xolo-server 2.2.4 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0af0f8b82fade2b7a8d3c65dedf4146e00e9adba56b7c553506a072b4942fcdb
-  data.tar.gz: f351cb8a10515a30b851490f77b64067f9485783a5ea0522c0ddf739f5a2ea25
+  metadata.gz: d27f4a3e1656ef59731865488978113bcbeb4a5ebbea8c120585371c49aad335
+  data.tar.gz: a006f5ec49ad3cfbad6ae5908e2da17b65cdc2bf8eb0c3a7133fcaa0af6db3f4
 SHA512:
-  metadata.gz: 9575c70693bbc8acf6abfb662e7d535a416dcb1bf32dfa69614194017011247ebcf8e4552f987952d484e30bca490100de0e311942eb9c18cf0bb2d7129ccb31
-  data.tar.gz: 1a3ce31608e7fe9d62fe86465a8c8c686c6caec1d44062f2fce899e8e6ccc56ee353adf4b84ac834b8aa500d30c1a9bbe7e222400742609a1df3856131b87432
+  metadata.gz: c47f0964d7c5f5a42ddb909a0ee6b5d8bb01ead710b6be7fe9087e882081dcf753fc9f783be8bd0e5658b49df36d012f59f956db768026c915faabc8f5d9a4a8
+  data.tar.gz: 448ec9e58919ada9612c8651f814d168d4d6117c92b3e76faa2c5bdc74eb7747298f6bdebcc1547b7c662084d97fbbd7fb018331c8424f28b79bf1114cdacba7

data/data/client/xolo

@@ -27,6 +27,9 @@ zmodload zsh/zutil
 ###############################
 ###############################
 
+# just in case
+export PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/libexec:$PATH"
+
 # Needed for the UTF-8 chars in the lsreg output
 export LANG="en_US.UTF-8"
 export LC_ALL="en_US.UTF-8"
@@ -94,6 +97,7 @@ be_verbose=
 debugging_on=
 no_versions=
 show_xolo_version=
+do_recon=
 
 # arguments
 command=
@@ -152,7 +156,9 @@ Options:
                      policies, etc, from test xolo server, not the production server.
                      Setting the XOLO_TEST_MODE env. variable does the same thing.
   -r, --recon:       With 'install' or 'uninstall' run a 'jamf recon' after the
-                     operation completes successfully.
+                     operation completes successfully. With 'update', run a 'jamf recon'
+                     before the checkin. NOTE: With update, the whole process may take
+                     many minutes.
   -n, --no-versions: With the 'list-titles' and 'list-installed' commands,
                      do not show the versions available, or the version
                      installed, respectively.
@@ -187,6 +193,9 @@ Commands:
     every time this computer checks in with Jamf Pro.
     Note: this just runs the 'jamf policy' command, which will execute any pending
     Jamf policies triggered by "recurring check-in".
+    If --recon is given, a Jamf recon will run first, followed by a 1 minute pause
+    for Jamf to process the data before doing the check-in. This helps the Mac to see
+    very recently-released versions as patch updates.
 
   refresh, r
     Update xolo's information about current titles and versions.
@@ -356,42 +365,43 @@ function debug() {
   debugging_on && echo "DEBUG: $*" 1>&2
 }
 
-# Gather all installed bundle ids and installed versions from lsreg
+# Gather all installed bundle ids and installed versions from system_profiler
 # store them in an associative array in $installed_apps.
 # keys are bundle ids, values are app name & installed version
 # separated by a semicolon
 # e.g. 'com.apple.Safari => Safari.app;14.0.3'
 ###############################
 function get_installed_apps() {
+  # debug "PATH is $PATH"
   debug "Getting all installed .apps on this Mac..."
   local app_name
   local app_bundle_id
   local app_vers
+  local app_plist
 
-  # loop thru lsreg output
-  "$LSREG" -dump Bundle | while IFS= read -r line ; do
-    # a line if ------ starts a new record
-    if [[ "$line" =~ '^-+$' ]] ; then
-      unset app_name
-      unset app_bundle_id
-      unset app_vers
-      continue
-    fi
+  json_app_data=$(/usr/sbin/system_profiler -json SPApplicationsDataType )
+
+  apps_to_look_at=$(echo "$json_app_data" | grep '"path"' | cut -d'"' -f4 | grep -v '^/System/')
+
+  for app_path in ${(f)apps_to_look_at} ; do
+    app_name=$(/usr/bin/basename "$app_path")
+    app_plist="$app_path/Contents/Info.plist"
+
+    if [[ -f "$app_plist" ]] ; then
+      app_bundle_id=$(/usr/bin/plutil -extract CFBundleIdentifier raw "$app_plist" 2>/dev/null)
 
-    # $MATCH is the whole matched string, $match is the array of captures
-    # NOTE this only works if the path is listed before the CFBundleIdentifier
-    # which seems to be the case in the lsreg output
-    [[ "$line" =~ '^path:[[:space:]]+/.*/(.+\.app) \(' ]] && app_name=$match[1]
-    [[ "$line" =~ '^[[:space:]]+CFBundleIdentifier = \"(.+)\";' ]] && app_bundle_id=$match[1]
-    [[ "$line" =~ '^[[:space:]]+CFBundleShortVersionString = \"(.+)\";' ]] && app_vers=$match[1]
+      app_vers=$(/usr/bin/plutil -extract CFBundleShortVersionString raw "$app_plist" 2>/dev/null)
+
+      # Use CFBundleVersion if no CFBundleShortVersionString
+      [[ -z "$app_vers" ]] && \
+        app_vers=$(/usr/bin/plutil -extract CFBundleVersion raw "$app_plist" 2>/dev/null)
 
-    if [[ -n "$app_name" && -n "$app_bundle_id" && -n "$app_vers" ]] ; then
       installed_apps[$app_bundle_id]="$app_name;$app_vers"
-      unset app_name
-      unset app_bundle_id
-      unset app_vers
+    else
+      debug "App Path '$app_path' has no Info.plist"
     fi
   done
+
   # installed_apps is now an associative array with bundle ids as keys and app names as values
 
   # print the installed apps - this is a long list
@@ -402,8 +412,70 @@ function get_installed_apps() {
     done
   fi
 
+# debug "PATH is $PATH"
 } # end installed_apps
 
+########################################
+########################################
+########################################
+########################################
+########################################
+########################################
+# Gather all installed bundle ids and installed versions from lsreg
+# store them in an associative array in $installed_apps.
+# keys are bundle ids, values are app name & installed version
+# separated by a semicolon
+# e.g. 'com.apple.Safari => Safari.app;14.0.3'
+###############################
+# function get_installed_apps() {
+#   debug "Getting all installed .apps on this Mac..."
+#   local app_name
+#   local app_bundle_id
+#   local app_vers
+
+#   # loop thru lsreg output
+#   "$LSREG" -dump Bundle | while IFS= read -r line ; do
+#     # a line if ------ starts a new record
+#     if [[ "$line" =~ '^-+$' ]] ; then
+#       unset app_name
+#       unset app_bundle_id
+#       unset app_vers
+#       continue
+#     fi
+
+#     # $MATCH is the whole matched string, $match is the array of captures
+#     # NOTE this only works if the path is listed before the CFBundleIdentifier
+#     # which seems to be the case in the lsreg output
+#     [[ "$line" =~ '^path:[[:space:]]+/.*/(.+\.app) \(' ]] && app_name=$match[1]
+#     [[ "$line" =~ '^[[:space:]]+CFBundleIdentifier = \"(.+)\";' ]] && app_bundle_id=$match[1]
+#     [[ "$line" =~ '^[[:space:]]+CFBundleShortVersionString = \"(.+)\";' ]] && app_vers=$match[1]
+
+#     if [[ -n "$app_name" && -n "$app_bundle_id" && -n "$app_vers" ]] ; then
+#       installed_apps[$app_bundle_id]="$app_name;$app_vers"
+#       unset app_name
+#       unset app_bundle_id
+#       unset app_vers
+#     fi
+#   done
+#   # installed_apps is now an associative array with bundle ids as keys and app names as values
+
+#   # print the installed apps - this is a long list
+#   if debugging_on ; then
+#     debug "All installed .apps on this Mac:"
+#     for bundle app in ${(kv)installed_apps}; do
+#           debug "'$bundle' -> '$app'"
+#     done
+#   fi
+
+# } # end installed_apps
+########################################
+########################################
+########################################
+########################################
+########################################
+########################################
+########################################
+
 # Extract data from the client-data.json file
 #
 # TODO: Once we only support macOS 15 (Sequoia) and higher, we
@@ -463,7 +535,7 @@ function all_xolo_titles() {
   read -r -d '' jscode <<ENDJAVASCRIPT
     result = Object.keys(parsed_data.titles).join('\n');
 ENDJAVASCRIPT
-  extract_json_data "$jscode" | sort
+  extract_json_data "$jscode" | /usr/bin/sort
 }
 
 # Outputs all known titles, one per line, with versions and statuses
@@ -969,6 +1041,12 @@ function run_recon() {
 function update() {
   say "Updating installed titles, or installing newly scoped ones..."
 
+  if [[ -n "$do_recon" ]]  ; then
+    run_recon
+    say "Pausing to let Jamf Pro process recon data..."
+    sleep 60
+  fi
+
   debug "Running jamf policy..."
     if be_verbose ; then
     $JAMF policy -verbose
@@ -1020,12 +1098,15 @@ function list_installed_titles() {
   local ttl
   local app_data
 
-
   verbose "Locating installed titles..."
 
   # populate the installed_apps associative array
   get_installed_apps
 
+  # gather output here, display it at the end
+  # rather than interspersed with debug lines
+  installed_titles_report=""
+
   while IFS= read -r ttl; do
     app_data=$(app_data_for_title $ttl)
 
@@ -1036,6 +1117,8 @@ function list_installed_titles() {
       display_title_if_installed_by_version_script $ttl
     fi
   done <<<"$(all_xolo_titles)"
+
+  say "$installed_titles_report"
   return 0
 }
 
@@ -1075,9 +1158,9 @@ function display_title_if_installed_by_app_data() {
   [[ "$inst_app_name" == "$app_name" ]] || return
 
   if [[ -n "$no_versions" ]] ; then
-    echo $ttl
+    installed_titles_report="$installed_titles_report\n$ttl"
   else
-    echo "$ttl ($inst_app_vers)"
+    installed_titles_report="$installed_titles_report\n$ttl ($inst_app_vers)"
   fi
 }
 
@@ -1114,9 +1197,9 @@ function display_title_if_installed_by_version_script() {
   [[ -n "$app_vers" ]] || return
 
   if [[ -n "$no_versions" ]] ; then
-    echo $ttl
+    installed_titles_report="$installed_titles_report\n$ttl"
   else
-    echo "$ttl ($app_vers)"
+    installed_titles_report="$installed_titles_report\n$ttl ($inst_app_vers)"
   fi
 }
 

data/lib/xolo/core/version.rb

@@ -12,7 +12,7 @@ module Xolo
 
     module Version
 
-      VERSION = '2.2.4'.freeze
+      VERSION = '2.4.0'.freeze
 
     end
 

data/lib/xolo/server/configuration.rb

@@ -156,6 +156,7 @@ module Xolo
 
         # @!attribute server_admin_jamf_group
         #   @return [String] The name of a Jamf account-group containing users of 'xadm'
+        #     who are allowed to manage the xoloserver itself
         server_admin_jamf_group: {
           type: :string,
           desc: <<~ENDDESC

data/lib/xolo/server/helpers/autopkg.rb

@@ -35,6 +35,11 @@ module Xolo
         AUTOPKG_UPLOADED_BY = 'autopkg'
         FAIL_UNTRUSTED_RECIPES_CLI_OPT = '-k FAIL_RECIPES_WITHOUT_TRUST_INFO=yes'
 
+        # when we find a .pkg after a recipe has run, it can't be older than this many
+        # seconds, or we assume it is from some other run of the recipe, not the one we
+        # just did. Currently 20 min
+        MAX_PKG_AGE = 1200
+
         # Module Methods
         #######################
         #######################
@@ -127,7 +132,9 @@ module Xolo
           clean_old_pkgs pkgdir
 
           cmd = autopkg_run_command(title_object)
-          progress "Running AutoPkg recipe for #{title_object.title} via command: #{cmd.join(' ')}", log: :info
+          progress "Running AutoPkg recipe '#{recipe}' for #{title_object.title}..."
+
+          log_info "Running AutoPkg recipe for #{title_object.title} via command: #{cmd.join(' ')}"
 
           unlock_autopkg_user_keychain
 
@@ -135,20 +142,83 @@ module Xolo
           souterr.strip!
 
           if status.success?
-            progress "AutoPkg recipe #{recipe} for title '#{title_object.title}' completed successfully.", log: :info, alert: true
+            progress "AutoPkg recipe '#{recipe}' for title '#{title_object.title}' completed successfully.", log: :info, alert: true
             log_debug 'AutoPkg output:'
             souterr.lines.each { |l| log_debug "AutoPkg: #{l.chomp}" }
 
             pkgs = pkgdir.children.select { |c| c.extname == '.pkg' }
+            # the Pathname of the newest .pkg
             pkgs.max_by(&:mtime)
 
+          # Failure is a option
           else
-            progress "ERROR: AutoPkg recipe #{recipe} failed with status #{status.exitstatus}.", log: :error, alert: true
-            log_error 'AutoPkg output:'
-            souterr.lines.each { |l| log_error "AutoPkg: #{l.chomp}" }
+            handle_failed_recipe(
+              recipe: recipe,
+              title_object: title_object,
+              status: status,
+              souterr: souterr
+            )
+          end
+        end
+
+        # Deal with a failed recipe run
+        #
+        ###############################
+        def handle_failed_recipe(recipe:, title_object:, status:, souterr:)
+          errmsg = "ERROR: AutoPkg recipe '#{recipe}' for title '#{title_object.title}' failed with status #{status.exitstatus}. Details logged and emailed to '#{title_object.contact_email}'"
+
+          progress errmsg, log: :error, alert: true
+
+          # log the details
+          log_error 'AutoPkg output:'
+          souterr.lines.each { |l| log_error "AutoPkg: #{l.chomp}" }
+
+          # email the details to the contact addr for the title
+          email_subj = "ERROR: AutoPkg recipe FAILED for title '#{title_object.title}'"
+          email_msg = <<~ENDEMAIL
+            The autopkg recipe '#{recipe}' for title '#{title_object.title}' failed with status #{status.exitstatus}.
+
+            Please check that the recipe is up to date. If not, please update the recipe's repo by running this as the autppkg user on the xolo server:
+
+               autopkg repo-update <repo-name>
+
+            Then confirm you still trust the recipe.
+            If so, run:
+
+               autopkg update-trust-info '#{recipe}'
+
+            Then tell xolo the xolo server to re-run the recipe - the .pkg will always be assigned to the latest version.
+
+               xadm rerun-autopkg-recipe #{title_object.title}
+
+            If needed, contact your xoloserver administrator to perform the autopkg commands.
+
+            Here is the output from the failed recipe:
+            ------------------------------------------
+            #{souterr}
+          ENDEMAIL
+
+          send_email to: title_object.contact_email, subject: email_subj, msg: email_msg, html: false
+
+          raise "AutoPkg recipe #{recipe} failed."
+        end
+
+        # confirm a given autopkg package is OK to use after running a recipe
+        ###########################
+        def validate_autopkg_pkg(pkg_src)
+          if pkg_src.nil?
+            msg = 'AutoPkg recipe is enabled for this title, but no pkg was found after running the recipe. Please check the AutoPkg recipe and the server log for details.'
+            progress msg, log: :warn, alert: true
+            return false
+          end
 
-            raise "AutoPkg recipe #{recipe} failed."
+          oldest_allowed = Time.now - MAX_PKG_AGE # 20 minutes ago
+          if pkg_src.mtime < oldest_allowed
+            msg = "AutoPkg recipe is enabled for this title, and a pkg was found after running the recipe, but it was last modified at #{pkg_src.mtime}, which is more than 20 minutes ago. To avoid accidentally uploading an old pkg, the server will not upload this pkg. Please check the AutoPkg recipe and the server log for details."
+            progress msg, log: :warn, alert: true
+            return false
           end
+          true
         end
 
         # remove any existing pkgs from the given autopkg output dir

data/lib/xolo/server/helpers/maintenance.rb

@@ -108,14 +108,14 @@ module Xolo
           @maint_timer_task
         end
 
-        # When was our last maint?
+        # When was our last automated maint?
         # @return [Time] the time of the last maint, or the epoch if never
         ######################################
         def self.last_maint
           @last_maint ||= Time.at(0)
         end
 
-        # Set the time of the last maint
+        # Set the time of the last maint, if it was automated
         # @param time [Time] the time of the last maint
         # @return [Time] the time of the last maint
         ######################################
@@ -153,7 +153,7 @@ module Xolo
             Xolo::Server.logger.info 'Maint: Starting nightly run now'
 
           else
-            Xolo::Server.logger.info "Maint: Not starting, it isn't time"
+            Xolo::Server.logger.debug "Maint: Not starting, it isn't time"
             return
           end
 
@@ -195,13 +195,16 @@ module Xolo
 
           # add new maintenance tasks/methods here
           ######
+          update_ssl_cert_and_key
           accept_title_editor_eas title_objects_for_maint
           auto_release_versions title_objects_for_maint
           cleanup_versions title_objects_for_maint
           notify_admins_of_unreleased_pilots title_objects_for_maint
 
-          # make note of the time.
-          Xolo::Server::Helpers::Maintenance.last_maint = Time.now
+          # make note of the time, but only for automated runs.
+          # Manual runs don't affect this.
+          Xolo::Server::Helpers::Maintenance.last_maint = Time.now unless @manual_maintenance
+
           log_info 'Maint: complete'
 
           log_debug 'Maint: running update_client_data after all tasks'
@@ -210,6 +213,51 @@ module Xolo
           mutex&.unlock
         end
 
+        # Re-fetch the SSL certificate and key, as defined in the server config,
+        # and compare to the current values. If they are different, save and activate
+        # the new ones.
+        #
+        # NOTE, to get the current values we read the active files from disk,
+        # not the value in memory in the Xolo::Server.config object.
+        # In other words we use this:
+        #     curr_crt = Xolo::Server::Configuration::SSL_CERT_FILE.read.strip
+        # Not this:
+        #     curr_crt = Xolo::Server.config.ssl_cert
+        # This is because the file contents are what get sent to the https clients,
+        # so that's what matters.
+        # We do however update the in-memory value if an update is needed, just in case.
+        ######################################
+        def update_ssl_cert_and_key
+          log_info 'Maint: Checking if SSL Certificate & Key need updating.'
+          update = false
+
+          # check the cert
+          new_crt_src = Xolo::Server.config.raw_data[:ssl_cert]
+          log_debug "Maint: Re-fetching SSL Certificate from: #{new_crt_src}"
+          new_crt = Xolo::Server.config.data_from_command_file_or_string(new_crt_src).strip
+          curr_crt = Xolo::Server::Configuration::SSL_CERT_FILE.read.strip
+          update = true unless new_crt == curr_crt
+
+          # check the key
+          new_key_src = Xolo::Server.config.raw_data[:ssl_key]
+          log_debug "Maint: Re-fetching SSL Private Key from: #{new_key_src}"
+          new_key = Xolo::Server.config.data_from_command_file_or_string(new_key_src).strip
+          curr_key = Xolo::Server::Configuration::SSL_KEY_FILE.read.strip
+          update = true unless new_key == curr_key
+
+          if update
+            log_info 'Maint: SSL Certificate or Key has been updated, installing...'
+            Xolo::Server.config.ssl_cert = new_crt
+            Xolo::Server.config.ssl_key = new_key
+            Xolo::Server::Configuration::SSL_CERT_FILE.pix_save new_crt
+            Xolo::Server::Configuration::SSL_KEY_FILE.pix_save new_key
+          else
+            log_debug 'Maint: SSL Certificate and Private Key are unchanged.'
+          end
+
+          log_info 'Maint: Done Checking if SSL Certificate & Key.'
+        end
+
         # look for any titles that need their Title Editor EA's accepted,
         # and auto accept them if we need to
         # @return [void]
@@ -286,13 +334,13 @@ module Xolo
             next unless vobj_to_release
 
             # release it
-            log_debug "Maint: About to auto-release version '#{vobj_to_release.version}' of '#{title}' which came out #{vobj_to_release.creation_date}"
+            log_debug "Maint: About to auto-release '#{title}' version '#{vobj_to_release.version}' which came out #{vobj_to_release.creation_date}"
 
             # releasing a version is done via the title obj, since it affects the status
             # of all versions.
             title_obj.release vobj_to_release.version
 
-            log_info "Maint: Auto-released version '#{vobj_to_release.version}' of '#{title}' which came out #{vobj_to_release.creation_date}", alert: true
+            log_info "Maint: Auto-released '#{title}' version '#{vobj_to_release.version}' which came out #{vobj_to_release.creation_date}", alert: true
 
             # pause for server to catch up
             sleep 60

data/lib/xolo/server/helpers/subscriptions.rb

@@ -91,7 +91,7 @@ module Xolo
                 new_version: new_version
               )
             else
-              log_debug "Title '#{title_name}' ID #{title_id} is not a subscribed title in Xolo. Ignoring webhook."
+              log_debug "Title '#{title_name}' ID #{title_id} is not a subscribed title. Ignoring webhook."
             end
           rescue => e
             msg = "Error processing PatchSoftwareTitleUpdated webhook event: #{e.class}: #{e}"
@@ -101,21 +101,6 @@ module Xolo
           end # thread
         end
 
-        # TODO: Delete this method after confirming we don't want it
-        # It wasn't in use when it was commented out.
-        #
-        # Subscribe to a title on a given patch source.
-        # @param source_id [Integer] the id or name of the patch source in Jamf
-        # @param name_id [Integer] the name_id of the title on that patch source
-        # @param display_name [String] an display name for the title
-        # @return [Integer] the id of the new subscribed title, or false on failure
-        #####################################
-        # def subscribe_to_title(source_id:, name_id:, display_name:)
-        #   new_sub = Jamf::PatchTitle.create name: display_name, source_id: source_id, name_id: name_id, cnx: jamf_cnx
-
-        #   new_sub.save
-        # end
-
       end # Subscriptions
 
     end # Helpers

data/lib/xolo/server/mixins/title_jamf_access.rb

@@ -1808,6 +1808,8 @@ module Xolo
           pol.self_service_description = new_desc
 
           pol.self_service_install_button_text = Xolo::Server::Title::SELF_SERVICE_INSTALL_BTN_TEXT
+          pol.self_service_reinstall_button_text = Xolo::Server::Title::SELF_SERVICE_REINSTALL_BTN_TEXT
+
           # icon already uploaded to jamf
           return if ssvc_icon_id
 
@@ -1823,13 +1825,6 @@ module Xolo
           self.ssvc_icon_id = Jamf::Policy.fetch(id: pol.id, cnx: jamf_cnx).icon.id
         end
 
-        # run the autopkg recipe if defined
-        # See Helpers::AutoPkg for more details
-        ############################
-        def run_autopkg_recipe
-          server_app_instance.run_autopkg_recipe self
-        end
-
         # Methods used by subscription stuff
         ##############################
 

data/lib/xolo/server/mixins/title_ted_access.rb

@@ -119,17 +119,17 @@ module Xolo
 
           # the capabilites
           stub_patch.capabilities.add_criterion(
-            # Use the title as the name, so it matches all the future versions/patches
-            # avoiding a warning message in the TEd gui.
-            # name: Xolo::Server::Version::STUB_PATCH_CAPABILITY_CRITERION_NAME,
-            name: title,
+            name: Xolo::Server::Version::STUB_PATCH_CAPABILITY_CRITERION_NAME,
             operator: Xolo::Server::Version::STUB_PATCH_CAPABILITY_CRITERION_OPERATOR,
             value: Xolo::Server::Version::STUB_PATCH_CAPABILITY_CRITERION_VALUE
           )
 
           # the component
           stub_patch.add_component(
-            name: Xolo::Server::Version::STUB_PATCH_COMPONENT_NAME,
+            # Use the title as the name, so it matches all the future versions/patches
+            # avoiding a warning message in the TEd gui.
+            # name: Xolo::Server::Version::STUB_PATCH_COMPONENT_NAME,
+            name: title,
             version: Xolo::Server::Version::STUB_PATCH_VERSION
           )
 

data/lib/xolo/server/routes/maint.rb

@@ -51,7 +51,7 @@ module Xolo
             start_time: Xolo::Server.start_time,
             uptime: uptime_secs.pix_humanize_secs,
             uptime_secs: uptime_secs,
-            last_maint: Xolo::Server::Helpers::Maintenance.last_maint,
+            last_automated_maint: Xolo::Server::Helpers::Maintenance.last_maint,
             app_env: Xolo::Server.app_env,
             test_server: Xolo::Server.test_server?,
             data_dir: Xolo::Server::DATA_DIR,
@@ -71,6 +71,14 @@ module Xolo
           }
 
           if params[:extended]
+            ssl_cert_data ||= OpenSSL::X509::Certificate.new(Xolo::Server::Configuration::SSL_CERT_FILE.read)
+            state[:ssl_cert_subject] = ssl_cert_data.subject
+            state[:ssl_cert_issuer] = ssl_cert_data.issuer
+            state[:ssl_cert_valid_from] = ssl_cert_data.not_before.localtime
+            state[:ssl_cert_expires] = ssl_cert_data.not_after.localtime
+            state[:ssl_cert_serial] = ssl_cert_data.serial
+            state[:ssl_cert_signature_algorithm] = ssl_cert_data.signature_algorithm
+
             state[:gem_path] = Gem.paths.path
             state[:load_path] = $LOAD_PATH
             state[:object_locks] = Xolo::Server.object_locks
@@ -98,6 +106,8 @@ module Xolo
         # run the maintenance process manually from a server admin via xadm
         ################
         post '/maint/maint-start' do
+          @manual_maintenance = true
+
           log_info "Starting manual server maintenance by #{session[:admin]}"
 
           session[:admin] = "Maintenance by #{session[:admin]}"

data/lib/xolo/server/routes/titles.rb

@@ -288,6 +288,30 @@ module Xolo
           body data
         end
 
+        # rerun the titles autopkg recipe
+        ######################
+        post '/titles/:title/rerun_autopkg_recipe' do
+          halt_on_missing_title params[:title]
+          halt_on_locked_title params[:title]
+          title = instantiate_title params[:title]
+
+          unless title.autopkg_enabled?
+            msg = "Title '#{params[:title]}' is not configured to use AutoPkg"
+            log_debug "ERROR: #{msg}"
+            halt 409, { status: 409, error: msg }
+          end
+
+          unless title.latest_version
+            msg = "Title '#{params[:title]}' has no versions, cannot re-run the recipe"
+            log_debug "ERROR: #{msg}"
+            halt 404, { status: 404, error: msg }
+          end
+
+          with_streaming do
+            title.rerun_autopkg_recipe
+          end
+        end
+
       end # Titles
 
     end #  Routes

data/lib/xolo/server/title.rb

@@ -120,6 +120,7 @@ module Xolo
       JPAPI_PATCH_REPORT_RSRC = 'patch-report'
 
       SELF_SERVICE_INSTALL_BTN_TEXT = 'Install'
+      SELF_SERVICE_REINSTALL_BTN_TEXT = 'Re-Install'
 
       # Class Methods
       ######################
@@ -1144,6 +1145,27 @@ module Xolo
         unlock
       end
 
+      # run the autopkg recipe if defined
+      # See Helpers::AutoPkg for more details
+      ############################
+      def run_autopkg_recipe
+        server_app_instance.run_autopkg_recipe self
+      end
+
+      # Re run the autopkg recipe
+      # and re-upload the pkg
+      ############################
+      def rerun_autopkg_recipe
+        pkg_src = server_app_instance.run_autopkg_recipe self
+
+        return unless server_app_instance.validate_autopkg_pkg pkg_src
+
+        latest_version_obj = version_object latest_version
+        latest_version_obj.pkg_is_from_autopkg = true
+
+        server_app_instance.process_and_upload_autopkg_pkg title, latest_version_obj, pkg_src
+      end
+
       # Is this title locked for updates?
       #############################
       def locked?

data/lib/xolo/server/version.rb

@@ -748,18 +748,7 @@ module Xolo
 
         pkg_src = title_object.run_autopkg_recipe
 
-        if pkg_src.nil?
-          msg = 'AutoPkg recipe is enabled for this title, but no pkg was found after running the recipe. Please check the AutoPkg recipe and the server log for details.'
-          progress msg, log: :warn, alert: true
-          return
-        end
-
-        oldest_allowed = Time.now - 1200 # 20 minutes ago
-        if pkg_src.mtime < oldest_allowed
-          msg = "AutoPkg recipe is enabled for this title, and a pkg was found after running the recipe, but it was last modified at #{pkg_src.mtime}, which is more than 20 minutes ago. To avoid accidentally uploading an old pkg, the server will not upload this pkg. Please check the AutoPkg recipe and the server log for details."
-          progress msg, log: :warn, alert: true
-          return
-        end
+        return unless server_app_instance.validate_autopkg_pkg pkg_src
 
         # this lets future code know that the pkg we're working with came from autopkg
         self.pkg_is_from_autopkg = true

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: xolo-server
 version: !ruby/object:Gem::Version
-  version: 2.2.4
+  version: 2.4.0
 platform: ruby
 authors:
 - Chris Lasell
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-24 00:00:00.000000000 Z
+date: 2026-09-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday