Add a Primo remediation kit to Fleet
Put in place everything a kit Primo maintains for a known issue needs: its scripts in your script library, and its reports in Fleet, which each computer runs every hour to tell what is left to fix. Returns each script with its scriptId, its purpose (check, remediate or manual) and the platforms to run it on, and each report. Nothing is run on a device: run a script with runScript, and read the reports with getRemediationKitFindings.
Safe to call again: a script the library already holds under the same name is left as it is and reported present, or differs when its source is not the kit’s; a report is brought back to the kit when it drifted.
Kits: emudhra_ca_compromise, the eMudhra CA compromise of October 2026 (https://docs.getprimo.com/guides/security/emudhra-ca-compromise). Its scripts: check-emudhra-exposure.sh (macOS and Linux, read-only, also sees pip’s own certifi and Node.js installed with nvm, fnm, Volta, asdf or mise) and Fleet’s remediate-emudhra-ca-compromise-macos.sh and -linux.sh, which remove trust in the compromised roots and keep a *.pre-emudhra backup of each file they edit. On Windows, distrust-emudhra-intermediates-windows.ps1 downloads the 16 compromised intermediates from crt.sh, checks each one’s SHA-256, and adds them to the machine’s Untrusted Certificates (exit 2 when crt.sh cannot be reached); Fleet’s remediate-emudhra-ca-compromise-windows.ps1 is manual: it embeds the certificates, so Microsoft Defender blocks it (ScriptContainedMaliciousContent in its output).
Authorizations
Use your Primo API key in the Authorization header as Bearer <API_KEY>.
Body
The kit. emudhra_ca_compromise: the eMudhra CA compromise of October 2026.
emudhra_ca_compromise