[8.18] (backport #8670) [testing] validate artifact hashes in artifact fetcher #8686
+50
−19
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?s=60&v=4){kind=small}
* feat: validate artifact hashes in artifact fetcher * fix: do not load the whole file in memory * fix: reuse existing VerifySHA512Hash to verify package hash (cherry picked from commit 707c63f)
mergify
bot
requested review from
ycombinator and
pchila
and removed request for
a team
8 tasks
github-actions
bot
added
Team:Elastic-Agent-Control-Plane
|
Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane) |
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR improves the robustness of the test artifact fetcher by validating the integrity of downloaded packages and introducing retry logic for both corrupted downloads and snapshot metadata fetch failures. Specifically, it:
.sha512checksum of each downloaded artifact to detect corruption..jsonfile for snapshot build IDs), which previously failed with transient errors.Why is it important?
This PR addresses two known failure cases in upgrade test pipelines:
.tar.gzartifacts would not be detected, leading to tar extraction errors such asflate: corrupt input before offset.... This caused test flakiness and debugging overhead.By introducing checksum validation and retry logic, this PR makes upgrade tests more reliable and deterministic.
Checklist
./changelog/fragmentsusing the changelog toolDisruptive User Impact
None. This change only affects internal test infrastructure and does not impact users of the Elastic Agent or its public APIs.
How to test this PR locally
Related issues
This is an automatic backport of pull request #8670 done by [Mergify](https://mergify.com).