Add Homebrew to software inventory

[getvictor]

Goal

User story
As a Fleet admin,
I want to see the Homebrew version that my hosts are using
so that I can make sure it has no vulnerabilities.

Context

Propose creating a Fleet extension git_tags table that will return the HEAD tags of a specific git repo on the host. Usage:

SELECT * FROM git_tags WHERE path = '/opt/homebrew/Library/Homebrew`;

The Fleet server can then use this table to get the Homebrew version, add Homebrew to the list of software, and perform vulnerability checks against it.

To get the Homebrew version on macOS, either do:

brew --version

or

git -C /opt/homebrew/Library/Homebrew tag --points-at HEAD

Things to consider:

• What if my company installs Homebrew at a custom location? The above path to Homebrew should be configurable and should accept multiple possible paths.

• Requestor(s): _____

• Product designer: _____

Changes

Product

• [ ] UI changes: TODO
• [ ] CLI usage changes: TODO
• [ ] REST API changes: TODO
• [ ] Fleet's agent (fleetd) changes: TODO
• [ ] Permissions changes: TODO
• [ ] Changes to paid features or tiers: TODO

Engineering

• [ ] Reference documentation changes: TODO
• [ ] Usage documentation changes: TODO
• [ ] Database schema migrations: TODO
• [ ] Load testing: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Manual testing steps

1. Step 1
2. Step 2
3. Step 3

Testing notes

Confirmation

1. [ ] Engineer (@____): Added comment to user story confirming successful completion of QA.
2. [ ] QA (@____): Added comment to user story confirming successful completion of QA.

[nonpunctual]

we probably have to consider user context, i.e., homebrew recommends not to use sudo to install homebrew, so, when we try to run those commands against it as root from fleetd we might get nothing back?

I had to use sudo -u to get a Fleet script to call homebrew.

Also, the other thing to consider might be if it was installed in a non-default location

[JoStableford]

Related to a Slack conversation