Prepare and distribute Fleet installers

Employee instructions are in Set up your computer or phone for work. The iPhone plan is Apple Business User Enrollment, with no Fleet Premium purchase.

Prepared release

The handbook working copy contains installers/fleet/2026-09-14/:

Artifact	Target	Agent version
cadence-fleet-linux-amd64.deb	Debian/Ubuntu, x86-64, systemd	1.60.0
cadence-fleet-linux-amd64.rpm	Fedora/RHEL-family, x86-64, systemd	1.60.0
cadence-fleet-macos-universal.pkg	macOS, Apple silicon and Intel	1.60.0
cadence-fleet-windows-amd64.msi	Windows, Intel/AMD x64	1.60.0
SHA256SUMS	Checksums for the four installers	—
manifest.json	Sizes, hashes, versions, and inspected configuration	—

All four were freshly built with fleetctl package using Fleet’s stable update service. Their embedded server is https://devices.cadence15.com. They include Fleet Desktop and remote-script execution and use stable automatic updates. The enrollment secret was taken from the existing correctly configured RPM; all four carry the same secret. No live enrollment was performed during preparation, so confirm the secret is still active and test a real device before a broad rollout.

Archive inspection confirms the URL, matching nonempty secrets, settings, package versions, and declared architectures. RPM digest verification also passed. These checks do not replace installation testing on Windows, Linux, and macOS.

The old .deb in the Fleet repository root points at devices.c15.io and must not be distributed. Use this dated release, not the old root-level files. Previously installed devices do not learn the corrected server address from a documentation change; reinstall the corrected package and verify check-in.

Distribution

The configured installer binaries are stored with their manifests and checksums in this handbook repository. Include all four binaries when committing the release. The employee guide links directly to those files on the repository’s main branch; new links become available after the release is merged and pushed. Readers need access to the private handbook repository and must sign in to GitHub to download.

The files embed Cadence’s enrollment secret, so keep repository access limited to authorized users. The source files are outside Astro’s shared public/ directory. The internal handbook provides the links; GitHub serves the download bytes. This also avoids Cloudflare Pages’ 25 MiB per-file limit without a separate storage service. Cloudflare Pages limits

Keep the release’s checksums available separately from the download when confirming an unexpected installer warning. The checksum confirms the expected bytes; it is not a code-signing certificate.

Signing

These are custom, unsigned packages. The Mac package is not notarized. The employee guide describes Apple’s exception for a specifically trusted download; it does not disable Gatekeeper. Systems that require signed packages need a signed release.

For a smoother Mac rollout, use an organization-owned Apple Developer Program membership to obtain a Developer ID Installer certificate and sign/notarize the package with Fleet’s --sign-identity and --notarize options. This is independent of Fleet Premium and independent of the Apple Business iPhone pilot. Recalculate hashes after signing. Fleet packaging and signing

Linux signing is separate: use the organization’s RPM signing key if enforcing local-package GPG checks. We have not set up an apt/yum repository or invented a signing identity for this release.

Rebuild

Run from the Fleet repository on a build workstation with fleetctl, Python 3, ar, rpm, rpm2cpio, cpio, and Docker/Podman available. The Mac and Windows packages can be built on Linux using Fleet’s packaging containers. Windows archive verification also runs WiX in a container. Supply the active enrollment secret from Doppler in FLEET_OSQUERY_ENROLL_SECRET; do not put its value in documentation or shell history.

Use a new dated output directory for each release. For example, set release_dir to an absolute path under the handbook’s installers/fleet/:

umask 077
: "${release_dir:?Set a new absolute release directory}"
: "${FLEET_OSQUERY_ENROLL_SECRET:?Load the active enrollment secret from Doppler}"
mkdir -p "$release_dir"

fleetctl package --type=deb --arch=amd64 \
  --fleet-url=https://devices.cadence15.com \
  --enroll-secret="$FLEET_OSQUERY_ENROLL_SECRET" \
  --fleet-desktop --enable-scripts --disable-open-folder \
  --outfile="$release_dir/cadence-fleet-linux-amd64.deb"

fleetctl package --type=rpm --arch=amd64 \
  --fleet-url=https://devices.cadence15.com \
  --enroll-secret="$FLEET_OSQUERY_ENROLL_SECRET" \
  --fleet-desktop --enable-scripts --disable-open-folder \
  --outfile="$release_dir/cadence-fleet-linux-amd64.rpm"

fleetctl package --type=msi --arch=amd64 \
  --fleet-url=https://devices.cadence15.com \
  --enroll-secret="$FLEET_OSQUERY_ENROLL_SECRET" \
  --fleet-desktop --enable-scripts --disable-open-folder \
  --outfile="$release_dir/cadence-fleet-windows-amd64.msi"

fleetctl package --type=pkg \
  --fleet-url=https://devices.cadence15.com \
  --enroll-secret="$FLEET_OSQUERY_ENROLL_SECRET" \
  --fleet-desktop --enable-scripts --disable-open-folder \
  --outfile="$release_dir/cadence-fleet-macos-universal.pkg"

On the Fedora build workstation, the fleetctl on PATH is a sandbox wrapper. The real binary is at ~/.local/state/bui/sandboxes/fleet/overlays/home-sandbox/.fleetctl/fleetctl. The packaging container needs a temporary directory labeled container_file_t under SELinux; otherwise mkbom can fail with exit status 139. Set TMPDIR to that directory when building and verifying. If Podman refuses the short image name, first run podman pull docker.io/fleetdm/wix:latest. The Fleet repository’s deploy/fly/README.md documents that workstation setup.

After all packages finish, inspect them without installing them:

python3 deploy/fly/scripts/verify-installers.py "$release_dir" > "$release_dir/manifest.json"
(cd "$release_dir" && sha256sum cadence-fleet-linux-amd64.deb cadence-fleet-linux-amd64.rpm cadence-fleet-macos-universal.pkg cadence-fleet-windows-amd64.msi > SHA256SUMS)

Stop if verification fails. Stable components can change between builds; the verifier rejects a release with mismatched versions. Rebuild a consistent set, then update the handbook release version, hashes, and date together. Update the expected SHA-256 value embedded in each platform section of device-setup.md along with its download link; employees use those commands to check their downloads. Signing also changes the hashes.

Pilot verification and operations

Install on one Debian/Ubuntu host, one RPM-based host, a Mac, and an x64 Windows computer. Check the system service, a recent Fleet check-in, Fleet Desktop, owner mapping, and policy/report results. Verify both Mac architectures before claiming both have been tested. Test uninstall and confirm that removing a record in Fleet alone does not remove the agent.

Review the remote-script capability and actual report collection with pilot participants. Windows, Linux, and Mac agents have elevated host access; their access is not contained to a work profile.

If a device cannot reach Fleet, check Cloudflare’s agent endpoint rules and the server’s enrollment configuration. Do not relax the admin API’s Access policy to fix an agent check-in. If the secret is rotated, rebuild the packages and replace the handbook release; previously shared installers keep their embedded secret.