fix(FLEETMDM-002-2): CU-86akbhhtv 37 review findings across 32 files

cmd/cve/generate.go

@@ -153,7 +153,7 @@ func downloadLatestGitHubAsset(dbDir, fileName string) error {
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("get last mod start date: %w", fmt.Errorf("unexpected status code %d", resp.StatusCode))
+		return fmt.Errorf("unexpected status code %d fetching %s", resp.StatusCode, fileName)
 	}
 
 	lastModStartDate, err := io.ReadAll(resp.Body)
@@ -271,11 +271,26 @@ func gunzipFileToDisk(filename, dbpath string) error {
 
 	// Using a maxBytes limit to prevent decompression bombs: gosec G110
 	maxBytes := 200 * 1024 * 1024 // 200MB
-	_, err = io.CopyN(out, gz, int64(maxBytes))
+	written, err := io.CopyN(out, gz, int64(maxBytes))
 	if err != nil && err != io.EOF {
 		msg := fmt.Sprintf("error copying file %s: %v", f.Name(), err)
 		panic(msg)
 	}
+	if written == int64(maxBytes) {
+		// Check if there is more data beyond the limit, which means the file
+		// exceeds maxBytes and was not fully copied; fail rather than silently
+		// truncate.
+		extra := make([]byte, 1)
+		n, peekErr := gz.Read(extra)
+		if n > 0 {
+			msg := fmt.Sprintf("error copying file %s: exceeds maximum allowed size of %d bytes", f.Name(), maxBytes)
+			panic(msg)
+		}
+		if peekErr != nil && peekErr != io.EOF {
+			msg := fmt.Sprintf("error copying file %s: %v", f.Name(), peekErr)
+			panic(msg)
+		}
+	}
 
 	return nil
 }

orbit/cmd/desktop/desktop_linux.go

@@ -54,7 +54,8 @@ func blockWaitForStopEvent(_ string) error {
 func trayIconExists() bool {
 	conn, err := dbus.SessionBus()
 	if err != nil {
-		log.Error().Err(err)
+		log.Error().Err(err).Msg("trayIconExists: connect to session bus")
+		return false
 	}
 
 	// Get the name we would expect systray to reserve for our tray icon.

orbit/pkg/platform/platform_windows.go

@@ -163,7 +163,7 @@ func GetProcessesByName(name string) ([]*gopsutil_process.Process, error) {
 
 	// sanity check on returned snapshot handle
 	if snapshot == windows.InvalidHandle {
-		return nil, errors.New("the snapshot returned returned by CreateToolhelp32Snapshot is invalid")
+		return nil, errors.New("the snapshot returned by CreateToolhelp32Snapshot is invalid")
 	}
 	// Closing the handle to avoid handle leaks.
 	defer windows.CloseHandle(snapshot) //nolint:errcheck
@@ -322,7 +322,7 @@ func hardwareGetSMBiosUUID() (string, error) {
 			// UUID sanity check
 			isValidUUID, err := isValidUUID(uuidBytes)
 			if err != nil {
-				return "", fmt.Errorf("%v", err)
+				return "", fmt.Errorf("%w", err)
 			}
 
 			if !isValidUUID {

orbit/pkg/token/readwriter.go

@@ -92,7 +92,7 @@ func (rw *ReadWriter) SetRemoteUpdateFunc(f remoteUpdaterFunc) {
 func (rw *ReadWriter) Write(id string) error {
 	if rw.remoteUpdate != nil {
 		if err := rw.remoteUpdate(id); err != nil {
-			return err
+			return fmt.Errorf("remote update of token: %w", err)
 		}
 	}
 

orbit/pkg/update/flag_runner.go

@@ -152,7 +152,7 @@ func (r *ExtensionRunner) Run(config *fleet.OrbitConfig) error {
 			}
 			return nil
 		default:
-			return fmt.Errorf("stat file: %s", extensionAutoLoadFile)
+			return fmt.Errorf("stat file %s: %w", extensionAutoLoadFile, err)
 		}
 	}
 

orbit/pkg/update/runner.go

@@ -372,7 +372,10 @@ func (r *Runner) updateTarget(target string) error {
 }
 
 func (r *Runner) Interrupt(err error) {
-	r.cancel <- struct{}{}
+	select {
+	case r.cancel <- struct{}{}:
+	default:
+	}
 }
 
 // compareVersion compares the old and new versions of a binary and prints the appropriate message.

server/datastore/mysql/migrations/tables/20240327115530_AddDDMTables.go

@@ -125,7 +125,7 @@ CREATE TABLE IF NOT EXISTS host_mdm_apple_declarations (
 )
     `)
 	if err != nil {
-		return fmt.Errorf("creatign host_mdm_apple_declarations table %w", err)
+		return fmt.Errorf("creating host_mdm_apple_declarations table: %w", err)
 	}
 
 	return nil

server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go

@@ -13,7 +13,7 @@ func Up_20240815000001(tx *sql.Tx) error {
 	// Idempotent migration.
 	if !columnExists(tx, "vpp_apps_teams", "self_service") {
 		if _, err := tx.Exec("ALTER TABLE vpp_apps_teams ADD COLUMN self_service bool NOT NULL DEFAULT false"); err != nil {
-			return fmt.Errorf("Failed to add self_service to vpp_apps_teams: %w", err)
+			return fmt.Errorf("failed to add self_service to vpp_apps_teams: %w", err)
 		}
 	}
 	return nil
@@ -22,3 +22,4 @@ func Up_20240815000001(tx *sql.Tx) error {
 func Down_20240815000001(tx *sql.Tx) error {
 	return nil
 }
+

server/datastore/mysql/migrations/tables/20250304162702_AddCATables.go

@@ -22,7 +22,7 @@ func Up_20250304162702(tx *sql.Tx) error {
 	    UNIQUE KEY idx_ca_config_assets_name (name)
 	) ENGINE = InnoDB DEFAULT CHARSET = utf8mb4 COLLATE = utf8mb4_unicode_ci`)
 	if err != nil {
-		return fmt.Errorf("failed to create ca_config_assets table: %s", err)
+		return fmt.Errorf("failed to create ca_config_assets table: %w", err)
 	}
 
 	if !columnExists(tx, "host_mdm_managed_certificates", "not_valid_after") {
@@ -31,7 +31,7 @@ func Up_20250304162702(tx *sql.Tx) error {
 	ADD COLUMN not_valid_after DATETIME(6) NULL
 	`)
 		if err != nil {
-			return fmt.Errorf("failed to add not_valid_after column to host_mdm_managed_certificates table: %s", err)
+			return fmt.Errorf("failed to add not_valid_after column to host_mdm_managed_certificates table: %w", err)
 		}
 	}
 	return nil

server/datastore/mysql/migrations/tables/20250331042354_AddSCIMTables.go

@@ -68,7 +68,7 @@ func Up_20250331042354(tx *sql.Tx) error {
 	`)
 
 	if err != nil {
-		return fmt.Errorf("failed to create scim tables: %s", err)
+		return fmt.Errorf("failed to create scim tables: %w", err)
 	}
 
 	return nil

server/datastore/mysql/migrations/tables/20251124090450_AddHostPlatformFleetVar.go

@@ -24,11 +24,11 @@ func Up_20251124090450(tx *sql.Tx) error {
 	createdAt := time.Date(2025, 11, 19, 0, 0, 0, 0, time.UTC)
 	stmt, args, err := sqlx.Named(insStmt, map[string]any{"created_at": createdAt})
 	if err != nil {
-		return fmt.Errorf("Failed to prepare insert for FLEET_VAR_HOST_PLATFORM: %s", err)
+		return fmt.Errorf("failed to prepare insert for FLEET_VAR_HOST_PLATFORM: %w", err)
 	}
 	_, err = tx.Exec(stmt, args...)
 	if err != nil {
-		return fmt.Errorf("failed to insert FLEET_VAR_HOST_PLATFORM into fleet_variables: %s", err)
+		return fmt.Errorf("failed to insert FLEET_VAR_HOST_PLATFORM into fleet_variables: %w", err)
 	}
 	return nil
 }

server/datastore/mysql/migrations/tables/20260217141240_ResetInvalidPlatformOnLabels.go

@@ -2,6 +2,7 @@ package tables
 
 import (
 	"database/sql"
+	"fmt"
 )
 
 func init() {
@@ -12,7 +13,7 @@ func Up_20260217141240(tx *sql.Tx) error {
 	// Idempotent migration. Naturally re-runnable (UPDATE/MODIFY/JSON-config only).
 	_, err := tx.Exec(`UPDATE labels SET platform = '' WHERE platform NOT IN ('', 'centos', 'darwin', 'windows', 'ubuntu')`)
 	if err != nil {
-		return err
+		return fmt.Errorf("resetting invalid platform on labels: %w", err)
 	}
 	return nil
 }

server/datastore/mysql/migrations/tables/20260409153714_AddApiEndpointPermissionsTables.go

@@ -2,6 +2,7 @@ package tables
 
 import (
 	"database/sql"
+	"fmt"
 )
 
 func init() {
@@ -22,7 +23,7 @@ func Up_20260409153714(tx *sql.Tx) error {
 			)
 		`)
 		if err != nil {
-			return err
+			return fmt.Errorf("create user_api_endpoints table: %w", err)
 		}
 	}
 

server/datastore/mysql/migrations/tables/20260522195225_AddManagedLocalAccountRotationColumns.go

@@ -29,7 +29,7 @@ func Up_20260522195225(tx *sql.Tx) error {
 		ALTER TABLE host_managed_local_account_passwords
 			ADD KEY idx_hmlap_auto_rotate_at (auto_rotate_at)
 	`); err != nil {
-			return fmt.Errorf("adding rotation columns to host_managed_local_account_passwords: %w", err)
+			return fmt.Errorf("adding idx_hmlap_auto_rotate_at index to host_managed_local_account_passwords: %w", err)
 		}
 	}
 	return nil

server/fleet/agent_options.go

@@ -65,7 +65,7 @@ func SuggestAgentOptionsCorrection(err error) error {
 	if field := GetJSONUnknownField(err); field != nil {
 		correctKeyPath, keyErr := FindAgentOptionsKeyPath(*field)
 		if keyErr != nil {
-			return fmt.Errorf("error parsing generated agent options struct: %w", err)
+			return fmt.Errorf("error parsing generated agent options struct: %w", keyErr)
 		}
 		var keyPathJoined string
 		switch pathLen := len(correctKeyPath); {

server/logging/pubsub.go

@@ -78,9 +78,13 @@ func (w *pubSubLogWriter) Write(ctx context.Context, logs []json.RawMessage) err
 		}
 
 		if len(data)+estimateAttributeSize(attributes) > pubsub.MaxPublishRequestBytes {
+			logPreview := log
+			if len(logPreview) > 100 {
+				logPreview = logPreview[:100]
+			}
 			w.logger.InfoContext(ctx, "dropping log over 10MB PubSub limit",
 				"size", len(data),
-				"log", string(log[:100])+"...",
+				"log", string(logPreview)+"...",
 			)
 			continue
 		}
@@ -95,6 +99,9 @@ func (w *pubSubLogWriter) Write(ctx context.Context, logs []json.RawMessage) err
 
 	// Wait for each message to be pushed to the server
 	for _, result := range results {
+		if result == nil {
+			continue
+		}
 		_, err := result.Get(ctx)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "pubsub publish")

server/mail/ses.go

@@ -106,7 +106,7 @@ func (s *sesSender) sendMail(ctx context.Context, e fleet.Email, msg []byte) err
 		SourceArn:    &s.sourceArn,
 	})
 	if err != nil {
-		return err
+		return fmt.Errorf("send raw email via ses: %w", err)
 	}
 	return nil
 }

server/mdm/apple/cert.go

@@ -132,12 +132,12 @@ func GetSignedAPNSCSR(client *http.Client, csr *x509.CertificateRequest) error {
 
 	req, err := http.NewRequest(http.MethodPost, u, bytes.NewReader(b))
 	if err != nil {
-		return err
+		return fmt.Errorf("creating csr signing request for fleetdm api: %w", err)
 	}
 
 	resp, err := client.Do(req)
 	if err != nil {
-		return err
+		return fmt.Errorf("sending csr signing request to fleetdm api: %w", err)
 	}
 	defer resp.Body.Close()
 

server/mdm/apple/profile_verifier.go

@@ -55,7 +55,7 @@ func VerifyHostMDMProfiles(ctx context.Context, ds fleet.ProfileVerificationStor
 
 	expectedByProfIdentifier, err := ds.GetHostMDMProfilesExpectedForVerification(ctx, host)
 	if err != nil {
-		return err
+		return ctxerr.Wrap(ctx, err, "getting expected MDM profiles for verification")
 	}
 
 	missing := make([]string, 0, len(expectedByProfIdentifier))
@@ -85,7 +85,7 @@ func VerifyHostMDMProfiles(ctx context.Context, ds fleet.ProfileVerificationStor
 	if len(missing) > 0 {
 		counts, err := ds.GetHostMDMProfilesRetryCounts(ctx, host)
 		if err != nil {
-			return err
+			return ctxerr.Wrap(ctx, err, "getting host MDM profile retry counts")
 		}
 		retriesByProfileIdentifier := make(map[string]uint, len(counts))
 		for _, r := range counts {
@@ -174,3 +174,4 @@ func HandleHostMDMProfileInstallResult(ctx context.Context, ds fleet.ProfileVeri
 	}
 	return nil
 }
+

server/mdm/internal/commonmdm/commonmdm.go

@@ -1,6 +1,7 @@
 package commonmdm
 
 import (
+	"fmt"
 	"net/url"
 	"path"
 )
@@ -10,7 +11,7 @@ import (
 func ResolveURL(serverURL, relPath string, cleanQuery bool) (string, error) {
 	u, err := url.Parse(serverURL)
 	if err != nil {
-		return "", err
+		return "", fmt.Errorf("parsing server URL: %w", err)
 	}
 	u.Path = path.Join(u.Path, relPath)
 	if cleanQuery {

server/mdm/nanodep/client/transport.go

@@ -234,7 +234,7 @@ func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
 
 		session, err = DoAuth(t.client, sessionReq, tokens)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("transport: performing dep auth: %w", err)
 		}
 
 		// save our session token for use by following requests
@@ -277,3 +277,4 @@ func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
 
 	return resp, nil
 }
+

server/mdm/scep/cmd/scepclient/scepclient.go

@@ -88,8 +88,7 @@ func run(cfg runCfg) error {
 
 	csr, err := loadOrMakeCSR(cfg.csrPath, opts)
 	if err != nil {
-		fmt.Println(err)
-		os.Exit(1)
+		return fmt.Errorf("load or make CSR: %w", err)
 	}
 
 	var self *x509.Certificate
@@ -256,7 +255,7 @@ func validateFlags(keyPath, serverURL, caFingerprint string, useKeyEnciphermentS
 	}
 	_, err := url.Parse(serverURL)
 	if err != nil {
-		return fmt.Errorf("invalid server-url flag parameter %s", err)
+		return fmt.Errorf("invalid server-url flag parameter: %w", err)
 	}
 	if caFingerprint != "" && useKeyEnciphermentSelector {
 		return errors.New("ca-fingerprint and key-encipherment-selector can't be used at the same time")

server/platform/http/post_json.go

@@ -33,13 +33,13 @@ func (e *errWithStatus) StatusCode() int {
 func PostJSONWithTimeout(ctx context.Context, url string, v any, logger *slog.Logger) error {
 	jsonBytes, err := json.Marshal(v)
 	if err != nil {
-		return err
+		return fmt.Errorf("marshal json body: %w", err)
 	}
 
 	client := fleethttp.NewClient(fleethttp.WithTimeout(30 * time.Second))
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewBuffer(jsonBytes))
 	if err != nil {
-		return err
+		return fmt.Errorf("build POST request: %w", err)
 	}
 
 	req.Header.Set("Content-Type", "application/json")

server/service/client_setup.go

@@ -42,10 +42,6 @@ func (c *Client) Setup(email, name, password, org string) (string, error) {
 		)
 	}
 
-	if response.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("setup got HTTP %d, expected 200", response.StatusCode)
-	}
-
 	var responseBody setupResponse
 	err = json.NewDecoder(response.Body).Decode(&responseBody)
 	if err != nil {
@@ -58,3 +54,4 @@ func (c *Client) Setup(email, name, password, org string) (string, error) {
 
 	return *responseBody.Token, nil
 }
+

server/service/openframe/openframe_token_refresher.go

@@ -31,7 +31,7 @@ func (tr *OpenframeTokenRefresher) Start() error {
 	log.Info().Msg("Scheduling token refresh job")
 	_, err := tr.cron.AddFunc("*/5 * * * * *", tr.refreshToken)
 	if err != nil {
-		return fmt.Errorf("failed to schedule token refresh job: %v", err)
+		return fmt.Errorf("failed to schedule token refresh job: %w", err)
 	}
 	tr.cron.Start()
 	log.Info().Msg("Token refresh job started")
@@ -73,4 +73,4 @@ func (tr *OpenframeTokenRefresher) refreshToken() {
 
 	tr.authorizationManager.UpdateToken(token)
 	log.Info().Msg("Openframe token refreshed")
-}
+}