fix(windows): pull secure-tls-bootstrap-client from aks dalec

parts/common/components.json

@@ -939,6 +939,7 @@
       "name": "aks-secure-tls-bootstrap-client",
       "downloadLocation": "/opt/aks-secure-tls-bootstrap-client/downloads",
       "windowsDownloadLocation": "c:\\akse-cache\\aks-secure-tls-bootstrap-client\\",
+      "windowsDownloadedFileName": "windows-amd64.zip",
       "downloadURIs": {
         "ubuntu": {
           "r2604": {
@@ -1010,10 +1011,10 @@
             "versionsV2": [
               {
                 "renovateTag": "<DO_NOT_UPDATE>",
-                "latestVersion": "1.1.4"
+                "latestVersion": "1.1.4-3"
               }
             ],
-            "downloadURL": "https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v${version}/windows-amd64.zip"
+            "downloadURL": "https://packages.aks.azure.com/dalec-packages/aks-secure-tls-bootstrap-client/$($version.Split('-')[0])/windows/amd64/aks-secure-tls-bootstrap-client_${version}_amd64.zip"
           }
         }
       }

schemas/components.cue

@@ -98,6 +98,7 @@ package components
 	name:              string
 	downloadLocation?:  string
 	windowsDownloadLocation?:  string
+	windowsDownloadedFileName?: string
 	downloadURIs:      #DownloadURIs
 }
 

vhdbuilder/packer/test/windows-files-check.ps1

@@ -26,12 +26,7 @@ $SkipMapForSignature = @{
 
 $SkipSignatureCheckForBinaries = @{
     # win-bridge.exe is not signed in these k8s packages, and it will be removed from k8s package in the future
-    "win-bridge.exe"                      = $True;
-    # aks-secure-tls-bootstrap-client.exe should be signed once it has been onboarded to Dalec and published via Upstream,
-    # though for now we allow-list it as to not block secure TLS bootstrapping development
-    # NOTE: this is okay since the binary is cleaned up during node provisioning when secure TLS bootstrapping is disabled (which is currently the default in production)
-    # TODO(cameissner): remove this once the binary is properly signed
-    "aks-secure-tls-bootstrap-client.exe" = $True;
+    "win-bridge.exe" = $True;
 }
 
 # MisMatchFiles is used to record files whose file sizes are different on Global and MoonCake
@@ -132,6 +127,9 @@ function Test-ValidateSinglePackageSignature {
 
     foreach ($URL in $map[$dir]) {
         $fileName = [IO.Path]::GetFileName($URL)
+        if ($packageCacheFileNames.ContainsKey($URL)) {
+            $fileName = $packageCacheFileNames[$URL]
+        }
         $dest = [IO.Path]::Combine($dir, $fileName)
 
         $installDir = "c:\SignatureCheck"

vhdbuilder/packer/test/windows-vhd-content-test.ps1

@@ -138,6 +138,9 @@ function Test-FilesToCacheOnVHD {
 
         foreach ($URL in $map[$fakeDir]) {
             $fileName = [IO.Path]::GetFileName($URL)
+            if ($packageCacheFileNames.ContainsKey($URL)) {
+                $fileName = $packageCacheFileNames[$URL]
+            }
             $dest = [IO.Path]::Combine($dir, $fileName)
 
             if (![System.IO.File]::Exists($dest)) {

vhdbuilder/packer/windows/components_json_helpers.ps1

@@ -161,6 +161,39 @@ function GetPackagesFromComponentsJson
     return $output
 }
 
+function GetWindowsPackageCacheFileNamesFromComponentsJson
+{
+    Param(
+        [Parameter(Mandatory = $true)][Object]
+        $componentsJsonContent
+    )
+    $output = @{}
+
+    foreach ($package in $componentsJsonContent.Packages)
+    {
+        $cacheFileName = $package.windowsDownloadedFileName
+        if ([string]::IsNullOrEmpty($cacheFileName))
+        {
+            continue
+        }
+
+        $part = GetWindowsDownloadPartForPackage $package
+        $downloadUrl = $part.windowsDownloadUrl
+        if ([string]::IsNullOrEmpty($downloadUrl))
+        {
+            $downloadUrl = $part.downloadUrl
+        }
+
+        foreach ($windowsVersion in $part.versionsV2)
+        {
+            $version = $windowsVersion.latestVersion
+            $output[(SafeReplaceString($downloadUrl))] = SafeReplaceString($cacheFileName)
+        }
+    }
+
+    return $output
+}
+
 function GetWindowsPackageVersionFromComponentsJson
 {
     Param(

vhdbuilder/packer/windows/components_json_helpers.tests.ps1

@@ -638,6 +638,40 @@ Describe 'Gets the Binaries' {
         $packages["location"] | Should -Contain "https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v1.8.22.zip"
     }
 
+    It 'uses a stable Windows cache filename when configured' {
+        $componentsJson.Packages[0] | Add-Member -NotePropertyName "windowsDownloadedFileName" -NotePropertyValue "windows-amd64.zip"
+        $componentsJson.Packages[0].downloadUris.windows.default.versionsV2 = @(
+            [PSCustomObject]@{
+                latestVersion = "1.8.22"
+            }
+        )
+
+        $cacheFileNames = GetWindowsPackageCacheFileNamesFromComponentsJson $componentsJson
+
+        $cacheFileNames["https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v1.8.22.zip"] | Should -Be "windows-amd64.zip"
+    }
+
+    It 'keeps the versioned cache filename for a previous Windows package version' {
+        $componentsJson.Packages[0] | Add-Member -NotePropertyName "windowsDownloadedFileName" -NotePropertyValue "windows-amd64.zip"
+        $componentsJson.Packages[0].downloadUris.windows.default.versionsV2 = @(
+            [PSCustomObject]@{
+                latestVersion = "1.8.22"
+                previousLatestVersion = "1.8.21"
+            }
+        )
+
+        $cacheFileNames = GetWindowsPackageCacheFileNamesFromComponentsJson $componentsJson
+
+        $cacheFileNames["https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v1.8.22.zip"] | Should -Be "windows-amd64.zip"
+        $cacheFileNames.ContainsKey("https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v1.8.21.zip") | Should -BeFalse
+    }
+
+    It 'does not override the Windows cache filename by default' {
+        $cacheFileNames = GetWindowsPackageCacheFileNamesFromComponentsJson $componentsJson
+
+        $cacheFileNames | ConvertTo-Json -Compress | Should -Be "{}"
+    }
+
     It 'can get the latest Windows package version by name' {
         $componentsJson.Packages[0] | Add-Member -NotePropertyName "name" -NotePropertyValue "oras"
         $componentsJson.Packages[0].downloadUris.windows.default.versionsV2 = @(

vhdbuilder/packer/windows/configure-windows-vhd.ps1

@@ -443,6 +443,10 @@ function Get-PackagesToCacheOnVHD
         foreach ($URL in $map[$dir])
         {
             $fileName = [IO.Path]::GetFileName($URL)
+            if ($packageCacheFileNames.ContainsKey($URL))
+            {
+                $fileName = $packageCacheFileNames[$URL]
+            }
             $dest = [IO.Path]::Combine($dir, $fileName)
 
             Write-Log "Downloading $URL to $dest"

vhdbuilder/packer/windows/windows-vhd-configuration.ps1

@@ -71,6 +71,7 @@ $global:imagesToPull = GetComponentsFromComponentsJson $componentsJson
 $global:ociArtifactsToPull = GetOCIArtifactsFromComponentsJson $componentsJson
 $global:keysToSet = GetRegKeysToApply $windowsSettingsJson
 $global:map = GetPackagesFromComponentsJson $componentsJson
+$global:packageCacheFileNames = GetWindowsPackageCacheFileNamesFromComponentsJson $componentsJson
 $global:releaseNotesToSet = GetKeyMapForReleaseNotes $windowsSettingsJson
 
 $validSKU = GetWindowsBaseVersions $windowsSettingsJson