Fleet runbook

Deploy BeProof with Fleet macOS MDM (agent + GitOps-style policies).

Prerequisites: Fleet server with macOS MDM enabled, macOS 14+ Apple Silicon hosts enrolled.

1. Software installer (PKG)

Upload PKG to Fleet or host on internal CDN:

./scripts/build_mdm_pkg.sh \
  --app dist/app/BeProofApp.app \
  --version 1.0.5 \
  --output BeProofApp-macos.pkg \
  --signing-identity "Developer ID Installer: Your Org (TEAMID)"

In Fleet UI:

1. Software → Add software → PKG
2. Upload package, set Self-service off for pilot
3. Target Label (pilot ring)

Or define in fleet.yml / GitOps per your Fleet version docs.

2. Configuration profile (PPPC)

1. Controls → OS settings → Custom settings
2. Upload signed com.beproof.app.pppc.mobileconfig
3. Apply to pilot label

Reference: PPPC.md

3. Org-policy overlay script

Fleet Scripts (macOS, run as root):

#!/bin/bash
set -euo pipefail
ORG_DIR="/Library/Application Support/BeProof"
mkdir -p "$ORG_DIR"
curl -fsSL "https://your-internal-host/org-policy-overlay.json" \
  -o "$ORG_DIR/org-policy-overlay.json"
chmod 644 "$ORG_DIR/org-policy-overlay.json"

Schedule: Run once at enrollment + periodic drift check.

BeProof reads:

/Library/Application Support/BeProof/org-policy-overlay.json

When present, endpoints auto-report scanScopeSource: mdm_profile.

4. Fleet queries (validation)

Add custom query for pilot visibility:

SELECT 1 AS ok
FROM file
WHERE path = '/Library/Application Support/BeProof/org-policy-overlay.json';

Optional script check via Fleet Scripts log: run beproof evaluate-policy --format json and parse auditMode.

5. CLI on managed hosts

Install CLI for automation:

brew tap oxy9en/beproof https://github.com/oxy9en/AgAudit-releases
brew install beproof

Document that CLI keychain scans use the terminal's TCC context, not com.beproof.app.

6. Rollout rings

Pin PKG version per pilot ring in Fleet. BeProof disables in-app Sparkle updates in managed mode — promote versions with MDM PKG only.

See also: deploy README