Automatically install software - BE: Policy automations

[lukeheath]

Story: #19551.

QA notes

• As usual, check the Figma linked in the Epic.
• Test the feature by creating policies and assigning them to installers.
• On each step, check the generated activities for the hosts look good. When Fleet triggers an automatic installation on a host, the admin that uploaded the package is shown as the author of the automatic installation.

1. Prepare teams, hosts and installers before running this version.
2. Run prepare db with new version (20240829170024 - PolicyAutomaticInstallSoftware).
3. Add osquery-perf hosts too. It has support for installers, e.g.: go run ./cmd/osquery-perf -enroll_secret <...> -os_templates=windows_11.tmpl:1,macos_14.1.2.tmpl:1,ubuntu_22.04.tmpl:1 -host_count 3 -software_installer_install_fail_prob .25 -policy_pass_prob 0.5.

Other tests:

• - Configure packages and policies, enroll a host from scratch to Fleet, check that the software is automatically installed in it.
• - Policy with SQL with typos should not cause an automatic installation.
• - Test unsetting an installer from a policy.
• - Test with two different policies with two different installers on the same team, test they are installed on the correct hosts.
• - Test associating a pkg to a linux policy, we allow associating it, but Fleet should not queue a installation because it's a pkg and the target are linux hosts.
• - Test deleting teams with software installers and policies associated to installers. Teams deletion should just work as usual (all installers and policies should be gone too after deleting the team).
• - Test deleting policies with associated installers.
• - Test deleting installers with associated policies is not allowed. Also test that after deleting/unassociating the policy you can delete the installer.
• - A package already installed on the host and a failing policy should not queue an install request. A package already installed on the host will make the policy pass and therefore an install request won’t be queued.
• - Check automatic installation of a installer that was uploaded by a deleted user, activities should show the name of the deleted user.
  • Bug ticket
• - Test existing functionality for manual installation and Self-service installations of packages, check activities. It should all look as before this feature (IOW we didn't break existing functionality).
• - Test policies associated to Self-service software installers, should install them just exactly like not Self-service (check activities).

Packages for testing

These are the packages + policy SQLs that I used to test the feature the way our users will use it.

macOS

Microsoft Teams

• URL: https://statics.teams.cdn.office.net/production-osx/enterprise/webview2/lkg/MicrosoftTeams.pkg
• Default install script works.
• SELECT 1 FROM apps WHERE name = 'Microsoft Teams.app' AND version_compare(bundle_short_version, '24193.1707.3028.4282') >= 0;

Firefox

• URL: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg
• Default install script works.
• SELECT 1 FROM apps WHERE name = 'Firefox.app' AND version_compare(bundle_short_version, '129.0.2') >= 0;

Windows

Tailscale

• URL: https://dl.tailscale.com/stable/tailscale-setup-1.72.0.exe
• Default script for exes doesn't work, script:

$exeFilePath = "${env:INSTALLER_PATH}"
$installProcess = Start-Process $exeFilePath `
  -ArgumentList "/quiet /norestart" `
  -PassThru -Verb RunAs -Wait

• Policy query: SELECT 1 FROM programs WHERE name = 'Tailscale' AND version_compare(version, '1.72.0') >= 0;

Firefox

• URL: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/win64/en-US/Firefox%20Setup%20129.0.2.msi
• Default install script works.
• Policy query: SELECT 1 FROM programs WHERE name = 'Mozilla Firefox (x64 en-US)' AND version_compare(version, '129.0.2') >= 0;

Linux

1Password

• URL: https://downloads.1password.com/linux/debian/amd64/stable/1password-latest.deb
• Default install script works.
• Policy query: SELECT 1 FROM deb_packages WHERE name = '1password' AND version_compare(version, '8.10.39') >= 0;
• 1Password has to be uninstalled the following way: sudo apt purge --remove 1password.

Firefox

• URL: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/linux-x86_64/en-US/firefox-129.0.2.deb
• Default install script works.
• Policy query: SELECT 1 FROM deb_packages WHERE name = 'firefox' AND version_compare(version, '129.0.2') >= 0;

[lucasmrod]

@xpkoala Added notes for QA.

[lukeheath]

@xpkoala Just a heads up there are QA notes here (since you may not look at the sub-task).

[fleet-release]

Fleet installs with grace,
Like clouds bring rain to the earth,
Teams find peace in place.