85864a580c
Browser enrollment used osascript on every elevate. Ship a signed privileged helper installed at PKG time so probo:// can enroll over XPC with no second admin prompt. Add make install/uninstall/clean for local PKG test loops, and show alerts only on failure. Mirror the Go lint path for the macOS SPM package: Make targets, root configs, and a Linux CI job. Keep checks syntax-only so they do not need a macOS SDK. Format the existing sources so the new gates start clean. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
104 lines
3.0 KiB
Go
104 lines
3.0 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
// of this software and associated documentation files (the "Software"), to deal
|
|
// in the Software without restriction, including without limitation the rights
|
|
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
// copies of the Software, and to permit persons to whom the Software is
|
|
// furnished to do so, subject to the following conditions:
|
|
//
|
|
// The above copyright notice and this permission notice shall be included in
|
|
// all copies or substantial portions of the Software.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
// SOFTWARE.
|
|
|
|
//go:build windows
|
|
|
|
package elevate
|
|
|
|
import (
|
|
"fmt"
|
|
"os/exec"
|
|
"strings"
|
|
|
|
"go.probo.inc/probo/pkg/deviceagent/checks"
|
|
)
|
|
|
|
func runElevatedInstall(opts InstallOptions, enrollmentToken string) error {
|
|
args := []string{
|
|
"install",
|
|
"--server",
|
|
opts.ServerURL,
|
|
"--enrollment-token",
|
|
enrollmentToken,
|
|
}
|
|
if opts.ConfigDir != "" {
|
|
args = append(args, "--dir", opts.ConfigDir)
|
|
}
|
|
|
|
argList := make([]string, len(args))
|
|
for i, arg := range args {
|
|
argList[i] = "'" + escapePowerShellSingleQuoted(arg) + "'"
|
|
}
|
|
|
|
script := fmt.Sprintf(
|
|
`$p = Start-Process -FilePath %s -ArgumentList @(%s) -Verb RunAs -Wait -PassThru; if ($p.ExitCode -ne 0) { exit $p.ExitCode }`,
|
|
"'"+escapePowerShellSingleQuoted(opts.ExePath)+"'",
|
|
strings.Join(argList, ","),
|
|
)
|
|
|
|
candidates := checks.CommandCandidates("powershell.exe")
|
|
if len(candidates) == 0 {
|
|
return fmt.Errorf("command %q not available at expected absolute path", "powershell.exe")
|
|
}
|
|
|
|
out, err := exec.Command(
|
|
candidates[0],
|
|
"-NoProfile",
|
|
"-NonInteractive",
|
|
"-Command",
|
|
script,
|
|
).CombinedOutput()
|
|
|
|
return commandError(out, err)
|
|
}
|
|
|
|
func runElevatedUninstall(opts UninstallOptions) error {
|
|
args := []string{"uninstall"}
|
|
if opts.ConfigDir != "" {
|
|
args = append(args, "--dir", opts.ConfigDir)
|
|
}
|
|
|
|
argList := make([]string, len(args))
|
|
for i, arg := range args {
|
|
argList[i] = "'" + escapePowerShellSingleQuoted(arg) + "'"
|
|
}
|
|
|
|
script := fmt.Sprintf(
|
|
`$p = Start-Process -FilePath %s -ArgumentList @(%s) -Verb RunAs -Wait -PassThru; if ($p.ExitCode -ne 0) { exit $p.ExitCode }`,
|
|
"'"+escapePowerShellSingleQuoted(opts.ExePath)+"'",
|
|
strings.Join(argList, ","),
|
|
)
|
|
|
|
candidates := checks.CommandCandidates("powershell.exe")
|
|
if len(candidates) == 0 {
|
|
return fmt.Errorf("command %q not available at expected absolute path", "powershell.exe")
|
|
}
|
|
|
|
out, err := exec.Command(
|
|
candidates[0],
|
|
"-NoProfile",
|
|
"-NonInteractive",
|
|
"-Command",
|
|
script,
|
|
).CombinedOutput()
|
|
|
|
return commandError(out, err)
|
|
}
|