From d5e7014fe4a35d55ef9f41e43fa0952da2afa03f Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:35 +0000 Subject: [PATCH 01/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/logging/pubsub.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/server/logging/pubsub.go b/server/logging/pubsub.go index 6f5b19fedc8..94718a04a79 100644 --- a/server/logging/pubsub.go +++ b/server/logging/pubsub.go @@ -78,9 +78,13 @@ func (w *pubSubLogWriter) Write(ctx context.Context, logs []json.RawMessage) err } if len(data)+estimateAttributeSize(attributes) > pubsub.MaxPublishRequestBytes { + logPreview := log + if len(logPreview) > 100 { + logPreview = logPreview[:100] + } w.logger.InfoContext(ctx, "dropping log over 10MB PubSub limit", "size", len(data), - "log", string(log[:100])+"...", + "log", string(logPreview)+"...", ) continue } @@ -95,6 +99,9 @@ func (w *pubSubLogWriter) Write(ctx context.Context, logs []json.RawMessage) err // Wait for each message to be pushed to the server for _, result := range results { + if result == nil { + continue + } _, err := result.Get(ctx) if err != nil { return ctxerr.Wrap(ctx, err, "pubsub publish") From 1f82791027da30453348c5c94e4cdb8d81fa8119 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:36 +0000 Subject: [PATCH 02/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/mdm/scep/cmd/scepclient/scepclient.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/server/mdm/scep/cmd/scepclient/scepclient.go b/server/mdm/scep/cmd/scepclient/scepclient.go index b840c44eb73..6b9fb6db706 100644 --- a/server/mdm/scep/cmd/scepclient/scepclient.go +++ b/server/mdm/scep/cmd/scepclient/scepclient.go @@ -88,8 +88,7 @@ func run(cfg runCfg) error { csr, err := loadOrMakeCSR(cfg.csrPath, opts) if err != nil { - fmt.Println(err) - os.Exit(1) + return fmt.Errorf("load or make CSR: %w", err) } var self *x509.Certificate @@ -256,7 +255,7 @@ func validateFlags(keyPath, serverURL, caFingerprint string, useKeyEnciphermentS } _, err := url.Parse(serverURL) if err != nil { - return fmt.Errorf("invalid server-url flag parameter %s", err) + return fmt.Errorf("invalid server-url flag parameter: %w", err) } if caFingerprint != "" && useKeyEnciphermentSelector { return errors.New("ca-fingerprint and key-encipherment-selector can't be used at the same time") From a0d56cd9327b993af58d34f9974ca900f45b09dc Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:37 +0000 Subject: [PATCH 03/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- cmd/cve/generate.go | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/cmd/cve/generate.go b/cmd/cve/generate.go index 1e7913a41c5..d417bf0f74f 100644 --- a/cmd/cve/generate.go +++ b/cmd/cve/generate.go @@ -153,7 +153,7 @@ func downloadLatestGitHubAsset(dbDir, fileName string) error { defer resp.Body.Close() if resp.StatusCode != http.StatusOK { - return fmt.Errorf("get last mod start date: %w", fmt.Errorf("unexpected status code %d", resp.StatusCode)) + return fmt.Errorf("unexpected status code %d fetching %s", resp.StatusCode, fileName) } lastModStartDate, err := io.ReadAll(resp.Body) @@ -271,11 +271,26 @@ func gunzipFileToDisk(filename, dbpath string) error { // Using a maxBytes limit to prevent decompression bombs: gosec G110 maxBytes := 200 * 1024 * 1024 // 200MB - _, err = io.CopyN(out, gz, int64(maxBytes)) + written, err := io.CopyN(out, gz, int64(maxBytes)) if err != nil && err != io.EOF { msg := fmt.Sprintf("error copying file %s: %v", f.Name(), err) panic(msg) } + if written == int64(maxBytes) { + // Check if there is more data beyond the limit, which means the file + // exceeds maxBytes and was not fully copied; fail rather than silently + // truncate. + extra := make([]byte, 1) + n, peekErr := gz.Read(extra) + if n > 0 { + msg := fmt.Sprintf("error copying file %s: exceeds maximum allowed size of %d bytes", f.Name(), maxBytes) + panic(msg) + } + if peekErr != nil && peekErr != io.EOF { + msg := fmt.Sprintf("error copying file %s: %v", f.Name(), peekErr) + panic(msg) + } + } return nil } From ff0b47dfe37836293c23ca2a6d058fef77e7a4de Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:38 +0000 Subject: [PATCH 04/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/mdm/apple/profile_verifier.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/server/mdm/apple/profile_verifier.go b/server/mdm/apple/profile_verifier.go index 3053488937a..e11aff813de 100644 --- a/server/mdm/apple/profile_verifier.go +++ b/server/mdm/apple/profile_verifier.go @@ -55,7 +55,7 @@ func VerifyHostMDMProfiles(ctx context.Context, ds fleet.ProfileVerificationStor expectedByProfIdentifier, err := ds.GetHostMDMProfilesExpectedForVerification(ctx, host) if err != nil { - return err + return ctxerr.Wrap(ctx, err, "getting expected MDM profiles for verification") } missing := make([]string, 0, len(expectedByProfIdentifier)) @@ -85,7 +85,7 @@ func VerifyHostMDMProfiles(ctx context.Context, ds fleet.ProfileVerificationStor if len(missing) > 0 { counts, err := ds.GetHostMDMProfilesRetryCounts(ctx, host) if err != nil { - return err + return ctxerr.Wrap(ctx, err, "getting host MDM profile retry counts") } retriesByProfileIdentifier := make(map[string]uint, len(counts)) for _, r := range counts { @@ -174,3 +174,4 @@ func HandleHostMDMProfileInstallResult(ctx context.Context, ds fleet.ProfileVeri } return nil } + From 2463fcd4ab09067eab6af9704c45f17ce76bff8d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:39 +0000 Subject: [PATCH 05/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- orbit/pkg/platform/platform_windows.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/orbit/pkg/platform/platform_windows.go b/orbit/pkg/platform/platform_windows.go index bb190eda4f9..5ffbff9cb86 100644 --- a/orbit/pkg/platform/platform_windows.go +++ b/orbit/pkg/platform/platform_windows.go @@ -163,7 +163,7 @@ func GetProcessesByName(name string) ([]*gopsutil_process.Process, error) { // sanity check on returned snapshot handle if snapshot == windows.InvalidHandle { - return nil, errors.New("the snapshot returned returned by CreateToolhelp32Snapshot is invalid") + return nil, errors.New("the snapshot returned by CreateToolhelp32Snapshot is invalid") } // Closing the handle to avoid handle leaks. defer windows.CloseHandle(snapshot) //nolint:errcheck @@ -322,7 +322,7 @@ func hardwareGetSMBiosUUID() (string, error) { // UUID sanity check isValidUUID, err := isValidUUID(uuidBytes) if err != nil { - return "", fmt.Errorf("%v", err) + return "", fmt.Errorf("%w", err) } if !isValidUUID { From c6e2defca95f7b3b549d8a4d491b1c64de936ce2 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:40 +0000 Subject: [PATCH 06/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/service/client_setup.go | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/server/service/client_setup.go b/server/service/client_setup.go index 36c312efef9..b899d4b27a2 100644 --- a/server/service/client_setup.go +++ b/server/service/client_setup.go @@ -42,10 +42,6 @@ func (c *Client) Setup(email, name, password, org string) (string, error) { ) } - if response.StatusCode != http.StatusOK { - return "", fmt.Errorf("setup got HTTP %d, expected 200", response.StatusCode) - } - var responseBody setupResponse err = json.NewDecoder(response.Body).Decode(&responseBody) if err != nil { @@ -58,3 +54,4 @@ func (c *Client) Setup(email, name, password, org string) (string, error) { return *responseBody.Token, nil } + From acd0731984721bfaebe54b2a40d6d7d1281c176e Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:41 +0000 Subject: [PATCH 07/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/mail/ses.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/mail/ses.go b/server/mail/ses.go index 9cdd7577116..519a3fb606f 100644 --- a/server/mail/ses.go +++ b/server/mail/ses.go @@ -106,7 +106,7 @@ func (s *sesSender) sendMail(ctx context.Context, e fleet.Email, msg []byte) err SourceArn: &s.sourceArn, }) if err != nil { - return err + return fmt.Errorf("send raw email via ses: %w", err) } return nil } From 533515089a4831316fae7c12200bbdb45f8030f8 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:42 +0000 Subject: [PATCH 08/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- tools/android/android.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/android/android.go b/tools/android/android.go index c4e5c54743f..95fb6c6ea5c 100644 --- a/tools/android/android.go +++ b/tools/android/android.go @@ -223,7 +223,7 @@ func devicesDelete(mgmt *androidmanagement.Service, enterpriseID string, deviceI } _, err := mgmt.Enterprises.Devices.Delete("enterprises/" + enterpriseID + "/devices/" + deviceID).Do() if err != nil { - log.Fatalf("Error listing devices: %v", err) + log.Fatalf("Error deleting device: %v", err) } log.Printf("Device %s deleted", deviceID) } From fcdaab5058fc9dba674ae4a67344e8906d789875 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:43 +0000 Subject: [PATCH 09/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/fleet/agent_options.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/fleet/agent_options.go b/server/fleet/agent_options.go index fb128c575bd..706b5fd0bcd 100644 --- a/server/fleet/agent_options.go +++ b/server/fleet/agent_options.go @@ -65,7 +65,7 @@ func SuggestAgentOptionsCorrection(err error) error { if field := GetJSONUnknownField(err); field != nil { correctKeyPath, keyErr := FindAgentOptionsKeyPath(*field) if keyErr != nil { - return fmt.Errorf("error parsing generated agent options struct: %w", err) + return fmt.Errorf("error parsing generated agent options struct: %w", keyErr) } var keyPathJoined string switch pathLen := len(correctKeyPath); { From 6673a95d446fb5c4c32591e5d9575d1c39039132 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:45 +0000 Subject: [PATCH 10/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- orbit/pkg/update/flag_runner.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/orbit/pkg/update/flag_runner.go b/orbit/pkg/update/flag_runner.go index b70d017bd3f..e603e8ee66c 100644 --- a/orbit/pkg/update/flag_runner.go +++ b/orbit/pkg/update/flag_runner.go @@ -152,7 +152,7 @@ func (r *ExtensionRunner) Run(config *fleet.OrbitConfig) error { } return nil default: - return fmt.Errorf("stat file: %s", extensionAutoLoadFile) + return fmt.Errorf("stat file %s: %w", extensionAutoLoadFile, err) } } From 1760faa44a1c494fbab77d68ebed359037450cfd Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:45 +0000 Subject: [PATCH 11/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- orbit/cmd/desktop/desktop_linux.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/orbit/cmd/desktop/desktop_linux.go b/orbit/cmd/desktop/desktop_linux.go index 5ad2febfffd..f0974e41637 100644 --- a/orbit/cmd/desktop/desktop_linux.go +++ b/orbit/cmd/desktop/desktop_linux.go @@ -54,7 +54,8 @@ func blockWaitForStopEvent(_ string) error { func trayIconExists() bool { conn, err := dbus.SessionBus() if err != nil { - log.Error().Err(err) + log.Error().Err(err).Msg("trayIconExists: connect to session bus") + return false } // Get the name we would expect systray to reserve for our tray icon. From d920560a4f639dfa38225cfb4165aa5771d302f8 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:46 +0000 Subject: [PATCH 12/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- .../mysql/migrations/tables/20240327115530_AddDDMTables.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/datastore/mysql/migrations/tables/20240327115530_AddDDMTables.go b/server/datastore/mysql/migrations/tables/20240327115530_AddDDMTables.go index 357604e9c2d..3eb3961ed2e 100644 --- a/server/datastore/mysql/migrations/tables/20240327115530_AddDDMTables.go +++ b/server/datastore/mysql/migrations/tables/20240327115530_AddDDMTables.go @@ -125,7 +125,7 @@ CREATE TABLE IF NOT EXISTS host_mdm_apple_declarations ( ) `) if err != nil { - return fmt.Errorf("creatign host_mdm_apple_declarations table %w", err) + return fmt.Errorf("creating host_mdm_apple_declarations table: %w", err) } return nil From ba91e79148ad792ffbbb6545c5cf25467d6d74c0 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:47 +0000 Subject: [PATCH 13/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- .../mysql/migrations/tables/20250331042354_AddSCIMTables.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/datastore/mysql/migrations/tables/20250331042354_AddSCIMTables.go b/server/datastore/mysql/migrations/tables/20250331042354_AddSCIMTables.go index a431aeb61eb..e7a63b855ca 100644 --- a/server/datastore/mysql/migrations/tables/20250331042354_AddSCIMTables.go +++ b/server/datastore/mysql/migrations/tables/20250331042354_AddSCIMTables.go @@ -68,7 +68,7 @@ func Up_20250331042354(tx *sql.Tx) error { `) if err != nil { - return fmt.Errorf("failed to create scim tables: %s", err) + return fmt.Errorf("failed to create scim tables: %w", err) } return nil From 91674c033e21d24a155571aee9a6a05502ac827a Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:48 +0000 Subject: [PATCH 14/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- .../tables/20251124090450_AddHostPlatformFleetVar.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/datastore/mysql/migrations/tables/20251124090450_AddHostPlatformFleetVar.go b/server/datastore/mysql/migrations/tables/20251124090450_AddHostPlatformFleetVar.go index 3b6115c25e9..a215dda87f7 100644 --- a/server/datastore/mysql/migrations/tables/20251124090450_AddHostPlatformFleetVar.go +++ b/server/datastore/mysql/migrations/tables/20251124090450_AddHostPlatformFleetVar.go @@ -24,11 +24,11 @@ func Up_20251124090450(tx *sql.Tx) error { createdAt := time.Date(2025, 11, 19, 0, 0, 0, 0, time.UTC) stmt, args, err := sqlx.Named(insStmt, map[string]any{"created_at": createdAt}) if err != nil { - return fmt.Errorf("Failed to prepare insert for FLEET_VAR_HOST_PLATFORM: %s", err) + return fmt.Errorf("failed to prepare insert for FLEET_VAR_HOST_PLATFORM: %w", err) } _, err = tx.Exec(stmt, args...) if err != nil { - return fmt.Errorf("failed to insert FLEET_VAR_HOST_PLATFORM into fleet_variables: %s", err) + return fmt.Errorf("failed to insert FLEET_VAR_HOST_PLATFORM into fleet_variables: %w", err) } return nil } From b9aadb507c2900995a1ef4dc1327970988ccc235 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:50 +0000 Subject: [PATCH 15/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/service/openframe/openframe_token_refresher.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/service/openframe/openframe_token_refresher.go b/server/service/openframe/openframe_token_refresher.go index 7689008b648..d1a3650efc5 100644 --- a/server/service/openframe/openframe_token_refresher.go +++ b/server/service/openframe/openframe_token_refresher.go @@ -31,7 +31,7 @@ func (tr *OpenframeTokenRefresher) Start() error { log.Info().Msg("Scheduling token refresh job") _, err := tr.cron.AddFunc("*/5 * * * * *", tr.refreshToken) if err != nil { - return fmt.Errorf("failed to schedule token refresh job: %v", err) + return fmt.Errorf("failed to schedule token refresh job: %w", err) } tr.cron.Start() log.Info().Msg("Token refresh job started") @@ -73,4 +73,4 @@ func (tr *OpenframeTokenRefresher) refreshToken() { tr.authorizationManager.UpdateToken(token) log.Info().Msg("Openframe token refreshed") -} \ No newline at end of file +} From b365257dc14ce5cd5cd997caed4864976d205141 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:50 +0000 Subject: [PATCH 16/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- tools/dibble/pkg/command/policies.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tools/dibble/pkg/command/policies.go b/tools/dibble/pkg/command/policies.go index 7fb41237df9..22a93b9bfe0 100644 --- a/tools/dibble/pkg/command/policies.go +++ b/tools/dibble/pkg/command/policies.go @@ -1,6 +1,8 @@ package command import ( + "fmt" + "github.com/spf13/cobra" "github.com/fleetdm/fleet/v4/tools/dibble/pkg/seed" @@ -50,7 +52,7 @@ func listExistingTeams(c *Client) ([]seed.Team, error) { } `json:"fleets"` } if err := c.Get("/api/latest/fleet/fleets?per_page=500", &resp); err != nil { - return nil, err + return nil, fmt.Errorf("listing existing teams: %w", err) } out := make([]seed.Team, 0, len(resp.Teams)+len(resp.Fleets)) for _, t := range resp.Teams { From 18c146baf4e0e0d9903de6bd2635baa9b2c8552e Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:51 +0000 Subject: [PATCH 17/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- .../mysql/migrations/tables/20250304162702_AddCATables.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/datastore/mysql/migrations/tables/20250304162702_AddCATables.go b/server/datastore/mysql/migrations/tables/20250304162702_AddCATables.go index eb372690e38..3a4e9a28942 100644 --- a/server/datastore/mysql/migrations/tables/20250304162702_AddCATables.go +++ b/server/datastore/mysql/migrations/tables/20250304162702_AddCATables.go @@ -22,7 +22,7 @@ func Up_20250304162702(tx *sql.Tx) error { UNIQUE KEY idx_ca_config_assets_name (name) ) ENGINE = InnoDB DEFAULT CHARSET = utf8mb4 COLLATE = utf8mb4_unicode_ci`) if err != nil { - return fmt.Errorf("failed to create ca_config_assets table: %s", err) + return fmt.Errorf("failed to create ca_config_assets table: %w", err) } if !columnExists(tx, "host_mdm_managed_certificates", "not_valid_after") { @@ -31,7 +31,7 @@ func Up_20250304162702(tx *sql.Tx) error { ADD COLUMN not_valid_after DATETIME(6) NULL `) if err != nil { - return fmt.Errorf("failed to add not_valid_after column to host_mdm_managed_certificates table: %s", err) + return fmt.Errorf("failed to add not_valid_after column to host_mdm_managed_certificates table: %w", err) } } return nil From 82a5c804b8c1577e0e55f650f6d682ab7c92fac3 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:52 +0000 Subject: [PATCH 18/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- .../tables/20260409153714_AddApiEndpointPermissionsTables.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/datastore/mysql/migrations/tables/20260409153714_AddApiEndpointPermissionsTables.go b/server/datastore/mysql/migrations/tables/20260409153714_AddApiEndpointPermissionsTables.go index 0f5cfed5f84..ac92a4df05d 100644 --- a/server/datastore/mysql/migrations/tables/20260409153714_AddApiEndpointPermissionsTables.go +++ b/server/datastore/mysql/migrations/tables/20260409153714_AddApiEndpointPermissionsTables.go @@ -2,6 +2,7 @@ package tables import ( "database/sql" + "fmt" ) func init() { @@ -22,7 +23,7 @@ func Up_20260409153714(tx *sql.Tx) error { ) `) if err != nil { - return err + return fmt.Errorf("create user_api_endpoints table: %w", err) } } From 1b685f5f34879b6e7494ab0ceb039db492d90d13 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:53 +0000 Subject: [PATCH 19/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- .../20260522195225_AddManagedLocalAccountRotationColumns.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/datastore/mysql/migrations/tables/20260522195225_AddManagedLocalAccountRotationColumns.go b/server/datastore/mysql/migrations/tables/20260522195225_AddManagedLocalAccountRotationColumns.go index 36a5468dc92..4b9d308a263 100644 --- a/server/datastore/mysql/migrations/tables/20260522195225_AddManagedLocalAccountRotationColumns.go +++ b/server/datastore/mysql/migrations/tables/20260522195225_AddManagedLocalAccountRotationColumns.go @@ -29,7 +29,7 @@ func Up_20260522195225(tx *sql.Tx) error { ALTER TABLE host_managed_local_account_passwords ADD KEY idx_hmlap_auto_rotate_at (auto_rotate_at) `); err != nil { - return fmt.Errorf("adding rotation columns to host_managed_local_account_passwords: %w", err) + return fmt.Errorf("adding idx_hmlap_auto_rotate_at index to host_managed_local_account_passwords: %w", err) } } return nil From dbee11fe0ed82738e721178857441acf8d50760e Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:54 +0000 Subject: [PATCH 20/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- orbit/pkg/token/readwriter.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/orbit/pkg/token/readwriter.go b/orbit/pkg/token/readwriter.go index 279fc6a81d5..d3df1ebb6eb 100644 --- a/orbit/pkg/token/readwriter.go +++ b/orbit/pkg/token/readwriter.go @@ -92,7 +92,7 @@ func (rw *ReadWriter) SetRemoteUpdateFunc(f remoteUpdaterFunc) { func (rw *ReadWriter) Write(id string) error { if rw.remoteUpdate != nil { if err := rw.remoteUpdate(id); err != nil { - return err + return fmt.Errorf("remote update of token: %w", err) } } From 0b2a2e65a4df33a15d3babe478a9ba81cee9d1d7 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:56 +0000 Subject: [PATCH 21/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- orbit/pkg/update/runner.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/orbit/pkg/update/runner.go b/orbit/pkg/update/runner.go index 89f5267aae2..608d5a30851 100644 --- a/orbit/pkg/update/runner.go +++ b/orbit/pkg/update/runner.go @@ -372,7 +372,10 @@ func (r *Runner) updateTarget(target string) error { } func (r *Runner) Interrupt(err error) { - r.cancel <- struct{}{} + select { + case r.cancel <- struct{}{}: + default: + } } // compareVersion compares the old and new versions of a binary and prints the appropriate message. From 356f11a1ded3e3440c4917558714ee97dc1b80ee Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:57 +0000 Subject: [PATCH 22/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- .../tables/20240815000001_AddSelfServiceToVPPAppsTeams.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go b/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go index 951a8157793..d3b89b7b489 100644 --- a/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go +++ b/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go @@ -13,7 +13,7 @@ func Up_20240815000001(tx *sql.Tx) error { // Idempotent migration. if !columnExists(tx, "vpp_apps_teams", "self_service") { if _, err := tx.Exec("ALTER TABLE vpp_apps_teams ADD COLUMN self_service bool NOT NULL DEFAULT false"); err != nil { - return fmt.Errorf("Failed to add self_service to vpp_apps_teams: %w", err) + return fmt.Errorf("failed to add self_service to vpp_apps_teams: %w", err) } } return nil @@ -22,3 +22,4 @@ func Up_20240815000001(tx *sql.Tx) error { func Down_20240815000001(tx *sql.Tx) error { return nil } + From e052e2f3541aa2193a477e74f7b9041aca72c289 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:58 +0000 Subject: [PATCH 23/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- .../tables/20260217141240_ResetInvalidPlatformOnLabels.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/datastore/mysql/migrations/tables/20260217141240_ResetInvalidPlatformOnLabels.go b/server/datastore/mysql/migrations/tables/20260217141240_ResetInvalidPlatformOnLabels.go index 39b1f89fc48..332d2445b9f 100644 --- a/server/datastore/mysql/migrations/tables/20260217141240_ResetInvalidPlatformOnLabels.go +++ b/server/datastore/mysql/migrations/tables/20260217141240_ResetInvalidPlatformOnLabels.go @@ -2,6 +2,7 @@ package tables import ( "database/sql" + "fmt" ) func init() { @@ -12,7 +13,7 @@ func Up_20260217141240(tx *sql.Tx) error { // Idempotent migration. Naturally re-runnable (UPDATE/MODIFY/JSON-config only). _, err := tx.Exec(`UPDATE labels SET platform = '' WHERE platform NOT IN ('', 'centos', 'darwin', 'windows', 'ubuntu')`) if err != nil { - return err + return fmt.Errorf("resetting invalid platform on labels: %w", err) } return nil } From 30c44cb7f241a66b78e8b56d604282244b09f427 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:43:59 +0000 Subject: [PATCH 24/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/mdm/apple/cert.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/mdm/apple/cert.go b/server/mdm/apple/cert.go index 563f124db9d..551e41fb15c 100644 --- a/server/mdm/apple/cert.go +++ b/server/mdm/apple/cert.go @@ -132,12 +132,12 @@ func GetSignedAPNSCSR(client *http.Client, csr *x509.CertificateRequest) error { req, err := http.NewRequest(http.MethodPost, u, bytes.NewReader(b)) if err != nil { - return err + return fmt.Errorf("creating csr signing request for fleetdm api: %w", err) } resp, err := client.Do(req) if err != nil { - return err + return fmt.Errorf("sending csr signing request to fleetdm api: %w", err) } defer resp.Body.Close() From 4514078bb040cc847dd6c07267c84e1aa711e04b Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:44:00 +0000 Subject: [PATCH 25/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/mdm/internal/commonmdm/commonmdm.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/mdm/internal/commonmdm/commonmdm.go b/server/mdm/internal/commonmdm/commonmdm.go index 36b6209d6cf..9d4a9512a28 100644 --- a/server/mdm/internal/commonmdm/commonmdm.go +++ b/server/mdm/internal/commonmdm/commonmdm.go @@ -1,6 +1,7 @@ package commonmdm import ( + "fmt" "net/url" "path" ) @@ -10,7 +11,7 @@ import ( func ResolveURL(serverURL, relPath string, cleanQuery bool) (string, error) { u, err := url.Parse(serverURL) if err != nil { - return "", err + return "", fmt.Errorf("parsing server URL: %w", err) } u.Path = path.Join(u.Path, relPath) if cleanQuery { From db7c7c256a129feb08a3096b98f01813f780bb63 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:44:01 +0000 Subject: [PATCH 26/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/mdm/nanodep/client/transport.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/mdm/nanodep/client/transport.go b/server/mdm/nanodep/client/transport.go index b6842fd21d1..626583e03b2 100644 --- a/server/mdm/nanodep/client/transport.go +++ b/server/mdm/nanodep/client/transport.go @@ -234,7 +234,7 @@ func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) { session, err = DoAuth(t.client, sessionReq, tokens) if err != nil { - return nil, err + return nil, fmt.Errorf("transport: performing dep auth: %w", err) } // save our session token for use by following requests @@ -277,3 +277,4 @@ func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) { return resp, nil } + From ef66c59550f4eb548f928d5c0e6a79c1d8a4dbde Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:44:02 +0000 Subject: [PATCH 27/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/platform/http/post_json.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/platform/http/post_json.go b/server/platform/http/post_json.go index 595e8ce5069..d409d0bc996 100644 --- a/server/platform/http/post_json.go +++ b/server/platform/http/post_json.go @@ -33,13 +33,13 @@ func (e *errWithStatus) StatusCode() int { func PostJSONWithTimeout(ctx context.Context, url string, v any, logger *slog.Logger) error { jsonBytes, err := json.Marshal(v) if err != nil { - return err + return fmt.Errorf("marshal json body: %w", err) } client := fleethttp.NewClient(fleethttp.WithTimeout(30 * time.Second)) req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewBuffer(jsonBytes)) if err != nil { - return err + return fmt.Errorf("build POST request: %w", err) } req.Header.Set("Content-Type", "application/json") From fb225092540763cf4250dc30a0ac341ae027de56 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:44:03 +0000 Subject: [PATCH 28/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/service/redis_policy_set/redis_policy_set.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/server/service/redis_policy_set/redis_policy_set.go b/server/service/redis_policy_set/redis_policy_set.go index 7b3936db51d..321342d3796 100644 --- a/server/service/redis_policy_set/redis_policy_set.go +++ b/server/service/redis_policy_set/redis_policy_set.go @@ -51,7 +51,7 @@ func (r *redisFailingPolicySet) ListSets() ([]uint, error) { ids, err := redigo.Uint64s(conn.Do("SMEMBERS", r.policySetOfSetsKey())) if err != nil && err != redigo.ErrNil { - return nil, err + return nil, fmt.Errorf("list failing policy sets: %w", err) } policyIDs := make([]uint, len(ids)) for i := range ids { @@ -144,7 +144,10 @@ func (r *redisFailingPolicySet) RemoveHosts(policyID uint, hosts []fleet.PolicyS args = args.Add(hostEntry(host)) } _, err := conn.Do("SREM", args...) - return err + if err != nil { + return fmt.Errorf("remove hosts from policy set: %w", err) + } + return nil } // RemoveSet removes a policy set. From 3053cc2feb8c147687ac553c851ef6dde63e1a2e Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:44:04 +0000 Subject: [PATCH 29/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/vulnerabilities/utils/utils.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/vulnerabilities/utils/utils.go b/server/vulnerabilities/utils/utils.go index bf718ccd8ff..8477a97b08a 100644 --- a/server/vulnerabilities/utils/utils.go +++ b/server/vulnerabilities/utils/utils.go @@ -138,7 +138,7 @@ func LatestFile(fileName string, dir string) (string, error) { case errors.Is(err, fs.ErrNotExist): files, err := os.ReadDir(dir) if err != nil { - return "", err + return "", fmt.Errorf("read dir %q: %w", dir, err) } prefix := strings.Split(fileName, "-")[0] From be69b81eb1833db08b9b2f40bd7f4f6311170659 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:44:05 +0000 Subject: [PATCH 30/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- server/worker/macos_setup_assistant.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/worker/macos_setup_assistant.go b/server/worker/macos_setup_assistant.go index 7f55e36926b..b3a24d97e32 100644 --- a/server/worker/macos_setup_assistant.go +++ b/server/worker/macos_setup_assistant.go @@ -349,7 +349,7 @@ func (m *MacosSetupAssistant) getTeamNoTeam(ctx context.Context, tmID *uint) (*f if tmID != nil { tm, err := m.Datastore.TeamWithExtras(ctx, *tmID) // TODO see if we can convert this workflow to TeamLite if err != nil { - return nil, err + return nil, ctxerr.Wrap(ctx, err, "get team with extras") } team = tm } From 0f8ade82d596b65dcc12d68b181658ab81738ae5 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:44:06 +0000 Subject: [PATCH 31/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- tools/desktop/desktop.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/desktop/desktop.go b/tools/desktop/desktop.go index fb1f3ac9a04..4fcf1d9dfdd 100644 --- a/tools/desktop/desktop.go +++ b/tools/desktop/desktop.go @@ -235,11 +235,11 @@ func createMacOSApp(version, authority string, notarize bool) error { defer os.Remove(notarizationZip) if err := packaging.Notarize(notarizationZip, "com.fleetdm.desktop"); err != nil { - return err + return fmt.Errorf("notarize app: %w", err) } if err := packaging.Staple(appDir); err != nil { - return err + return fmt.Errorf("staple app: %w", err) } } From 22150ca424f6c1c7e33880f5cc3996642c71da76 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:44:07 +0000 Subject: [PATCH 32/32] fix(FLEETMDM-002-2): 37 review findings across 32 files --- tools/github-manage/cmd/gm/bugs.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/github-manage/cmd/gm/bugs.go b/tools/github-manage/cmd/gm/bugs.go index ee373ba264a..3a8349941ae 100644 --- a/tools/github-manage/cmd/gm/bugs.go +++ b/tools/github-manage/cmd/gm/bugs.go @@ -192,12 +192,12 @@ func fetchOpenBugs(limit int) ([]BugIssue, error) { output, err := ghapi.RunCommandAndReturnOutput(command) if err != nil { - return nil, fmt.Errorf("gh command failed: %v", err) + return nil, fmt.Errorf("gh command failed: %w", err) } var bugs []BugIssue if err := json.Unmarshal(output, &bugs); err != nil { - return nil, fmt.Errorf("failed to parse JSON response: %v", err) + return nil, fmt.Errorf("failed to parse JSON response: %w", err) } if len(bugs) == limit {