Following up with a few more things I hit once I got the export working, all on 4.89.2. The main blocker is software installers. Our export includes packages with

hash_sha256

for installers that were uploaded through the UI and live in Fleet, not in the repo. A dry run fails with "package not found with hash <sha>" for a package that is currently installed and working on hosts. What is the intended pattern for installers uploaded through the UI? We can't commit the .pkg and .deb files. Is there a supported way to reference an already uploaded installer by hash, or does this need the software GitOps exception? Second, the two commands produce different layouts.

fleetctl new

creates a

platforms/

tree, and

generate-gitops

writes

lib/<fleet-name>/

with relative ../lib paths from fleets/. Which should a new repo standardize on? I am leaning towards the

generate-gitops

layout since the paths already resolve, but want to check that isn't the legacy shape. Two smaller ones, both from

generate-gitops

output that then fails validation on the way back in. It writes

setup_experience

as the literal string 'TODO: update with your setup_experience configuration', which fails with "expected type fleet.MacOSSetup but got string". And it omits the controls key from default.yml entirely, which fails with "'controls' must be set on global config". Are those known gaps, or should those keys just be dropped or stubbed by hand?

adding a note for our internal teams that this was addressed over in macadmins slack! hope things are going better with it today @Stefan Seul!