CLI-871 Add MDM deployment scripts as public reference by kirill-knize-sonarsource · Pull Request #601 · SonarSource/sonarqube-cli

kirill-knize-sonarsource · 2026-07-21T12:46:24Z

Summary by Gitar

Added deployment scripts:
- Introduced platform-specific scripts for Linux, macOS, and Windows to automate sonarqube-cli installation via MDM.
Automated lifecycle management:
- Provided install.sh/install.ps1, update.sh/update.ps1, rollback.sh/rollback.ps1, and remove.sh/remove.ps1 for managing binary distribution.
MDM integration:
- Included logic for version pinning and artifact URL overrides via environment or JumpCloud variable injection.
User environment handling:
- Added logic to symlink or override standalone user installations to ensure the MDM-managed version takes precedence in the PATH.
Security and verification:
- Implemented mandatory SHA256 checksum verification during download to ensure integrity of fetched binaries.

_{This will update automatically on new commits.}

netlify · 2026-07-21T12:46:28Z

✅ Deploy Preview for sonarqube-cli canceled.

Name	Link
🔨 Latest commit	`e46b229`
🔍 Latest deploy log	https://app.netlify.com/projects/sonarqube-cli/deploys/6a5f81edcf81160008af818d

hashicorp-vault-sonar-prod · 2026-07-21T12:46:36Z

CLI-871

gitar-bot · 2026-07-21T12:48:31Z

+verify_sha256() {
+    local binary="$1" version="$2"
+    local platform os base url expected actual
+    platform="$(cdn_platform)"
+    os="$(cdn_os)"
+    if [[ -z "$platform" || -z "$os" ]]; then
+        echo "Warning: unsupported platform — skipping SHA256 check." >&2
+        return
+    fi
+    base="sonarqube-cli-${version}-${platform}"
+    url="${ARTIFACT_BASE_URL}/${version}/${os}/${base}.bin.sha256"
+    expected="$(curl -fsSL --proto "$HTTPS_ONLY" --proto-redir "$HTTPS_ONLY" "$url" 2>/dev/null | awk '{print $1}')"
+    if [[ -z "$expected" ]]; then
+        echo "Error: could not fetch SHA256 from $url — aborting." >&2
+        exit 1


💡 Security: SHA256 fetched from same origin as binary gives no supply-chain protection

verify_sha256 / Test-BinarySha256 download the .sha256 file from the same artifact host as the binary itself over the same channel. This only guards against transport corruption; an attacker who can tamper with (or MITM) the artifact server can replace both the binary and its published hash, so the check provides no integrity guarantee against a compromised source. Consider verifying a detached signature against a pinned public key, or pinning the expected hash out-of-band, rather than trusting a hash served alongside the artifact.

_{Was this helpful? React with 👍 / 👎}

Mirrors the JumpCloud install/update/rollback/remove scripts for macOS, Linux, and Windows, so the customer-facing MDM deployment guide can link to a reviewable source instead of internal tooling.

gitar-bot · 2026-07-21T14:29:00Z

Code Review 👍 Approved with suggestions 3 resolved / 4 findings

Introduces automated MDM deployment scripts with binary lifecycle management and integrity verification. Consider fetching SHA256 checksums from an independent source to improve supply-chain security.

💡 Security: SHA256 fetched from same origin as binary gives no supply-chain protection

📄 mdm-scripts/linux/install.sh:42-56 📄 mdm-scripts/windows/install.ps1:34-48

verify_sha256 / Test-BinarySha256 download the .sha256 file from the same artifact host as the binary itself over the same channel. This only guards against transport corruption; an attacker who can tamper with (or MITM) the artifact server can replace both the binary and its published hash, so the check provides no integrity guarantee against a compromised source. Consider verifying a detached signature against a pinned public key, or pinning the expected hash out-of-band, rather than trusting a hash served alongside the artifact.

✅ 3 resolved

✅ Bug: Machine PATH update bakes in expanded env vars, corrupting PATH

📄 mdm-scripts/windows/install.ps1:78-88
Add-ToMachinePath reads the current PATH with Get-ItemProperty and rewrites it with Set-ItemProperty ... -Type ExpandString. Get-ItemProperty expands REG_EXPAND_SZ values, so entries like %SystemRoot%\system32 come back already resolved to C:\Windows\system32; writing that back permanently loses the %SystemRoot% references in the machine PATH (a well-known PowerShell pitfall) and can break machines that rely on those variables. Read/write the raw value with [Environment]::GetEnvironmentVariable('Path','Machine') / [Environment]::SetEnvironmentVariable('Path', ..., 'Machine'), which does not expand REG_EXPAND_SZ.

✅ Bug: update.ps1 version check never matches, re-downloads every run

📄 mdm-scripts/windows/update.ps1:85-93
The Windows update compares $installedSemver = (& $MdmBinary --version).Trim() (the full CLI version output) against $targetSemver (X.Y.Z extracted from the version string). The Linux/macOS scripts extract the semver from the binary output with grep -oE '^[0-9]+\.[0-9]+\.[0-9]+', but the Windows script does not, so unless sonar --version prints exactly X.Y.Z the equality fails and the 'Already at version, nothing to do' short-circuit never triggers — the binary is re-downloaded on every scheduled run. Additionally, if --version emits multiple lines, & ... returns an object[] and .Trim() throws under $ErrorActionPreference='Stop'. Extract the semver the same way as the shell scripts.

✅ Edge Case: remove.sh loop can delete unrelated binaries named 'sonar'

📄 mdm-scripts/linux/remove.sh:24-33 📄 mdm-scripts/macos/remove.sh:24-33
The removal loop repeatedly deletes whatever command -v sonar resolves to until nothing remains, running as root over the system PATH. If any unrelated executable happens to be named sonar (or a stale hash entry resolves), it will be removed without confirmation. Consider restricting removal to the known MDM/standalone locations, or verifying the binary is sonarqube-cli (e.g. via --version output) before deleting.

🤖 Prompt for agents

Code Review: Introduces automated MDM deployment scripts with binary lifecycle management and integrity verification. Consider fetching SHA256 checksums from an independent source to improve supply-chain security.

1. 💡 Security: SHA256 fetched from same origin as binary gives no supply-chain protection
   Files: mdm-scripts/linux/install.sh:42-56, mdm-scripts/windows/install.ps1:34-48

   verify_sha256 / Test-BinarySha256 download the `.sha256` file from the same artifact host as the binary itself over the same channel. This only guards against transport corruption; an attacker who can tamper with (or MITM) the artifact server can replace both the binary and its published hash, so the check provides no integrity guarantee against a compromised source. Consider verifying a detached signature against a pinned public key, or pinning the expected hash out-of-band, rather than trusting a hash served alongside the artifact.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

sonarqubecloud · 2026-07-21T14:45:29Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

gitar-bot Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread mdm-scripts/windows/install.ps1

gitar-bot Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread mdm-scripts/windows/update.ps1

gitar-bot Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread mdm-scripts/linux/remove.sh

kirill-knize-sonarsource force-pushed the knize/CLI-871-mdm-scripts branch from 853fd39 to 7dc58db Compare July 21, 2026 14:11

CLI-871 Add MDM deployment scripts as public reference

e46b229

Mirrors the JumpCloud install/update/rollback/remove scripts for macOS, Linux, and Windows, so the customer-facing MDM deployment guide can link to a reviewable source instead of internal tooling.

kirill-knize-sonarsource force-pushed the knize/CLI-871-mdm-scripts branch from 7dc58db to e46b229 Compare July 21, 2026 14:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

CLI-871 Add MDM deployment scripts as public reference#601

CLI-871 Add MDM deployment scripts as public reference#601
kirill-knize-sonarsource wants to merge 1 commit into
masterfrom
knize/CLI-871-mdm-scripts

kirill-knize-sonarsource commented Jul 21, 2026 •

edited by gitar-bot Bot

Loading

Uh oh!

netlify Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

hashicorp-vault-sonar-prod Bot commented Jul 21, 2026 •

edited by atlassian Bot

Loading

Uh oh!

Uh oh!

Uh oh!

gitar-bot Bot Jul 21, 2026

Uh oh!

Uh oh!

gitar-bot Bot commented Jul 21, 2026

Uh oh!

sonarqubecloud Bot commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kirill-knize-sonarsource commented Jul 21, 2026 • edited by gitar-bot Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Gitar

Uh oh!

netlify Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for sonarqube-cli canceled.

Uh oh!

hashicorp-vault-sonar-prod Bot commented Jul 21, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gitar-bot Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gitar-bot Bot commented Jul 21, 2026

Uh oh!

sonarqubecloud Bot commented Jul 21, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kirill-knize-sonarsource commented Jul 21, 2026 •

edited by gitar-bot Bot

Loading

netlify Bot commented Jul 21, 2026 •

edited

Loading

hashicorp-vault-sonar-prod Bot commented Jul 21, 2026 •

edited by atlassian Bot

Loading