fleet/server/mdm/apple
Victor Lyuboslavsky 6b7d232522
Additional CA validation (#27169)
For #26623

- Updated `github.com/groob/plist` to `github.com/micromdm/plist` -- it
was renamed
- Added validation that restricts DigiCert Fleet variables to
`com.apple.security.pkcs12` payloads plus additional restrictions
- Added validation that restricts Custom SCEP Fleet variables to
`com.apple.security.scep` payloads plus additional restrictions
- Enabled multiple CAs (Fleet variables) to be present in an Apple MDM
profile. But each CA can only be used once. For example, we can have
DigiCert CA and Custom SCEP CA in one Apple profile.

# Checklist for submitter
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
2025-03-19 08:27:55 -05:00
..
appmanifest Additional CA validation (#27169) 2025-03-19 08:27:55 -05:00
gdmf Add LUKS escrow trigger and orbit config endpoints, persist/retrieve LUKS passphrase (#23763) 2024-11-18 16:44:25 -06:00
itunes fix: report a failure in setup experience if a VPP app installation fails due to lack of licenses (#27163) 2025-03-17 09:43:51 -04:00
mobileconfig DigiCert backend (#26914) 2025-03-10 13:02:49 -05:00
vpp fix: don't fail when there are no VPP app version updates (#26677) 2025-02-27 17:00:55 -05:00
apple_bm.go Fix bug in ABM token renewal flow (#22988) 2024-10-18 13:16:04 -05:00
apple_mdm.go Add MDM CertificateList command for host certificates feature (#26479) 2025-02-20 16:49:41 -06:00
apple_mdm_external_test.go MABM: fix/update non-integration MABM-related skipped tests (#21799) 2024-09-04 10:08:22 -04:00
apple_mdm_test.go Additional CA validation (#27169) 2025-03-19 08:27:55 -05:00
AppleIncRootCertificate.cer Enforce latest OS when macOS, iOS, and iPadOS hosts automatically enroll (#21291) 2024-08-21 13:21:11 -05:00
AppleIphoneDeviceCA.cer implement OTA enrollment (#21942) 2024-09-10 16:52:17 -03:00
cert.go Allow APNS key to be in unencrypted PKCS8 format (#24570) 2024-12-09 16:23:22 -06:00
commander.go Additional CA validation (#27169) 2025-03-19 08:27:55 -05:00
commander_test.go Additional CA validation (#27169) 2025-03-19 08:27:55 -05:00
deviceinfo.go Additional CA validation (#27169) 2025-03-19 08:27:55 -05:00
profile_matcher.go use only the UUID part of external_host_identifier for Puppet runs (#13176) 2023-08-07 12:41:13 -03:00
profile_matcher_test.go Add validations to disallow custom MDM profiles that contain names reserved by Fleet (#15373) 2023-11-30 17:19:18 -06:00
profile_verifier.go Fixed potential deadlocks when deploying Apple configuration profiles. (#24777) 2024-12-16 11:16:42 -06:00
profile_verifier_test.go allow to verify profiles that are pending (#15911) 2024-01-04 18:26:04 -03:00
util.go Added util func around semver to allow for custom preprocessing. Upgraded semver lib (#25437) 2025-01-23 10:21:15 -06:00
util_test.go gate DEP enrollment behind SSO when configured (#11309) 2023-04-27 09:43:20 -03:00