Change in behavior: Policy function findfiles

Note: this blog post was updated January 29th, 2026

Here comes a profoundly belated blog post on a behavior change. Better late than never.

Due to various bugs with the glob engine on Windows, we decided to rewrite it in CFEngine 3.24.0. Not only does the new glob engine resolve these bugs on Windows, but it also adds support for brace expansion on all platforms. E.g.

bundle agent main
{
  vars:
    "matches"
  	  slist => findfiles("C:/{foo,bar}.txt");
  reports:
  	"$(matches)";
}

& 'C:\Program Files\Cfengine\bin\cf-agent.exe' -Kf C:\findfiles.cf

R: C:\bar.txt
R: C:\foo.txt

Users may experience issues due to the fact that the new glob engine outputs the matched paths with the system separator (i.e., $(const.dirsep)). E.g., given the following policy, you can see how the output with the matched files changed from having forward slashes in CFEngine 3.21 to having backslashes in CFEngine 3.24 on Windows.

bundle agent main
{
  vars:
    "matches"
	    slist => findfiles("C:/Users/Administrator/Downloads/*.msi");
  reports:
    "CFEngine $(sys.cf_version) matches:";
	  "$(matches)";
}

& 'C:\Program Files\Cfengine\bin\cf-agent.exe' -Kf C:\findfiles.cf

R: CFEngine 3.21.7 matches:
R: C:/Users/Administrator/Downloads/cfengine-nova-3.21.7-1-x86_64.msi
R: C:/Users/Administrator/Downloads/cfengine-nova-3.24.2-1-x86_64.msi

& 'C:\Program Files\Cfengine\bin\cf-agent.exe' -Kf C:\findfiles.cf

R: CFEngine 3.24.2 matches:
R: C:\Users\Administrator\Downloads\cfengine-nova-3.21.7-1-x86_64.msi
R: C:\Users\Administrator\Downloads\cfengine-nova-3.24.2-1-x86_64.msi

Some users may experience issues where they use the returned file paths of the findfiles() function in regular expressions. In this case, the back slashes must either be escaped with an addition backslash, or replaced with forward slashes. Otherwise, the regex engine will interpret them as control characters. A typical error message you would encounter in this case is:

error: Regular expression error: 'unknown property after \P or \p' in expression 'C:\Program Files\foo.json' (offset: 5)

Hence, if your policy breaks due to the fact that it depends on the assumption that the matched paths contain forward slashes, then you know why.

If you have questions or need help, reach out on the mailing list or GitHub discussions. If you have a support contract, feel free to open a ticket in our support system.