From b1273573ed33712613795e2f401bdf9376a90679 Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Thu, 11 Jun 2026 15:50:53 -0400
Subject: [PATCH] Fix jq $def keyword collision in optional-integrations-load

The agent-policy enumeration passed --argjson def, creating a jq
variable $def. 'def' is a reserved keyword in jq and the deployed jq
version rejects it, so the program failed to compile and
in_use_integrations was left empty (silently disabling the in-use
upgrade guard). Rename the arg to $defaults.
---
 .../sbin_jinja/so-elastic-fleet-optional-integrations-load    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-optional-integrations-load b/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-optional-integrations-load
index 7579123cb..75bbc29d8 100644
--- a/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-optional-integrations-load
+++ b/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-optional-integrations-load
@@ -53,8 +53,8 @@ for AGENT_POLICY in $agent_policies; do
     # non-default integrations that are in-use in any policy
     while IFS= read -r PACKAGE_NAME; do
         [ -n "$PACKAGE_NAME" ] && in_use_integrations+=("$PACKAGE_NAME")
-    done < <(jq -r --argjson def "$default_packages_json" \
-        '.item.package_policies[].package.name | select(. as $n | ($def | index($n)) | not)' \
+    done < <(jq -r --argjson defaults "$default_packages_json" \
+        '.item.package_policies[].package.name | select(. as $n | ($defaults | index($n)) | not)' \
         <<<"$policy_json")
 done