[DO NOT REVIEW]feat(anc): verify and extract repository hotfix packages

aks-node-controller/app.go

@@ -74,13 +74,6 @@ type App struct {
 	// grpcDialContext overrides how the gRPC LPS client dials, letting tests point the client at
 	// an in-process (bufconn) server. When nil, the real TLS dial to the apiserver front is used.
 	grpcDialContext func(ctx context.Context, target string) (net.Conn, error)
-	// httpDownload overrides the real HTTP GET for download-hotfix artifact fetching, letting
-	// unit tests inject canned binary content or errors without real networking. When nil, the
-	// real HTTP download is used.
-	httpDownload func(ctx context.Context, url string) ([]byte, error)
-	// downloadDir overrides the directory where artifact downloads are staged. When empty,
-	// defaults to filepath.Dir(hotfixBinaryPath). Used for testing.
-	downloadDir string
 }
 
 // provision.json values are emitted as strings by the shell jq invocation.

aks-node-controller/checkhotfix.go

@@ -211,7 +211,7 @@ func (a *App) checkHotfix(ctx context.Context) (checkHotfixOutcome, error) {
 	// value keeps the reported outcome consistent with what download-hotfix will actually read:
 	// a pointer with no entry for this node's base stages nothing resolvable, so it must report
 	// noHotfixForBase, not LPSRead.
-	staged := hotfixConfig{Hotfixes: cfg.Hotfixes, Artifacts: cfg.Artifacts}
+	staged := hotfixConfig{Hotfixes: cfg.Hotfixes}
 
 	if err := writeHotfixConfig(hotfixPath, staged); err != nil {
 		return outcomeFailed, fmt.Errorf("writing hotfix config: %w", err)
@@ -444,16 +444,15 @@ func (a *App) coldStartHotfixConfig() (hotfixConfig, bool, error) {
 	// Lenient parse: the AKSNodeConfig is protojson, but the cold-start pointer is an
 	// out-of-contract top-level object, so parse it permissively with encoding/json.
 	var lenient struct {
-		Hotfixes  map[string]string                  `json:"hotfixes"`
-		Artifacts map[string]map[string]artifactInfo `json:"artifacts"`
+		Hotfixes map[string]string `json:"hotfixes"`
 	}
 	if err := json.Unmarshal(raw, &lenient); err != nil {
 		return hotfixConfig{}, false, fmt.Errorf("parsing cold-start hotfixes from node config: %w", err)
 	}
 	if len(lenient.Hotfixes) == 0 {
 		return hotfixConfig{}, false, nil
 	}
-	return hotfixConfig{Hotfixes: lenient.Hotfixes, Artifacts: lenient.Artifacts}, true, nil
+	return hotfixConfig{Hotfixes: lenient.Hotfixes}, true, nil
 }
 
 // writeHotfixConfig stages the LPS-served hotfixes map to the path download-hotfix reads.
@@ -482,21 +481,13 @@ func writeHotfixConfig(path string, cfg hotfixConfig) error {
 		hotfixes = map[string]string{}
 	}
 	out := struct {
-		Version        string                             `json:"version,omitempty"`
-		ScriptsVersion string                             `json:"scripts_version,omitempty"`
-		Hotfixes       map[string]string                  `json:"hotfixes"`
-		Artifacts      map[string]map[string]artifactInfo `json:"artifacts,omitempty"`
+		Version        string            `json:"version,omitempty"`
+		ScriptsVersion string            `json:"scripts_version,omitempty"`
+		Hotfixes       map[string]string `json:"hotfixes"`
 	}{
 		Version:        existing.Version,
 		ScriptsVersion: existing.ScriptsVersion,
 		Hotfixes:       hotfixes,
-		Artifacts:      cfg.Artifacts,
-	}
-	// Preserve existing artifacts when the incoming config has none (e.g. LPS response
-	// doesn't include artifacts yet). This mirrors the Version/ScriptsVersion preservation
-	// and avoids erasing artifacts that cloud-init originally wrote.
-	if out.Artifacts == nil {
-		out.Artifacts = existing.Artifacts
 	}
 	data, err := json.Marshal(out)
 	if err != nil {

aks-node-controller/checkhotfix_test.go

@@ -682,13 +682,12 @@
 	}
 }
 
-// TestWriteHotfixConfig_PreservesExistingVersionAndScriptsVersion is the unit-level guard for
-// the read-modify-write: given a pre-existing file (as cloud-init writes) carrying version and
-// scripts_version, writeHotfixConfig must keep those fields and only replace the hotfixes map.
-func TestWriteHotfixConfig_PreservesExistingVersionAndScriptsVersion(t *testing.T) {
+// TestWriteHotfixConfig_PreservesVersionsAndDropsArtifacts guards the read-modify-write:
+// version fields remain compatible with cloud-init, while the retired artifacts contract is removed.
+func TestWriteHotfixConfig_PreservesVersionsAndDropsArtifacts(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "hotfix.json")
 	require.NoError(t, os.WriteFile(path, []byte(
-		`{"version":"202604.01.5","scripts_version":"202604.01.7","hotfixes":{"202604.01":"202604.01.5"}}`), 0644))
+		`{"version":"202604.01.5","scripts_version":"202604.01.7","hotfixes":{"202604.01":"202604.01.5"},"artifacts":{"202604.01.5":{"linux-ubuntu-22.04-amd64":{"url":"https://packages.microsoft.com/fake.deb","sha256":"abc123"}}}}`), 0644))
 
 	require.NoError(t, writeHotfixConfig(path, hotfixConfig{Hotfixes: map[string]string{"202604.01": "202604.01.9"}}))