Run Python scripts on macOS & Linux

[noahtalerman]

• @noahtalerman: @allenhouchins's PR: Add Python script support for macOS and Linux #38562

Goal

User story
As an IT admin,
I want to add a Python script to Fleet
so that I can run it on my macOS and Linux hosts.

Changes

Product

• UI changes:
  • Changes included in PR
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: No changes
• Fleet's agent (fleetd) changes: No changes
• Fleet server configuration changes: No changes
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: No changes
• GitOps mode UI changes: No changes
• GitOps generation changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: No changes
• My device and fleetdm.com/better changes: No changes
• Usage statistics: No changes
• Other reference documentation changes: No changes
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: Extract this into its own PR https://github.com/fleetdm/fleet/pull/38562/changes#diff-7dc3fd8de336b2ad465a68dde80ee9bd180b46e11a065b56047be49f1948c8aeR4520
• Feature guide changes: Extract this into its own PR https://github.com/fleetdm/fleet/pull/38562/changes#diff-6317e1600a9d5ca2c765a0475f9309f18f0b8a60d9b44c9edb17adf3f090b705R5
• This is a premium only feature: No

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Risk level: Low

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

• Try to add a Python script in Controls > Scripts. Verify that it shows up properly as a Python script and is distinguishable from a Powershell or Unix shell script. Try this on a Fleet and on "Unassigned"
• Edit a python script. Save it, run it and make sure the updated version is what gets run
• Delete a python script. Make sure it can be deleted
• Run the added Python script on macOS and Linux hosts
• Make sure a python script can be defined as a Policy Automation and it runs properly on macOS and Linux when triggered by the policy
• Use the batch scripts feature to run a python script on 2 or more hosts at once. Verify that it runs successfully on both hosts
• Use the batch scripts feature to run a python script on a macOS, Windwos and Linux host. Verify it runs on the macOS and Linux hosts but gets marked incompatible on Windows
• Run a long-running(longer than the script timeout) script on macOS and Linux hosts. Verify it still gets cancelled by the script timeout
• Add custom variables to fleet. Verify they're properly replaced in python scripts
• Try to add a python script to setup experience. Verify it is blocked
• Make sure you can't define a python script as a payload-free package
• Make sure you can't define a python script as an install/uninstall script Assuming this gets fixed, otherwise skip Software Install, Post install and Uninstall scripts does not validate shell script format #41500
• Add a python script and execute it on a macOS host and a linux host in Fleet Free
• Add a python script via Gitops to both "unassigned"(no team) and a team. Verify it can be executed on a host
• Upload a python script with an invalid shebang(try python2) and a .py script with no shebang. Verify it is rejected
• Confirm error messages in GitOps/API/UI match what's outlined in PR
• Try to use features not supported in the version of python on your host. Verify that it tries to run and returns whatever error python returns when you try to do this directly(i.e. it doesn't hang forever or return some way that masks the failure reason)

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan.
2. QA: Added comment to user story confirming successful completion of test plan.

[noahtalerman]

Hey @georgekarrv can you please help us T-shirt size this one? Check out Allen's PR for reference: #38562

To keep this simple, we think we want to add Python scripts to Fleet's allowlist of scripts you can upload.

cc @JordanMontgomery

[marko-lisica]

Hey @lukeheath , I moved this one from 4.88 to 4.84, because Allen already made a PR (#38562), and I can move it through drafting next design sprint. Let me know if that's feasible.

cc @noahtalerman

[georgekarrv]

Putting a small just because there is often a lot to double check and validate for new filetypes that we will want to button up.

[lukeheath]

@georgekarrv Agree we want to be diligent about reviewing community PRs and not allowing guilt-induced merges. But, we need to timebox how much we invest in that. I'm setting to an XS because if the team looks at the PR and estimates more than an 8, please don't bring it into the sprint. At that point, we'd want to re-evaluate our approach.