feat(anc): direct HTTP download for hotfix with SHA-256 verification by abigailliang-aks-sig-node · Pull Request #9233 · Azure/AgentBaker

Abigail Liang (abigailliang-aks-sig-node) · 2026-08-18T01:43:06Z

Summary

Add artifacts field to hotfix config JSON for direct HTTP download URLs + SHA-256 checksums
~25x faster than apt-get/dnf path (0.87s vs 10-22s)
URL restricted to HTTPS + PMC allowlist, cross-domain redirects rejected
Backward compatible: falls back to apt/dnf when no artifacts field or no OS/arch match

Fallback strategy

Condition	Behavior
`artifacts` missing or no OS/arch match	Fallback to apt/dnf
HTTP network error	Fallback to apt/dnf
SHA-256 mismatch	Hard fail, keep VHD-baked ANC
Invalid URL (non-HTTPS, non-PMC)	Hard fail, keep VHD-baked ANC

Example hotfix config with artifacts

{
  "hotfixes": {
    "202607.02": "202607.02.2"
  },
  "artifacts": {
    "202607.02.2": {
      "ubuntu-22.04-amd64": {
        "url": "https://packages.microsoft.com/...deb",
        "sha256": "c5c29cd3..."
      }
    }
  }
}

Future work (separate PRs)

Descriptor signing (schemaVersion, expiresAt, keyId)
LPS/ABSvc/CRP changes to preserve artifacts field during serialization
Package content validation (version/arch/OS inside package)

Test plan

All existing hotfix tests pass
New tests: artifact HTTP success, SHA mismatch hard fail, HTTP error fallback, no artifacts fallback, invalid URL hard fail
buildArtifactKey tests for Ubuntu/AzureLinux
validateArtifactURL tests for HTTPS/host allowlist
E2E with real PMC artifact

github-actions · 2026-08-18T01:48:12Z

Windows Unit Test Results

3 files 12 suites 49s ⏱️
389 tests 389 ✅ 0 💤 0 ❌
392 runs 392 ✅ 0 💤 0 ❌

Results for commit a06a78b.

♻️ This comment has been updated with latest results.

Copilot

Pull request overview

Adds a faster hotfix delivery path for aks-node-controller by allowing direct HTTPS artifact downloads (with SHA-256 verification) when the hotfix config includes an artifacts descriptor, while retaining the existing apt/dnf fallback behavior.

Changes:

Extend hotfix config parsing to support an artifacts map keyed by hotfix version and ID-VERSION_ID-GOARCH.
Implement direct HTTP download with URL allowlisting, redirect restrictions, and SHA-256 verification (with hard-fail on integrity violations).
Add unit tests covering artifact parsing, URL validation, key building, and download/fallback behaviors.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
aks-node-controller/hotfix.go	Adds artifact resolution + direct HTTP download/verify path and associated config structs/helpers.
aks-node-controller/hotfix_test.go	Adds tests for artifacts parsing, artifact key derivation, URL validation, and download behavior.
aks-node-controller/checkhotfix.go	Propagates/stages `artifacts` through check-hotfix (LPS + cold-start) into the shared pointer file.
aks-node-controller/app.go	Adds an injectable `httpDownload` hook to allow unit tests to bypass real networking.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…fication Replace the slow apt-get/dnf package manager path (~10-22s) with direct HTTP download (~0.87s) when an artifact descriptor is present in the hotfix config. The new optional `artifacts` field in the hotfix JSON maps version + OS/arch to a download URL and SHA-256 digest. Fallback strategy: - No artifacts or no OS/arch match: fallback to apt/dnf (backward compat) - HTTP network error: fallback to apt/dnf - SHA-256 mismatch or invalid URL: hard fail, keep VHD-baked ANC

Three places were discarding the new artifacts field: 1. LPS staging (line 212): only carried Hotfixes 2. Cold-start fallback (line 448): lenient struct lacked Artifacts 3. writeHotfixConfig serialization: anonymous struct omitted Artifacts All three now pass Artifacts through so download-hotfix can use the direct HTTP download path end-to-end.

Add downloadDir field to App so tests can override the temp file directory (CI lacks /opt/azure/containers/). Update test assertion to expect the copyBinaryAlongside error (vhdBinaryPath not present) while verifying package manager was not invoked.

…lobals lint

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

aks-node-controller/hotfix.go:641

When client.Do(req) returns an error, it can still return a non-nil resp. Not closing resp.Body in that case can leak connections/file descriptors (and prevent transport reuse).

	resp, err := client.Do(req)
	if err != nil {
		cancel()
		return nil, err
	}

aks-node-controller/checkhotfix.go:493

This only preserves existing.Artifacts when cfg.Artifacts is nil. If the incoming config has an empty-but-non-nil map (e.g. an explicit "artifacts": {} from an upstream serializer), this will overwrite any cloud-init populated artifacts with an empty object.

	// Preserve existing artifacts when the incoming config has none (e.g. LPS response
	// doesn't include artifacts yet). This mirrors the Version/ScriptsVersion preservation
	// and avoids erasing artifacts that cloud-init originally wrote.
	if out.Artifacts == nil {
		out.Artifacts = existing.Artifacts
	}

Abigail Liang (abigailliang-aks-sig-node) marked this pull request as ready for review August 18, 2026 01:46

Copilot AI lite review requested due to automatic review settings August 18, 2026 01:46

Copilot started reviewing on behalf of Abigail Liang (abigailliang-aks-sig-node) August 18, 2026 01:47 View session

Copilot AI reviewed Aug 18, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 18, 2026 05:56

Copilot started reviewing on behalf of Abigail Liang (abigailliang-aks-sig-node) August 18, 2026 05:56 View session

This comment was marked as duplicate.

Sign in to view

Copilot AI review requested due to automatic review settings August 18, 2026 06:01

Copilot started reviewing on behalf of Abigail Liang (abigailliang-aks-sig-node) August 18, 2026 06:02 View session

This comment was marked as duplicate.

Sign in to view

Copilot AI review requested due to automatic review settings August 18, 2026 06:22

Copilot started reviewing on behalf of Abigail Liang (abigailliang-aks-sig-node) August 18, 2026 06:23 View session

Abigail Liang (abigailliang-aks-sig-node) enabled auto-merge (squash) August 18, 2026 06:27

This comment was marked as duplicate.

Sign in to view

Abigail Liang (abigailliang-aks-sig-node) added 5 commits August 18, 2026 13:57

fix(anc): inline allowlist in validateArtifactURL to avoid gochecknog…

4e13258

…lobals lint

fix

a06a78b

Copilot AI review requested due to automatic review settings August 18, 2026 20:58

Abigail Liang (abigailliang-aks-sig-node) force-pushed the abigailliang/anc-hotfix-http-download branch from 4f17626 to a06a78b Compare August 18, 2026 20:58

Copilot started reviewing on behalf of Abigail Liang (abigailliang-aks-sig-node) August 18, 2026 20:59 View session

Copilot AI reviewed Aug 18, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat(anc): direct HTTP download for hotfix with SHA-256 verification - #9233

feat(anc): direct HTTP download for hotfix with SHA-256 verification#9233
Abigail Liang (abigailliang-aks-sig-node) wants to merge 5 commits into
mainfrom
abigailliang/anc-hotfix-http-download

Abigail Liang (abigailliang-aks-sig-node) commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as duplicate.

Uh oh!

This comment was marked as duplicate.

Uh oh!

This comment was marked as duplicate.

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Abigail Liang (abigailliang-aks-sig-node) commented Aug 18, 2026

Summary

Fallback strategy

Example hotfix config with artifacts

Future work (separate PRs)

Test plan

Uh oh!

github-actions Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Windows Unit Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as duplicate.

Uh oh!

This comment was marked as duplicate.

Uh oh!

This comment was marked as duplicate.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 18, 2026 •

edited

Loading