From 6a382ad4b45c63b40884142e5e83035657860a3f Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Tue, 1 Apr 2025 09:43:34 +0200
Subject: [PATCH 01/42] Add component list to specs

---
 dev-tools/mage/pkgtypes.go       |   2 +
 dev-tools/packaging/packages.yml | 288 +++++++++++++++++++------------
 2 files changed, 175 insertions(+), 115 deletions(-)

diff --git a/dev-tools/mage/pkgtypes.go b/dev-tools/mage/pkgtypes.go
index 81aef4444ab..11726d99628 100644
--- a/dev-tools/mage/pkgtypes.go
+++ b/dev-tools/mage/pkgtypes.go
@@ -29,6 +29,7 @@ import (
 	"gopkg.in/yaml.v3"
 
 	"github.com/elastic/elastic-agent/dev-tools/mage/pkgcommon"
+	"github.com/elastic/elastic-agent/dev-tools/packaging"
 )
 
 const (
@@ -107,6 +108,7 @@ type PackageSpec struct {
 	OutputFile        string                 `yaml:"output_file,omitempty"` // Optional
 	ExtraVars         map[string]string      `yaml:"extra_vars,omitempty"`  // Optional
 	ExtraTags         []string               `yaml:"extra_tags,omitempty"`  // Optional
+	Components        []packaging.BinarySpec `yaml:"components"`            // Optional: Components required for this package
 
 	evalContext            map[string]interface{}
 	packageDir             string
diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index e537dad6cd2..8c3fd8bed02 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -4,6 +4,126 @@
 # Official Beats. The shared section contains YAML anchors that are used to
 # define common parts of the package in order to not repeat ourselves.
 
+# List all the available platforms
+platforms: &all-platforms
+  - &linux-amd64
+    os: linux
+    arch: x86_64
+  - &linux-arm64
+    os: linux
+    arch: arm64
+  - &windows-amd64
+    os: windows
+    arch: x86_64
+  - &darwin-amd64
+    os: darwin
+    arch: x86_64
+  - &darwin-arm64
+    os: darwin
+    arch: aarch64
+
+# List all the package type constants (see dev-tools/mage/pkgcommon/pkgcommon-types.go)
+packageTypes: &all-package-types
+  - &pkg-type-rpm
+      1 # RPM
+  - &pkg-type-deb
+      2 # Deb
+  - &pkg-type-zip
+      3 # zip
+  - &pkg-type-targz
+      4 # tar.gz
+  - &pkg-type-docker
+      5 # docker
+
+# List *all* the components available for packaging in elastic-agent
+components:
+  # general template for new components
+  #  - &comp-<anchor name>
+  #    projectName: <project name under manifest>
+  #    packageName: <template representing the name of the archive to download/extract>
+  #    binaryName: <binary name>
+  #    platforms:
+  #      - <platform, use anchors for platforms above>
+  #    pythonWheel: true # true if it's a package that is not platform specific
+  #    packageTypes: *all-package-types # package types it should be included in
+  - &comp-agentbeat
+    projectName: beats
+    packageName: agentbeat-{{.Version}}-{{.Platform}}.{{.Ext}}
+    binaryName: agentbeat
+    platforms: *all-platforms
+    packageTypes: *all-package-types
+  - &comp-apm_server
+    projectName: apm-server
+    packageName: apm-server-{{.Version}}-{{.Platform}}.{{.Ext}}
+    binaryName: apm-server
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
+      - *windows-amd64
+      - *darwin-amd64
+    packageTypes: *all-package-types
+  - &comp-cloudbeat
+    projectName: cloudbeat
+    packageName: cloudbeat-{{.Version}}-{{.Platform}}.{{.Ext}}
+    binaryName: cloudbeat
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
+    packageTypes: *all-package-types
+  - &comp-connectors
+    projectName: connectors
+    packageName: connectors-{{.Version}}.zip
+    binaryName: connectors
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
+    pythonWheel: true
+    packageTypes: *all-package-types
+  - &comp-endpoint
+    projectName: endpoint-dev
+    packageName: endpoint-security-{{.Version}}-{{.Platform}}.{{.Ext}}
+    binaryName: endpoint-security
+    platforms: *all-platforms
+    packageTypes: *all-package-types
+  - &comp-fleet-server
+    projectName: fleet-server
+    packageName: fleet-server-{{.Version}}-{{.Platform}}.{{.Ext}}
+    binaryName: fleet-server
+    platforms: *all-platforms
+    packageTypes: *all-package-types
+  - &comp-pf-elastic-collector
+    projectName: prodfiler
+    packageName: pf-elastic-collector-{{.Version}}-{{.Platform}}.{{.Ext}}
+    binaryName: pf-elastic-collector
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
+    packageTypes: *all-package-types
+  - &comp-pf-elastic-symbolizer
+    projectName: prodfiler
+    packageName: pf-elastic-symbolizer-{{.Version}}-{{.Platform}}.{{.Ext}}
+    binaryName: pf-elastic-symbolizer
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
+    packageTypes: *all-package-types
+  - &comp-pf-host-agent
+    projectName: prodfiler
+    packageName: pf-host-agent-{{.Version}}-{{.Platform}}.{{.Ext}}
+    binaryName: pf-host-agent
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
+    packageTypes: *all-package-types
+  - &comp-agentbeat-fips
+    projectName: beats
+    packageName: agentbeat-fips-{{.Version}}-{{.Platform}}.{{.Ext}}
+    binaryName: agentbeat
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
+    packageTypes: *all-package-types
+
 shared:
   - &common
     name: '{{.BeatName}}'
@@ -16,7 +136,38 @@ shared:
     url: '{{.BeatURL}}'
     description: '{{.BeatDescription}}'
 
+  - &common_fips
+    name: '{{.BeatName}}-fips'
+    service_name: '{{.BeatServiceName}}'
+    os: '{{.GOOS}}'
+    arch: '{{.PackageArch}}'
+    vendor: '{{.BeatVendor}}'
+    version: '{{ agent_package_version }}'
+    fips: true
+    license: '{{.BeatLicense}}'
+    url: '{{.BeatURL}}'
+    description: '{{.BeatDescription}}'
+
   # agent specific
+
+  # components included in elastic-agent package specs defined before components support in this YAML
+  - &elastic_agent_components
+    components:
+      - *comp-agentbeat
+      - *comp-apm_server
+      - *comp-cloudbeat
+      - *comp-connectors
+      - *comp-endpoint
+      - *comp-fleet-server
+      - *comp-pf-elastic-collector
+      - *comp-pf-elastic-symbolizer
+      - *comp-pf-host-agent
+
+  # components included in FIPS-compliant elastic-agent package specs
+  - &elastic_agent_fips_components
+    components:
+      - *comp-agentbeat-fips
+
   # Deb/RPM spec for community beats.
   - &deb_rpm_agent_spec
     <<: *common
@@ -170,7 +321,7 @@ shared:
     <<: *agent_darwin_app_bundle_files
     <<: *agent_binary_common_files
 
-  - &agent_components
+  - &agent_unpacked_components_files
     'data/{{.BeatName}}-{{ commit_short }}/components':
       source: '{{.AgentDropPath}}/{{.GOOS}}-{{.AgentArchName}}.tar.gz/'
       mode: 0755
@@ -178,7 +329,7 @@ shared:
       skip_on_missing: true
 
   # Binary package spec (tar.gz for linux) for community beats.
-  - &agent_binary_spec_no_components
+  - &agent_binary_spec_no_component_files
     <<: *common
     files:
       <<: *agent_binary_files
@@ -186,21 +337,30 @@ shared:
 
   - &agent_binary_spec
     <<: *common
+    <<: *elastic_agent_components
     files:
       <<: *agent_binary_files
       <<: *linux_otel_files
-      <<: *agent_components
+      <<: *agent_unpacked_components_files
 
+  - &agent_binary_fips_spec
+    <<: *common_fips
+    <<: *elastic_agent_fips_components
+    files:
+      <<: *agent_binary_files
+      <<: *agent_unpacked_components_files
 
   - &agent_darwin_binary_spec
     <<: *common
+    <<: *elastic_agent_components
     files:
       <<: *agent_darwin_binary_files
-      <<: *agent_components
+      <<: *agent_unpacked_components_files
 
   # Binary package spec (zip for windows) for community beats.
   - &agent_windows_binary_spec
     <<: *common
+    <<: *elastic_agent_components
     files:
       <<: *agent_binary_files
       'data/{{.BeatName}}-{{ commit_short }}/components':
@@ -308,7 +468,7 @@ shared:
         mode: 0644
 
   - &agent_docker_edot_spec
-    <<: *agent_binary_spec_no_components
+    <<: *agent_binary_spec_no_component_files
     docker_variant: 'elastic-otel-collector'
     name: 'elastic-otel-collector'
     extra_vars:
@@ -340,7 +500,7 @@ shared:
     name: 'elastic-otel-collector-wolfi'
 
   - &agent_docker_slim_spec
-    <<: *agent_binary_spec_no_components
+    <<: *agent_binary_spec_no_component_files
     docker_variant: 'slim'
     extra_vars:
       dockerfile: 'Dockerfile.elastic-agent.tmpl'
@@ -584,115 +744,6 @@ shared:
         source: '{{ repo.RootDir }}/dev-tools/licenses/ELASTIC-LICENSE-2.0.txt'
         mode: 0644
 
-platforms: &all-platforms
-  - &linux-amd64
-    os: linux
-    arch: x86_64
-  - &linux-arm64
-    os: linux
-    arch: arm64
-  - &windows-amd64
-    os: windows
-    arch: x86_64
-  - &darwin-amd64
-    os: darwin
-    arch: x86_64
-  - &darwin-arm64
-    os: darwin
-    arch: aarch64
-
-packageTypes: &all-package-types
-  - &pkg-type-rpm
-    1 # RPM
-  - &pkg-type-deb
-    2 # Deb
-  - &pkg-type-zip
-    3 # zip
-  - &pkg-type-targz
-    4 # tar.gz
-  - &pkg-type-docker
-    5 # docker
-
-components:
-  # general template for new components
-#  - &comp-<anchor name>
-#    projectName: <project name under manifest>
-#    packageName: <template representing the name of the archive to download/extract>
-#    binaryName: <binary name>
-#    platforms:
-#      - <platform, use anchors for platforms above>
-#    pythonWheel: true # true if it's a package that is not platform specific
-#    packageTypes: *all-package-types # package types it should be included in
-  - &comp-agentbeat
-    projectName: beats
-    packageName: agentbeat-{{.Version}}-{{.Platform}}.{{.Ext}}
-    binaryName: agentbeat
-    platforms: *all-platforms
-    packageTypes: *all-package-types
-  - &comp-apm_server
-    projectName: apm-server
-    packageName: apm-server-{{.Version}}-{{.Platform}}.{{.Ext}}
-    binaryName: apm-server
-    platforms:
-      - *linux-amd64
-      - *linux-arm64
-      - *windows-amd64
-      - *darwin-amd64
-    packageTypes: *all-package-types
-  - &comp-cloudbeat
-    projectName: cloudbeat
-    packageName: cloudbeat-{{.Version}}-{{.Platform}}.{{.Ext}}
-    binaryName: cloudbeat
-    platforms:
-      - *linux-amd64
-      - *linux-arm64
-    packageTypes: *all-package-types
-  - &comp-connectors
-    projectName: connectors
-    packageName: connectors-{{.Version}}.zip
-    binaryName: connectors
-    platforms:
-      - *linux-amd64
-      - *linux-arm64
-    pythonWheel: true
-    packageTypes: *all-package-types
-  - &comp-endpoint
-    projectName: endpoint-dev
-    packageName: endpoint-security-{{.Version}}-{{.Platform}}.{{.Ext}}
-    binaryName: endpoint-security
-    platforms: *all-platforms
-    packageTypes: *all-package-types
-  - &comp-fleet-server
-    projectName: fleet-server
-    packageName: fleet-server-{{.Version}}-{{.Platform}}.{{.Ext}}
-    binaryName: fleet-server
-    platforms: *all-platforms
-    packageTypes: *all-package-types
-  - &comp-pf-elastic-collector
-    projectName: prodfiler
-    packageName: pf-elastic-collector-{{.Version}}-{{.Platform}}.{{.Ext}}
-    binaryName: pf-elastic-collector
-    platforms:
-      - *linux-amd64
-      - *linux-arm64
-    packageTypes: *all-package-types
-  - &comp-pf-elastic-collector
-    projectName: prodfiler
-    packageName: pf-elastic-symbolizer-{{.Version}}-{{.Platform}}.{{.Ext}}
-    binaryName: pf-elastic-symbolizer
-    platforms:
-      - *linux-amd64
-      - *linux-arm64
-    packageTypes: *all-package-types
-  - &comp-pf-host-agent
-    projectName: prodfiler
-    packageName: pf-host-agent-{{.Version}}-{{.Platform}}.{{.Ext}}
-    binaryName: pf-host-agent
-    platforms:
-      - *linux-amd64
-      - *linux-arm64
-    packageTypes: *all-package-types
-
 # specs is a list of named packaging "flavors".
 specs:
   # Community Beats
@@ -1362,6 +1413,13 @@ specs:
             symlink: true
             mode: 0755
 
+    ######## Start FIPS Specs ########
+    - os: linux
+      types: [tgz]
+      spec:
+        <<: *agent_binary_fips_spec
+        <<: *elastic_license_for_binaries
+    ######## End FIPS Specs ########
 
   # Elastic Beat with Elastic License and binary taken from the x-pack dir.
   elastic_beat_agent_demo_binaries:

From 8f53cdda5d57830e3829814c36bbc316c7fd7bb1 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Tue, 1 Apr 2025 10:09:27 +0200
Subject: [PATCH 02/42] WIP - extract component dependencies from the packages
 to be built

---
 dev-tools/mage/crossbuild.go        |  4 +-
 dev-tools/mage/manifest/manifest.go |  4 +-
 dev-tools/mage/pkg.go               | 12 ++---
 dev-tools/packaging/settings.go     | 34 ++++++++++++
 magefile.go                         | 81 ++++++++++++++++++++++++++++-
 5 files changed, 124 insertions(+), 11 deletions(-)

diff --git a/dev-tools/mage/crossbuild.go b/dev-tools/mage/crossbuild.go
index c7340490d41..8c4e70d150e 100644
--- a/dev-tools/mage/crossbuild.go
+++ b/dev-tools/mage/crossbuild.go
@@ -30,11 +30,11 @@ const defaultCrossBuildTarget = "golangCrossBuild"
 var Platforms = BuildPlatforms.Defaults()
 
 // SelectedPackageTypes is the list of package types. If empty, all packages types
-// are considered to be selected (see isPackageTypeSelected).
+// are considered to be selected (see IsPackageTypeSelected).
 var SelectedPackageTypes []PackageType
 
 // SelectedDockerVariants is the list of docker variants. If empty, all docker variants
-// are considered to be selected (see isDockerVariantSelected).
+// are considered to be selected (see IsDockerVariantSelected).
 var SelectedDockerVariants []DockerVariant
 
 func init() {
diff --git a/dev-tools/mage/manifest/manifest.go b/dev-tools/mage/manifest/manifest.go
index 8557e7bd2bc..fc80dc864f2 100644
--- a/dev-tools/mage/manifest/manifest.go
+++ b/dev-tools/mage/manifest/manifest.go
@@ -126,7 +126,7 @@ func DownloadManifest(ctx context.Context, manifest string) (Build, error) {
 
 // DownloadComponents is going to download a set of components from the given manifest into the destination
 // dropPath folder in order to later use that folder for packaging
-func DownloadComponents(ctx context.Context, manifest string, platforms []string, dropPath string) error {
+func DownloadComponents(ctx context.Context, expectedBinaries []packaging.BinarySpec, manifest string, platforms []string, dropPath string) error {
 	manifestResponse, err := DownloadManifest(ctx, manifest)
 	if err != nil {
 		return fmt.Errorf("failed to download remote manifest file %w", err)
@@ -145,7 +145,7 @@ func DownloadComponents(ctx context.Context, manifest string, platforms []string
 
 	errGrp, downloadsCtx := errgroup.WithContext(ctx)
 	// for project, pkgs := range expectedProjectPkgs() {
-	for _, spec := range packaging.ExpectedBinaries {
+	for _, spec := range expectedBinaries {
 		for _, platform := range platforms {
 			targetPath := filepath.Join(dropPath)
 			err := os.MkdirAll(targetPath, 0755)
diff --git a/dev-tools/mage/pkg.go b/dev-tools/mage/pkg.go
index ed93e86344e..8a271cb1aa4 100644
--- a/dev-tools/mage/pkg.go
+++ b/dev-tools/mage/pkg.go
@@ -42,12 +42,12 @@ func Package() error {
 			}
 
 			for _, pkgType := range pkg.Types {
-				if !isPackageTypeSelected(pkgType) {
+				if !IsPackageTypeSelected(pkgType) {
 					log.Printf("Skipping %s package type because it is not selected", pkgType)
 					continue
 				}
 
-				if pkgType == Docker && !isDockerVariantSelected(pkg.Spec.DockerVariant) {
+				if pkgType == Docker && !IsDockerVariantSelected(pkg.Spec.DockerVariant) {
 					log.Printf("Skipping %s docker variant type because it is not selected", pkg.Spec.DockerVariant)
 					continue
 				}
@@ -112,9 +112,9 @@ func Package() error {
 	return nil
 }
 
-// isPackageTypeSelected returns true if SelectedPackageTypes is empty or if
+// IsPackageTypeSelected returns true if SelectedPackageTypes is empty or if
 // pkgType is present on SelectedPackageTypes. It returns false otherwise.
-func isPackageTypeSelected(pkgType PackageType) bool {
+func IsPackageTypeSelected(pkgType PackageType) bool {
 	if len(SelectedPackageTypes) == 0 {
 		return true
 	}
@@ -127,9 +127,9 @@ func isPackageTypeSelected(pkgType PackageType) bool {
 	return false
 }
 
-// isDockerVariantSelected returns true if SelectedDockerVariants is empty or if
+// IsDockerVariantSelected returns true if SelectedDockerVariants is empty or if
 // docVariant is present on SelectedDockerVariants. It returns false otherwise.
-func isDockerVariantSelected(docVariant DockerVariant) bool {
+func IsDockerVariantSelected(docVariant DockerVariant) bool {
 	if len(SelectedDockerVariants) == 0 {
 		return true
 	}
diff --git a/dev-tools/packaging/settings.go b/dev-tools/packaging/settings.go
index 606e8187dcf..e66567303d6 100644
--- a/dev-tools/packaging/settings.go
+++ b/dev-tools/packaging/settings.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"io"
 	"log"
+	"slices"
 	"text/template"
 
 	"github.com/magefile/mage/mg"
@@ -110,6 +111,39 @@ func (proj BinarySpec) GetPackageName(version string, platform string) string {
 	return buf.String()
 }
 
+func (proj BinarySpec) Equal(other BinarySpec) bool {
+	if proj.BinaryName != other.BinaryName {
+		return false
+	}
+
+	if proj.PackageName != other.PackageName {
+		return false
+	}
+
+	if proj.ProjectName != other.ProjectName {
+		return false
+	}
+
+	if !slices.Equal(proj.Platforms, other.Platforms) {
+		return false
+	}
+
+	if proj.PythonWheel != other.PythonWheel {
+		return false
+	}
+
+	if !slices.Equal(proj.PackageTypes, other.PackageTypes) {
+		return false
+	}
+
+	return true
+}
+
+// ExpectedBinaries  is a map of binaries agent needs to their project in the unified-release manager.
+// The project names are those used in the "projects" list in the unified release manifest.
+// See the sample manifests in the testdata directory.
+var ExpectedBinaries []BinarySpec
+
 type Platform struct {
 	OS   string
 	Arch string
diff --git a/magefile.go b/magefile.go
index 732e4f85f44..784fa940bd7 100644
--- a/magefile.go
+++ b/magefile.go
@@ -596,7 +596,45 @@ func DownloadManifest(ctx context.Context) error {
 		return errAtLeastOnePlatform
 	}
 
-	if e := manifest.DownloadComponents(ctx, devtools.ManifestURL, platforms, dropPath); e != nil {
+	// Enforce that we use the correct elastic-agent packaging, to correctly load component dependencies
+	devtools.UseElasticAgentPackaging()
+
+	// Extract the dependencies from the selected packages
+	mappedDependencies := map[string]packaging.BinarySpec{}
+	for _, pkg := range devtools.Packages {
+		if isSelected(pkg) {
+			if mg.Verbose() {
+				log.Printf("package %s is selected, collecting dependencies", pkg.Spec.Name)
+			}
+
+			for _, component := range pkg.Spec.Components {
+
+				if existingComp, ok := mappedDependencies[component.PackageName]; ok {
+					// sanity check: verify that for the same packageName we have the same component spec
+					if !existingComp.Equal(component) {
+						panic(fmt.Errorf("found component %+v and %+v sharing the same package name %q but they are not equal",
+							existingComp, component, component.PackageName))
+					}
+				} else {
+					mappedDependencies[component.PackageName] = component
+					if mg.Verbose() {
+						log.Printf("Added component %+v to the list of component to download from manifest", component)
+					}
+				}
+			}
+		}
+	}
+	if mg.Verbose() {
+		log.Printf("collected mappedDependencies: %v", mappedDependencies)
+	}
+
+	// collect the dependencies into a slice
+	dependencies := make([]packaging.BinarySpec, 0, len(mappedDependencies))
+	for _, pkg := range mappedDependencies {
+		dependencies = append(dependencies, pkg)
+	}
+
+	if e := manifest.DownloadComponents(ctx, dependencies, devtools.ManifestURL, platforms, dropPath); e != nil {
 		return fmt.Errorf("failed to download the manifest file, %w", e)
 	}
 	log.Printf(">> Completed downloading packages from manifest into drop-in %s", dropPath)
@@ -604,6 +642,47 @@ func DownloadManifest(ctx context.Context) error {
 	return nil
 }
 
+func isSelected(pkg devtools.OSPackageArgs) bool {
+
+	// Checks if this package is compatible with the FIPS settings
+	if pkg.Spec.FIPS != devtools.FIPSBuild {
+		log.Printf("Skipping %s/%s package type because FIPS flag doesn't match [pkg=%v, build=%v]", pkg.Spec, pkg.OS, pkg.Spec.FIPS, devtools.FIPSBuild)
+		return false
+	}
+
+	platforms := devtools.Platforms
+	for _, platform := range platforms {
+		if !isPackageSelectedForPlatform(pkg, platform) {
+			continue
+		}
+
+		pkgTypesSelected := 0
+		for _, pkgType := range pkg.Types {
+			if !devtools.IsPackageTypeSelected(pkgType) {
+				log.Printf("Skipping %s package type because it is not selected", pkgType)
+				continue
+			}
+
+			if pkgType == devtools.Docker && !devtools.IsDockerVariantSelected(pkg.Spec.DockerVariant) {
+				log.Printf("Skipping %s docker variant type because it is not selected", pkg.Spec.DockerVariant)
+				continue
+			}
+			pkgTypesSelected++
+		}
+		// if we found at least one package type for one platform the package spec is selected
+		return pkgTypesSelected > 0
+	}
+	return true
+}
+
+func isPackageSelectedForPlatform(pkg devtools.OSPackageArgs, platform devtools.BuildPlatform) bool {
+	if pkg.OS == platform.GOOS() && (pkg.Arch == "" || pkg.Arch == platform.Arch()) {
+		return true
+	}
+
+	return false
+}
+
 // FixDRADockerArtifacts is a workaround for the DRA artifacts produced by the package target. We had to do
 // because the initial unified release manager DSL code required specific names that the package does not produce,
 // we wanted to keep backwards compatibility with the artifacts of the unified release and the DRA.

From 041e076b66c2a248e1dba971b11ddc2f276feef6 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Tue, 1 Apr 2025 15:08:11 +0200
Subject: [PATCH 03/42] Refactor component extraction from package specs

---
 magefile.go | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/magefile.go b/magefile.go
index 784fa940bd7..2fd55698b36 100644
--- a/magefile.go
+++ b/magefile.go
@@ -599,9 +599,24 @@ func DownloadManifest(ctx context.Context) error {
 	// Enforce that we use the correct elastic-agent packaging, to correctly load component dependencies
 	devtools.UseElasticAgentPackaging()
 
+	dependencies, err := ExtractComponentsFromSelectedPkgSpecs(devtools.Packages)
+
+	if err != nil {
+		return fmt.Errorf("failed extracting dependencies: %w", err)
+	}
+
+	if e := manifest.DownloadComponents(ctx, dependencies, devtools.ManifestURL, platforms, dropPath); e != nil {
+		return fmt.Errorf("failed to download the manifest file, %w", e)
+	}
+	log.Printf(">> Completed downloading packages from manifest into drop-in %s", dropPath)
+
+	return nil
+}
+
+func ExtractComponentsFromSelectedPkgSpecs(pkgSpecs []devtools.OSPackageArgs) ([]packaging.BinarySpec, error) {
 	// Extract the dependencies from the selected packages
 	mappedDependencies := map[string]packaging.BinarySpec{}
-	for _, pkg := range devtools.Packages {
+	for _, pkg := range pkgSpecs {
 		if isSelected(pkg) {
 			if mg.Verbose() {
 				log.Printf("package %s is selected, collecting dependencies", pkg.Spec.Name)
@@ -612,8 +627,8 @@ func DownloadManifest(ctx context.Context) error {
 				if existingComp, ok := mappedDependencies[component.PackageName]; ok {
 					// sanity check: verify that for the same packageName we have the same component spec
 					if !existingComp.Equal(component) {
-						panic(fmt.Errorf("found component %+v and %+v sharing the same package name %q but they are not equal",
-							existingComp, component, component.PackageName))
+						return nil, fmt.Errorf("found component %+v and %+v sharing the same package name %q but they are not equal",
+							existingComp, component, component.PackageName)
 					}
 				} else {
 					mappedDependencies[component.PackageName] = component
@@ -633,13 +648,7 @@ func DownloadManifest(ctx context.Context) error {
 	for _, pkg := range mappedDependencies {
 		dependencies = append(dependencies, pkg)
 	}
-
-	if e := manifest.DownloadComponents(ctx, dependencies, devtools.ManifestURL, platforms, dropPath); e != nil {
-		return fmt.Errorf("failed to download the manifest file, %w", e)
-	}
-	log.Printf(">> Completed downloading packages from manifest into drop-in %s", dropPath)
-
-	return nil
+	return dependencies, nil
 }
 
 func isSelected(pkg devtools.OSPackageArgs) bool {

From 2c0f1664c698e58b53759c83945fe3ac76db3612 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 2 Apr 2025 08:04:34 +0200
Subject: [PATCH 04/42] Fix package tests error handling

---
 dev-tools/packaging/testing/package_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index dec618f9a82..4dc1d5d6cfc 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -286,7 +286,7 @@ func checkManifestFileContents(t *testing.T, extractedPackageDir string) {
 func parseManifest(t *testing.T, dir string) v1.PackageManifest {
 	manifestReadCloser, err := os.Open(filepath.Join(dir, v1.ManifestFileName))
 	if err != nil {
-		t.Errorf("opening manifest %s : %v", v1.ManifestFileName, err)
+		t.Fatalf("opening manifest %s : %v", v1.ManifestFileName, err)
 	}
 	defer func(closer io.ReadCloser) {
 		err := closer.Close()
@@ -295,7 +295,7 @@ func parseManifest(t *testing.T, dir string) v1.PackageManifest {
 
 	m, err := v1.ParseManifest(manifestReadCloser)
 	if err != nil {
-		t.Errorf("unmarshaling package manifest: %v", err)
+		t.Fatalf("unmarshaling package manifest: %v", err)
 	}
 	return *m
 }

From 87171f8b9512f937f07d8da786c9bb3dad3dc646 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 2 Apr 2025 08:06:16 +0200
Subject: [PATCH 05/42] Inject dependencies and remove references to
 ExpectedBinaries

---
 dev-tools/mage/checksums.go |  4 +--
 magefile.go                 | 52 +++++++++++++++++++++----------------
 2 files changed, 32 insertions(+), 24 deletions(-)

diff --git a/dev-tools/mage/checksums.go b/dev-tools/mage/checksums.go
index d4fbfc55808..a683746eebc 100644
--- a/dev-tools/mage/checksums.go
+++ b/dev-tools/mage/checksums.go
@@ -95,14 +95,14 @@ func ChecksumsWithoutManifest(versionedFlatPath string, versionedDropPath string
 }
 
 // This is a helper function for flattenDependencies that's used when building from a manifest
-func ChecksumsWithManifest(platform, dependenciesVersion string, versionedFlatPath string, versionedDropPath string, manifestResponse *manifest.Build) map[string]string {
+func ChecksumsWithManifest(platform, dependenciesVersion, versionedFlatPath, versionedDropPath string, manifestResponse *manifest.Build, dependencies []packaging.BinarySpec) map[string]string {
 	checksums := make(map[string]string)
 	if manifestResponse == nil {
 		return checksums
 	}
 
 	// Iterate over the external binaries that we care about for packaging agent
-	for _, spec := range packaging.ExpectedBinaries {
+	for _, spec := range dependencies {
 
 		if spec.PythonWheel {
 			if mg.Verbose() {
diff --git a/magefile.go b/magefile.go
index 2fd55698b36..ca4e7082815 100644
--- a/magefile.go
+++ b/magefile.go
@@ -598,9 +598,7 @@ func DownloadManifest(ctx context.Context) error {
 
 	// Enforce that we use the correct elastic-agent packaging, to correctly load component dependencies
 	devtools.UseElasticAgentPackaging()
-
 	dependencies, err := ExtractComponentsFromSelectedPkgSpecs(devtools.Packages)
-
 	if err != nil {
 		return fmt.Errorf("failed extracting dependencies: %w", err)
 	}
@@ -1131,8 +1129,20 @@ func packageAgent(ctx context.Context, platforms []string, dependenciesVersion s
 		log.Printf("--- Packaging dependenciesVersion[%s], %+v \n", dependenciesVersion, platforms)
 	}
 
+	log.Println("--- Running packaging function")
+	mg.Deps(agentPackaging)
+
+	dependencies, err := ExtractComponentsFromSelectedPkgSpecs(devtools.Packages)
+	if err != nil {
+		return fmt.Errorf("failed extracting dependencies: %w", err)
+	}
+
+	if mg.Verbose() {
+		log.Printf("dependencies extracted from package specs: %v", dependencies)
+	}
+
 	// download/copy all the necessary dependencies for packaging elastic-agent
-	archivePath, dropPath := collectPackageDependencies(platforms, dependenciesVersion, packageTypes)
+	archivePath, dropPath := collectPackageDependencies(platforms, dependenciesVersion, packageTypes, dependencies)
 
 	// cleanup after build
 	defer os.RemoveAll(archivePath)
@@ -1148,12 +1158,9 @@ func packageAgent(ctx context.Context, platforms []string, dependenciesVersion s
 	defer os.RemoveAll(flatPath)
 
 	// extract all dependencies from their archives into flat dir
-	flattenDependencies(platforms, dependenciesVersion, archivePath, dropPath, flatPath, manifestResponse)
+	flattenDependencies(platforms, dependenciesVersion, archivePath, dropPath, flatPath, manifestResponse, dependencies)
 
 	// package agent
-	log.Println("--- Running packaging function")
-	mg.Deps(agentPackaging)
-
 	log.Println("--- Running post packaging ")
 	mg.Deps(Update)
 	mg.Deps(agentBinaryTarget, CrossBuildGoDaemon)
@@ -1172,7 +1179,7 @@ func packageAgent(ctx context.Context, platforms []string, dependenciesVersion s
 // NOTE: after the build is done the caller must:
 // - delete archivePath and dropPath contents
 // - unset AGENT_DROP_PATH environment variable
-func collectPackageDependencies(platforms []string, packageVersion string, packageTypes []mage.PackageType) (archivePath string, dropPath string) {
+func collectPackageDependencies(platforms []string, packageVersion string, packageTypes []devtools.PackageType, dependencies []packaging.BinarySpec) (archivePath, dropPath string) {
 	dropPath, found := os.LookupEnv(agentDropPath)
 
 	// try not to shadow too many variables
@@ -1184,13 +1191,13 @@ func collectPackageDependencies(platforms []string, packageVersion string, packa
 		dropPath = filepath.Join("build", "distributions", "elastic-agent-drop")
 		dropPath, err = filepath.Abs(dropPath)
 		if err != nil {
-			panic(err)
+			panic(fmt.Errorf("obtaining absolute path for default drop path: %w", err))
 		}
 
 		if mg.Verbose() {
 			log.Printf(">> Creating drop-in folder %+v \n", dropPath)
 		}
-		archivePath = movePackagesToArchive(dropPath, platforms, packageVersion)
+		archivePath = movePackagesToArchive(dropPath, platforms, packageVersion, dependencies)
 
 		if hasSnapshotEnv() {
 			packageVersion = fmt.Sprintf("%s-SNAPSHOT", packageVersion)
@@ -1215,7 +1222,8 @@ func collectPackageDependencies(platforms []string, packageVersion string, packa
 
 			errGroup, ctx := errgroup.WithContext(context.Background())
 			completedDownloads := &atomic.Int32{}
-			for _, spec := range packaging.ExpectedBinaries {
+
+			for _, spec := range dependencies {
 				for _, platform := range platforms {
 
 					if !spec.SupportsPlatform(platform) {
@@ -1315,18 +1323,18 @@ func collectPackageDependencies(platforms []string, packageVersion string, packa
 			}
 		}
 	} else {
-		archivePath = movePackagesToArchive(dropPath, platforms, packageVersion)
+		archivePath = movePackagesToArchive(dropPath, platforms, packageVersion, nil)
 	}
 	return archivePath, dropPath
 }
 
-func removePythonWheels(matches []string, version string) []string {
+func removePythonWheels(matches []string, version string, dependencies []packaging.BinarySpec) []string {
 	if hasSnapshotEnv() {
 		version = fmt.Sprintf("%s-SNAPSHOT", version)
 	}
 
 	var wheels []string
-	for _, spec := range packaging.ExpectedBinaries {
+	for _, spec := range dependencies {
 		if spec.PythonWheel {
 			wheels = append(wheels, spec.GetPackageName(version, ""))
 		}
@@ -1343,7 +1351,7 @@ func removePythonWheels(matches []string, version string) []string {
 
 // flattenDependencies will extract all the required packages collected in archivePath and dropPath in flatPath and
 // regenerate checksums
-func flattenDependencies(platforms []string, dependenciesVersion, archivePath, dropPath, flatPath string, manifestResponse *manifest.Build) {
+func flattenDependencies(platforms []string, dependenciesVersion, archivePath, dropPath, flatPath string, manifestResponse *manifest.Build, dependencies []packaging.BinarySpec) {
 
 	for _, pltf := range platforms {
 
@@ -1373,7 +1381,7 @@ func flattenDependencies(platforms []string, dependenciesVersion, archivePath, d
 
 		// never flatten any python wheels, the packages.yml and docker should handle
 		// those specifically so that the python wheels are installed into the container
-		matches = removePythonWheels(matches, dependenciesVersion)
+		matches = removePythonWheels(matches, dependenciesVersion, dependencies)
 
 		if mg.Verbose() {
 			log.Printf("--- Extracting into the flat dir: %v", matches)
@@ -1403,7 +1411,7 @@ func flattenDependencies(platforms []string, dependenciesVersion, archivePath, d
 		checksums := make(map[string]string)
 		// Operate on the files depending on if we're packaging from a manifest or not
 		if manifestResponse != nil {
-			checksums = devtools.ChecksumsWithManifest(pltf, dependenciesVersion, versionedFlatPath, versionedDropPath, manifestResponse)
+			checksums = devtools.ChecksumsWithManifest(pltf, dependenciesVersion, versionedFlatPath, versionedDropPath, manifestResponse, dependencies)
 		} else {
 			checksums = devtools.ChecksumsWithoutManifest(versionedFlatPath, versionedDropPath, dependenciesVersion)
 		}
@@ -1774,7 +1782,7 @@ func appendComponentChecksums(versionedDropPath string, checksums map[string]str
 }
 
 // movePackagesToArchive Create archive folder and move any pre-existing artifacts into it.
-func movePackagesToArchive(dropPath string, platforms []string, packageVersion string) string {
+func movePackagesToArchive(dropPath string, platforms []string, packageVersion string, dependencies []packaging.BinarySpec) string {
 	archivePath := filepath.Join(dropPath, "archives")
 	os.MkdirAll(archivePath, 0o755)
 
@@ -1796,7 +1804,7 @@ func movePackagesToArchive(dropPath string, platforms []string, packageVersion s
 				log.Printf("--- Evaluating moving dependency %s to archive path %s\n", f, archivePath)
 			}
 			// if the matched file name does not contain the platform suffix and it's not a platform-independent package, skip it
-			if !strings.Contains(f, packageSuffix) && !isPlatformIndependentPackage(f, packageVersion) {
+			if !strings.Contains(f, packageSuffix) && !isPlatformIndependentPackage(f, packageVersion, dependencies) {
 				if mg.Verbose() {
 					log.Printf("--- Skipped moving dependency %s to archive path\n", f)
 				}
@@ -1821,7 +1829,7 @@ func movePackagesToArchive(dropPath string, platforms []string, packageVersion s
 			}
 
 			// Platform-independent packages need to be placed in the archive sub-folders for all platforms, copy instead of moving
-			if isPlatformIndependentPackage(f, packageVersion) {
+			if isPlatformIndependentPackage(f, packageVersion, nil) {
 				if err := copyFile(f, targetPath); err != nil {
 					panic(fmt.Errorf("failed copying file: %w", err))
 				}
@@ -1866,9 +1874,9 @@ func copyFile(src, dst string) error {
 	return nil
 }
 
-func isPlatformIndependentPackage(f string, packageVersion string) bool {
+func isPlatformIndependentPackage(f string, packageVersion string, dependencies []packaging.BinarySpec) bool {
 	fileBaseName := filepath.Base(f)
-	for _, spec := range packaging.ExpectedBinaries {
+	for _, spec := range dependencies {
 		packageName := spec.GetPackageName(packageVersion, "")
 		// as of now only python wheels packages are platform-independent
 		if spec.PythonWheel && (fileBaseName == packageName || fileBaseName == packageName+sha512FileExt) {

From 7de031ef30c32028acd7ea1859fad5cb9e26e017 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 2 Apr 2025 08:24:43 +0200
Subject: [PATCH 06/42] Remove ExpectedBinaries global

---
 dev-tools/mage/manifest/manifest_test.go |  9 ++++++---
 dev-tools/packaging/settings.go          | 22 ++++++++++++----------
 2 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/dev-tools/mage/manifest/manifest_test.go b/dev-tools/mage/manifest/manifest_test.go
index 0d971edf69b..76a0d53cd2e 100644
--- a/dev-tools/mage/manifest/manifest_test.go
+++ b/dev-tools/mage/manifest/manifest_test.go
@@ -138,7 +138,7 @@ func TestResolveManifestPackage(t *testing.T) {
 			projects := manifestJson.Projects
 
 			// Verify the component name is in the list of expected packages.
-			spec, ok := findBinarySpec(tc.binary)
+			spec, ok := findBinarySpec(t, tc.binary)
 			assert.True(t, ok)
 
 			if !spec.SupportsPlatform(tc.platform) {
@@ -158,8 +158,11 @@ func TestResolveManifestPackage(t *testing.T) {
 	}
 }
 
-func findBinarySpec(name string) (packaging.BinarySpec, bool) {
-	for _, spec := range packaging.ExpectedBinaries {
+func findBinarySpec(t *testing.T, name string) (packaging.BinarySpec, bool) {
+	components, err := packaging.Components()
+	require.NoError(t, err, "error loading components from packages.yml")
+
+	for _, spec := range components {
 		if spec.BinaryName == name {
 			return spec, true
 		}
diff --git a/dev-tools/packaging/settings.go b/dev-tools/packaging/settings.go
index e66567303d6..3eb70266391 100644
--- a/dev-tools/packaging/settings.go
+++ b/dev-tools/packaging/settings.go
@@ -44,10 +44,7 @@ var (
 			ext:      "zip",
 		},
 	}
-	// ExpectedBinaries  is a map of binaries agent needs to their project in the unified-release manager.
-	// The project names are those used in the "projects" list in the unified release manifest.
-	// See the sample manifests in the testdata directory.
-	ExpectedBinaries []BinarySpec
+	settings *packagesConfig
 )
 
 func init() {
@@ -57,7 +54,7 @@ func init() {
 		return
 	}
 
-	ExpectedBinaries = packageSettings.Components
+	settings = packageSettings
 }
 
 type platformAndExt struct {
@@ -139,11 +136,6 @@ func (proj BinarySpec) Equal(other BinarySpec) bool {
 	return true
 }
 
-// ExpectedBinaries  is a map of binaries agent needs to their project in the unified-release manager.
-// The project names are those used in the "projects" list in the unified release manifest.
-// See the sample manifests in the testdata directory.
-var ExpectedBinaries []BinarySpec
-
 type Platform struct {
 	OS   string
 	Arch string
@@ -178,3 +170,13 @@ func parsePackageSettings(r io.Reader) (*packagesConfig, error) {
 	}
 	return packagesConf, nil
 }
+
+// Components returns a *copy* of all the binary specs loaded from packages.yml
+func Components() ([]BinarySpec, error) {
+	if settings == nil {
+		return nil, fmt.Errorf("package settings not loaded")
+	}
+	ret := make([]BinarySpec, len(settings.Components))
+	copy(ret, settings.Components)
+	return ret, nil
+}

From 9896dfebfdc47e51984ffcca5738dd78cf3e79f1 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 2 Apr 2025 17:02:07 +0200
Subject: [PATCH 07/42] Add rootdir to components

---
 dev-tools/mage/pkgtypes.go                  |  4 +--
 dev-tools/packaging/packages.yml            | 33 ++++++++++++++++++---
 dev-tools/packaging/settings.go             | 24 +++++++++++++++
 dev-tools/packaging/testing/package_test.go | 33 ++++++++++-----------
 4 files changed, 70 insertions(+), 24 deletions(-)

diff --git a/dev-tools/mage/pkgtypes.go b/dev-tools/mage/pkgtypes.go
index 11726d99628..cad09fb54ef 100644
--- a/dev-tools/mage/pkgtypes.go
+++ b/dev-tools/mage/pkgtypes.go
@@ -41,13 +41,13 @@ const (
 	packageStagingDir = "build/package"
 
 	// defaultBinaryName specifies the output file for zip and tar.gz.
-	defaultBinaryName = "{{.Name}}{{if .Qualifier}}-{{.Qualifier}}{{end}}-{{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}{{if .OS}}-{{.OS}}{{end}}{{if .Arch}}-{{.Arch}}{{end}}{{if .FIPS}}-fips{{end}}"
+	defaultBinaryName = "{{.Name}}{{if .Qualifier}}-{{.Qualifier}}{{end}}-{{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}{{if .OS}}-{{.OS}}{{end}}{{if .Arch}}-{{.Arch}}{{end}}"
 
 	// defaultRootDir is the default name of the root directory contained inside of zip and
 	// tar.gz packages.
 	// NOTE: This uses .BeatName instead of .Name because we wanted the internal
 	// directory to not include "-oss".
-	defaultRootDir = "{{.BeatName}}{{if .Qualifier}}-{{.Qualifier}}{{end}}-{{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}{{if .OS}}-{{.OS}}{{end}}{{if .Arch}}-{{.Arch}}{{end}}{{if .FIPS}}-fips{{end}}"
+	defaultRootDir = "{{.BeatName}}{{if .Qualifier}}-{{.Qualifier}}{{end}}-{{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}{{if .OS}}-{{.OS}}{{end}}{{if .Arch}}-{{.Arch}}{{end}}"
 
 	componentConfigMode os.FileMode = 0600
 
diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index 8c3fd8bed02..c0d20465018 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -42,6 +42,7 @@ components:
   #    projectName: <project name under manifest>
   #    packageName: <template representing the name of the archive to download/extract>
   #    binaryName: <binary name>
+  #    rootDir: <template representing directory from the archive root where the binary is located>
   #    platforms:
   #      - <platform, use anchors for platforms above>
   #    pythonWheel: true # true if it's a package that is not platform specific
@@ -49,12 +50,14 @@ components:
   - &comp-agentbeat
     projectName: beats
     packageName: agentbeat-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: agentbeat-{{.Version}}-{{.Platform}}
     binaryName: agentbeat
     platforms: *all-platforms
     packageTypes: *all-package-types
   - &comp-apm_server
     projectName: apm-server
     packageName: apm-server-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: apm-server-{{.Version}}-{{.Platform}}
     binaryName: apm-server
     platforms:
       - *linux-amd64
@@ -65,6 +68,7 @@ components:
   - &comp-cloudbeat
     projectName: cloudbeat
     packageName: cloudbeat-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: cloudbeat-{{.Version}}-{{.Platform}}
     binaryName: cloudbeat
     platforms:
       - *linux-amd64
@@ -73,6 +77,10 @@ components:
   - &comp-connectors
     projectName: connectors
     packageName: connectors-{{.Version}}.zip
+    # FIXME: connectors use only <major>.<minor>.<patch> in the root directory name so the definition should be something like:
+    # rootDir: elasticsearch_connectors-{{beat_version}}
+    # We don't support that yet, so we are not gonna define a rootDir (not a problem since we don't extract the archive
+    # during packaging
     binaryName: connectors
     platforms:
       - *linux-amd64
@@ -82,18 +90,21 @@ components:
   - &comp-endpoint
     projectName: endpoint-dev
     packageName: endpoint-security-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: endpoint-security-{{.Version}}-{{.Platform}}
     binaryName: endpoint-security
     platforms: *all-platforms
     packageTypes: *all-package-types
   - &comp-fleet-server
     projectName: fleet-server
     packageName: fleet-server-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: fleet-server-{{.Version}}-{{.Platform}}
     binaryName: fleet-server
     platforms: *all-platforms
     packageTypes: *all-package-types
   - &comp-pf-elastic-collector
     projectName: prodfiler
     packageName: pf-elastic-collector-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: pf-elastic-collector-{{.Version}}-{{.Platform}}
     binaryName: pf-elastic-collector
     platforms:
       - *linux-amd64
@@ -102,6 +113,7 @@ components:
   - &comp-pf-elastic-symbolizer
     projectName: prodfiler
     packageName: pf-elastic-symbolizer-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: pf-elastic-symbolizer-{{.Version}}-{{.Platform}}
     binaryName: pf-elastic-symbolizer
     platforms:
       - *linux-amd64
@@ -110,6 +122,7 @@ components:
   - &comp-pf-host-agent
     projectName: prodfiler
     packageName: pf-host-agent-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: pf-host-agent-{{.Version}}-{{.Platform}}
     binaryName: pf-host-agent
     platforms:
       - *linux-amd64
@@ -118,6 +131,7 @@ components:
   - &comp-agentbeat-fips
     projectName: beats
     packageName: agentbeat-fips-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: agentbeat-{{.Version}}-{{.Platform}}
     binaryName: agentbeat
     platforms:
       - *linux-amd64
@@ -1467,8 +1481,8 @@ specs:
       spec:
         <<: *common
         <<: *elastic_license_for_binaries
+        name: '{{.BeatName}}-core'
         version: '{{ beat_version }}'
-        qualifier: core
         files:
           '{{.BeatName}}{{.BinaryExt}}':
             source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
@@ -1478,8 +1492,8 @@ specs:
       spec:
         <<: *common
         <<: *elastic_license_for_binaries
+        name: '{{.BeatName}}-core'
         version: '{{ beat_version }}'
-        qualifier: core
         files:
           '{{.BeatName}}{{.BinaryExt}}':
             source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
@@ -1489,8 +1503,8 @@ specs:
       spec:
         <<: *common
         <<: *elastic_license_for_binaries
+        name: '{{.BeatName}}-core'
         version: '{{ beat_version }}'
-        qualifier: core
         files:
           '{{.BeatName}}{{.BinaryExt}}':
             source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
@@ -1500,8 +1514,19 @@ specs:
       spec:
         <<: *common
         <<: *elastic_license_for_binaries
+        name: '{{.BeatName}}-core'
         version: '{{ beat_version }}'
-        qualifier: core
         files:
           '{{.BeatName}}{{.BinaryExt}}':
             source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
+
+    - os: linux
+      types: [tgz]
+      spec:
+        <<: *common_fips
+        <<: *elastic_license_for_binaries
+        name: '{{.BeatName}}-core-fips'
+        version: '{{ beat_version }}'
+        files:
+          '{{.BeatName}}{{.BinaryExt}}':
+            source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
\ No newline at end of file
diff --git a/dev-tools/packaging/settings.go b/dev-tools/packaging/settings.go
index 3eb70266391..976e40ee334 100644
--- a/dev-tools/packaging/settings.go
+++ b/dev-tools/packaging/settings.go
@@ -65,6 +65,7 @@ type platformAndExt struct {
 type BinarySpec struct {
 	BinaryName   string                  `yaml:"binaryName"`
 	PackageName  string                  `yaml:"packageName"`
+	RootDir      string                  `yaml:"rootDir"`
 	ProjectName  string                  `yaml:"projectName"`
 	Platforms    []Platform              `yaml:"platforms"`
 	PythonWheel  bool                    `yaml:"pythonWheel"`
@@ -108,6 +109,29 @@ func (proj BinarySpec) GetPackageName(version string, platform string) string {
 	return buf.String()
 }
 
+func (proj BinarySpec) GetRootDir(version string, platform string) string {
+	if proj.RootDir == "" {
+		// shortcut to avoid rendering template when there's no RootDir specified
+		return ""
+	}
+	tmpl, err := template.New("inner_path").Parse(proj.RootDir)
+	if err != nil {
+		panic(fmt.Errorf("parsing innerPath template for project/binary %s/%s %q: %w", proj.ProjectName, proj.BinaryName, proj.RootDir, err))
+	}
+
+	// look for the platform strings, if not found an empty object is returned and empty values will be used for rendering
+	pltfStrings := PlatformPackages[platform]
+	tmplContext := map[string]string{"Version": version, "Platform": pltfStrings.platform, "Ext": pltfStrings.ext}
+
+	var buf bytes.Buffer
+	err = tmpl.Execute(&buf, tmplContext)
+	if err != nil {
+		panic(fmt.Errorf("rendering innerPath template for project/binary %s/%s %q with context %v: %w",
+			proj.ProjectName, proj.BinaryName, proj.PackageName, tmplContext, err))
+	}
+	return buf.String()
+}
+
 func (proj BinarySpec) Equal(other BinarySpec) bool {
 	if proj.BinaryName != other.BinaryName {
 		return false
diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index 4dc1d5d6cfc..1b5d056806f 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -25,7 +25,6 @@ import (
 	"io"
 	"maps"
 	"os"
-	"path"
 	"path/filepath"
 	"regexp"
 	"slices"
@@ -220,16 +219,7 @@ func checkTar(t *testing.T, file string, fipsCheck bool) {
 	checkModulesOwner(t, p, true)
 	checkLicensesPresent(t, "", p)
 
-	t.Run(p.Name+"_check_manifest_file", func(t *testing.T) {
-		tempExtractionPath := t.TempDir()
-		err = mage.Extract(file, tempExtractionPath)
-		require.NoError(t, err, "error extracting tar archive")
-		containingDir := strings.TrimSuffix(path.Base(file), ".tar.gz")
-		checkManifestFileContents(t, filepath.Join(tempExtractionPath, containingDir))
-		if fipsCheck {
-			checkFIPS(t, filepath.Join(tempExtractionPath, containingDir))
-		}
-	})
+	t.Run(p.Name+"_check_manifest_file", testManifestFile(file))
 
 	checkSha512PackageHash(t, file)
 }
@@ -248,17 +238,24 @@ func checkZip(t *testing.T, file string) {
 	checkModulesPermissions(t, p)
 	checkLicensesPresent(t, "", p)
 
-	t.Run(p.Name+"_check_manifest_file", func(t *testing.T) {
-		tempExtractionPath := t.TempDir()
-		err = mage.Extract(file, tempExtractionPath)
-		require.NoError(t, err, "error extracting zip archive")
-		containingDir := strings.TrimSuffix(path.Base(file), ".zip")
-		checkManifestFileContents(t, filepath.Join(tempExtractionPath, containingDir))
-	})
+	t.Run(p.Name+"_check_manifest_file", testManifestFile(file))
 
 	checkSha512PackageHash(t, file)
 }
 
+func testManifestFile(file string) func(t *testing.T) {
+	return func(t *testing.T) {
+		tempExtractionPath := t.TempDir()
+		err := mage.Extract(file, tempExtractionPath)
+		require.NoErrorf(t, err, "error extracting archive %q", file)
+		dirEntries, err := os.ReadDir(tempExtractionPath)
+		require.NoErrorf(t, err, "error listing extraction dir %q", tempExtractionPath)
+		require.Lenf(t, dirEntries, 1, "archive %q should contain a single directory", file)
+		containingDir := dirEntries[0].Name()
+		checkManifestFileContents(t, filepath.Join(tempExtractionPath, containingDir))
+	}
+}
+
 func checkManifestFileContents(t *testing.T, extractedPackageDir string) {
 	t.Log("Checking file manifest.yaml")
 	m := parseManifest(t, extractedPackageDir)

From 20cafa0e265c187eaf0eebef44d3234f2f10bade Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 2 Apr 2025 17:35:29 +0200
Subject: [PATCH 08/42] Extract actual version matched on the package file and
 use it to render RootDir

---
 dev-tools/mage/checksums.go         | 33 ++++++++++++++++-------------
 dev-tools/mage/manifest/manifest.go | 22 +++++++++----------
 2 files changed, 29 insertions(+), 26 deletions(-)

diff --git a/dev-tools/mage/checksums.go b/dev-tools/mage/checksums.go
index a683746eebc..071b609c8ef 100644
--- a/dev-tools/mage/checksums.go
+++ b/dev-tools/mage/checksums.go
@@ -124,21 +124,24 @@ func ChecksumsWithManifest(platform, dependenciesVersion, versionedFlatPath, ver
 			continue
 		}
 
-		// Combine the package name w/ the versioned flat path
-		fullPath := filepath.Join(versionedFlatPath, manifestPackage.Name)
-
-		// Eliminate the file extensions to get the proper directory
-		// name that we need to copy
-		var dirToCopy string
-		if strings.HasSuffix(fullPath, ".tar.gz") {
-			dirToCopy = fullPath[:strings.LastIndex(fullPath, ".tar.gz")]
-		} else if strings.HasSuffix(fullPath, ".zip") {
-			dirToCopy = fullPath[:strings.LastIndex(fullPath, ".zip")]
-		} else {
-			dirToCopy = fullPath
+		rootDir := spec.GetRootDir(manifestPackage.ActualVersion, platform)
+
+		// fallback to extracting directory name from packageName
+		if rootDir == "" {
+			log.Printf("Could not find rootDir for %s/%s. Falling back to fileName %s", spec.ProjectName, spec.BinaryName, manifestPackage.Name)
+			rootDir = manifestPackage.Name
+			if strings.HasSuffix(rootDir, ".tar.gz") {
+				rootDir = strings.TrimSuffix(rootDir, ".tar.gz")
+			} else if strings.HasSuffix(rootDir, ".zip") {
+				rootDir = strings.TrimSuffix(rootDir, ".zip")
+			}
 		}
+
+		// Combine the package name w/ the versioned flat path
+		fullPath := filepath.Join(versionedFlatPath, rootDir)
+
 		if mg.Verbose() {
-			log.Printf(">>>>>>> Calculated directory to copy: [%s]", dirToCopy)
+			log.Printf(">>>>>>> Calculated directory to copy: [%s]", fullPath)
 		}
 
 		// Set copy options
@@ -149,11 +152,11 @@ func ChecksumsWithManifest(platform, dependenciesVersion, versionedFlatPath, ver
 			Sync: true,
 		}
 		if mg.Verbose() {
-			log.Printf("> prepare to copy %s into %s ", dirToCopy, versionedDropPath)
+			log.Printf("> prepare to copy %s into %s ", fullPath, versionedDropPath)
 		}
 
 		// Do the copy
-		err = copy.Copy(dirToCopy, versionedDropPath, options)
+		err = copy.Copy(fullPath, versionedDropPath, options)
 		if err != nil {
 			panic(err)
 		}
diff --git a/dev-tools/mage/manifest/manifest.go b/dev-tools/mage/manifest/manifest.go
index fc80dc864f2..625c38f682f 100644
--- a/dev-tools/mage/manifest/manifest.go
+++ b/dev-tools/mage/manifest/manifest.go
@@ -187,8 +187,9 @@ func DownloadComponents(ctx context.Context, expectedBinaries []packaging.Binary
 }
 
 type ResolvedPackage struct {
-	Name string
-	URLs []string
+	Name          string
+	ActualVersion string
+	URLs          []string
 }
 
 func ResolveManifestPackage(project Project, spec packaging.BinarySpec, dependencyVersion string, platform string) (*ResolvedPackage, error) {
@@ -206,8 +207,9 @@ func ResolveManifestPackage(project Project, spec packaging.BinarySpec, dependen
 		}
 
 		return &ResolvedPackage{
-			Name: packageName,
-			URLs: []string{exactMatch.URL, exactMatch.ShaURL, exactMatch.AscURL},
+			Name:          packageName,
+			ActualVersion: dependencyVersion,
+			URLs:          []string{exactMatch.URL, exactMatch.ShaURL, exactMatch.AscURL},
 		}, nil
 	}
 
@@ -221,9 +223,6 @@ func ResolveManifestPackage(project Project, spec packaging.BinarySpec, dependen
 		return nil, fmt.Errorf("no exact match and filename %q does not seem to contain dependencyVersion %q to try a fallback", packageName, dependencyVersion)
 	}
 
-	// TODO move relaxVersion to the version package so we can rewrite the version like so
-	//parseVersion, _ := version.ParseVersion(dependencyVersion)
-	//parseVersion.GetRelaxedPatchRegexp()
 	relaxedVersion, err := relaxVersion(dependencyVersion)
 	if err != nil {
 		return nil, fmt.Errorf("relaxing dependencyVersion %q: %w", dependencyVersion, err)
@@ -235,7 +234,7 @@ func ResolveManifestPackage(project Project, spec packaging.BinarySpec, dependen
 
 	// locate the original version in the filename and substitute the relaxed version regexp, quoting everything around that
 	relaxedPackageName := regexp.QuoteMeta(packageName[:versionIndex])
-	relaxedPackageName += relaxedVersion
+	relaxedPackageName += `(?P<version>` + relaxedVersion + `)`
 	relaxedPackageName += regexp.QuoteMeta(packageName[versionIndex+len(dependencyVersion):])
 
 	if mg.Verbose() {
@@ -251,13 +250,14 @@ func ResolveManifestPackage(project Project, spec packaging.BinarySpec, dependen
 		if mg.Verbose() {
 			log.Printf(">>>>>>>>>>> Evaluating filename %s", pkgName)
 		}
-		if relaxedPackageNameRegexp.MatchString(pkgName) {
+		if submatches := relaxedPackageNameRegexp.FindStringSubmatch(pkgName); len(submatches) > 0 {
 			if mg.Verbose() {
 				log.Printf(">>>>>>>>>>> Found matching packageName for [%s, %s]: %s", project.Branch, project.CommitHash, pkgName)
 			}
 			return &ResolvedPackage{
-				Name: pkgName,
-				URLs: []string{pkg.URL, pkg.ShaURL, pkg.AscURL},
+				Name:          pkgName,
+				ActualVersion: submatches[1],
+				URLs:          []string{pkg.URL, pkg.ShaURL, pkg.AscURL},
 			}, nil
 		}
 	}

From 57cddeb6a6b14acb0d04070def42a4cab1bdae90 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 2 Apr 2025 17:36:25 +0200
Subject: [PATCH 09/42] Package elastic-agent FIPS specs when FIPS=true is
 specified

---
 dev-tools/mage/pkg.go | 20 +++++++++++++++++++-
 magefile.go           | 10 ++++++++--
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/dev-tools/mage/pkg.go b/dev-tools/mage/pkg.go
index 8a271cb1aa4..6de7cc1df0e 100644
--- a/dev-tools/mage/pkg.go
+++ b/dev-tools/mage/pkg.go
@@ -34,6 +34,15 @@ func Package() error {
 	// platforms := updateWithDarwinUniversal(Platforms)
 	platforms := Platforms
 
+	if mg.Verbose() {
+		packages := make([]string, 0, len(Packages))
+		for _, p := range Packages {
+			packages = append(packages, fmt.Sprintf("spec %s on %s/%s", p.Spec.Name, p.OS, p.Arch))
+		}
+
+		log.Printf("Packaging for platforms %v, packages %v", platforms, packages)
+	}
+
 	tasks := make(map[string][]interface{})
 	for _, target := range platforms {
 		for _, pkg := range Packages {
@@ -41,6 +50,12 @@ func Package() error {
 				continue
 			}
 
+			// Checks if this package is compatible with the FIPS settings
+			if pkg.Spec.FIPS != FIPSBuild {
+				log.Printf("Skipping %s/%s package type because FIPS flag doesn't match [pkg=%v, build=%v]", pkg.Spec.Name, pkg.OS, pkg.Spec.FIPS, FIPSBuild)
+				continue
+			}
+
 			for _, pkgType := range pkg.Types {
 				if !IsPackageTypeSelected(pkgType) {
 					log.Printf("Skipping %s package type because it is not selected", pkgType)
@@ -80,7 +95,6 @@ func Package() error {
 				spec.OS = target.GOOS()
 				spec.Arch = packageArch
 				spec.Snapshot = Snapshot
-				spec.FIPS = FIPSBuild
 				spec.evalContext = map[string]interface{}{
 					"GOOS":          target.GOOS(),
 					"GOARCH":        target.GOARCH(),
@@ -100,6 +114,10 @@ func Package() error {
 
 				spec = spec.Evaluate()
 
+				if mg.Verbose() {
+					log.Printf("Adding task for packaging %s on %s/%s", spec.Name, target.GOOS(), target.Arch())
+				}
+
 				tasks[target.GOOS()+"-"+target.Arch()] = append(tasks[target.GOOS()+"-"+target.Arch()], packageBuilder{target, spec, pkgType}.Build)
 			}
 		}
diff --git a/magefile.go b/magefile.go
index ca4e7082815..8ed18a8c690 100644
--- a/magefile.go
+++ b/magefile.go
@@ -597,7 +597,9 @@ func DownloadManifest(ctx context.Context) error {
 	}
 
 	// Enforce that we use the correct elastic-agent packaging, to correctly load component dependencies
-	devtools.UseElasticAgentPackaging()
+	// Use mg.Deps() to ensure that the function will be called only once per mage invocation.
+	// devtools.Use*Packaging functions are not idempotent as they append in devtools.Packages
+	mg.Deps(devtools.UseElasticAgentPackaging)
 	dependencies, err := ExtractComponentsFromSelectedPkgSpecs(devtools.Packages)
 	if err != nil {
 		return fmt.Errorf("failed extracting dependencies: %w", err)
@@ -1277,7 +1279,11 @@ func collectPackageDependencies(platforms []string, packageVersion string, packa
 					cmd.Dir = pwd
 					cmd.Stdout = os.Stdout
 					cmd.Stderr = os.Stderr
-					cmd.Env = append(os.Environ(), fmt.Sprintf("PWD=%s", pwd), "AGENT_PACKAGING=on")
+					cmd.Env = append(os.Environ(),
+						fmt.Sprintf("PWD=%s", pwd),
+						"AGENT_PACKAGING=on",
+						fmt.Sprintf("FIPS=%v", devtools.FIPSBuild),
+					)
 					if envVar := selectedPackageTypes(); envVar != "" {
 						cmd.Env = append(cmd.Env, envVar)
 					}

From 32616c0193f9f3ffe4e19b28ac62d3e546dd0294 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Thu, 3 Apr 2025 10:13:45 +0200
Subject: [PATCH 10/42] refactor ResolveManifestPackage

---
 dev-tools/mage/manifest/manifest.go | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/dev-tools/mage/manifest/manifest.go b/dev-tools/mage/manifest/manifest.go
index 625c38f682f..7303b952867 100644
--- a/dev-tools/mage/manifest/manifest.go
+++ b/dev-tools/mage/manifest/manifest.go
@@ -216,13 +216,20 @@ func ResolveManifestPackage(project Project, spec packaging.BinarySpec, dependen
 	// If we didn't find it, it may be an Independent Agent Release, where
 	// the opted-in projects will have a patch version one higher than
 	// the rest of the projects, so we "relax" the version constraint
+	return resolveManifestPackageUsingRelaxedVersion(project, spec, dependencyVersion, platform)
+}
+
+func resolveManifestPackageUsingRelaxedVersion(project Project, spec packaging.BinarySpec, dependencyVersion string, platform string) (*ResolvedPackage, error) {
+	// start with the rendered package name
+	packageName := spec.GetPackageName(dependencyVersion, platform)
 
-	// Find the original version in the filename
+	// Find the original version in the rendered filename
 	versionIndex := strings.Index(packageName, dependencyVersion)
 	if versionIndex == -1 {
 		return nil, fmt.Errorf("no exact match and filename %q does not seem to contain dependencyVersion %q to try a fallback", packageName, dependencyVersion)
 	}
 
+	// obtain a regexp from the exact version string that allows for some flexibility on patch version, prerelease and build metadata tokens
 	relaxedVersion, err := relaxVersion(dependencyVersion)
 	if err != nil {
 		return nil, fmt.Errorf("relaxing dependencyVersion %q: %w", dependencyVersion, err)
@@ -262,7 +269,7 @@ func ResolveManifestPackage(project Project, spec packaging.BinarySpec, dependen
 		}
 	}
 
-	return nil, fmt.Errorf("package [%s] not found in project manifest at %s", packageName, project.ExternalArtifactsManifestURL)
+	return nil, fmt.Errorf("package [%s] not found in project manifest at %s using relaxed version %q", packageName, project.ExternalArtifactsManifestURL, relaxedPackageName)
 }
 
 // versionRegexp is taken from https://semver.org/ (see the FAQ section/Is there a suggested regular expression (RegEx) to check a SemVer string?)

From 58bcc269c18f5887ca9d10b6fca3efe120408b45 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Thu, 3 Apr 2025 15:18:25 +0200
Subject: [PATCH 11/42] Move FIPS compile settings in packages.yml

---
 dev-tools/mage/build.go          | 20 +++++++++++++-------
 dev-tools/packaging/packages.yml | 18 ++++++++++++++++--
 dev-tools/packaging/settings.go  | 18 ++++++++++++++++++
 3 files changed, 47 insertions(+), 9 deletions(-)

diff --git a/dev-tools/mage/build.go b/dev-tools/mage/build.go
index 92da55273b1..c5d879a6510 100644
--- a/dev-tools/mage/build.go
+++ b/dev-tools/mage/build.go
@@ -18,6 +18,8 @@ import (
 	"github.com/magefile/mage/sh"
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
+
+	"github.com/elastic/elastic-agent/dev-tools/packaging"
 )
 
 // BuildArgs are the arguments used for the "build" target and they define how
@@ -73,6 +75,7 @@ func DefaultBuildArgs() BuildArgs {
 	args := BuildArgs{
 		Name: BeatName,
 		CGO:  build.Default.CgoEnabled,
+		Env:  map[string]string{},
 		Vars: map[string]string{
 			elasticAgentModulePath + "/version.buildTime": "{{ date }}",
 			elasticAgentModulePath + "/version.commit":    "{{ commit }}",
@@ -88,8 +91,16 @@ func DefaultBuildArgs() BuildArgs {
 	}
 
 	if FIPSBuild {
-		args.ExtraFlags = append(args.ExtraFlags, "-tags=requirefips")
-		args.CGO = true
+
+		fipsConfig := packaging.Settings().FIPS
+
+		for _, tag := range fipsConfig.Compile.Tags {
+			args.ExtraFlags = append(args.ExtraFlags, "-tags="+tag)
+		}
+		args.CGO = args.CGO || fipsConfig.Compile.CGO
+		for varName, value := range fipsConfig.Compile.Env {
+			args.Env[varName] = value
+		}
 	}
 
 	if DevBuild {
@@ -191,11 +202,6 @@ func Build(params BuildArgs) error {
 		cgoEnabled = "1"
 	}
 
-	if FIPSBuild {
-		cgoEnabled = "1"
-		env["GOEXPERIMENT"] = "systemcrypto"
-	}
-
 	env["CGO_ENABLED"] = cgoEnabled
 
 	// Spec
diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index c0d20465018..985550dfc00 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -1,8 +1,7 @@
 ---
 
 # This file contains the package specifications for both Community Beats and
-# Official Beats. The shared section contains YAML anchors that are used to
-# define common parts of the package in order to not repeat ourselves.
+# Official Beats.
 
 # List all the available platforms
 platforms: &all-platforms
@@ -35,6 +34,19 @@ packageTypes: &all-package-types
   - &pkg-type-docker
       5 # docker
 
+# Settings section contains general compiling and packaging settings
+settings:
+  fips:
+    compile:
+      cgo: true
+      env:
+        GOEXPERIMENT: systemcrypto
+      tags:
+        - requirefips
+      platforms:
+        - *linux-amd64
+        - *linux-arm64
+
 # List *all* the components available for packaging in elastic-agent
 components:
   # general template for new components
@@ -138,6 +150,8 @@ components:
       - *linux-arm64
     packageTypes: *all-package-types
 
+# The shared section contains YAML anchors that are used to
+# define common parts of the package in order to not repeat ourselves.
 shared:
   - &common
     name: '{{.BeatName}}'
diff --git a/dev-tools/packaging/settings.go b/dev-tools/packaging/settings.go
index 976e40ee334..78b9de6219a 100644
--- a/dev-tools/packaging/settings.go
+++ b/dev-tools/packaging/settings.go
@@ -176,10 +176,24 @@ func (p Platform) Platform() string {
 	return p.OS + "/" + p.Arch
 }
 
+type FIPSConfig struct {
+	Compile struct {
+		CGO       bool              `yaml:"cgo"`
+		Env       map[string]string `yaml:"env"`
+		Tags      []string          `yaml:"tags"`
+		Platforms []Platform        `yaml:"platforms"`
+	} `yaml:"compile"`
+}
+
+type GlobalSettings struct {
+	FIPS FIPSConfig `yaml:"fips"`
+}
+
 type packagesConfig struct {
 	Platforms    []Platform              `yaml:"platforms"`
 	PackageTypes []pkgcommon.PackageType `yaml:"packageTypes"`
 	Components   []BinarySpec            `yaml:"components"`
+	Settings     GlobalSettings          `yaml:"settings"`
 }
 
 func parsePackageSettings(r io.Reader) (*packagesConfig, error) {
@@ -204,3 +218,7 @@ func Components() ([]BinarySpec, error) {
 	copy(ret, settings.Components)
 	return ret, nil
 }
+
+func Settings() GlobalSettings {
+	return settings.Settings
+}

From 9ba0fc289d840ed8fe21263ee6c9f1f30e186819 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Thu, 3 Apr 2025 16:17:13 +0200
Subject: [PATCH 12/42] Add more FIPS components

---
 dev-tools/packaging/packages.yml | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index 985550dfc00..d2e87ba7937 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -149,7 +149,23 @@ components:
       - *linux-amd64
       - *linux-arm64
     packageTypes: *all-package-types
-
+  - &comp-apm_server-fips
+    projectName: apm-server
+    packageName: apm-server-fips-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: apm-server-fips-{{.Version}}-{{.Platform}}
+    binaryName: apm-server
+    platforms:
+      # FIXME: is apm-server-fips not available for linux/amd64? infra PR is pending
+      # - *linux-amd64
+      - *linux-arm64
+    packageTypes: *all-package-types
+  - &comp-fleet-server-fips
+    projectName: fleet-server
+    packageName: fleet-server-fips-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: fleet-server-fips-{{.Version}}-{{.Platform}}
+    binaryName: fleet-server
+    platforms: *all-platforms
+    packageTypes: *all-package-types
 # The shared section contains YAML anchors that are used to
 # define common parts of the package in order to not repeat ourselves.
 shared:
@@ -195,6 +211,8 @@ shared:
   - &elastic_agent_fips_components
     components:
       - *comp-agentbeat-fips
+      - *comp-apm_server-fips
+      - *comp-fleet-server-fips
 
   # Deb/RPM spec for community beats.
   - &deb_rpm_agent_spec
@@ -1447,6 +1465,11 @@ specs:
       spec:
         <<: *agent_binary_fips_spec
         <<: *elastic_license_for_binaries
+        files:
+          '{{.BeatName}}{{.BinaryExt}}':
+            source: data/{{.BeatName}}-{{ commit_short }}/{{.BeatName}}{{.BinaryExt}}
+            symlink: true
+            mode: 0755
     ######## End FIPS Specs ########
 
   # Elastic Beat with Elastic License and binary taken from the x-pack dir.

From eaa8f43950b91250677b879f73eeaf085f057c78 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Fri, 4 Apr 2025 08:31:10 +0200
Subject: [PATCH 13/42] Properly handle dependenciesVersion when calling mage
 package

---
 magefile.go | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/magefile.go b/magefile.go
index 8ed18a8c690..f999f9f3f6c 100644
--- a/magefile.go
+++ b/magefile.go
@@ -571,6 +571,9 @@ func Package(ctx context.Context) error {
 		dependenciesVersion = beatVersion
 	}
 
+	// add the snapshot suffix if needed
+	dependenciesVersion += devtools.SnapshotSuffix()
+
 	packageAgent(ctx, platforms, dependenciesVersion, manifestResponse, mg.F(devtools.UseElasticAgentPackaging), mg.F(CrossBuild), devtools.SelectedPackageTypes)
 	return nil
 }
@@ -1201,9 +1204,9 @@ func collectPackageDependencies(platforms []string, packageVersion string, packa
 		}
 		archivePath = movePackagesToArchive(dropPath, platforms, packageVersion, dependencies)
 
-		if hasSnapshotEnv() {
-			packageVersion = fmt.Sprintf("%s-SNAPSHOT", packageVersion)
-		}
+		//if hasSnapshotEnv() {
+		//	packageVersion = fmt.Sprintf("%s-SNAPSHOT", packageVersion)
+		//}
 
 		os.Setenv(agentDropPath, dropPath)
 

From 2dbeb3c7a7c81dfd6dcd655f869bb48f2a35b248 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Fri, 4 Apr 2025 08:50:51 +0200
Subject: [PATCH 14/42] Refactor ChecksumsWithoutManifest to use list of
 dependencies instead of globbing files

---
 dev-tools/mage/checksums.go | 57 +++++++++++++++++++------------------
 magefile.go                 |  2 +-
 2 files changed, 31 insertions(+), 28 deletions(-)

diff --git a/dev-tools/mage/checksums.go b/dev-tools/mage/checksums.go
index 071b609c8ef..8311febe452 100644
--- a/dev-tools/mage/checksums.go
+++ b/dev-tools/mage/checksums.go
@@ -42,22 +42,30 @@ func CopyComponentSpecs(componentName, versionedDropPath string) (string, error)
 }
 
 // This is a helper function for flattenDependencies that's used when not packaging from a manifest
-func ChecksumsWithoutManifest(versionedFlatPath string, versionedDropPath string, packageVersion string) map[string]string {
-	globExpr := filepath.Join(versionedFlatPath, fmt.Sprintf("*%s*", packageVersion))
-	if mg.Verbose() {
-		log.Printf("Finding files to copy with %s", globExpr)
-	}
-	files, err := filepath.Glob(globExpr)
-	if err != nil {
-		panic(err)
-	}
-	if mg.Verbose() {
-		log.Printf("Validating checksums for %+v", files)
-		log.Printf("--- Copying into %s: %v", versionedDropPath, files)
-	}
-
+func ChecksumsWithoutManifest(platform string, dependenciesVersion string, versionedFlatPath string, versionedDropPath string, dependencies []packaging.BinarySpec) map[string]string {
 	checksums := make(map[string]string)
-	for _, f := range files {
+
+	for _, dep := range dependencies {
+
+		if dep.PythonWheel {
+			if mg.Verbose() {
+				log.Printf(">>>>>>> Component %s/%s is a Python wheel, skipping", dep.ProjectName, dep.BinaryName)
+			}
+			continue
+		}
+
+		if !dep.SupportsPlatform(platform) {
+			log.Printf(">>>>>>> Component %s/%s does not support platform %s, skipping", dep.ProjectName, dep.BinaryName, platform)
+			continue
+		}
+
+		srcDir := filepath.Join(versionedFlatPath, dep.GetRootDir(dependenciesVersion, platform))
+
+		if mg.Verbose() {
+			log.Printf("Validating checksums for %+v", dep.BinaryName)
+			log.Printf("--- Copying into %s: %v", versionedDropPath, srcDir)
+		}
+
 		options := copy.Options{
 			OnSymlink: func(_ string) copy.SymlinkAction {
 				return copy.Shallow
@@ -65,37 +73,32 @@ func ChecksumsWithoutManifest(versionedFlatPath string, versionedDropPath string
 			Sync: true,
 		}
 		if mg.Verbose() {
-			log.Printf("> prepare to copy %s into %s ", f, versionedDropPath)
+			log.Printf("> prepare to copy %s into %s ", srcDir, versionedDropPath)
 		}
 
-		err = copy.Copy(f, versionedDropPath, options)
+		err := copy.Copy(srcDir, versionedDropPath, options)
 		if err != nil {
-			panic(err)
+			panic(fmt.Errorf("copying dependency %s files from %q to %q: %w", dep.BinaryName, srcDir, versionedDropPath, err))
 		}
 
 		// copy spec file for match
-		specName := filepath.Base(f)
-		idx := strings.Index(specName, "-"+packageVersion)
-		if idx != -1 {
-			specName = specName[:idx]
-		}
 		if mg.Verbose() {
-			log.Printf(">>>> Looking to copy spec file: [%s]", specName)
+			log.Printf(">>>> Looking to copy spec file: [%s]", dep.BinaryName)
 		}
 
-		checksum, err := CopyComponentSpecs(specName, versionedDropPath)
+		checksum, err := CopyComponentSpecs(dep.BinaryName, versionedDropPath)
 		if err != nil {
 			panic(err)
 		}
 
-		checksums[specName+ComponentSpecFileSuffix] = checksum
+		checksums[dep.BinaryName+ComponentSpecFileSuffix] = checksum
 	}
 
 	return checksums
 }
 
 // This is a helper function for flattenDependencies that's used when building from a manifest
-func ChecksumsWithManifest(platform, dependenciesVersion, versionedFlatPath, versionedDropPath string, manifestResponse *manifest.Build, dependencies []packaging.BinarySpec) map[string]string {
+func ChecksumsWithManifest(platform string, dependenciesVersion string, versionedFlatPath string, versionedDropPath string, manifestResponse *manifest.Build, dependencies []packaging.BinarySpec) map[string]string {
 	checksums := make(map[string]string)
 	if manifestResponse == nil {
 		return checksums
diff --git a/magefile.go b/magefile.go
index f999f9f3f6c..9c36c8e3d82 100644
--- a/magefile.go
+++ b/magefile.go
@@ -1422,7 +1422,7 @@ func flattenDependencies(platforms []string, dependenciesVersion, archivePath, d
 		if manifestResponse != nil {
 			checksums = devtools.ChecksumsWithManifest(pltf, dependenciesVersion, versionedFlatPath, versionedDropPath, manifestResponse, dependencies)
 		} else {
-			checksums = devtools.ChecksumsWithoutManifest(versionedFlatPath, versionedDropPath, dependenciesVersion)
+			checksums = devtools.ChecksumsWithoutManifest(pltf, dependenciesVersion, versionedFlatPath, versionedDropPath, dependencies)
 		}
 
 		if err := appendComponentChecksums(versionedDropPath, checksums); err != nil {

From fc7e7efaab9b24a5e4f6e091469ba181cacaeb0a Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Fri, 4 Apr 2025 08:54:14 +0200
Subject: [PATCH 15/42] fixup! Properly handle dependenciesVersion when calling
 mage package

---
 magefile.go | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/magefile.go b/magefile.go
index 9c36c8e3d82..81e65c3bd2b 100644
--- a/magefile.go
+++ b/magefile.go
@@ -1204,10 +1204,6 @@ func collectPackageDependencies(platforms []string, packageVersion string, packa
 		}
 		archivePath = movePackagesToArchive(dropPath, platforms, packageVersion, dependencies)
 
-		//if hasSnapshotEnv() {
-		//	packageVersion = fmt.Sprintf("%s-SNAPSHOT", packageVersion)
-		//}
-
 		os.Setenv(agentDropPath, dropPath)
 
 		if devtools.ExternalBuild == true {

From 543a3511ca517d710c4ff1bc6020450d78a1857c Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Fri, 4 Apr 2025 09:57:31 +0200
Subject: [PATCH 16/42] Disable apm-server-fips on linux/arm64 because binary
 name is wrong

---
 dev-tools/packaging/packages.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index d2e87ba7937..c3d1cda8b3d 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -157,7 +157,8 @@ components:
     platforms:
       # FIXME: is apm-server-fips not available for linux/amd64? infra PR is pending
       # - *linux-amd64
-      - *linux-arm64
+      # FIXME: is apm-server-fips on linux/arm64 has a different binary name 'apm-server-fips' but 'apm-server.spec.yml' spec file
+      #- *linux-arm64
     packageTypes: *all-package-types
   - &comp-fleet-server-fips
     projectName: fleet-server

From 298dfe9e4560c835418ffbd8609eb3549edc7ffa Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Fri, 4 Apr 2025 10:04:46 +0200
Subject: [PATCH 17/42] fixup! Add rootdir to components

---
 dev-tools/packaging/testing/package_test.go | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index 1b5d056806f..b77c15831ad 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -219,7 +219,7 @@ func checkTar(t *testing.T, file string, fipsCheck bool) {
 	checkModulesOwner(t, p, true)
 	checkLicensesPresent(t, "", p)
 
-	t.Run(p.Name+"_check_manifest_file", testManifestFile(file))
+	t.Run(p.Name+"_check_manifest_file", testManifestFile(file, fipsCheck))
 
 	checkSha512PackageHash(t, file)
 }
@@ -238,12 +238,12 @@ func checkZip(t *testing.T, file string) {
 	checkModulesPermissions(t, p)
 	checkLicensesPresent(t, "", p)
 
-	t.Run(p.Name+"_check_manifest_file", testManifestFile(file))
+	t.Run(p.Name+"_check_manifest_file", testManifestFile(file, false))
 
 	checkSha512PackageHash(t, file)
 }
 
-func testManifestFile(file string) func(t *testing.T) {
+func testManifestFile(file string, checkFips bool) func(t *testing.T) {
 	return func(t *testing.T) {
 		tempExtractionPath := t.TempDir()
 		err := mage.Extract(file, tempExtractionPath)
@@ -253,6 +253,9 @@ func testManifestFile(file string) func(t *testing.T) {
 		require.Lenf(t, dirEntries, 1, "archive %q should contain a single directory", file)
 		containingDir := dirEntries[0].Name()
 		checkManifestFileContents(t, filepath.Join(tempExtractionPath, containingDir))
+		if checkFips {
+			checkFIPS(t, filepath.Join(tempExtractionPath, containingDir))
+		}
 	}
 }
 

From 5a0d9bd33aa84f433e978de18ab77e869e3a141b Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Fri, 4 Apr 2025 16:52:14 +0200
Subject: [PATCH 18/42] Rework useDRAAgentBinaryForPackage for repackaging
 agent

Define elastic-agent-core components (both FIPS and non-FIPS variants)
and define package name and root dir templates.
Implement some filtering on component list to extract the correct
component definition according to the FIPSBuild flag.
Refactor code that downloads pre-compiled elastic-agent binaries and
places them in the golangCrossBuild directory to make use of the new
component definition.
---
 dev-tools/mage/manifest/manifest.go |   4 +-
 dev-tools/packaging/packages.yml    |  27 +++-
 dev-tools/packaging/settings.go     |  39 +++++
 magefile.go                         | 237 ++++++++++++++++------------
 4 files changed, 204 insertions(+), 103 deletions(-)

diff --git a/dev-tools/mage/manifest/manifest.go b/dev-tools/mage/manifest/manifest.go
index 7303b952867..7c33f08e8b3 100644
--- a/dev-tools/mage/manifest/manifest.go
+++ b/dev-tools/mage/manifest/manifest.go
@@ -310,12 +310,12 @@ func DownloadPackage(ctx context.Context, downloadUrl string, target string) err
 	}
 	valid := false
 	for _, manifestHost := range AllowedManifestHosts {
-		if manifestHost == parsedURL.Host {
+		if manifestHost == parsedURL.Hostname() {
 			valid = true
 		}
 	}
 	if !valid {
-		log.Printf("Not allowed %s, valid ones are %+v", parsedURL.Host, AllowedManifestHosts)
+		log.Printf("Not allowed %s, valid ones are %+v", parsedURL.Hostname(), AllowedManifestHosts)
 		return errorNotAllowedManifestURL
 	}
 	cleanUrl := fmt.Sprintf("https://%s%s", parsedURL.Host, parsedURL.Path)
diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index c3d1cda8b3d..e9cbb64044e 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -55,6 +55,7 @@ components:
   #    packageName: <template representing the name of the archive to download/extract>
   #    binaryName: <binary name>
   #    rootDir: <template representing directory from the archive root where the binary is located>
+  #    fips: <boolean indicating if this components whether FIPS compliant>
   #    platforms:
   #      - <platform, use anchors for platforms above>
   #    pythonWheel: true # true if it's a package that is not platform specific
@@ -140,11 +141,20 @@ components:
       - *linux-amd64
       - *linux-arm64
     packageTypes: *all-package-types
+  # Elastic Agent core component, defined here because it's a dependency when packaging using elastic-agent DRA
+  - &comp-elastic-agent-core
+    projectName: elastic-agent-core
+    packageName: elastic-agent-core-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: elastic-agent-core-{{.Version}}-{{.Platform}}
+    binaryName: elastic-agent
+    platforms: *all-platforms
+    packageTypes: *all-package-types
   - &comp-agentbeat-fips
     projectName: beats
     packageName: agentbeat-fips-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: agentbeat-{{.Version}}-{{.Platform}}
     binaryName: agentbeat
+    fips: true
     platforms:
       - *linux-amd64
       - *linux-arm64
@@ -154,6 +164,7 @@ components:
     packageName: apm-server-fips-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: apm-server-fips-{{.Version}}-{{.Platform}}
     binaryName: apm-server
+    fips: true
     platforms:
       # FIXME: is apm-server-fips not available for linux/amd64? infra PR is pending
       # - *linux-amd64
@@ -165,7 +176,21 @@ components:
     packageName: fleet-server-fips-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: fleet-server-fips-{{.Version}}-{{.Platform}}
     binaryName: fleet-server
-    platforms: *all-platforms
+    fips: true
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
+    packageTypes: *all-package-types
+  # Elastic Agent core component (FIPS-compliant version), defined here because it's a dependency when packaging using elastic-agent DRA
+  - &comp-elastic-agent-core-fips
+    projectName: elastic-agent-core
+    packageName: elastic-agent-core-fips-{{.Version}}-{{.Platform}}.{{.Ext}}
+    rootDir: elastic-agent-core-{{.Version}}-{{.Platform}}
+    binaryName: elastic-agent
+    fips: true
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
     packageTypes: *all-package-types
 # The shared section contains YAML anchors that are used to
 # define common parts of the package in order to not repeat ourselves.
diff --git a/dev-tools/packaging/settings.go b/dev-tools/packaging/settings.go
index 78b9de6219a..90b611ff046 100644
--- a/dev-tools/packaging/settings.go
+++ b/dev-tools/packaging/settings.go
@@ -67,6 +67,7 @@ type BinarySpec struct {
 	PackageName  string                  `yaml:"packageName"`
 	RootDir      string                  `yaml:"rootDir"`
 	ProjectName  string                  `yaml:"projectName"`
+	FIPS         bool                    `yaml:"fips"`
 	Platforms    []Platform              `yaml:"platforms"`
 	PythonWheel  bool                    `yaml:"pythonWheel"`
 	PackageTypes []pkgcommon.PackageType `yaml:"packageTypes"`
@@ -141,10 +142,18 @@ func (proj BinarySpec) Equal(other BinarySpec) bool {
 		return false
 	}
 
+	if proj.RootDir != other.RootDir {
+		return false
+	}
+
 	if proj.ProjectName != other.ProjectName {
 		return false
 	}
 
+	if proj.FIPS != other.FIPS {
+		return false
+	}
+
 	if !slices.Equal(proj.Platforms, other.Platforms) {
 		return false
 	}
@@ -222,3 +231,33 @@ func Components() ([]BinarySpec, error) {
 func Settings() GlobalSettings {
 	return settings.Settings
 }
+
+func FilterComponents(filters ...ComponentFilter) []BinarySpec {
+	ret := make([]BinarySpec, 0, len(settings.Components))
+
+COMPLOOP:
+	for _, c := range settings.Components {
+		for _, filter := range filters {
+			if !filter(c) {
+				// this filter doesn't match, move to the next component
+				continue COMPLOOP
+			}
+		}
+		ret = append(ret, c)
+	}
+	return ret
+}
+
+type ComponentFilter func(BinarySpec) bool
+
+func WithProjectName(projectName string) ComponentFilter {
+	return func(p BinarySpec) bool {
+		return p.ProjectName == projectName
+	}
+}
+
+func WithFIPS(fips bool) ComponentFilter {
+	return func(p BinarySpec) bool {
+		return p.FIPS == fips
+	}
+}
diff --git a/magefile.go b/magefile.go
index 81e65c3bd2b..43a5d87c45d 100644
--- a/magefile.go
+++ b/magefile.go
@@ -97,8 +97,9 @@ const (
 
 	cloudImageTmpl = "docker.elastic.co/observability-ci/elastic-agent:%s"
 
-	baseURLForStagingDRA = "https://staging.elastic.co/"
-	agentCoreProjectName = "elastic-agent-core"
+	baseURLForSnapshotDRA = "https://snapshots.elastic.co/"
+	baseURLForStagingDRA  = "https://staging.elastic.co/"
+	agentCoreProjectName  = "elastic-agent-core"
 
 	helmChartPath      = "./deploy/helm/elastic-agent"
 	helmOtelChartPath  = "./deploy/helm/edot-collector/kube-stack"
@@ -1439,7 +1440,25 @@ type branchInfo struct {
 // FetchLatestAgentCoreStagingDRA is a mage target that will retrieve the elastic-agent-core DRA artifacts and
 // place them under build/dra/buildID. It accepts one argument that has to be a release branch present in staging DRA
 func FetchLatestAgentCoreStagingDRA(ctx context.Context, branch string) error {
-	branchInfo, err := findLatestBuildForBranch(ctx, baseURLForStagingDRA, branch)
+
+	elasticAgentCoreComponents := packaging.FilterComponents(packaging.WithProjectName(agentCoreProjectName), packaging.WithFIPS(devtools.FIPSBuild))
+
+	if len(elasticAgentCoreComponents) != 1 {
+		return fmt.Errorf(
+			"found an unexpected number of elastic-agent-core components (should be 1) [projectName: %q, fips: %v]: %v",
+			agentCoreProjectName,
+			devtools.FIPSBuild,
+			elasticAgentCoreComponents,
+		)
+	}
+
+	elasticAgentCoreComponent := elasticAgentCoreComponents[0]
+
+	branchInformation, err := findLatestBuildForBranch(ctx, baseURLForSnapshotDRA, branch)
+
+	if err != nil {
+		return fmt.Errorf("getting latest build for branch %q: %v", err)
+	}
 
 	// Create a dir with the buildID at <root>/build/dra/<buildID>
 	repositoryRoot, err := findRepositoryRoot()
@@ -1452,14 +1471,19 @@ func FetchLatestAgentCoreStagingDRA(ctx context.Context, branch string) error {
 		return fmt.Errorf("creating %q directory: %w", err)
 	}
 
-	artifacts, err := downloadDRAArtifacts(ctx, branchInfo.ManifestURL, draDownloadDir, agentCoreProjectName)
+	build, err := manifest.DownloadManifest(ctx, branchInformation.ManifestURL)
+	if err != nil {
+		return fmt.Errorf("downloading manifest from %q: %w", branchInformation.ManifestURL, err)
+	}
+
+	artifacts, err := downloadDRAArtifacts(ctx, &build, build.Version, draDownloadDir, elasticAgentCoreComponent)
 	if err != nil {
-		return fmt.Errorf("downloading DRA artifacts from %q: %w", branchInfo.ManifestURL, err)
+		return fmt.Errorf("downloading DRA artifacts from %q: %w", branchInformation.ManifestURL, err)
 	}
 
 	fmt.Println("Downloaded agent core DRAs:")
 	for k := range artifacts {
-		fmt.Println(k)
+		fmt.Println(filepath.Join(draDownloadDir, k))
 	}
 	return nil
 }
@@ -1493,7 +1517,7 @@ func PackageUsingDRA(ctx context.Context) error {
 		return fmt.Errorf("setting agent commit hash %q: %w", agentCoreProject.CommitHash, err)
 	}
 
-	return packageAgent(ctx, platforms, parsedVersion.VersionWithPrerelease(), manifestResponse, mg.F(devtools.UseElasticAgentPackaging), mg.F(useDRAAgentBinaryForPackage, devtools.ManifestURL), devtools.SelectedPackageTypes)
+	return packageAgent(ctx, platforms, parsedVersion.VersionWithPrerelease(), manifestResponse, mg.F(devtools.UseElasticAgentPackaging), mg.F(useDRAAgentBinaryForPackage, devtools.ManifestURL, parsedVersion.VersionWithPrerelease()), devtools.SelectedPackageTypes)
 }
 
 func downloadManifestAndSetVersion(ctx context.Context, url string) (*manifest.Build, *version.ParsedSemVer, error) {
@@ -1578,42 +1602,9 @@ func mapManifestPlatformToAgentPlatform(manifestPltf string) (string, bool) {
 	return mappedPltf, found
 }
 
-func filterPackagesByPlatform(pkgs map[string]manifest.Package) map[string]manifest.Package {
-	if mg.Verbose() {
-		log.Printf("unfiltered packages: %v", pkgs)
-	}
-	platforms := devtools.Platforms.Names()
-	filteredPackages := map[string]manifest.Package{}
-	for pkgName, pkgDesc := range pkgs {
-		if mg.Verbose() {
-			log.Printf("checking if %s:%v should be included", pkgName, pkgDesc)
-		}
-		for _, pkgOS := range pkgDesc.Os {
-			platformString, _ := mapManifestPlatformToAgentPlatform(fmt.Sprintf("%s/%s", pkgOS, pkgDesc.Architecture))
-			if slices.Contains(platforms, platformString) {
-				if mg.Verbose() {
-					log.Printf("platforms include %s", platformString)
-				}
-				filteredPackages[pkgName] = pkgDesc
-				break
-			}
-		}
-	}
-	if mg.Verbose() {
-		log.Printf("filtered packages: %v", filteredPackages)
-	}
-	return filteredPackages
-}
-
-func downloadDRAArtifacts(ctx context.Context, manifestUrl string, downloadDir string, projects ...string) (map[string]manifest.Package, error) {
-	build, err := manifest.DownloadManifest(ctx, manifestUrl)
-	if err != nil {
-		return nil, fmt.Errorf("downloading manifest from %q: %w", manifestUrl, err)
-	}
+func downloadDRAArtifacts(ctx context.Context, build *manifest.Build, version string, draDownloadDir string, components ...packaging.BinarySpec) (map[string]manifest.Package, error) {
 
-	// Create a dir with the buildID at <downloadDir>/<buildID>
-	draDownloadDir := filepath.Join(downloadDir, build.BuildID)
-	err = os.MkdirAll(draDownloadDir, 0o770)
+	err := os.MkdirAll(draDownloadDir, 0o770)
 	if err != nil {
 		return nil, fmt.Errorf("creating %q directory: %w", draDownloadDir, err)
 	}
@@ -1623,60 +1614,93 @@ func downloadDRAArtifacts(ctx context.Context, manifestUrl string, downloadDir s
 	downloadedArtifacts := map[string]manifest.Package{}
 	errGrp, errCtx := errgroup.WithContext(ctx)
 
-	for _, projectName := range projects {
-		project, ok := build.Projects[projectName]
-		if !ok {
-			return nil, fmt.Errorf("project %q not found in manifest at %q", projectName, manifestUrl)
-		}
+	var downloaders []func() error
 
-		if mg.Verbose() {
-			log.Printf("build %q project %s packages: %+v", build.BuildID, projectName, project)
-		}
-		// filter down the packages to the platforms we are building/support
-		filteredPackages := filterPackagesByPlatform(project.Packages)
-		if mg.Verbose() {
-			log.Printf("packages to download: %v", filteredPackages)
-		}
-		for pkgName, pkgDesc := range filteredPackages {
-			downloadFunc := func(pkgName string, pkgDesc manifest.Package) func() error {
-				return func() error {
-					artifactDownloadPath := filepath.Join(draDownloadDir, pkgName)
-					err := manifest.DownloadPackage(errCtx, pkgDesc.URL, artifactDownloadPath)
-					if err != nil {
-						return fmt.Errorf("downloading %q: %w", pkgName, err)
-					}
+	for _, comp := range components {
+		for _, platform := range devtools.Platforms.Names() {
 
-					// download the SHA to check integrity
-					artifactSHADownloadPath := filepath.Join(draDownloadDir, pkgName+sha512FileExt)
-					err = manifest.DownloadPackage(errCtx, pkgDesc.ShaURL, artifactSHADownloadPath)
-					if err != nil {
-						return fmt.Errorf("downloading SHA for %q: %w", pkgName, err)
-					}
+			if !comp.SupportsPlatform(platform) {
+				if mg.Verbose() {
+					log.Printf("skipping download of %s/%s for platform %s as it's not supported", comp.ProjectName, comp.BinaryName, platform)
+				}
+				continue
+			}
 
-					err = download.VerifyChecksum(sha512.New(), artifactDownloadPath, artifactSHADownloadPath)
-					if err != nil {
-						return fmt.Errorf("validating checksum for %q: %w", pkgName, err)
-					}
+			project, ok := build.Projects[comp.ProjectName]
+			if !ok {
+				return nil, fmt.Errorf("project %q not found in manifest", comp.ProjectName)
+			}
 
-					// we should probably validate the signature, it can be done later as we return the package metadata
-					// see https://github.com/elastic/elastic-agent/issues/4445
+			if mg.Verbose() {
+				log.Printf("build %q project %s packages: %+v", build.BuildID, comp.ProjectName, project)
+			}
 
-					mx.Lock()
-					defer mx.Unlock()
-					downloadedArtifacts[artifactDownloadPath] = pkgDesc
+			packageName := comp.GetPackageName(version, platform)
 
-					return nil
-				}
-			}(pkgName, pkgDesc)
+			if packageSpec, ok := project.Packages[packageName]; ok {
+				downloadFunc := func(pkgName string, pkgDesc manifest.Package) func() error {
+					return func() error {
+						artifactDownloadPath := filepath.Join(draDownloadDir, pkgName)
+						err := manifest.DownloadPackage(errCtx, pkgDesc.URL, artifactDownloadPath)
+						if err != nil {
+							return fmt.Errorf("downloading %q: %w", pkgName, err)
+						}
+
+						// download the SHA to check integrity
+						artifactSHADownloadPath := filepath.Join(draDownloadDir, pkgName+sha512FileExt)
+						err = manifest.DownloadPackage(errCtx, pkgDesc.ShaURL, artifactSHADownloadPath)
+						if err != nil {
+							return fmt.Errorf("downloading SHA for %q: %w", pkgName, err)
+						}
+
+						err = download.VerifyChecksum(sha512.New(), artifactDownloadPath, artifactSHADownloadPath)
+						if err != nil {
+							return fmt.Errorf("validating checksum for %q: %w", pkgName, err)
+						}
+
+						// we should probably validate the signature, it can be done later as we return the package metadata
+						// see https://github.com/elastic/elastic-agent/issues/4445
+
+						mx.Lock()
+						defer mx.Unlock()
+						downloadedArtifacts[pkgName] = pkgDesc
+
+						return nil
+					}
+				}(packageName, packageSpec)
+				downloaders = append(downloaders, downloadFunc)
+			} else {
+				return nil, fmt.Errorf("package %q not found in project %q", packageName, comp.ProjectName)
+			}
 
-			errGrp.Go(downloadFunc)
 		}
 	}
 
+	for _, downloader := range downloaders {
+		errGrp.Go(downloader)
+	}
+
 	return downloadedArtifacts, errGrp.Wait()
 }
 
-func useDRAAgentBinaryForPackage(ctx context.Context, manifestUrl string) error {
+func useDRAAgentBinaryForPackage(ctx context.Context, manifestURL string, version string) error {
+
+	elasticAgentCoreComponents := packaging.FilterComponents(packaging.WithProjectName(agentCoreProjectName), packaging.WithFIPS(devtools.FIPSBuild))
+
+	if len(elasticAgentCoreComponents) != 1 {
+		return fmt.Errorf(
+			"found an unexpected number of elastic-agent-core components (should be 1) [projectName: %q, fips: %v]: %v",
+			agentCoreProjectName,
+			devtools.FIPSBuild,
+			elasticAgentCoreComponents,
+		)
+	}
+
+	elasticAgentCoreComponent := elasticAgentCoreComponents[0]
+	if mg.Verbose() {
+		log.Printf("found elastic-agent-core component used: %v", elasticAgentCoreComponent)
+	}
+
 	repositoryRoot, err := findRepositoryRoot()
 	if err != nil {
 		return fmt.Errorf("looking up for repository root: %w", err)
@@ -1684,8 +1708,16 @@ func useDRAAgentBinaryForPackage(ctx context.Context, manifestUrl string) error
 
 	downloadDir := filepath.Join(repositoryRoot, "build", "dra")
 
+	manifestResponse, err := manifest.DownloadManifest(ctx, manifestURL)
+	if err != nil {
+		return fmt.Errorf("downloading manifest from %s: %w", manifestURL, err)
+	}
+
 	// fetch the agent-core DRA artifacts for the current branch
-	artifacts, err := downloadDRAArtifacts(ctx, manifestUrl, downloadDir, agentCoreProjectName)
+
+	// Create a dir with the buildID at <downloadDir>/<buildID>
+	draDownloadDir := filepath.Join(downloadDir, manifestResponse.BuildID)
+	artifacts, err := downloadDRAArtifacts(ctx, &manifestResponse, version, draDownloadDir, elasticAgentCoreComponent)
 	if err != nil {
 		return fmt.Errorf("downloading elastic-agent-core artifacts: %w", err)
 	}
@@ -1693,39 +1725,43 @@ func useDRAAgentBinaryForPackage(ctx context.Context, manifestUrl string) error
 	mg.Deps(EnsureCrossBuildOutputDir)
 
 	// place the artifacts where the package.yml expects them (in build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}})
-	for artifactFile, artifactMeta := range artifacts {
+	for _, platform := range devtools.Platforms.Names() {
+		if !elasticAgentCoreComponent.SupportsPlatform(platform) {
+			continue
+		}
+
+		expectedPackageName := elasticAgentCoreComponent.GetPackageName(version, platform)
+
+		artifactMetadata, ok := artifacts[expectedPackageName]
+
+		if !ok {
+			return fmt.Errorf("elastic-agent-core package %q has not been downloaded for platform %s", expectedPackageName, platform)
+		}
+
 		// uncompress the archive first
 		const extractionSubdir = "extracted"
-		extractDir := filepath.Join(filepath.Dir(artifactFile), extractionSubdir)
+		extractDir := filepath.Join(draDownloadDir, extractionSubdir)
+		artifactFile := filepath.Join(draDownloadDir, expectedPackageName)
 		err = devtools.Extract(artifactFile, extractDir)
 		if err != nil {
 			return fmt.Errorf("extracting %q: %w", artifactFile, err)
 		}
 
-		// we can take a shortcut as the archive contains a subdirectory with the same name of the file minus the extension
-		// and we have to rename the binary file while moving using the same name
-		artifactBaseFileName := filepath.Base(artifactFile)
-		artifactBaseFileExt := filepath.Ext(artifactBaseFileName)
-		if artifactBaseFileExt == ".gz" {
-			// get the next extension to get .tar.gz if it's there
-			artifactBaseFileExt = filepath.Ext(strings.TrimSuffix(artifactBaseFileName, artifactBaseFileExt)) + artifactBaseFileExt
-		}
-
 		// this is the directory name where we can find the agent executable
-		targetArtifactName := strings.TrimSuffix(artifactBaseFileName, artifactBaseFileExt)
-		const agentBinaryName = "elastic-agent"
+		targetArtifactName := elasticAgentCoreComponent.GetRootDir(version, platform)
 		binaryExt := ""
-		if slices.Contains(artifactMeta.Os, "windows") {
+		if slices.Contains(artifactMetadata.Os, "windows") {
 			binaryExt += ".exe"
 		}
-		srcBinaryPath := filepath.Join(extractDir, targetArtifactName, agentBinaryName+binaryExt)
+
+		srcBinaryPath := filepath.Join(extractDir, targetArtifactName, elasticAgentCoreComponent.BinaryName+binaryExt)
 		srcStat, err := os.Stat(srcBinaryPath)
 		if err != nil {
 			return fmt.Errorf("stat source binary name %q: %w", srcBinaryPath, err)
 		}
 		log.Printf("Source binary %q stat: %+v", srcBinaryPath, srcStat)
 
-		dstPlatform, _ := mapManifestPlatformToAgentPlatform(fmt.Sprintf("%s-%s", artifactMeta.Os[0], artifactMeta.Architecture))
+		dstPlatform, _ := mapManifestPlatformToAgentPlatform(fmt.Sprintf("%s-%s", artifactMetadata.Os[0], artifactMetadata.Architecture))
 		dstFileName := fmt.Sprintf("elastic-agent-%s", dstPlatform) + binaryExt
 		dstBinaryPath := filepath.Join(repositoryRoot, "build", "golang-crossbuild", dstFileName)
 
@@ -1738,6 +1774,7 @@ func useDRAAgentBinaryForPackage(ctx context.Context, manifestUrl string) error
 			return fmt.Errorf("copying %q to %q: %w", srcBinaryPath, dstBinaryPath, err)
 		}
 	}
+
 	return nil
 }
 

From bc17bed3a4ebe179a0503c91fc13143aec088b87 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Fri, 4 Apr 2025 17:14:56 +0200
Subject: [PATCH 19/42] Write spec FIPS flag into manifest.yaml when packaging

---
 dev-tools/mage/pkgtypes.go       | 1 +
 dev-tools/mage/settings.go       | 7 ++++---
 dev-tools/packaging/packages.yml | 4 ++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/dev-tools/mage/pkgtypes.go b/dev-tools/mage/pkgtypes.go
index cad09fb54ef..3cca0b06848 100644
--- a/dev-tools/mage/pkgtypes.go
+++ b/dev-tools/mage/pkgtypes.go
@@ -430,6 +430,7 @@ func (s PackageSpec) Evaluate(args ...map[string]interface{}) PackageSpec {
 		s.packageDir = filepath.Clean(mustExpand(s.packageDir))
 	}
 	s.evalContext["PackageDir"] = s.packageDir
+	s.evalContext["fips"] = s.FIPS
 
 	evaluatedFiles := make(map[string]PackageFile, len(s.Files))
 	for target, f := range s.Files {
diff --git a/dev-tools/mage/settings.go b/dev-tools/mage/settings.go
index ab09281e015..bd3e824275a 100644
--- a/dev-tools/mage/settings.go
+++ b/dev-tools/mage/settings.go
@@ -337,7 +337,7 @@ func AgentPackageVersion() (string, error) {
 	return BeatQualifiedVersion()
 }
 
-func PackageManifest() (string, error) {
+func PackageManifest(fips bool) (string, error) {
 
 	packageVersion, err := AgentPackageVersion()
 	if err != nil {
@@ -359,14 +359,15 @@ func PackageManifest() (string, error) {
 		return "", fmt.Errorf("retrieving agent flavors: %w", err)
 	}
 
-	return GeneratePackageManifest(BeatName, packageVersion, Snapshot, hash, commitHashShort, registry)
+	return GeneratePackageManifest(BeatName, packageVersion, Snapshot, hash, commitHashShort, fips, registry)
 }
 
-func GeneratePackageManifest(beatName, packageVersion string, snapshot bool, fullHash, shortHash string, flavorsRegistry map[string][]string) (string, error) {
+func GeneratePackageManifest(beatName, packageVersion string, snapshot bool, fullHash, shortHash string, fips bool, flavorsRegistry map[string][]string) (string, error) {
 	m := v1.NewManifest()
 	m.Package.Version = packageVersion
 	m.Package.Snapshot = snapshot
 	m.Package.Hash = fullHash
+	m.Package.Fips = fips
 
 	versionedHomePath := path.Join("data", fmt.Sprintf("%s-%s", beatName, shortHash))
 	m.Package.VersionedHome = versionedHomePath
diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index e9cbb64044e..c236682930b 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -302,7 +302,7 @@ shared:
       /var/lib/{{.BeatName}}/data/{{.BeatName}}-{{agent_package_version}}{{snapshot_suffix}}-{{ commit_short }}/manifest.yaml:
         mode: 0644
         content: >
-          {{ manifest }}
+          {{ manifest .fips }}
 
   - &linux_otel_files
     'otelcol':
@@ -347,7 +347,7 @@ shared:
     'manifest.yaml':
       mode: 0644
       content: >
-        {{ manifest }}
+        {{ manifest .fips }}
 
   - &agent_binary_files
     '{{.BeatName}}{{.BinaryExt}}':

From 0316195eb040d48c8408ca5f8a39aa87f4861cc7 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Sat, 5 Apr 2025 07:52:38 +0200
Subject: [PATCH 20/42] fixup! Write spec FIPS flag into manifest.yaml when
 packaging

---
 testing/integration/upgrade_standalone_same_commit_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/integration/upgrade_standalone_same_commit_test.go b/testing/integration/upgrade_standalone_same_commit_test.go
index 3d508f44a81..337be4dda39 100644
--- a/testing/integration/upgrade_standalone_same_commit_test.go
+++ b/testing/integration/upgrade_standalone_same_commit_test.go
@@ -368,7 +368,7 @@ func generateNewManifestContent(t *testing.T, manifestReader io.Reader, newVersi
 	t.Logf("read old manifest: %+v", oldManifest)
 
 	// replace manifest content
-	newManifest, err := mage.GeneratePackageManifest("elastic-agent", newVersion.String(), oldManifest.Package.Snapshot, oldManifest.Package.Hash, oldManifest.Package.Hash[:6], nil)
+	newManifest, err := mage.GeneratePackageManifest("elastic-agent", newVersion.String(), oldManifest.Package.Snapshot, oldManifest.Package.Hash, oldManifest.Package.Hash[:6], oldManifest.Package.Fips, nil)
 	require.NoErrorf(t, err, "GeneratePackageManifest(%v, %v, %v, %v, %v) failed", newVersion.String(), oldManifest.Package.Snapshot, oldManifest.Package.Hash, oldManifest.Package.Hash[:6], nil)
 
 	t.Logf("generated new manifest:\n%s", newManifest)

From 0c1aa5850c4abe221885f9f4ebfa009f395b3b2a Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 11:58:32 +0200
Subject: [PATCH 21/42] Add FIPS elastic agent absic and cloud docker images

---
 dev-tools/mage/dockerbuilder.go             |  4 +-
 dev-tools/packaging/packages.yml            | 95 +++++++++++++++++++++
 dev-tools/packaging/testing/package_test.go | 10 ++-
 3 files changed, 103 insertions(+), 6 deletions(-)

diff --git a/dev-tools/mage/dockerbuilder.go b/dev-tools/mage/dockerbuilder.go
index 8bc7498d9f5..627c665bbcb 100644
--- a/dev-tools/mage/dockerbuilder.go
+++ b/dev-tools/mage/dockerbuilder.go
@@ -227,9 +227,7 @@ func (b *dockerBuilder) dockerBuild() (string, []string, error) {
 	if b.Snapshot {
 		mainTag = mainTag + "-SNAPSHOT"
 	}
-	if b.FIPS {
-		mainTag = mainTag + "-fips"
-	}
+
 	if repository := b.ExtraVars["repository"]; repository != "" {
 		mainTag = fmt.Sprintf("%s/%s", repository, mainTag)
 	}
diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index c236682930b..6b41731e4c9 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -473,11 +473,17 @@ shared:
     docker_variant: 'wolfi'
     extra_vars:
       from: '--platform=linux/amd64 cgr.dev/chainguard/wolfi-base'
+
   - &docker_wolfi_arm_spec
     docker_variant: 'wolfi'
     extra_vars:
       from: '--platform=linux/arm64 cgr.dev/chainguard/wolfi-base'
 
+  - &docker_fips_spec
+    docker_variant: 'basic'
+    extra_vars:
+      from: 'docker.elastic.co/wolfi/chainguard-base-fips:latest'
+
   - &docker_elastic_spec
     extra_vars:
       repository: 'docker.elastic.co/elastic-agent'
@@ -507,6 +513,27 @@ shared:
         source: '{{ repo.RootDir }}/deploy/kubernetes/elastic-agent-standalone/templates.d'
         mode: 0755
 
+  - &agent_docker_fips_spec
+    <<: *agent_binary_fips_spec
+    extra_vars:
+      dockerfile: 'Dockerfile.elastic-agent.tmpl'
+      docker_entrypoint: 'docker-entrypoint.elastic-agent.tmpl'
+      user: '{{ .BeatName }}'
+      linux_capabilities: ''
+      beats_install_path: "install"
+    files:
+      'elastic-agent.yml':
+        source: 'elastic-agent.docker.yml'
+        mode: 0600
+        config: true
+      '.elastic-agent.active.commit':
+        content: >
+          {{ commit }}
+        mode: 0644
+      'hints.inputs.d':
+        source: '{{ repo.RootDir }}/deploy/kubernetes/elastic-agent-standalone/templates.d'
+        mode: 0755
+
   # cloud build to beats-ci repository
   - &agent_docker_cloud_spec
     docker_variant: 'cloud'
@@ -523,6 +550,21 @@ shared:
         source: '{{.AgentDropPath}}/archives/{{.GOOS}}-{{.AgentArchName}}.tar.gz/agentbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz'
         mode: 0755
 
+  - &agent_docker_cloud_fips_spec
+    docker_variant: 'cloud'
+    extra_vars:
+      repository: 'docker.elastic.co/beats-ci'
+    files:
+      'data/cloud_downloads/filebeat.sh':
+        source: '{{ elastic_beats_dir }}/dev-tools/packaging/files/linux/filebeat.sh'
+        mode: 0755
+      'data/cloud_downloads/metricbeat.sh':
+        source: '{{ elastic_beats_dir }}/dev-tools/packaging/files/linux/metricbeat.sh'
+        mode: 0755
+      'data/cloud_downloads/agentbeat-fips-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz':
+        source: '{{.AgentDropPath}}/archives/{{.GOOS}}-{{.AgentArchName}}.tar.gz/agentbeat-fips-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz'
+        mode: 0755
+
   # service build is based on previous cloud variant
   - &agent_docker_service_spec
     docker_variant: 'service'
@@ -1496,6 +1538,59 @@ specs:
             source: data/{{.BeatName}}-{{ commit_short }}/{{.BeatName}}{{.BinaryExt}}
             symlink: true
             mode: 0755
+
+    - os: linux
+      arch: amd64
+      types: [ docker ]
+      spec:
+        <<: *docker_fips_spec
+        <<: *docker_builder_spec
+        <<: *agent_docker_fips_spec
+        <<: *docker_elastic_spec
+        <<: *elastic_license_for_binaries
+        files:
+          '{{.BeatName}}{{.BinaryExt}}':
+            source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
+
+    - os: linux
+      arch: arm64
+      types: [ docker ]
+      spec:
+        <<: *docker_fips_spec
+        <<: *docker_builder_arm_spec
+        <<: *agent_docker_fips_spec
+        <<: *docker_elastic_spec
+        <<: *elastic_license_for_binaries
+        files:
+          '{{.BeatName}}{{.BinaryExt}}':
+            source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
+
+    - os: linux
+      arch: amd64
+      types: [ docker ]
+      spec:
+        <<: *docker_fips_spec
+        <<: *agent_docker_fips_spec
+        # The cloud image is always based on Wolfi
+        <<: *docker_builder_spec
+        <<: *agent_docker_cloud_fips_spec
+        <<: *elastic_license_for_binaries
+        files:
+          '{{.BeatName}}{{.BinaryExt}}':
+            source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
+    - os: linux
+      arch: arm64
+      types: [ docker ]
+      spec:
+        <<: *agent_docker_spec
+        # The cloud image is always based on Wolfi
+        <<: *docker_wolfi_arm_spec
+        <<: *docker_builder_arm_spec
+        <<: *agent_docker_cloud_fips_spec
+        <<: *elastic_license_for_binaries
+        files:
+          '{{.BeatName}}{{.BinaryExt}}':
+            source: ./build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}}
     ######## End FIPS Specs ########
 
   # Elastic Beat with Elastic License and binary taken from the x-pack dir.
diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index b77c15831ad..d045fb7b11e 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -118,8 +118,9 @@ func TestDocker(t *testing.T) {
 	dockers := getFiles(t, regexp.MustCompile(`\.docker\.tar\.gz$`))
 	sizeMap := make(map[string]int64)
 	for _, docker := range dockers {
+		fipsPackage := strings.Contains(docker, "-fips-")
 		t.Log(docker)
-		k, s := checkDocker(t, docker)
+		k, s := checkDocker(t, docker, fipsPackage)
 		sizeMap[k] = s
 	}
 
@@ -341,7 +342,7 @@ func checkNpcapNotices(pkg, file string, contents io.Reader) error {
 	return nil
 }
 
-func checkDocker(t *testing.T, file string) (string, int64) {
+func checkDocker(t *testing.T, file string, fipsPackage bool) (string, int64) {
 	if strings.Contains(file, "elastic-otel-collector") {
 		return checkEdotCollectorDocker(t, file)
 	}
@@ -356,7 +357,10 @@ func checkDocker(t *testing.T, file string) (string, int64) {
 	checkDockerLabels(t, p, info, file)
 	checkDockerUser(t, p, info, *rootUserContainer)
 	checkFilePermissions(t, p, configFilePattern, os.FileMode(0644))
-	checkFilePermissions(t, p, otelcolScriptPattern, os.FileMode(0755))
+	if !fipsPackage {
+		// FIPS docker image do not contain an otelcol script, run this check only on non FIPS compliant images
+		checkFilePermissions(t, p, otelcolScriptPattern, os.FileMode(0755))
+	}
 	checkManifestPermissionsWithMode(t, p, os.FileMode(0644))
 	checkModulesPresent(t, "", p)
 	checkModulesDPresent(t, "", p)

From 9ea7006b7ee5dafdb079469f774bef9d3367f704 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 12:56:35 +0200
Subject: [PATCH 22/42] fixup! Add FIPS elastic agent absic and cloud docker
 images

---
 dev-tools/packaging/packages.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index 6b41731e4c9..52bbbc5f4ad 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -1582,9 +1582,9 @@ specs:
       arch: arm64
       types: [ docker ]
       spec:
-        <<: *agent_docker_spec
+        <<: *docker_fips_spec
+        <<: *agent_docker_fips_spec
         # The cloud image is always based on Wolfi
-        <<: *docker_wolfi_arm_spec
         <<: *docker_builder_arm_spec
         <<: *agent_docker_cloud_fips_spec
         <<: *elastic_license_for_binaries

From 4cf8d4fac717b430eea78899d4a1159d249d1e4f Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 13:04:00 +0200
Subject: [PATCH 23/42] Build FIPS docker images in CI packaging

---
 .buildkite/integration.pipeline.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.buildkite/integration.pipeline.yml b/.buildkite/integration.pipeline.yml
index f3de81d4eac..9c73c3b43cd 100644
--- a/.buildkite/integration.pipeline.yml
+++ b/.buildkite/integration.pipeline.yml
@@ -28,7 +28,7 @@ steps:
       - label: "Packaging: Ubuntu x86_64 FIPS"
         key: "packaging-ubuntu-x86-64-fips"
         env:
-          PACKAGES: "tar.gz"
+          PACKAGES: "tar.gz,docker"
           PLATFORMS: "linux/amd64"
           FIPS: "true"
         command: ".buildkite/scripts/steps/integration-package.sh"
@@ -61,7 +61,7 @@ steps:
       - label: "Packaging: Ubuntu arm64 FIPS"
         key: "packaging-ubuntu-arm64-fips"
         env:
-          PACKAGES: "tar.gz"
+          PACKAGES: "tar.gz,docker"
           PLATFORMS: "linux/arm64"
           FIPS: "true"
         command: ".buildkite/scripts/steps/integration-package.sh"

From ec5906b1f99107581ea6bfcd39ffa9f7e68a7aba Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 13:13:24 +0200
Subject: [PATCH 24/42] fixup! Build FIPS docker images in CI packaging

---
 .buildkite/integration.pipeline.yml | 34 +++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/.buildkite/integration.pipeline.yml b/.buildkite/integration.pipeline.yml
index 9c73c3b43cd..520323156e3 100644
--- a/.buildkite/integration.pipeline.yml
+++ b/.buildkite/integration.pipeline.yml
@@ -28,7 +28,7 @@ steps:
       - label: "Packaging: Ubuntu x86_64 FIPS"
         key: "packaging-ubuntu-x86-64-fips"
         env:
-          PACKAGES: "tar.gz,docker"
+          PACKAGES: "tar.gz"
           PLATFORMS: "linux/amd64"
           FIPS: "true"
         command: ".buildkite/scripts/steps/integration-package.sh"
@@ -61,7 +61,7 @@ steps:
       - label: "Packaging: Ubuntu arm64 FIPS"
         key: "packaging-ubuntu-arm64-fips"
         env:
-          PACKAGES: "tar.gz,docker"
+          PACKAGES: "tar.gz"
           PLATFORMS: "linux/arm64"
           FIPS: "true"
         command: ".buildkite/scripts/steps/integration-package.sh"
@@ -118,6 +118,36 @@ steps:
           imagePrefix: "core-ubuntu-2204-aarch64"
           diskSizeGb: 200
 
+      - label: "Packaging: Containers linux/amd64 FIPS"
+        key: packaging-containers-x86-64
+        env:
+          PACKAGES: "docker"
+          PLATFORMS: "linux/amd64"
+          FIPS: "true"
+        command: ".buildkite/scripts/steps/integration-package.sh"
+        artifact_paths:
+          - build/distributions/**
+        agents:
+          provider: "gcp"
+          machineType: "n2-standard-8"
+          diskSizeGb: 200
+
+      - label: "Packaging: Containers linux/arm64 FIPS"
+        key: packaging-containers-arm64
+        env:
+          PACKAGES: "docker"
+          PLATFORMS: "linux/arm64"
+          FIPS: "true"
+        command: |
+          .buildkite/scripts/steps/integration-package.sh
+        artifact_paths:
+          - build/distributions/**
+        agents:
+          provider: "aws"
+          instanceType: "c6g.4xlarge"
+          imagePrefix: "core-ubuntu-2204-aarch64"
+          diskSizeGb: 200
+
   - label: "Serverless integration test"
     key: "serverless-integration-tests"
     depends_on:

From 72430dc524ab5965de7d89c14b5a7667aed6c811 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 13:16:28 +0200
Subject: [PATCH 25/42] fixup! fixup! Build FIPS docker images in CI packaging

---
 .buildkite/integration.pipeline.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.buildkite/integration.pipeline.yml b/.buildkite/integration.pipeline.yml
index 520323156e3..e4f09c24735 100644
--- a/.buildkite/integration.pipeline.yml
+++ b/.buildkite/integration.pipeline.yml
@@ -119,7 +119,7 @@ steps:
           diskSizeGb: 200
 
       - label: "Packaging: Containers linux/amd64 FIPS"
-        key: packaging-containers-x86-64
+        key: packaging-containers-x86-64-fips
         env:
           PACKAGES: "docker"
           PLATFORMS: "linux/amd64"
@@ -133,7 +133,7 @@ steps:
           diskSizeGb: 200
 
       - label: "Packaging: Containers linux/arm64 FIPS"
-        key: packaging-containers-arm64
+        key: packaging-containers-arm64-fips
         env:
           PACKAGES: "docker"
           PLATFORMS: "linux/arm64"

From d7665bbfd4b44151d6e690da2526bc8a106b7925 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 13:45:07 +0200
Subject: [PATCH 26/42] Fix FIPS .tar.gz package tests

---
 dev-tools/packaging/testing/package_test.go | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index d045fb7b11e..0eb7da7a0fd 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -93,17 +93,10 @@ func TestDeb(t *testing.T) {
 
 func TestTar(t *testing.T) {
 	// Regexp matches *-arch.tar.gz, but not *-arch.docker.tar.gz
-	tars := getFiles(t, regexp.MustCompile(`-\w+\.tar\.gz$`))
-	for _, tar := range tars {
-		checkTar(t, tar, false)
-	}
-}
-
-func TestFIPSTar(t *testing.T) {
-	// Regexp matches *-arch-fips.tar.gz, but not *-arch.docker.tar.gz
-	tars := getFiles(t, regexp.MustCompile(`-\w+-fips\.tar\.gz$`))
-	for _, tar := range tars {
-		checkTar(t, tar, *fips)
+	tarFiles := getFiles(t, regexp.MustCompile(`-\w+\.tar\.gz$`))
+	for _, tarFile := range tarFiles {
+		fipsPackage := strings.Contains(tarFile, "-fips-")
+		checkTar(t, tarFile, fipsPackage)
 	}
 }
 

From 8b3b3d1b7b5d174a540e0598a18dc8dc66d2462b Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 14:26:07 +0200
Subject: [PATCH 27/42] Restructure package tests

---
 dev-tools/packaging/testing/package_test.go | 53 +++++++++++++--------
 1 file changed, 32 insertions(+), 21 deletions(-)

diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index 0eb7da7a0fd..0c4d4f7f5ce 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -79,7 +79,9 @@ var (
 func TestRPM(t *testing.T) {
 	rpms := getFiles(t, regexp.MustCompile(`\.rpm$`))
 	for _, rpm := range rpms {
-		checkRPM(t, rpm)
+		t.Run(filepath.Base(rpm), func(t *testing.T) {
+			checkRPM(t, rpm)
+		})
 	}
 }
 
@@ -87,7 +89,9 @@ func TestDeb(t *testing.T) {
 	debs := getFiles(t, regexp.MustCompile(`\.deb$`))
 	buf := new(bytes.Buffer)
 	for _, deb := range debs {
-		checkDeb(t, deb, buf)
+		t.Run(filepath.Base(deb), func(t *testing.T) {
+			checkDeb(t, deb, buf)
+		})
 	}
 }
 
@@ -95,15 +99,20 @@ func TestTar(t *testing.T) {
 	// Regexp matches *-arch.tar.gz, but not *-arch.docker.tar.gz
 	tarFiles := getFiles(t, regexp.MustCompile(`-\w+\.tar\.gz$`))
 	for _, tarFile := range tarFiles {
-		fipsPackage := strings.Contains(tarFile, "-fips-")
-		checkTar(t, tarFile, fipsPackage)
+		t.Run(filepath.Base(tarFile), func(t *testing.T) {
+			fipsPackage := strings.Contains(tarFile, "-fips-")
+			checkTar(t, tarFile, fipsPackage)
+		})
+
 	}
 }
 
 func TestZip(t *testing.T) {
 	zips := getFiles(t, regexp.MustCompile(`^\w+\S+.zip$`))
 	for _, zip := range zips {
-		checkZip(t, zip)
+		t.Run(filepath.Base(zip), func(t *testing.T) {
+			checkZip(t, zip)
+		})
 	}
 }
 
@@ -112,9 +121,11 @@ func TestDocker(t *testing.T) {
 	sizeMap := make(map[string]int64)
 	for _, docker := range dockers {
 		fipsPackage := strings.Contains(docker, "-fips-")
-		t.Log(docker)
-		k, s := checkDocker(t, docker, fipsPackage)
-		sizeMap[k] = s
+		t.Run(filepath.Base(docker), func(t *testing.T) {
+			t.Log(docker)
+			k, s := checkDocker(t, docker, fipsPackage)
+			sizeMap[k] = s
+		})
 	}
 
 	if len(dockers) == 0 {
@@ -213,7 +224,7 @@ func checkTar(t *testing.T, file string, fipsCheck bool) {
 	checkModulesOwner(t, p, true)
 	checkLicensesPresent(t, "", p)
 
-	t.Run(p.Name+"_check_manifest_file", testManifestFile(file, fipsCheck))
+	t.Run("check_manifest_file", testManifestFile(file, fipsCheck))
 
 	checkSha512PackageHash(t, file)
 }
@@ -232,7 +243,7 @@ func checkZip(t *testing.T, file string) {
 	checkModulesPermissions(t, p)
 	checkLicensesPresent(t, "", p)
 
-	t.Run(p.Name+"_check_manifest_file", testManifestFile(file, false))
+	t.Run("check_manifest_file", testManifestFile(file, false))
 
 	checkSha512PackageHash(t, file)
 }
@@ -420,7 +431,7 @@ func checkConfigPermissions(t *testing.T, p *packageFile) {
 }
 
 func checkFilePermissions(t *testing.T, p *packageFile, configPattern *regexp.Regexp, expectedMode os.FileMode) {
-	t.Run(p.Name+" file permissions", func(t *testing.T) {
+	t.Run("file permissions", func(t *testing.T) {
 		for _, entry := range p.Contents {
 			if configPattern.MatchString(entry.File) {
 				mode := entry.Mode.Perm()
@@ -449,7 +460,7 @@ func checkOwner(t *testing.T, entry packageEntry, expectRoot bool) {
 }
 
 func checkConfigOwner(t *testing.T, p *packageFile, expectRoot bool) {
-	t.Run(p.Name+" config file owner", func(t *testing.T) {
+	t.Run("config file owner", func(t *testing.T) {
 		for _, entry := range p.Contents {
 			if configFilePattern.MatchString(entry.File) {
 				checkOwner(t, entry, expectRoot)
@@ -466,7 +477,7 @@ func checkManifestPermissions(t *testing.T, p *packageFile) {
 }
 
 func checkManifestPermissionsWithMode(t *testing.T, p *packageFile, expectedMode os.FileMode) {
-	t.Run(p.Name+" manifest file permissions", func(t *testing.T) {
+	t.Run("manifest file permissions", func(t *testing.T) {
 		for _, entry := range p.Contents {
 			if manifestFilePattern.MatchString(entry.File) {
 				mode := entry.Mode.Perm()
@@ -481,7 +492,7 @@ func checkManifestPermissionsWithMode(t *testing.T, p *packageFile, expectedMode
 
 // Verify that the manifest owner is correct.
 func checkManifestOwner(t *testing.T, p *packageFile, expectRoot bool) {
-	t.Run(p.Name+" manifest file owner", func(t *testing.T) {
+	t.Run("manifest file owner", func(t *testing.T) {
 		for _, entry := range p.Contents {
 			if manifestFilePattern.MatchString(entry.File) {
 				checkOwner(t, entry, expectRoot)
@@ -492,7 +503,7 @@ func checkManifestOwner(t *testing.T, p *packageFile, expectRoot bool) {
 
 // Verify the permissions of the modules.d dir and its contents.
 func checkModulesPermissions(t *testing.T, p *packageFile) {
-	t.Run(p.Name+" modules.d file permissions", func(t *testing.T) {
+	t.Run("modules.d file permissions", func(t *testing.T) {
 		for _, entry := range p.Contents {
 			if modulesDFilePattern.MatchString(entry.File) {
 				mode := entry.Mode.Perm()
@@ -513,7 +524,7 @@ func checkModulesPermissions(t *testing.T, p *packageFile) {
 
 // Verify the owner of the modules.d dir and its contents.
 func checkModulesOwner(t *testing.T, p *packageFile, expectRoot bool) {
-	t.Run(p.Name+" modules.d file owner", func(t *testing.T) {
+	t.Run("modules.d file owner", func(t *testing.T) {
 		for _, entry := range p.Contents {
 			if modulesDFilePattern.MatchString(entry.File) || modulesDDirPattern.MatchString(entry.File) {
 				checkOwner(t, entry, expectRoot)
@@ -526,7 +537,7 @@ func checkModulesOwner(t *testing.T, p *packageFile, expectRoot bool) {
 // executable.
 func checkSystemdUnitPermissions(t *testing.T, p *packageFile) {
 	const expectedMode = os.FileMode(0644)
-	t.Run(p.Name+" systemd unit file permissions", func(t *testing.T) {
+	t.Run("systemd unit file permissions", func(t *testing.T) {
 		for _, entry := range p.Contents {
 			if systemdUnitFilePattern.MatchString(entry.File) {
 				mode := entry.Mode.Perm()
@@ -629,7 +640,7 @@ func checkLicensesPresent(t *testing.T, prefix string, p *packageFile) {
 func checkDockerEntryPoint(t *testing.T, p *packageFile, info *dockerInfo) {
 	expectedMode := os.FileMode(0755)
 
-	t.Run(fmt.Sprintf("%s entrypoint", p.Name), func(t *testing.T) {
+	t.Run("entrypoint", func(t *testing.T) {
 		if len(info.Config.Entrypoint) == 0 {
 			t.Fatal("no entrypoint")
 		}
@@ -656,7 +667,7 @@ func checkDockerLabels(t *testing.T, p *packageFile, info *dockerInfo, file stri
 		return
 	}
 
-	t.Run(fmt.Sprintf("%s license labels", p.Name), func(t *testing.T) {
+	t.Run("license labels", func(t *testing.T) {
 		expectedLicense := "Elastic License"
 		ossPrefix := strings.Join([]string{
 			info.Config.Labels["org.label-schema.name"],
@@ -677,7 +688,7 @@ func checkDockerLabels(t *testing.T, p *packageFile, info *dockerInfo, file stri
 		}
 	})
 
-	t.Run(fmt.Sprintf("%s required labels", p.Name), func(t *testing.T) {
+	t.Run("required labels", func(t *testing.T) {
 		// From https://redhat-connect.gitbook.io/partner-guide-for-red-hat-openshift-and-container/program-on-boarding/technical-prerequisites
 		requiredLabels := []string{"name", "vendor", "version", "release", "summary", "description"}
 		for _, label := range requiredLabels {
@@ -689,7 +700,7 @@ func checkDockerLabels(t *testing.T, p *packageFile, info *dockerInfo, file stri
 }
 
 func checkDockerUser(t *testing.T, p *packageFile, info *dockerInfo, expectRoot bool) {
-	t.Run(fmt.Sprintf("%s user", p.Name), func(t *testing.T) {
+	t.Run("user", func(t *testing.T) {
 		if expectRoot != (info.Config.User == rootUser) {
 			t.Errorf("unexpected docker user: %s", info.Config.User)
 		}

From 4635764829447c4f822026a959360c77178b0c6d Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 15:47:24 +0200
Subject: [PATCH 28/42] Extend FIPS check to all binaries in components
 directory

---
 dev-tools/mage/pkg.go                       |   4 -
 dev-tools/packaging/testing/package_test.go | 124 ++++++++++++--------
 2 files changed, 77 insertions(+), 51 deletions(-)

diff --git a/dev-tools/mage/pkg.go b/dev-tools/mage/pkg.go
index 6de7cc1df0e..3e2fde3ba1d 100644
--- a/dev-tools/mage/pkg.go
+++ b/dev-tools/mage/pkg.go
@@ -266,10 +266,6 @@ func TestPackages(options ...TestPackagesOption) error {
 		args = append(args, "-root-owner")
 	}
 
-	if FIPSBuild {
-		args = append(args, "-fips")
-	}
-
 	args = append(args, "-files", MustExpand("{{.PWD}}/build/distributions/*"))
 
 	if out, err := goTest(args...); err != nil {
diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index 0c4d4f7f5ce..55ae25ea61d 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -224,9 +224,20 @@ func checkTar(t *testing.T, file string, fipsCheck bool) {
 	checkModulesOwner(t, p, true)
 	checkLicensesPresent(t, "", p)
 
-	t.Run("check_manifest_file", testManifestFile(file, fipsCheck))
+	// extract archive in a temporary directory
+	tempExtractionPath := t.TempDir()
+	err = mage.Extract(file, tempExtractionPath)
+	require.NoErrorf(t, err, "error extracting archive %q", file)
+
+	t.Run("check_manifest_file", testManifestFile(tempExtractionPath, fipsCheck))
 
 	checkSha512PackageHash(t, file)
+
+	if fipsCheck {
+		t.Run("FIPS check", func(t *testing.T) {
+			checkFIPS(t, tempExtractionPath)
+		})
+	}
 }
 
 func checkZip(t *testing.T, file string) {
@@ -248,19 +259,13 @@ func checkZip(t *testing.T, file string) {
 	checkSha512PackageHash(t, file)
 }
 
-func testManifestFile(file string, checkFips bool) func(t *testing.T) {
+func testManifestFile(agentPackageRootDir string, checkFips bool) func(t *testing.T) {
 	return func(t *testing.T) {
-		tempExtractionPath := t.TempDir()
-		err := mage.Extract(file, tempExtractionPath)
-		require.NoErrorf(t, err, "error extracting archive %q", file)
-		dirEntries, err := os.ReadDir(tempExtractionPath)
-		require.NoErrorf(t, err, "error listing extraction dir %q", tempExtractionPath)
-		require.Lenf(t, dirEntries, 1, "archive %q should contain a single directory", file)
+		dirEntries, err := os.ReadDir(agentPackageRootDir)
+		require.NoErrorf(t, err, "error listing extraction dir %q", agentPackageRootDir)
+		require.Lenf(t, dirEntries, 1, "archive should contain a single directory: found %v", dirEntries)
 		containingDir := dirEntries[0].Name()
-		checkManifestFileContents(t, filepath.Join(tempExtractionPath, containingDir))
-		if checkFips {
-			checkFIPS(t, filepath.Join(tempExtractionPath, containingDir))
-		}
+		checkManifestFileContents(t, filepath.Join(agentPackageRootDir, containingDir))
 	}
 }
 
@@ -707,53 +712,78 @@ func checkDockerUser(t *testing.T, p *packageFile, info *dockerInfo, expectRoot
 	})
 }
 
-func checkFIPS(t *testing.T, extractedPackageDir string) {
+func checkFIPS(t *testing.T, agentPackageRootDir string) {
+	dirEntries, err := os.ReadDir(agentPackageRootDir)
+	require.NoErrorf(t, err, "error listing extraction dir %q", agentPackageRootDir)
+	require.Lenf(t, dirEntries, 1, "archive should contain a single directory: found %v", dirEntries)
+
+	extractedPackageDir := filepath.Join(agentPackageRootDir, dirEntries[0].Name())
 	t.Logf("Checking agent binary in %q for FIPS compliance", extractedPackageDir)
 	m := parseManifest(t, extractedPackageDir)
 	versionedHome := m.Package.VersionedHome
-	require.DirExistsf(t, filepath.Join(extractedPackageDir, versionedHome), " versiondedHome directory %q not found in %q", versionedHome, extractedPackageDir)
+	versionedHomePath := filepath.Join(extractedPackageDir, versionedHome)
+	require.DirExistsf(t, versionedHomePath, " versiondedHome directory %q not found in %q", versionedHome, extractedPackageDir)
 	binaryPath := filepath.Join(extractedPackageDir, versionedHome, "elastic-agent") // TODO eventually we will need to support .exe as well
 	require.FileExistsf(t, binaryPath, "Unable to find elastic-agent executable in versioned home in %q", extractedPackageDir)
 
-	info, err := buildinfo.ReadFile(binaryPath)
+	binaries := []string{binaryPath}
+	componentsDir := filepath.Join(versionedHomePath, "components")
+	entries, err := filepath.Glob(filepath.Join(componentsDir, "*.spec.yml"))
 	require.NoError(t, err)
+	for _, dirEntry := range entries {
+		componentBinary := strings.TrimSuffix(dirEntry, ".spec.yml")
+		binaries = append(binaries, componentBinary)
+	}
+
+	for _, binary := range binaries {
+		binaryRelPath, err := filepath.Rel(agentPackageRootDir, binary)
+		require.NoError(t, err)
+		t.Run(binaryRelPath, func(t *testing.T) {
+			fileInfo, err := os.Stat(binary)
+			require.NoErrorf(t, err, "error collecting info on component %s", binary)
+			require.Truef(t, fileInfo.Mode().IsRegular() && (fileInfo.Mode().Perm()&0111 > 0), "component %s exists and has a spec file but it's not an executable regular file", binary)
+
+			info, err := buildinfo.ReadFile(binary)
+			require.NoError(t, err)
+
+			foundTags := false
+			foundExperiment := false
+			for _, setting := range info.Settings {
+				switch setting.Key {
+				case "-tags":
+					foundTags = true
+					require.Contains(t, setting.Value, "requirefips")
+					continue
+				case "GOEXPERIMENT":
+					foundExperiment = true
+					require.Contains(t, setting.Value, "systemcrypto")
+					continue
+				}
+			}
 
-	foundTags := false
-	foundExperiment := false
-	for _, setting := range info.Settings {
-		switch setting.Key {
-		case "-tags":
-			foundTags = true
-			require.Contains(t, setting.Value, "requirefips")
-			continue
-		case "GOEXPERIMENT":
-			foundExperiment = true
-			require.Contains(t, setting.Value, "systemcrypto")
-			continue
-		}
-	}
-
-	require.True(t, foundTags, "Did not find -tags within binary version information")
-	require.True(t, foundExperiment, "Did not find GOEXPERIMENT within binary version information")
+			require.True(t, foundTags, "Did not find -tags within binary version information")
+			require.True(t, foundExperiment, "Did not find GOEXPERIMENT within binary version information")
 
-	// TODO only elf is supported at the moment, in the future we will need to use macho (darwin) and pe (windows)
-	f, err := elf.Open(binaryPath)
-	require.NoError(t, err, "unable to open ELF file")
+			// TODO only elf is supported at the moment, in the future we will need to use macho (darwin) and pe (windows)
+			f, err := elf.Open(binary)
+			require.NoError(t, err, "unable to open ELF file")
 
-	symbols, err := f.Symbols()
-	if err != nil {
-		t.Logf("no symbols present in %q: %v", binaryPath, err)
-		return
-	}
+			symbols, err := f.Symbols()
+			if err != nil {
+				t.Logf("no symbols present in %q: %v", binary, err)
+				return
+			}
 
-	hasOpenSSL := false
-	for _, symbol := range symbols {
-		if strings.Contains(symbol.Name, "OpenSSL_version") {
-			hasOpenSSL = true
-			break
-		}
+			hasOpenSSL := false
+			for _, symbol := range symbols {
+				if strings.Contains(symbol.Name, "OpenSSL_version") {
+					hasOpenSSL = true
+					break
+				}
+			}
+			require.True(t, hasOpenSSL, "unable to find OpenSSL_version symbol")
+		})
 	}
-	require.True(t, hasOpenSSL, "unable to find OpenSSL_version symbol")
 }
 
 // ensureNoBuildIDLinks checks for regressions related to

From cbd4b9ecf7b164ca440423f1bf2a7f83f0bd30b1 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 15:47:45 +0200
Subject: [PATCH 29/42] fixup! Restructure package tests

---
 dev-tools/packaging/testing/package_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index 55ae25ea61d..75376a98c37 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -578,7 +578,7 @@ func checkMonitorsDPresent(t *testing.T, prefix string, p *packageFile) {
 }
 
 func checkHintsInputsD(t *testing.T, name string, r *regexp.Regexp, p *packageFile) {
-	t.Run(fmt.Sprintf("%s %s contents", p.Name, name), func(t *testing.T) {
+	t.Run(fmt.Sprintf("%s contents", name), func(t *testing.T) {
 		total := 0
 		for _, entry := range p.Contents {
 			if r.MatchString(entry.File) {

From 1ec60879af0cf2cebe1cbc83eea1e2b9c007cacd Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 15:55:23 +0200
Subject: [PATCH 30/42] fixup! fixup! Restructure package tests

---
 dev-tools/packaging/testing/package_test.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index 75376a98c37..1174cf9b265 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -73,7 +73,6 @@ var (
 	monitorsd         = flag.Bool("monitors.d", false, "check monitors.d folder contents")
 	rootOwner         = flag.Bool("root-owner", false, "expect root to own package files")
 	rootUserContainer = flag.Bool("root-user-container", false, "expect root in container user")
-	fips              = flag.Bool("fips", false, "check agent binary for FIPS compliance")
 )
 
 func TestRPM(t *testing.T) {

From 605293f24c85be4eee1553fd8653a4df193cf194 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 16:23:52 +0200
Subject: [PATCH 31/42] fixup! Extend FIPS check to all binaries in components
 directory

---
 dev-tools/packaging/testing/package_test.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dev-tools/packaging/testing/package_test.go b/dev-tools/packaging/testing/package_test.go
index 1174cf9b265..04162688794 100644
--- a/dev-tools/packaging/testing/package_test.go
+++ b/dev-tools/packaging/testing/package_test.go
@@ -253,7 +253,12 @@ func checkZip(t *testing.T, file string) {
 	checkModulesPermissions(t, p)
 	checkLicensesPresent(t, "", p)
 
-	t.Run("check_manifest_file", testManifestFile(file, false))
+	// extract archive in a temporary directory
+	tempExtractionPath := t.TempDir()
+	err = mage.Extract(file, tempExtractionPath)
+	require.NoErrorf(t, err, "error extracting archive %q", file)
+
+	t.Run("check_manifest_file", testManifestFile(tempExtractionPath, false))
 
 	checkSha512PackageHash(t, file)
 }

From b5531d8a2e6ac07371f0950c0c5f5f4bd2ab8d07 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 17:31:10 +0200
Subject: [PATCH 32/42] Create FIPS elastic-agent-core artifacts in
 elastic-agent-binary-dra pipeline

---
 .../pipeline.elastic-agent-binary-dra.yml     | 61 ++++++++++++++++++-
 1 file changed, 60 insertions(+), 1 deletion(-)

diff --git a/.buildkite/pipeline.elastic-agent-binary-dra.yml b/.buildkite/pipeline.elastic-agent-binary-dra.yml
index 02bbffe3d07..3b6383140d5 100644
--- a/.buildkite/pipeline.elastic-agent-binary-dra.yml
+++ b/.buildkite/pipeline.elastic-agent-binary-dra.yml
@@ -25,7 +25,21 @@ steps:
       env:
         DRA_WORKFLOW: "snapshot"
         PLATFORMS: "linux/amd64 windows/amd64 darwin/amd64"
-    
+
+    - label: ":package: linux/amd64 FIPS Elastic-Agent Core Snapshot"
+      commands:
+        - .buildkite/scripts/steps/build-agent-core.sh
+      key: "build-dra-snapshot-x86-fips"
+      artifact_paths:
+        - "build/distributions/**/*"
+      agents:
+        provider: "gcp"
+        machineType: "c2-standard-16"
+      env:
+        DRA_WORKFLOW: "snapshot"
+        PLATFORMS: "linux/amd64"
+        FIPS: "true"
+
     - label: ":package: linux/arm64 darwin/arm64 Elastic-Agent Core Snapshot"
       commands:
         - .buildkite/scripts/steps/build-agent-core.sh
@@ -40,6 +54,20 @@ steps:
         DRA_WORKFLOW: "snapshot"
         PLATFORMS: "linux/arm64 darwin/arm64"
 
+    - label: ":package: linux/arm64 FIPS Elastic-Agent Core Snapshot"
+      commands:
+        - .buildkite/scripts/steps/build-agent-core.sh
+      key: "build-dra-snapshot-arm-fips"
+      artifact_paths:
+        - "build/distributions/**/*"
+      agents:
+        provider: "aws"
+        instanceType: "c6g.4xlarge"
+        imagePrefix: "core-ubuntu-2204-aarch64"
+      env:
+        DRA_WORKFLOW: "snapshot"
+        PLATFORMS: "linux/arm64"
+        FIPS: "true"
     - wait
 
     - label: ":hammer: DRA Publish Elastic-Agent Core Snapshot"
@@ -86,6 +114,21 @@ steps:
         DRA_WORKFLOW: "staging"
         PLATFORMS: "linux/amd64 windows/amd64 darwin/amd64"
 
+    - label: ":package: linux/amd64 FIPS Elastic-Agent Core staging"
+      commands: |
+        source .buildkite/scripts/version_qualifier.sh
+        .buildkite/scripts/steps/build-agent-core.sh
+      key: "build-dra-staging-x86-fips"
+      artifact_paths:
+        - "build/distributions/**/*"
+      agents:
+        provider: "gcp"
+        machineType: "c2-standard-16"
+      env:
+        DRA_WORKFLOW: "staging"
+        PLATFORMS: "linux/amd64"
+        FIPS: "true"
+
     - label: ":package: linux/arm64 darwin/arm64 Elastic-Agent Core staging"
       commands: |
         source .buildkite/scripts/version_qualifier.sh
@@ -101,6 +144,22 @@ steps:
         DRA_WORKFLOW: "dra-core-staging"
         PLATFORMS: "linux/arm64 darwin/arm64"
 
+    - label: ":package: linux/arm64 darwin/arm64 Elastic-Agent Core staging"
+      commands: |
+        source .buildkite/scripts/version_qualifier.sh
+        .buildkite/scripts/steps/build-agent-core.sh
+      key: "build-dra-staging-arm-fips"
+      artifact_paths:
+        - "build/distributions/**/*"
+      agents:
+        provider: "aws"
+        instanceType: "c6g.4xlarge"
+        imagePrefix: "core-ubuntu-2204-aarch64"
+      env:
+        DRA_WORKFLOW: "dra-core-staging"
+        PLATFORMS: "linux/arm64 darwin/arm64"
+        FIPS: "true"
+
     - wait
 
     - label: ":hammer: DRA Publish Elastic-Agent Core staging"

From 9335dc85b651c90008ef59f245d96992a24b7574 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 18:18:58 +0200
Subject: [PATCH 33/42] Cleanup ChecksumsWithManifest and improve godoc

---
 dev-tools/mage/checksums.go | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/dev-tools/mage/checksums.go b/dev-tools/mage/checksums.go
index 8311febe452..7d57c204a87 100644
--- a/dev-tools/mage/checksums.go
+++ b/dev-tools/mage/checksums.go
@@ -9,7 +9,6 @@ import (
 	"log"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/magefile/mage/mg"
 	"github.com/otiai10/copy"
@@ -41,7 +40,12 @@ func CopyComponentSpecs(componentName, versionedDropPath string) (string, error)
 	return GetSHA512Hash(targetPath)
 }
 
-// This is a helper function for flattenDependencies that's used when not packaging from a manifest
+// ChecksumsWithoutManifest is a helper function for flattenDependencies that's used when not packaging from a manifest.
+// This function will iterate over the dependencies, resolve *exactly* the package name for each dependency and platform using the passed
+// dependenciesVersion, and it will copy the extracted files contained in the rootDir of each dependency from the versionedFlatPath
+// (a directory containing all the extracted dependencies per platform) to the versionedDropPath (a drop path by platform
+// that will be used to compose the package content)
+// ChecksumsWithoutManifest will accumulate the checksums of each component spec that is copied, and return it to the caller.
 func ChecksumsWithoutManifest(platform string, dependenciesVersion string, versionedFlatPath string, versionedDropPath string, dependencies []packaging.BinarySpec) map[string]string {
 	checksums := make(map[string]string)
 
@@ -97,7 +101,13 @@ func ChecksumsWithoutManifest(platform string, dependenciesVersion string, versi
 	return checksums
 }
 
-// This is a helper function for flattenDependencies that's used when building from a manifest
+// ChecksumsWithManifest is a helper function for flattenDependencies that's used when building from a manifest.
+// This function will iterate over the dependencies, resolve the package name for each dependency and platform using the manifest,
+// (there may be some variability there in case the manifest does not include an exact match for the expected filename),
+// and it will copy the extracted files contained in the rootDir of each dependency from the versionedFlatPath
+// (a directory containing all the extracted dependencies per platform) to the versionedDropPath (a drop path by platform
+// that will be used to compose the package content)
+// ChecksumsWithManifest will accumulate the checksums of each component spec that is copied, and return it to the caller.
 func ChecksumsWithManifest(platform string, dependenciesVersion string, versionedFlatPath string, versionedDropPath string, manifestResponse *manifest.Build, dependencies []packaging.BinarySpec) map[string]string {
 	checksums := make(map[string]string)
 	if manifestResponse == nil {
@@ -129,17 +139,6 @@ func ChecksumsWithManifest(platform string, dependenciesVersion string, versione
 
 		rootDir := spec.GetRootDir(manifestPackage.ActualVersion, platform)
 
-		// fallback to extracting directory name from packageName
-		if rootDir == "" {
-			log.Printf("Could not find rootDir for %s/%s. Falling back to fileName %s", spec.ProjectName, spec.BinaryName, manifestPackage.Name)
-			rootDir = manifestPackage.Name
-			if strings.HasSuffix(rootDir, ".tar.gz") {
-				rootDir = strings.TrimSuffix(rootDir, ".tar.gz")
-			} else if strings.HasSuffix(rootDir, ".zip") {
-				rootDir = strings.TrimSuffix(rootDir, ".zip")
-			}
-		}
-
 		// Combine the package name w/ the versioned flat path
 		fullPath := filepath.Join(versionedFlatPath, rootDir)
 

From f6ac709024c4be4e2180a31ad4beb66dea06d0d5 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 18:22:39 +0200
Subject: [PATCH 34/42] Clarify debug variables

---
 dev-tools/mage/pkg.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dev-tools/mage/pkg.go b/dev-tools/mage/pkg.go
index 3e2fde3ba1d..2103305e48d 100644
--- a/dev-tools/mage/pkg.go
+++ b/dev-tools/mage/pkg.go
@@ -35,12 +35,12 @@ func Package() error {
 	platforms := Platforms
 
 	if mg.Verbose() {
-		packages := make([]string, 0, len(Packages))
+		debugSelectedPackageSpecsWithPlatform := make([]string, 0, len(Packages))
 		for _, p := range Packages {
-			packages = append(packages, fmt.Sprintf("spec %s on %s/%s", p.Spec.Name, p.OS, p.Arch))
+			debugSelectedPackageSpecsWithPlatform = append(debugSelectedPackageSpecsWithPlatform, fmt.Sprintf("spec %s on %s/%s", p.Spec.Name, p.OS, p.Arch))
 		}
 
-		log.Printf("Packaging for platforms %v, packages %v", platforms, packages)
+		log.Printf("Packaging for platforms %v, packages %v", platforms, debugSelectedPackageSpecsWithPlatform)
 	}
 
 	tasks := make(map[string][]interface{})

From 8f19e2ed1085b38627d6c4d226279916bd5865d7 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 18:26:04 +0200
Subject: [PATCH 35/42] Improve comments on components definitions

---
 dev-tools/packaging/packages.yml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index 52bbbc5f4ad..b5e86331dad 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -49,13 +49,13 @@ settings:
 
 # List *all* the components available for packaging in elastic-agent
 components:
-  # general template for new components
+  # general template for new components (all attributes are mandatory)
   #  - &comp-<anchor name>
   #    projectName: <project name under manifest>
   #    packageName: <template representing the name of the archive to download/extract>
   #    binaryName: <binary name>
   #    rootDir: <template representing directory from the archive root where the binary is located>
-  #    fips: <boolean indicating if this components whether FIPS compliant>
+  #    fips: <boolean indicating if this component is FIPS compliant>
   #    platforms:
   #      - <platform, use anchors for platforms above>
   #    pythonWheel: true # true if it's a package that is not platform specific
@@ -90,10 +90,11 @@ components:
   - &comp-connectors
     projectName: connectors
     packageName: connectors-{{.Version}}.zip
-    # FIXME: connectors use only <major>.<minor>.<patch> in the root directory name so the definition should be something like:
-    # rootDir: elasticsearch_connectors-{{beat_version}}
-    # We don't support that yet, so we are not gonna define a rootDir (not a problem since we don't extract the archive
-    # during packaging
+    # FIXME: connectors use only <major>.<minor>.<patch> in the root directory name so the definition should be something
+    # using the beat_version or similar
+    # We don't support that yet, so we are defining a rootDir that will error out if rendered. This isnot a problem since
+    # we don't extract/manipulate the archive during packaging but it has its own special handling in the 'service' docker image
+    rootDir: elasticsearch_connectors-{{beat_version}}
     binaryName: connectors
     platforms:
       - *linux-amd64

From 39e20b49a1b083ad36b631e4a442c95aa6a559e9 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 18:30:52 +0200
Subject: [PATCH 36/42] Improve godoc for BinarySpec

---
 dev-tools/packaging/settings.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/dev-tools/packaging/settings.go b/dev-tools/packaging/settings.go
index 90b611ff046..c0ef6a96c81 100644
--- a/dev-tools/packaging/settings.go
+++ b/dev-tools/packaging/settings.go
@@ -91,6 +91,9 @@ func (proj BinarySpec) SupportsPackageType(pkgType pkgcommon.PackageType) bool {
 	return false
 }
 
+// GetPackageName will return a rendered version of the BinarySpec.packageName attribute (which is a golang template),
+// using version and platform strings provided to create a template context containing 'Version', 'Platform' and 'Ext' values.
+// The string returned will contain the expected filename of the package file for the BinarySpec
 func (proj BinarySpec) GetPackageName(version string, platform string) string {
 	tmpl, err := template.New("package_name").Parse(proj.PackageName)
 	if err != nil {
@@ -110,6 +113,10 @@ func (proj BinarySpec) GetPackageName(version string, platform string) string {
 	return buf.String()
 }
 
+// GetRootDir will return a rendered version of the BinarySpec.rootDir attribute (which is a golang template), using
+// version and platform strings provided to create a template context containing 'Version', 'Platform' and 'Ext' values.
+// The string returned will contain the expected name of the root directory created when extracted the package file for
+// the BinarySpec
 func (proj BinarySpec) GetRootDir(version string, platform string) string {
 	if proj.RootDir == "" {
 		// shortcut to avoid rendering template when there's no RootDir specified

From f39e53ef07be1a3286b14e45ab283e328a814e90 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Mon, 7 Apr 2025 18:39:13 +0200
Subject: [PATCH 37/42] fixup! Improve comments on components definitions

---
 dev-tools/packaging/packages.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index b5e86331dad..0e92f66baa6 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -65,6 +65,7 @@ components:
     packageName: agentbeat-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: agentbeat-{{.Version}}-{{.Platform}}
     binaryName: agentbeat
+    fips: false
     platforms: *all-platforms
     packageTypes: *all-package-types
   - &comp-apm_server
@@ -72,6 +73,7 @@ components:
     packageName: apm-server-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: apm-server-{{.Version}}-{{.Platform}}
     binaryName: apm-server
+    fips: false
     platforms:
       - *linux-amd64
       - *linux-arm64
@@ -83,6 +85,7 @@ components:
     packageName: cloudbeat-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: cloudbeat-{{.Version}}-{{.Platform}}
     binaryName: cloudbeat
+    fips: false
     platforms:
       - *linux-amd64
       - *linux-arm64
@@ -96,6 +99,7 @@ components:
     # we don't extract/manipulate the archive during packaging but it has its own special handling in the 'service' docker image
     rootDir: elasticsearch_connectors-{{beat_version}}
     binaryName: connectors
+    fips: false
     platforms:
       - *linux-amd64
       - *linux-arm64
@@ -106,6 +110,7 @@ components:
     packageName: endpoint-security-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: endpoint-security-{{.Version}}-{{.Platform}}
     binaryName: endpoint-security
+    fips: false
     platforms: *all-platforms
     packageTypes: *all-package-types
   - &comp-fleet-server
@@ -113,6 +118,7 @@ components:
     packageName: fleet-server-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: fleet-server-{{.Version}}-{{.Platform}}
     binaryName: fleet-server
+    fips: false
     platforms: *all-platforms
     packageTypes: *all-package-types
   - &comp-pf-elastic-collector
@@ -120,6 +126,7 @@ components:
     packageName: pf-elastic-collector-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: pf-elastic-collector-{{.Version}}-{{.Platform}}
     binaryName: pf-elastic-collector
+    fips: false
     platforms:
       - *linux-amd64
       - *linux-arm64
@@ -129,6 +136,7 @@ components:
     packageName: pf-elastic-symbolizer-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: pf-elastic-symbolizer-{{.Version}}-{{.Platform}}
     binaryName: pf-elastic-symbolizer
+    fips: false
     platforms:
       - *linux-amd64
       - *linux-arm64
@@ -138,6 +146,7 @@ components:
     packageName: pf-host-agent-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: pf-host-agent-{{.Version}}-{{.Platform}}
     binaryName: pf-host-agent
+    fips: false
     platforms:
       - *linux-amd64
       - *linux-arm64
@@ -148,6 +157,7 @@ components:
     packageName: elastic-agent-core-{{.Version}}-{{.Platform}}.{{.Ext}}
     rootDir: elastic-agent-core-{{.Version}}-{{.Platform}}
     binaryName: elastic-agent
+    fips: false
     platforms: *all-platforms
     packageTypes: *all-package-types
   - &comp-agentbeat-fips

From a2d90d24d8f1a4a205a7f400b601fef62dbb34a2 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 9 Apr 2025 08:43:53 +0200
Subject: [PATCH 38/42] re-include apm-server fips component

---
 dev-tools/packaging/packages.yml | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index 0e92f66baa6..5211a7a0bfe 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -95,8 +95,8 @@ components:
     packageName: connectors-{{.Version}}.zip
     # FIXME: connectors use only <major>.<minor>.<patch> in the root directory name so the definition should be something
     # using the beat_version or similar
-    # We don't support that yet, so we are defining a rootDir that will error out if rendered. This isnot a problem since
-    # we don't extract/manipulate the archive during packaging but it has its own special handling in the 'service' docker image
+    # We don't support that yet, so we are defining a rootDir that will error out if rendered. This is not a problem since
+    # we don't extract/manipulate the archive during packaging, it has its own special handling in the 'service' docker image
     rootDir: elasticsearch_connectors-{{beat_version}}
     binaryName: connectors
     fips: false
@@ -177,10 +177,8 @@ components:
     binaryName: apm-server
     fips: true
     platforms:
-      # FIXME: is apm-server-fips not available for linux/amd64? infra PR is pending
-      # - *linux-amd64
-      # FIXME: is apm-server-fips on linux/arm64 has a different binary name 'apm-server-fips' but 'apm-server.spec.yml' spec file
-      #- *linux-arm64
+      - *linux-amd64
+      - *linux-arm64
     packageTypes: *all-package-types
   - &comp-fleet-server-fips
     projectName: fleet-server

From 262062969d75f8747d1d015292e9e8cef18425ce Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 9 Apr 2025 08:59:39 +0200
Subject: [PATCH 39/42] cleanup mage package verbose logs

---
 magefile.go | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/magefile.go b/magefile.go
index 43a5d87c45d..6e086c05f95 100644
--- a/magefile.go
+++ b/magefile.go
@@ -637,21 +637,19 @@ func ExtractComponentsFromSelectedPkgSpecs(pkgSpecs []devtools.OSPackageArgs) ([
 				} else {
 					mappedDependencies[component.PackageName] = component
 					if mg.Verbose() {
-						log.Printf("Added component %+v to the list of component to download from manifest", component)
+						log.Printf("Added component %s to the list of component to download from manifest", component.PackageName)
 					}
 				}
 			}
 		}
 	}
-	if mg.Verbose() {
-		log.Printf("collected mappedDependencies: %v", mappedDependencies)
-	}
 
 	// collect the dependencies into a slice
 	dependencies := make([]packaging.BinarySpec, 0, len(mappedDependencies))
 	for _, pkg := range mappedDependencies {
 		dependencies = append(dependencies, pkg)
 	}
+
 	return dependencies, nil
 }
 
@@ -659,7 +657,7 @@ func isSelected(pkg devtools.OSPackageArgs) bool {
 
 	// Checks if this package is compatible with the FIPS settings
 	if pkg.Spec.FIPS != devtools.FIPSBuild {
-		log.Printf("Skipping %s/%s package type because FIPS flag doesn't match [pkg=%v, build=%v]", pkg.Spec, pkg.OS, pkg.Spec.FIPS, devtools.FIPSBuild)
+		log.Printf("Skipping %s/%s package type because FIPS flag doesn't match [pkg=%v, build=%v]", pkg.Spec.Name, pkg.OS, pkg.Spec.FIPS, devtools.FIPSBuild)
 		return false
 	}
 

From ba72248ebccd4091cc836cbe6eacefca4177c1a3 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 9 Apr 2025 09:09:18 +0200
Subject: [PATCH 40/42] Fix header of packages.yml

---
 dev-tools/packaging/packages.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml
index 5211a7a0bfe..9c7ac30449a 100644
--- a/dev-tools/packaging/packages.yml
+++ b/dev-tools/packaging/packages.yml
@@ -1,7 +1,6 @@
 ---
 
-# This file contains the package specifications for both Community Beats and
-# Official Beats.
+# This file contains the package specifications for Elastic Agent
 
 # List all the available platforms
 platforms: &all-platforms

From d738701672aaf5c8c211cd67aa314c356b2e676e Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 9 Apr 2025 09:48:09 +0200
Subject: [PATCH 41/42] fixup! Create FIPS elastic-agent-core artifacts in
 elastic-agent-binary-dra pipeline

---
 .buildkite/pipeline.elastic-agent-binary-dra.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.buildkite/pipeline.elastic-agent-binary-dra.yml b/.buildkite/pipeline.elastic-agent-binary-dra.yml
index 3b6383140d5..1b7e127c44b 100644
--- a/.buildkite/pipeline.elastic-agent-binary-dra.yml
+++ b/.buildkite/pipeline.elastic-agent-binary-dra.yml
@@ -144,7 +144,7 @@ steps:
         DRA_WORKFLOW: "dra-core-staging"
         PLATFORMS: "linux/arm64 darwin/arm64"
 
-    - label: ":package: linux/arm64 darwin/arm64 Elastic-Agent Core staging"
+    - label: ":package: linux/arm64 FIPS Elastic-Agent Core staging"
       commands: |
         source .buildkite/scripts/version_qualifier.sh
         .buildkite/scripts/steps/build-agent-core.sh

From e9be5cbe268988a5c1053868af759773e8a38080 Mon Sep 17 00:00:00 2001
From: Paolo Chila <paolo.chila@elastic.co>
Date: Wed, 9 Apr 2025 12:07:59 +0200
Subject: [PATCH 42/42] fixup! fixup! Create FIPS elastic-agent-core artifacts
 in elastic-agent-binary-dra pipeline

---
 .buildkite/pipeline.elastic-agent-binary-dra.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.buildkite/pipeline.elastic-agent-binary-dra.yml b/.buildkite/pipeline.elastic-agent-binary-dra.yml
index 1b7e127c44b..ea3cfd762e4 100644
--- a/.buildkite/pipeline.elastic-agent-binary-dra.yml
+++ b/.buildkite/pipeline.elastic-agent-binary-dra.yml
@@ -157,7 +157,7 @@ steps:
         imagePrefix: "core-ubuntu-2204-aarch64"
       env:
         DRA_WORKFLOW: "dra-core-staging"
-        PLATFORMS: "linux/arm64 darwin/arm64"
+        PLATFORMS: "linux/arm64"
         FIPS: "true"
 
     - wait