Update Fleet-maintained apps

[fleet-release]

Automated ingestion of latest Fleet-maintained app data.

Summary by CodeRabbit

• New Features

  • Updated the macOS Tailscale app to version 1.98.10.

• Bug Fixes

  • Improved the uninstall process by closing the app, removing installed components, and moving related user data to the Trash.

[github-actions]

Script Diff Results

ee/maintained-apps/outputs/tailscale-app/darwin.json

=== Install // 92413a45 -> 06b9111a ===

--- /tmp/old.3OtG38	2026-07-29 04:06:26.147348869 +0000
+++ /tmp/new.uZVZIt	2026-07-29 04:06:26.148348916 +0000
@@ -96,5 +96,5 @@
 
 # install pkg files
 quit_and_track_application 'io.tailscale.ipn.macsys'
-sudo installer -pkg "$TMPDIR/Tailscale-1.98.9-macos.pkg" -target /
+sudo installer -pkg "$TMPDIR/Tailscale-1.98.10-macos.pkg" -target /
 relaunch_application 'io.tailscale.ipn.macsys'

=== Uninstall Script (no changes) ===

[coderabbitai]

Walkthrough

The Tailscale macOS maintained-app definition is updated from version 1.98.9 to 1.98.10, including release detection, installer metadata, script references, and checksum values. The installer now uses the 1.98.10 package. The uninstall script now quits Tailscale, removes selected /usr/local files, and moves application-related user paths to the user trash instead of removing package receipts.

Possibly related PRs

• fleetdm/fleet#49944: Updates macOS maintained-app version metadata in the same darwin.json fields.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is far too brief and does not follow the required template sections or checklist items.	Add the template sections, especially Related issue, checklist entries, and testing details, or delete irrelevant items if they do not apply.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the Fleet-maintained apps update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fma-2607290401

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ee/maintained-apps/outputs/tailscale-app/darwin.json`:
- Around line 19-20: Propagate failures in the installer and uninstaller
scripts: make the `sudo installer` call fail the install flow before
`relaunch_application` runs, and ensure `remove_pkg_files`, `forget_pkg`,
`forget_receipt`, `remove_receipt_files`, `trash`, and critical `rm`/`mv`
operations return nonzero when commands fail. Preserve successful behavior while
allowing the script’s final status to report any partial or failed operation.
- Line 20: Update the uninstall sequence to run `tailscale configure sysext
deactivate` after `quit_application` and before `remove_pkg_files`. Check the
command’s result and wait until the system extension is removed, failing the
script if deactivation or removal verification fails; only continue to
package-file removal after successful deactivation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: dd1b7a34-8a15-4b6a-8713-7c6ec58f3478

📥 Commits

Reviewing files that changed from the base of the PR and between f4d7064 and fd34a0c.

📒 Files selected for processing (1)

• ee/maintained-apps/outputs/tailscale-app/darwin.json

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Propagate installer and uninstaller failures.

If sudo installer fails, relaunch_application can still return success, causing the install script to exit successfully. The uninstall script similarly ignores failures from pkgutil, rm, and mv, so automation can report success after a partial uninstall. Explicitly check critical commands and return nonzero on failure.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/tailscale-app/darwin.json` around lines 19 - 20,
Propagate failures in the installer and uninstaller scripts: make the `sudo
installer` call fail the install flow before `relaunch_application` runs, and
ensure `remove_pkg_files`, `forget_pkg`, `forget_receipt`,
`remove_receipt_files`, `trash`, and critical `rm`/`mv` operations return
nonzero when commands fail. Preserve successful behavior while allowing the
script’s final status to report any partial or failed operation.

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== file excerpt =="
wc -l ee/maintained-apps/outputs/tailscale-app/darwin.json
if [ -f ee/maintained-apps/outputs/tailscale-app/darwin.json ]; then
  python3 - <<'PY'
import json
from pathlib import Path
p=Path("ee/maintained-apps/outputs/tailscale-app/darwin.json")
d=json.loads(p.read_text())
s=d["outputs"][list(d["outputs"])[0]]["script"] if isinstance(d["outputs"], dict) else d["outputs"][0]["script"]
print("script_type:", type(s))
print("sysext found:", "sysext" in s)
print("deactivate/uninstall/unregister/tailscaled/deactivate found:", any(w in s.casefold() for w in ["sysext","deactivate","uninstall","unregister"]))
for i,line in enumerate(s.splitlines(),1):
    if "quit_application" in line or "remove_pkg_files" in line or "forget_pkg" in line or "tailscale" in line or "sysext" in line:
        print(f"{i}: {line}")
PY
fi

echo
echo "== target Tailscale uninstall guidance mentions =="
python3 - <<'PY'
import urllib.request
url="https://tailscale.com/docs/features/client/uninstall/_rsc=1sdj8/and/tab=macos+%28standalone%29/_rsc=1sdj8/and/tab=macos+%28standalone%29"
# Canonical link from comment may require exact path; try primary docs URL with query.
urls=[
    "https://tailscale.com/docs/features/client/uninstall",
    "https://tailscale.com/docs/administration/uninstall",
    "https://tailscale.com/kb/1103/uninstall-tailscale",
]
for u in urls:
    print("URL:", u)
    try:
        with urllib.request.urlopen(urllib.request.Request(u, headers={"User-Agent":"CodeRabbit-verifier"}), timeout=20) as r:
            text=r.read().decode("utf-8", "replace")
        print("status:", r.status, "contains sysext:", "sysext" in text or "system extension" in text.lower())
        for w in ["com.tailscale.ipn.macsys","system extension","deactivate","tailnet","uninstall"]:
            count=sum(l.count(w) for l in text.splitlines() if w.lower() in l.lower())
            if count>0:
                print(f" hits for {w!r}: {count}")
    except Exception as e:
        print("ERROR:", repr(e))
PY

Repository: fleetdm/fleet

Length of output: 319

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== raw darwin.json =="
cat -n ee/maintained-apps/outputs/tailscale-app/darwin.json

echo
echo "== keys/top values =="
python3 - <<'PY'
import json
from pathlib import Path

p = Path("ee/maintained-apps/outputs/tailscale-app/darwin.json")
data = json.loads(p.read_text())

def show(obj, path="root", limit=20):
    if isinstance(obj, dict):
        print(path, "type=dict keys=", sorted(obj.keys()))
        for i, (k, v) in enumerate(obj.items()):
            if i >= limit:
                print(" ... truncated")
                break
            print(path+f"[{k!r}]=")
            show(v, path+f"[{k!r}]", limit=limit)
    elif isinstance(obj, list):
        print(path, "type=list len=", len(obj))
        for i, v in enumerate(obj[:limit]):
            print(path+f"[{i}]=")
            show(v, path+f"[{i}]", limit=5)
    else:
        print(path, "type=", type(obj).__name__, "value=", repr(obj).replace("\n","\\n")[:2000])

show(data)
PY

echo
echo "== exact relevant command/text searches in JSON =="
python3 - <<'PY'
from pathlib import Path
import json
p = Path("ee/maintained-apps/outputs/tailscale-app/darwin.json")
s = json.loads(p.read_text())
def dump_strings(obj, path=""):
    found = []
    if isinstance(obj, str):
        lower = obj.lower()
        if any(x in lower for x in ["sysext","deactivate","uninstall","unregister","quit_application","remove_pkg_files","forget_pkg","com.tailscale.ipn.macsys","io.tailscale.ipn.macsys","tailscale"]):
            for i,line in enumerate(obj.splitlines(),1):
                if any(x in line for x in ["quit_application","remove_pkg_files","forget_pkg","tailscale","sysext","deactivate","uninstall","unregister","com.tailscale.ipn.macsys","io.tailscale.ipn.macsys"]):
                    print(f"{path}:{i}: {line}")
    elif isinstance(obj, dict):
        for k,v in obj.items():
            dump_strings(v, f"{path}.{k}")
    elif isinstance(obj, list):
        for i,v in enumerate(obj):
            dump_strings(v, f"{path}[{i}]")
dump_strings(s)
PY

Repository: fleetdm/fleet

Length of output: 19079

---

🌐 Web query:

Tailscale macOS standalone uninstall sysext deactivate com.tailscale.ipn.macsys

💡 Result:

To deactivate or manage the Tailscale system extension (com.tailscale.ipn.macsys) on the Standalone variant of the macOS client, you can use the built-in Tailscale CLI command [1][2]. The command to deactivate the extension is [1][2]: tailscale configure sysext deactivate For a complete removal or to troubleshoot issues with the extension, official Tailscale documentation provides a manual uninstallation process that involves deleting specific files and containers [3][4]. Manual Uninstallation Steps: 1. Deactivate the extension using the CLI command above (if possible) [1][2]. 2. If you are also removing the VPN configuration, you may need to run: tailscale configure mac-vpn uninstall [1] 3. Remove the associated files and containers from your library. Because some files may be owned by the root user, use sudo rm -rf in the Terminal [3][4]: ~/Library/Application Scripts/.io.tailscale.ipn.macsys ~/Library/Application Scripts/io.tailscale.ipn.macsys ~/Library/Application Scripts/io.tailscale.ipn.macsys.login-item-helper ~/Library/Application Scripts/io.tailscale.ipn.macsys.share-extension ~/Library/Caches/io.tailscale.ipn.macsys ~/Library/Containers/io.tailscale.ipn.macsys ~/Library/Containers/io.tailscale.ipn.macsys.login-item-helper ~/Library/Containers/io.tailscale.ipn.macsys.share-extension ~/Library/Containers/Tailscale ~/Library/Group Containers/.io.tailscale.ipn.macsys ~/Library/HTTPStorages/io.tailscale.ipn.macsys ~/Library/Preferences/io.tailscale.ipn.macsys.plist /Library/Tailscale Important Considerations: - Variants: Do not mix the Mac App Store and Standalone variants on the same machine, as this can cause extension conflicts [5][6]. If you have both, uninstall all versions, reboot, and install only your preferred variant [6]. - Troubleshooting: If the extension remains stuck or problematic, a system reboot is recommended to clear caches [7][6]. For advanced inspection of installed system extensions, you can use the system command systemextensionctl list [6].

Citations:

• 1: https://gitea.codinget.me/webnet/tailscale/src/commit/a1dcf12b671e8668b1bd3eedc7cfcb4381b9d29c/cmd/tailscale/cli/configure_apple.go
• 2: https://tailscale.com/docs/reference/tailscale-cli?tab=bash
• 3: https://tailscale.com/docs/features/client/uninstall?tab=macos+%28standalone%29
• 4: https://tailscale.com/docs/features/client/uninstall
• 5: https://tailscale.com/docs/concepts/macos-variants
• 6: macOS Tahoe (26.x) + Tailscale: Orphaned App Store System Extension Completely Breaks PKG Install tailscale/tailscale#17891
• 7: Cannot do a clean uninstall of tailscale App Store (MacOS) to switch to tailscale.pkg tailscale/tailscale#13222

---

Deactivate the Tailscale system extension before deleting package files.

The uninstall script quits the GUI, then removes files and forgets com.tailscale.ipn.macsys, but does not deactivate the registered Tailscale system extension. Run tailscale configure sysext deactivate, wait/check that macOS removes the extension, and fail if it fails, before calling remove_pkg_files.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/tailscale-app/darwin.json` at line 20, Update the
uninstall sequence to run `tailscale configure sysext deactivate` after
`quit_application` and before `remove_pkg_files`. Check the command’s result and
wait until the system extension is removed, failing the script if deactivation
or removal verification fails; only continue to package-file removal after
successful deactivation.

[github-actions]

Closing in favor of #50121.