[packaging] proxy binary to be for the root dir of windows archive by pkoutsovasilis · Pull Request #7601 · elastic/elastic-agent

pkoutsovasilis · 2025-03-27T19:17:47Z

What does this PR do?

This PR introduces a Windows-specific proxy binary (elastic-agent-archive-root.exe) that is placed at the root of the Elastic Agent .zip archive. The proxy acts as a thin wrapper that forwards execution to the actual agent binary located under the data/elastic-agent-{commit-sha} directory.

The proxy is built during the packaging step using a new Mage target (WindowsArchiveRootBinary), and replaces the duplicated agent binary that previously resided in the archive root due to lack of symlink support in .zip archives. This approach mimics the behavior seen on other platforms like Linux/macOS, where the root-level agent is a symlink into the versioned binary path.

This change avoids the need to duplicate the agent binary in the archive, reducing both the archive size and post-extraction disk footprint.

Why is it important?

The Windows .zip archive currently includes a full copy of the elastic-agent.exe binary at the root of the archive due to the lack of symlink support in the zip format. This duplication, increases the download size and disk footprint unnecessarily

Checklist

I have read and understood the pull request guidelines of this project.
My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in ./changelog/fragments using the changelog tool
I have added an integration test or an E2E test

Disruptive User Impact

There should be no disruptive user impact. The proxy binary is fully backward-compatible with existing workflows that invoke the elastic-agent.exe binary from the root of the archive on Windows. Users should not notice any difference in behavior.

How to test this PR locally

Package the windows archive

PACKAGES=zip EXTERNAL=true PLATFORMS=windows/amd64 SNAPSHOT=true mage -v package

Unzip the resulting .zip file and verify that:

The root elastic-agent.exe is a lightweight proxy (~2MB instead of 260MB+)
The actual binary lives under data/elastic-agent-/elastic-agent.exe
Running the root elastic-agent.exe launches the nested agent as expected

Related issues

Closes [Windows] Shrink the disk footprint of the .zip package by including only one copy of elastic-agent.exe #7592

Manual Testing

DRA dry-run here and artifacts are produced successfully (link) (ty @pchila 🙏 )
With the windows artifact from the above I directly installed a fleet-managed and agent got installed fine and reported healthy
I installed a standalone agent at the version v8.17.4. Then again from the windows artifact of the above DRA I did an upgrade and this was successful

mergify · 2025-03-27T19:18:41Z

This pull request does not have a backport label. Could you fix it @pkoutsovasilis? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-./d./d is the label that automatically backports to the 8./d branch. /d is the digit
backport-active-all is the label that automatically backports to all active branches.
backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

…chive and invoke the nested elastic-agent binary

elasticmachine · 2025-03-28T04:39:27Z

💚 Build Succeeded

Buildkite Build
Commit: 159b7b6

History

💔 Build #19280 failed a6aa52b

cc @pkoutsovasilis

elasticmachine · 2025-03-28T12:34:35Z

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

pchila

A couple of nitpicks, nothing blocking
Good to merge.

ebeahan

I'm unsure about introducing a top level dir named hack 😅

pkoutsovasilis · 2025-03-28T13:35:58Z

I'm unsure about introducing a top level dir named hack 😅

😄 I am not afraid to admit that choosing where this would live was kinda of puzzle, but then I recalled this one and it seemed appropriate to me. That said, more than happy to accept more "appropriate" proposals

swiatekm

LGTM, comment not blocking.

ebeahan · 2025-03-28T13:52:31Z

more than happy to accept more "appropriate" proposals.

I don't have strong feelings about using hack, but I worry it could be seen and taken out of context.

wrapper(s)? If we think it's something we might address different in the future (famous words): interim?

…roxy/go.mod" This reverts commit c9a698b.

cmacknz · 2025-03-28T15:30:21Z

ok so if my understanding is correct remove os.Stat entirely and allow the error from command.Start() to be raised instead?

Try this and see if the error is clearer. The way I tested this was to rename the data sub-directory to something else then run ./elastic-agent.exe install for reference to check what the command did.

…r if binary is missing

cmacknz · 2025-03-28T16:40:13Z

Something we changed is making Defender want to scan us before executing. That didn't happen the first time. My bet is it was the event log change. That's not worth this so I'd vote we pull that out.

cmacknz · 2025-03-28T16:40:46Z

(there is a chance this is unrelated but I am no MS Defender whisperer)

pkoutsovasilis · 2025-03-28T16:44:33Z

(there is a chance this is unrelated but I am no MS Defender whisperer)

hmmm I did get one similar notification but I assumed that windows defender just decided to wake up 🙂 ok better safe than sorry removing the eventlog

cmacknz · 2025-03-28T16:46:27Z

I can confirm writing to the event log does work, and doesn't happen when not running as an admin as expected.

cmacknz · 2025-03-28T16:47:11Z

Yeah that's the first time I've ever seen defender pop up like that so I think we must have done something to cause it.

pkoutsovasilis · 2025-03-28T16:52:11Z

ok reverted back to the initial log implementation but removed the timestamp inconsistency 🙂

cmacknz · 2025-03-28T17:45:22Z

Tested latest changes again, still works. Curiously I got the Defender pop up again so it wasn't the event log. There seems to be no consequences to this as far as I can tell and I have no idea what is actually causing it. Perhaps the os.Stat implicitly doing CreateFile was part of it? Not sure how much we want to churn on this. I'm not sure we even did anything to cause this TBH.

elastic-sonarqube · 2025-03-28T17:49:11Z

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 40%)

See analysis details on SonarQube

cmacknz · 2025-03-28T18:51:50Z

https://support.microsoft.com/en-us/topic/what-is-a-cloud-security-scan-75112696-7660-4450-9194-d717f72a8ad8

There is a chance the defender pop up goes away once we test a version of the file that is properly signed as part of the unified release.

cmacknz

LGTM, we should probably include a changelog if the disk size is smaller than 8.17 noting how much this saved (if not, we don't need to highlight how much bigger it got)

pkoutsovasilis · 2025-03-28T19:17:12Z

LGTM, we should probably include a changelog if the disk size is smaller than 8.17 noting how much this saved (if not, we don't need to highlight how much bigger it got)

So I did a quick comparison we are producing a ~ 50 MB larger archive compared to 8.17 🙂 But no more explosion when you decompress

blakerouse

CI passed, looks good!

pkoutsovasilis · 2025-03-31T11:43:01Z

@ebeahan should we merge this? 🙂

…7601) * feat: implement a proxy binary to be placed in the root of windows archive and invoke the nested elastic-agent binary * fix: remove redundant returns in the code * fix: reword error message when we cannot stat inner elastic-agent binary * fix: use slices.Contains to check if we are building for windows/amd64 * fix: add comment to capture that CommitSHA is set at build time * fix: rename hack folder to wrapper * fix: reside typo * fix: reword error message when we cannot stat inner elastic-agent binary * ci: automate go version updates for wrapper/windows/archive-proxy/go.mod * fix: switch logging to fmt and also log to windows event logger * Revert "ci: automate go version updates for wrapper/windows/archive-proxy/go.mod" This reverts commit c9a698b. * fix: initialise windows event log only if we are admin * fix: remove os.Stat call and rely on command.Start() to raise an error if binary is missing * fix: remove custom logger (cherry picked from commit 6b4b0dc) # Conflicts: # dev-tools/packaging/packages.yml

…7601) * feat: implement a proxy binary to be placed in the root of windows archive and invoke the nested elastic-agent binary * fix: remove redundant returns in the code * fix: reword error message when we cannot stat inner elastic-agent binary * fix: use slices.Contains to check if we are building for windows/amd64 * fix: add comment to capture that CommitSHA is set at build time * fix: rename hack folder to wrapper * fix: reside typo * fix: reword error message when we cannot stat inner elastic-agent binary * ci: automate go version updates for wrapper/windows/archive-proxy/go.mod * fix: switch logging to fmt and also log to windows event logger * Revert "ci: automate go version updates for wrapper/windows/archive-proxy/go.mod" This reverts commit c9a698b. * fix: initialise windows event log only if we are admin * fix: remove os.Stat call and rely on command.Start() to raise an error if binary is missing * fix: remove custom logger (cherry picked from commit 6b4b0dc)

…r of windows archive (#7638) * [packaging] proxy binary to be for the root dir of windows archive (#7601) * feat: implement a proxy binary to be placed in the root of windows archive and invoke the nested elastic-agent binary * fix: remove redundant returns in the code * fix: reword error message when we cannot stat inner elastic-agent binary * fix: use slices.Contains to check if we are building for windows/amd64 * fix: add comment to capture that CommitSHA is set at build time * fix: rename hack folder to wrapper * fix: reside typo * fix: reword error message when we cannot stat inner elastic-agent binary * ci: automate go version updates for wrapper/windows/archive-proxy/go.mod * fix: switch logging to fmt and also log to windows event logger * Revert "ci: automate go version updates for wrapper/windows/archive-proxy/go.mod" This reverts commit c9a698b. * fix: initialise windows event log only if we are admin * fix: remove os.Stat call and rely on command.Start() to raise an error if binary is missing * fix: remove custom logger (cherry picked from commit 6b4b0dc) # Conflicts: # dev-tools/packaging/packages.yml * fix: resolve conflicts --------- Co-authored-by: Panos Koutsovasilis <panos.koutsovasilis@elastic.co>

… of windows archive (#7637) * [packaging] proxy binary to be for the root dir of windows archive (#7601) * feat: implement a proxy binary to be placed in the root of windows archive and invoke the nested elastic-agent binary * fix: remove redundant returns in the code * fix: reword error message when we cannot stat inner elastic-agent binary * fix: use slices.Contains to check if we are building for windows/amd64 * fix: add comment to capture that CommitSHA is set at build time * fix: rename hack folder to wrapper * fix: reside typo * fix: reword error message when we cannot stat inner elastic-agent binary * ci: automate go version updates for wrapper/windows/archive-proxy/go.mod * fix: switch logging to fmt and also log to windows event logger * Revert "ci: automate go version updates for wrapper/windows/archive-proxy/go.mod" This reverts commit c9a698b. * fix: initialise windows event log only if we are admin * fix: remove os.Stat call and rely on command.Start() to raise an error if binary is missing * fix: remove custom logger (cherry picked from commit 6b4b0dc) # Conflicts: # dev-tools/packaging/packages.yml * fix: resolve conflicts --------- Co-authored-by: Panos Koutsovasilis <panos.koutsovasilis@elastic.co>

…7601) (#7639) * feat: implement a proxy binary to be placed in the root of windows archive and invoke the nested elastic-agent binary * fix: remove redundant returns in the code * fix: reword error message when we cannot stat inner elastic-agent binary * fix: use slices.Contains to check if we are building for windows/amd64 * fix: add comment to capture that CommitSHA is set at build time * fix: rename hack folder to wrapper * fix: reside typo * fix: reword error message when we cannot stat inner elastic-agent binary * ci: automate go version updates for wrapper/windows/archive-proxy/go.mod * fix: switch logging to fmt and also log to windows event logger * Revert "ci: automate go version updates for wrapper/windows/archive-proxy/go.mod" This reverts commit c9a698b. * fix: initialise windows event log only if we are admin * fix: remove os.Stat call and rely on command.Start() to raise an error if binary is missing * fix: remove custom logger (cherry picked from commit 6b4b0dc) Co-authored-by: Panos Koutsovasilis <panos.koutsovasilis@elastic.co> Co-authored-by: Eric Beahan <eric.beahan@elastic.co>

pkoutsovasilis self-assigned this Mar 27, 2025

pkoutsovasilis added the skip-changelog label Mar 27, 2025

pkoutsovasilis force-pushed the packaging/windows_archive_root_binary branch from a6aa52b to eaafbd0 Compare March 28, 2025 02:00

feat: implement a proxy binary to be placed in the root of windows ar…

159b7b6

…chive and invoke the nested elastic-agent binary

pkoutsovasilis force-pushed the packaging/windows_archive_root_binary branch from eaafbd0 to 159b7b6 Compare March 28, 2025 03:05

pkoutsovasilis added Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team backport-8.x Automated backport to the 8.x branch with mergify backport-8.18 Automated backport to the 8.18 branch backport-9.0 Automated backport to the 9.0 branch labels Mar 28, 2025

pkoutsovasilis marked this pull request as ready for review March 28, 2025 12:34

pkoutsovasilis requested a review from a team as a code owner March 28, 2025 12:34

pkoutsovasilis requested review from kaanyalti and ycombinator March 28, 2025 12:34

pchila previously approved these changes Mar 28, 2025

View reviewed changes

Comment thread hack/windows/archive-proxy/main.go Outdated

Comment thread hack/windows/archive-proxy/main.go Outdated

Comment thread hack/windows/archive-proxy/main.go Outdated

Comment thread magefile.go Outdated

pkoutsovasilis added 3 commits March 28, 2025 15:19

fix: remove redundant returns in the code

521e771

fix: reword error message when we cannot stat inner elastic-agent binary

6f5df45

fix: use slices.Contains to check if we are building for windows/amd64

fe889d4

pkoutsovasilis dismissed pchila’s stale review via fe889d4 March 28, 2025 13:27

pkoutsovasilis requested a review from pchila March 28, 2025 13:30

ebeahan reviewed Mar 28, 2025

View reviewed changes

swiatekm previously approved these changes Mar 28, 2025

View reviewed changes

Comment thread hack/windows/archive-proxy/main.go

fix: add comment to capture that CommitSHA is set at build time

bc4c38c

pkoutsovasilis dismissed swiatekm’s stale review via bc4c38c March 28, 2025 13:47

pkoutsovasilis requested a review from swiatekm March 28, 2025 13:48

swiatekm previously approved these changes Mar 28, 2025

View reviewed changes

Revert "ci: automate go version updates for wrapper/windows/archive-p…

b088b05

…roxy/go.mod" This reverts commit c9a698b.

pkoutsovasilis added 2 commits March 28, 2025 17:46

fix: initialise windows event log only if we are admin

df09d40

fix: remove os.Stat call and rely on command.Start() to raise an erro…

39d651a

…r if binary is missing

fix: remove custom logger

efe5fd5

cmacknz approved these changes Mar 28, 2025

View reviewed changes

blakerouse approved these changes Mar 28, 2025

View reviewed changes

pchila approved these changes Mar 31, 2025

View reviewed changes

pkoutsovasilis merged commit 6b4b0dc into elastic:main Mar 31, 2025

mergify Bot mentioned this pull request Mar 31, 2025

[8.x](backport #7601) [packaging] proxy binary to be for the root dir of windows archive #7637

Merged

8 tasks

This was referenced Mar 31, 2025

[8.18](backport #7601) [packaging] proxy binary to be for the root dir of windows archive #7638

Merged

[9.0](backport #7601) [packaging] proxy binary to be for the root dir of windows archive #7639

Merged

pkoutsovasilis deleted the packaging/windows_archive_root_binary branch June 3, 2025 04:15

Conversation

pkoutsovasilis commented Mar 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Why is it important?

Checklist

Disruptive User Impact

How to test this PR locally

Related issues

Manual Testing

Uh oh!

mergify Bot commented Mar 27, 2025

Uh oh!

elasticmachine commented Mar 28, 2025

💚 Build Succeeded

History

Uh oh!

elasticmachine commented Mar 28, 2025

Uh oh!

pchila left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ebeahan left a comment

Choose a reason for hiding this comment

Uh oh!

pkoutsovasilis commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

swiatekm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ebeahan commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cmacknz commented Mar 28, 2025

Uh oh!

cmacknz commented Mar 28, 2025

Uh oh!

cmacknz commented Mar 28, 2025

Uh oh!

pkoutsovasilis commented Mar 28, 2025

Uh oh!

cmacknz commented Mar 28, 2025

Uh oh!

cmacknz commented Mar 28, 2025

Uh oh!

pkoutsovasilis commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cmacknz commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elastic-sonarqube Bot commented Mar 28, 2025

Quality Gate failed

Uh oh!

cmacknz commented Mar 28, 2025

Uh oh!

cmacknz left a comment

Choose a reason for hiding this comment

Uh oh!

pkoutsovasilis commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blakerouse left a comment

Choose a reason for hiding this comment

Uh oh!

pkoutsovasilis commented Mar 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

pkoutsovasilis commented Mar 27, 2025 •

edited

Loading

pkoutsovasilis commented Mar 28, 2025 •

edited

Loading

ebeahan commented Mar 28, 2025 •

edited

Loading

pkoutsovasilis commented Mar 28, 2025 •

edited

Loading

cmacknz commented Mar 28, 2025 •

edited

Loading

pkoutsovasilis commented Mar 28, 2025 •

edited

Loading