fix(windows): pull secure-tls-bootstrap-client from aks dalec - #9364
Open
Mark Ibrahim (mxj220) wants to merge 5 commits into
Open
fix(windows): pull secure-tls-bootstrap-client from aks dalec#9364Mark Ibrahim (mxj220) wants to merge 5 commits into
Mark Ibrahim (mxj220) wants to merge 5 commits into
Conversation
Mark Ibrahim (mxj220)
requested review from
Devinwong,
Sri Harsha (SriHarsha001),
Abigail Liang (abigailliang-aks-sig-node),
Abdul Asfari (aboodasfari),
Nishchay (awesomenix),
Ben Brady (benjamin-brady),
Calvin S. (calvin197),
Cameron Meissner (cameronmeissner),
Sylvain Boily (djsly),
fcher,
Ganeshkumar Ashokavardhanan (ganeshkumarashok),
janenotjung-hue,
Karen Chen (karenychen),
lilypan26,
Peter Damianov (pdamianov-dev),
Patrick W. Healy (phealy),
r2k1,
Runzhen (runzhen),
Shun Lyu (sinmentis),
sulixu,
Tim Wright (timmy-wright),
Thibault Cohen (titilambert),
Xu Xue (xuexu6666) and
Zachary (zachary-bailey)
as code owners
September 1, 2026 20:14
github-actions
Bot
added
the
components
Contributor
Windows Unit Test Results 3 files 13 suites 49s ⏱️ Results for commit fe0c430. ♻️ This comment has been updated with latest results. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The filename migration does not preserve compatibility between old and new Windows CSE/VHD combinations.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Migrates the Windows secure TLS bootstrap client to the signed Dalec package.
Changes:
- Switches Windows artifact
1.1.4→1.1.4-3. - Updates cache discovery and tests for Dalec filenames.
- Removes the unsigned-binary signature exception.
Package Update Analysis: aks-secure-tls-bootstrap-client
Version change: 1.1.4 → 1.1.4-3 (packaging revision)
OS affected: Windows
Changelog: No application-version change; public packaging changelog unavailable.
Overall risk: 🔴 High—cache renaming breaks compatibility between independently released Windows CSE and VHD versions.
File summaries
| File | Description |
|---|---|
parts/common/components.json |
Uses the signed Dalec Windows artifact. |
staging/cse/windows/securetlsbootstrapfunc.ps1 |
Discovers the renamed cached archive. |
staging/cse/windows/securetlsbootstrapfunc.tests.ps1 |
Updates cache-install tests. |
vhdbuilder/packer/test/windows-files-check.ps1 |
Enforces signature validation for the client. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Mark Ibrahim (mxj220)
changed the title
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The undeclared schema field breaks validation, and previous package versions can overwrite the latest cached artifact.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 6/8 changed files
- Comments generated: 2
- Review effort level: Balanced
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The unresolved cache collision can cause a previous package version to overwrite the latest artifact.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 7/9 changed files
- Comments generated: 0 new
- Review effort level: Balanced
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Windows VHD content validation still expects the URL-derived filename and will report the renamed cached package as missing.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 7/9 changed files
- Comments generated: 1
- Review effort level: Balanced
Contributor
Changes cached containers or packages on windows VHDsPlease get a Windows SIG member to approve. The following dif file shows any additions or deletions from what will be cached on windows VHDs organised by VHD type.
diff --git a/vhd_files/2022-containerd-gen2.txt b/vhd_files/2022-containerd-gen2.txt
index 4e05767..4f70b87 100644
--- a/vhd_files/2022-containerd-gen2.txt
+++ b/vhd_files/2022-containerd-gen2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.4/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://packages.aks.azure.com/dalec-packages/aks-secure-tls-bootstrap-client/1.1.4/windows/amd64/aks-secure-tls-bootstrap-client_1.1.4-3_amd64.zip
diff --git a/vhd_files/2022-containerd.txt b/vhd_files/2022-containerd.txt
index a8c76d7..562800d 100644
--- a/vhd_files/2022-containerd.txt
+++ b/vhd_files/2022-containerd.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.4/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://packages.aks.azure.com/dalec-packages/aks-secure-tls-bootstrap-client/1.1.4/windows/amd64/aks-secure-tls-bootstrap-client_1.1.4-3_amd64.zip
diff --git a/vhd_files/2025-gen2-tl.txt b/vhd_files/2025-gen2-tl.txt
index e49ede0..7e1d6ed 100644
--- a/vhd_files/2025-gen2-tl.txt
+++ b/vhd_files/2025-gen2-tl.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.4/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://packages.aks.azure.com/dalec-packages/aks-secure-tls-bootstrap-client/1.1.4/windows/amd64/aks-secure-tls-bootstrap-client_1.1.4-3_amd64.zip
diff --git a/vhd_files/2025-gen2.txt b/vhd_files/2025-gen2.txt
index eec1d89..8814bd2 100644
--- a/vhd_files/2025-gen2.txt
+++ b/vhd_files/2025-gen2.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.4/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://packages.aks.azure.com/dalec-packages/aks-secure-tls-bootstrap-client/1.1.4/windows/amd64/aks-secure-tls-bootstrap-client_1.1.4-3_amd64.zip
diff --git a/vhd_files/2025.txt b/vhd_files/2025.txt
index 5997647..dd10605 100644
--- a/vhd_files/2025.txt
+++ b/vhd_files/2025.txt
@@ -4 +4 @@ c:\akse-cache\: https://packages.aks.azure.com/ccgakvplugin/v1.1.5/binaries/wind
-c:\akse-cache\aks-secure-tls-bootstrap-client\: https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v1.1.4/windows-amd64.zip
+c:\akse-cache\aks-secure-tls-bootstrap-client\: https://packages.aks.azure.com/dalec-packages/aks-secure-tls-bootstrap-client/1.1.4/windows/amd64/aks-secure-tls-bootstrap-client_1.1.4-3_amd64.zip |
Tim Wright (timmy-wright)
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
pull secure-tls-bootstrap-client from aks dalec to fix ICM for unsigned binary
Which issue(s) this PR fixes:
Fixes #