✨ Detect Firefox remoting name on macOS (#5902)

Signed-off-by: Christian Zunker <christian@mondoo.com>

Author: czunker

providers/os/resources/packages/macos_packages.go

@@ -6,11 +6,14 @@ package packages
 import (
 	"fmt"
 	"io"
+	"path/filepath"
 	"strings"
 
 	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog/log"
 	"go.mondoo.com/cnquery/v12/providers-sdk/v1/inventory"
 	"go.mondoo.com/cnquery/v12/providers/os/connection/shared"
+	"go.mondoo.com/cnquery/v12/providers/os/resources/parsers"
 	"go.mondoo.com/cnquery/v12/providers/os/resources/purl"
 	plist "howett.net/plist"
 )
@@ -19,8 +22,18 @@ const (
 	MacosPkgFormat = "macos"
 )
 
+type sysProfilerItem struct {
+	Name    string `plist:"_name"`
+	Version string `plist:"version"`
+	Path    string `plist:"path"`
+}
+
+type sysProfiler struct {
+	Items []sysProfilerItem `plist:"_items"`
+}
+
 // parse macos system version property list
-func ParseMacOSPackages(platform *inventory.Platform, input io.Reader) ([]Package, error) {
+func ParseMacOSPackages(conn shared.Connection, platform *inventory.Platform, input io.Reader) ([]Package, error) {
 	var r io.ReadSeeker
 	r, ok := input.(io.ReadSeeker)
 
@@ -33,16 +46,6 @@ func ParseMacOSPackages(platform *inventory.Platform, input io.Reader) ([]Packag
 		r = strings.NewReader(string(packageList))
 	}
 
-	type sysProfilerItems struct {
-		Name    string `plist:"_name"`
-		Version string `plist:"version"`
-		Path    string `plist:"path"`
-	}
-
-	type sysProfiler struct {
-		Items []sysProfilerItems `plist:"_items"`
-	}
-
 	var data []sysProfiler
 	decoder := plist.NewDecoder(r)
 	err := decoder.Decode(&data)
@@ -56,13 +59,15 @@ func ParseMacOSPackages(platform *inventory.Platform, input io.Reader) ([]Packag
 
 	pkgs := make([]Package, len(data[0].Items))
 	for i, entry := range data[0].Items {
+		// We need a special handling for Firefox to determine ESR installations
+		purlQualifiers := getPurlQualifiers(conn, entry)
 		pkgs[i].Name = entry.Name
 		pkgs[i].Version = entry.Version
 		pkgs[i].Format = MacosPkgFormat
 		pkgs[i].FilesAvailable = PkgFilesIncluded
 		pkgs[i].Arch = platform.Arch
 		pkgs[i].PUrl = purl.NewPackageURL(
-			platform, purl.TypeMacos, entry.Name, entry.Version,
+			platform, purl.TypeMacos, entry.Name, entry.Version, purl.WithQualifiers(purlQualifiers),
 		).String()
 		if entry.Path != "" {
 			pkgs[i].Files = []FileRecord{
@@ -96,7 +101,7 @@ func (mpm *MacOSPkgManager) List() ([]Package, error) {
 		return nil, fmt.Errorf("could not read package list")
 	}
 
-	return ParseMacOSPackages(mpm.platform, cmd.Stdout)
+	return ParseMacOSPackages(mpm.conn, mpm.platform, cmd.Stdout)
 }
 
 func (mpm *MacOSPkgManager) Available() (map[string]PackageUpdate, error) {
@@ -107,3 +112,38 @@ func (mpm *MacOSPkgManager) Files(name string, version string, arch string) ([]F
 	// nothing extra to be done here since the list is already included in the package list
 	return nil, nil
 }
+
+func getPurlQualifiers(conn shared.Connection, entry sysProfilerItem) map[string]string {
+	qualifiers := make(map[string]string)
+	if entry.Name == "Firefox" {
+		appIni := ""
+		if entry.Path != "" {
+			appIni = filepath.Join(entry.Path, "Contents", "Resources", "application.ini")
+		}
+		if appIni != "" {
+			f, err := conn.FileSystem().Open(appIni)
+			if err != nil {
+				log.Debug().Err(err).Msg("could not open application.ini")
+				return nil
+			}
+			defer f.Close()
+			content, err := io.ReadAll(f)
+			if err != nil {
+				log.Debug().Err(err).Msg("could not read application.ini")
+				return nil
+			}
+			ini := parsers.ParseIni(string(content), "=")
+			if ini != nil {
+				if data, ok := ini.Fields["App"]; ok {
+					fields, ok := data.(map[string]any)
+					if ok {
+						if name, ok := fields["RemotingName"]; ok {
+							qualifiers["remoting-name"] = name.(string)
+						}
+					}
+				}
+			}
+		}
+	}
+	return qualifiers
+}

providers/os/resources/packages/macos_packages_test.go

@@ -29,9 +29,9 @@ func TestMacOsXPackageParser(t *testing.T) {
 		Arch:    "x86_64",
 		Family:  []string{"darwin", "bsd", "unix", "os"},
 	}
-	m, err := packages.ParseMacOSPackages(pf, c.Stdout)
+	m, err := packages.ParseMacOSPackages(mock, pf, c.Stdout)
 	assert.Nil(t, err)
-	assert.Equal(t, 2, len(m), "detected the right amount of packages")
+	assert.Equal(t, 3, len(m), "detected the right amount of packages")
 
 	assert.Equal(t, "Preview", m[0].Name, "pkg name detected")
 	assert.Equal(t, "10.0", m[0].Version, "pkg version detected")
@@ -47,4 +47,10 @@ func TestMacOsXPackageParser(t *testing.T) {
 	assert.Equal(t, packages.PkgFilesIncluded, m[1].FilesAvailable)
 	assert.Equal(t, "pkg:macos/macos/Contacts@11.0?arch=x86_64", m[1].PUrl)
 	assert.Equal(t, []packages.FileRecord{{Path: "/Applications/Contacts.app"}}, m[1].Files)
+
+	assert.Equal(t, "Firefox", m[2].Name, "pkg name detected")
+	assert.Equal(t, "128.12.0", m[2].Version, "pkg version detected")
+	assert.Equal(t, packages.MacosPkgFormat, m[2].Format, "pkg format detected")
+	assert.Equal(t, "pkg:macos/macos/Firefox@128.12.0?arch=x86_64&remoting-name=firefox-esr", m[2].PUrl)
+	assert.Equal(t, []packages.FileRecord{{Path: "/Applications/Firefox.app"}}, m[2].Files)
 }

providers/os/resources/packages/testdata/packages_macos.toml

@@ -69,10 +69,62 @@ stdout = """<?xml version="1.0" encoding="UTF-8"?>
 				<key>version</key>
 				<string>11.0</string>
 			</dict>
+			<dict>
+				<key>_name</key>
+				<string>Firefox</string>
+				<key>arch_kind</key>
+				<string>arch_arm_i64</string>
+				<key>info</key>
+				<string>Firefox 128.12.0</string>
+				<key>lastModified</key>
+				<date>2025-07-02T08:20:57Z</date>
+				<key>obtained_from</key>
+				<string>identified_developer</string>
+				<key>path</key>
+				<string>/Applications/Firefox.app</string>
+				<key>signed_by</key>
+				<array>
+					<string>Developer ID Application: Mozilla Corporation (43AQ936H96)</string>
+					<string>Developer ID Certification Authority</string>
+					<string>Apple Root CA</string>
+				</array>
+				<key>version</key>
+				<string>128.12.0</string>
+			</dict>
 		</array>
 		<key>_parentDataType</key>
 		<string>SPSoftwareDataType</string>
 	</dict>
 </array>
 </plist>
-"""
+"""
+
+[files."/Applications/Firefox.app/Contents/Resources/application.ini"]
+content = """
+; This file is not used. If you modify it and want the application to use
+; your modifications, move it under the browser/ subdirectory and start with
+; the "-app /path/to/browser/application.ini" argument.
+[App]
+Vendor=Mozilla
+Name=Firefox
+RemotingName=firefox-esr
+Version=128.14.0
+BuildID=20250811113756
+SourceRepository=https://hg.mozilla.org/releases/mozilla-esr128
+SourceStamp=df0b4a4887880a1b267ca2b4902afee84e80f6e9
+ID={ec8030f7-c20a-464f-9b0e-13a3a9e97384}
+
+[Gecko]
+MinVersion=128.14.0
+MaxVersion=128.14.0
+
+[XRE]
+EnableProfileMigrator=1
+
+[Crash Reporter]
+Enabled=1
+ServerURL=https://crash-reports.mozilla.com/submit?id={ec8030f7-c20a-464f-9b0e-13a3a9e97384}&version=128.14.0&buildid=20250811113756
+
+[AppUpdate]
+URL=https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%SYSTEM_CAPABILITIES%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml
+"""