local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n FULL_INSTALL_LOCATION=\"$VOLUME\"\n else\n FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n fi\n\n echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n root_app_dir=$(\n sudo pkgutil --only-dirs --files \"$PKGID\" \\\n | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n | grep 'Applications' \\\n | awk '{ print length, $0 }' \\\n | sort -n \\\n | head -n1 \\\n | cut -d' ' -f2-\n )\n if [ -n \"$root_app_dir\" ]; then\n echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n fi\n}\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nremove_launchctl_service 'com.citrix.AuthManager_Mac'\nremove_launchctl_service 'com.citrix.ctxusbd'\nremove_launchctl_service 'com.citrix.CtxWorkspaceHelperDaemon'\nremove_launchctl_service 'com.citrix.ctxworkspaceupdater'\nremove_launchctl_service 'com.citrix.devicetrust.launchagent'\nremove_launchctl_service 'com.citrix.ReceiverHelper'\nremove_launchctl_service 'com.citrix.ReceiverUninstallHelper'\nremove_launchctl_service 'com.citrix.ReceiverUpdaterHelper'\nremove_launchctl_service 'com.citrix.safariadapter'\nremove_launchctl_service 'com.citrix.ServiceRecords'\nremove_launchctl_service 'com.citrix.UninstallMonitor'\nquit_application 'Citrix.ServiceRecords'\nquit_application 'com.citrix.CitrixReceiverLauncher'\nquit_application 'com.citrix.receiver.nomas'\nquit_application 'com.citrix.ReceiverHelper'\nremove_pkg_files 'com.citrix.common'\nforget_pkg 'com.citrix.common'\nremove_pkg_files 'com.citrix.devicetrust.client'\nforget_pkg 'com.citrix.devicetrust.client'\nremove_pkg_files 'com.citrix.devicetrust.client.ica'\nforget_pkg 'com.citrix.devicetrust.client.ica'\nremove_pkg_files 'com.citrix.enterprisebrowserinstaller'\nforget_pkg 'com.citrix.enterprisebrowserinstaller'\nremove_pkg_files 'com.citrix.ICAClient'\nforget_pkg 'com.citrix.ICAClient'\nremove_pkg_files 'com.citrix.ICAClientcwa'\nforget_pkg 'com.citrix.ICAClientcwa'\nremove_pkg_files 'com.citrix.ICAClienthdx'\nforget_pkg 'com.citrix.ICAClienthdx'\nremove_pkg_files 'com.citrix.receiver.bcr'\nforget_pkg 'com.citrix.receiver.bcr'\ntrash $LOGGED_IN_USER '~/Library/Application Support/Citrix Receiver'\ntrash $LOGGED_IN_USER '~/Library/Application Support/Citrix Workspace'\ntrash $LOGGED_IN_USER '~/Library/Application Support/Citrix'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.citrix.CitrixReceiverLauncher'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.citrix.HdxRtcEngine'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.citrix.receiver*'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.citrix.ReceiverUpdater'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.citrix.receiver*'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.citrix.CitrixReceiverLauncher'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.citrix.receiver*'\ntrash $LOGGED_IN_USER '~/Library/Logs/Citrix Workspace'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.AuthManager.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.CitrixReceiverLauncher.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.HdxRtcEngine.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.receiver*.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.Receiver*.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.citrix.receiver.nomas.savedState'\ntrash $LOGGED_IN_USER '~/Library/WebKit/com.citrix.receiver.nomas'\n",
"d0785661": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.citrix.receiver.nomas'\nsudo installer -pkg \"$TMPDIR/CitrixWorkspaceAppUniversal26.03.10.40.pkg\" -target /\nrelaunch_application 'com.citrix.receiver.nomas'\n"
"ed152120": "#!/bin/bash\n\n# variables\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\nexpand_pkgid_and_map() {\n local PKGID=\"$1\"\n local FUNC=\"$2\"\n if [[ \"$PKGID\" == *\"*\" ]]; then\n local prefix=\"${PKGID%\\*}\"\n echo \"Expanding wildcard for PKGID: $PKGID\"\n for receipt in $(pkgutil --pkgs | grep \"^${prefix}\"); do\n echo \"Processing $receipt\"\n \"$FUNC\" \"$receipt\"\n done\n else\n \"$FUNC\" \"$PKGID\"\n fi\n}\n\nforget_pkg() {\n local PKGID=\"$1\"\n expand_pkgid_and_map \"$PKGID\" forget_receipt\n}\n\nforget_receipt() {\n local PKGID=\"$1\"\n sudo pkgutil --forget \"$PKGID\"\n}\n\nquit_application() {\n local bundle_id=\"$1\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nremove_launchctl_service() {\n local service=\"$1\"\n local booleans=(\"true\" \"false\")\n local plist_status\n local paths\n local should_sudo\n\n echo \"Removing launchctl service ${service}\"\n\n for should_sudo in \"${booleans[@]}\"; do\n plist_status=$(launchctl list \"${service}\" 2>/dev/null)\n\n if [[ $plist_status == \\{* ]]; then\n if [[ $should_sudo == \"true\" ]]; then\n sudo launchctl remove \"${service}\"\n else\n launchctl remove \"${service}\"\n fi\n sleep 1\n fi\n\n paths=(\n \"/Library/LaunchAgents/${service}.plist\"\n \"/Library/LaunchDaemons/${service}.plist\"\n )\n\n # if not using sudo, prepend the home directory to the paths\n if [[ $should_sudo == \"false\" ]]; then\n for i in \"${!paths[@]}\"; do\n paths[i]=\"${HOME}${paths[i]}\"\n done\n fi\n\n for path in \"${paths[@]}\"; do\n if [[ -e \"$path\" ]]; then\n if [[ $should_sudo == \"true\" ]]; then\n sudo rm -f -- \"$path\"\n else\n rm -f -- \"$path\"\n fi\n fi\n done\n done\n}\n\nremove_pkg_files() {\n local PKGID=\"$1\"\n expand_pkgid_and_map \"$PKGID\" remove_receipt_files\n}\n\nremove_receipt_files() {\n local PKGID=\"$1\"\n local PKGINFO VOLUME INSTALL_LOCATION FULL_INSTALL_LOCATION\n\n echo \"pkgutil --pkg-info-plist \\\"$PKGID\\\"\"\n PKGINFO=$(pkgutil --pkg-info-plist \"$PKGID\")\n VOLUME=$(echo \"$PKGINFO\" | awk '/<key>volume<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n INSTALL_LOCATION=$(echo \"$PKGINFO\" | awk '/<key>install-location<\\/key>/ {getline; gsub(/.*<string>|<\\/string>.*/, \"\"); print}')\n\n if [ -z \"$INSTALL_LOCATION\" ] || [ \"$INSTALL_LOCATION\" = \"/\" ]; then\n FULL_INSTALL_LOCATION=\"$VOLUME\"\n else\n FULL_INSTALL_LOCATION=\"$VOLUME/$INSTALL_LOCATION\"\n FULL_INSTALL_LOCATION=$(echo \"$FULL_INSTALL_LOCATION\" | sed 's|//|/|g')\n fi\n\n echo \"sudo pkgutil --only-files --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n sudo pkgutil --only-files --files \"$PKGID\" | sed \"s|^|/${INSTALL_LOCATION}/|\" | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n echo \"sudo pkgutil --only-dirs --files \\\"$PKGID\\\" | sed \\\"s|^|${FULL_INSTALL_LOCATION}/|\\\" | grep '\\\\.app$' | tr '\\\\\\\\n' '\\\\\\\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\"\n sudo pkgutil --only-dirs --files \"$PKGID\" | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" | grep '\\.app$' | tr '\\n' '\\0' | /usr/bin/sudo -u root -E -- /usr/bin/xargs -0 -- /bin/rm -rf\n\n root_app_dir=$(\n sudo pkgutil --only-dirs --files \"$PKGID\" \\\n | sed \"s|^|${FULL_INSTALL_LOCATION}/|\" \\\n | grep 'Applications' \\\n | awk '{ print length, $0 }' \\\n | sort -n \\\n | head -n1 \\\n | cut -d' ' -f2-\n )\n if [ -n \"$root_app_dir\" ]; then\n echo \"sudo rmdir -p \\\"$root_app_dir\\\" 2>/dev/null || :\"\n sudo rmdir -p \"$root_app_dir\" 2>/dev/null || :\n fi\n}\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nremove_launchctl_service 'com.citrix.AuthManager_Mac'\nremove_launchctl_service 'com.citrix.ctxusbd'\nremove_launchctl_service 'com.citrix.CtxWorkspaceHelperDaemon'\nremove_launchctl_service 'com.citrix.ctxworkspaceupdater'\nremove_launchctl_service 'com.citrix.devicetrust.launchagent'\nremove_launchctl_service 'com.citrix.ReceiverHelper'\nremove_launchctl_service 'com.citrix.ReceiverUninstallHelper'\nremove_launchctl_service 'com.citrix.safariadapter'\nremove_launchctl_service 'com.citrix.ServiceRecords'\nremove_launchctl_service 'com.citrix.UninstallMonitor'\nquit_application 'Citrix.ServiceRecords'\nquit_application 'com.citrix.CitrixReceiverLauncher'\nquit_application 'com.citrix.receiver.nomas'\nquit_application 'com.citrix.ReceiverHelper'\nremove_pkg_files 'com.citrix.common'\nforget_pkg 'com.citrix.common'\nremove_pkg_files 'com.citrix.devicetrust.client'\nforget_pkg 'com.citrix.devicetrust.client'\nremove_pkg_files 'com.citrix.devicetrust.client.ica'\nforget_pkg 'com.citrix.devicetrust.client.ica'\nremove_pkg_files 'com.citrix.enterprisebrowserinstaller'\nforget_pkg 'com.citrix.enterprisebrowserinstaller'\nremove_pkg_files 'com.citrix.ICAClient'\nforget_pkg 'com.citrix.ICAClient'\nremove_pkg_files 'com.citrix.ICAClientcwa'\nforget_pkg 'com.citrix.ICAClientcwa'\nremove_pkg_files 'com.citrix.ICAClienthdx'\nforget_pkg 'com.citrix.ICAClienthdx'\ntrash $LOGGED_IN_USER '~/Library/Application Support/Citrix Receiver'\ntrash $LOGGED_IN_USER '~/Library/Application Support/Citrix Workspace'\ntrash $LOGGED_IN_USER '~/Library/Application Support/Citrix'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.citrix.CitrixReceiverLauncher'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.citrix.HdxRtcEngine'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.citrix.receiver*'\ntrash $LOGGED_IN_USER '~/Library/Application Support/com.citrix.ReceiverUpdater'\ntrash $LOGGED_IN_USER '~/Library/Caches/com.citrix.receiver*'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.citrix.CitrixReceiverLauncher'\ntrash $LOGGED_IN_USER '~/Library/HTTPStorages/com.citrix.receiver*'\ntrash $LOGGED_IN_USER '~/Library/Logs/Citrix Workspace'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.AuthManager.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.CitrixReceiverLauncher.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.HdxRtcEngine.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.receiver*.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.citrix.Receiver*.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.citrix.receiver.nomas.savedState'\ntrash $LOGGED_IN_USER '~/Library/WebKit/com.citrix.receiver.nomas'\n",
"fe7ba180": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.citrix.receiver.nomas'\nsudo installer -pkg \"$TMPDIR/CitrixWorkspaceAppUniversal26.03.0.49.pkg\" -target /\nrelaunch_application 'com.citrix.receiver.nomas'\n"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Preserve installer failure status before relaunch logic.

In Line 20 (fe7ba180), adding relaunch_application after sudo installer can mask install failures because the script’s final status may come from the relaunch path instead of the installer.

Suggested fix
 quit_and_track_application 'com.citrix.receiver.nomas'
-sudo installer -pkg "$TMPDIR/CitrixWorkspaceAppUniversal26.03.0.49.pkg" -target /
-relaunch_application 'com.citrix.receiver.nomas'
+install_status=0
+sudo installer -pkg "$TMPDIR/CitrixWorkspaceAppUniversal26.03.0.49.pkg" -target / || install_status=$?
+if [[ $install_status -eq 0 ]]; then
+  relaunch_application 'com.citrix.receiver.nomas'
+fi
+exit $install_status
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"fe7ba180": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.citrix.receiver.nomas'\nsudo installer -pkg \"$TMPDIR/CitrixWorkspaceAppUniversal26.03.0.49.pkg\" -target /\nrelaunch_application 'com.citrix.receiver.nomas'\n"
"fe7ba180": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.citrix.receiver.nomas'\ninstall_status=0\nsudo installer -pkg \"$TMPDIR/CitrixWorkspaceAppUniversal26.03.0.49.pkg\" -target / || install_status=$?\nif [[ $install_status -eq 0 ]]; then\n relaunch_application 'com.citrix.receiver.nomas'\nfi\nexit $install_status\n"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/citrix-workspace/darwin.json` at line 20, The bash
script in the fe7ba180 string value currently calls relaunch_application
immediately after the sudo installer command without checking if the
installation succeeded. Capture the exit status of the sudo installer -pkg
command and verify it completed successfully before proceeding to call
relaunch_application. If the installer fails, the script should preserve and
propagate that failure status rather than allowing the subsequent
relaunch_application call to potentially mask the installation error.

Comment on lines +9 to 12
"installer_url": "https://releases.warp.dev/stable/v0.2026.06.17.09.49.stable_01/Warp.dmg",
"install_script_ref": "007bc795",
"uninstall_script_ref": "932356de",
"sha256": "no_check",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Require checksum verification for the new Warp artifact.

Line 9 points to a new installer, but this entry still uses sha256: "no_check" (Line 12), which disables artifact integrity validation for this release.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/warp/darwin.json` around lines 9 - 12, The sha256
field in the Warp darwin.json configuration is set to "no_check", which disables
integrity verification for the installer. Replace the "no_check" value with the
actual SHA256 checksum of the Warp.dmg file referenced in the installer_url to
enable artifact verification. Compute or obtain the correct SHA256 hash for the
specific installer version (v0.2026.06.17.09.49.stable_01) and update the sha256
field accordingly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants