feat(acl): convert ACL VHDs to COSI and publish to PMC - #8848
Open
Adams Anaglo (adamsanaglo) wants to merge 54 commits into
Open
Adams Anaglo (adamsanaglo) wants to merge 54 commits into
Adams Anaglo (adamsanaglo) wants to merge 54 commits into
Conversation
Add a post-build pipeline step that converts AzureContainerLinux (ACL) VHD images to COSI format using ImageCustomizer's convert command (v1.2.0-2). Changes: - New script: convert-vhd-to-cosi.sh downloads ACL VHD from blob storage, runs ImageCustomizer convert (VHD -> COSI), and uploads the COSI file - New make target: convert-vhd-to-cosi in packer.mk - Pipeline vars: set IMG_CUSTOMIZER_CONTAINER and IMG_CUSTOMIZER_VERSION on ACL build jobs in both PR and release pipelines - Builder template: add Convert ACL VHD to COSI step after SIG->classic conversion, conditioned on OS_SKU=AzureContainerLinux - Immutable copy: updated to also copy/remove .cosi files for ACL builds Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move the ACL COSI 'az storage blob copy start' from the VHD immutable copy task into a dedicated task with its own condition gating on OS_SKU=AzureContainerLinux, rather than using a bash if-block inside the VHD copy step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move 'Convert ACL VHD to COSI' task to after 'Copy to Immutable Storage Container' so the VHD is safely in immutable storage before conversion. Revert echo to original 'Successfully copied to immutable container'. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move 'Copy to Immutable Storage Container' (VHD) after 'Copy COSI to Immutable Storage Container'. New order: 1. Convert ACL VHD to COSI 2. Copy COSI to Immutable Storage Container 3. Copy to Immutable Storage Container (VHD) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use less specific version tag to pick up patch releases automatically. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
SIG_SOURCE_GALLERY_UNIQUE_NAME, SIG_SOURCE_IMAGE_NAME, and SIG_SOURCE_IMAGE_VERSION are set but never consumed by any script or template in the repo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
FIPS jobs were missing IMG_CUSTOMIZER_CONTAINER and IMG_CUSTOMIZER_VERSION, which are required for the COSI conversion step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Create generate-cosi-publishing-info.sh that writes cosi-publishing-info.json
with the immutable storage URL and image metadata, paralleling
generate-vhd-publishing-info.sh for VHDs.
Pipeline steps added after 'Copy COSI to Immutable Storage Container':
- Generate COSI Publishing Info (bash, no az-login needed)
- Publish COSI Publishing Info (artifact: cosi-publishing-info-{artifactName})
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Generate cosi-publishing-info.json (with sha256, size, cosi_url, and image metadata) directly in convert-vhd-to-cosi.sh while the COSI artifact is still on disk. Remove the standalone script and make target. Pipeline order: Convert + generate info -> Publish artifact -> Copy to immutable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
OS_NAME was referenced in cosi-publishing-info.json but never set. ACL COSI artifacts are always Linux, so hardcode it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The container entrypoint is already 'imagecustomizer', so the first argument should be the subcommand 'convert' directly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add an opt-in fallback to convert-vhd-to-cosi.sh so that when the MCR ImageCustomizer image for the requested version is unavailable, the script can pull from a configurable fallback registry (IMG_CUSTOMIZER_CONTAINER_FALLBACK, e.g. ghcr.io/microsoft/imagecustomizer). The fallback is gated by a script param defaulting to off, normalizes major.minor versions to major.minor.0 for GHCR's full semver tags, and is enabled for the ACL COSI conversion step. Bump IMG_CUSTOMIZER_VERSION from 1.4 to 1.5 for ACL jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Include the tag directly in IMG_CUSTOMIZER_CONTAINER (mcr.microsoft.com/azurelinux/imagecustomizer:1.5) and IMG_CUSTOMIZER_CONTAINER_FALLBACK (ghcr.io/microsoft/imagecustomizer:1.5.0) for the ACL COSI conversion. Drop the separate IMG_CUSTOMIZER_VERSION variable and the major.minor to major.minor.0 normalization from convert-vhd-to-cosi.sh, since both registries now carry fully-qualified tags. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…nnection - convert-vhd-to-cosi.sh: convert+stage only; emit AFD cosi_url + sha1 for aks-rp cosi register - upload-cosi-to-pmc.sh (new) + make target: upload staged COSI under PMC's SC (no az-login dep) - pipeline: Upload COSI to PMC task under COSI_PMC_SERVICE_CONNECTION; drop obsolete COSI immutable-copy step - fix azExitCode masking + set -u guards
…y ADO compile-time authz
…copy azcopy cannot infer the service type for a custom *.azurefd.net host and won't send the AAD token to a non-default trusted suffix. Mint a storage-scoped token and PUT the staged .cosi directly to PMC's AFD upload endpoint (AFD passthrough-forwards the Bearer token to the blob origin), matching the proven Nebraska POC. Stream with curl -T to avoid loading a multi-GB COSI into memory.
A single Blob REST PUT is capped at 5000 MiB, so the real converted COSI (>5 GiB) failed with HTTP 413 RequestBodyTooLarge. Replace the curl PUT with a small cmd/cosi-upload Go tool that uses the Azure Blob SDK's UploadFile (16 MiB blocks, concurrency 8), which chunks via Put Block + Put Block List and is not subject to the single-PUT limit. Auth is unchanged (Microsoft Entra via the AzureCLI@2 login); AFD forwards the bearer token to the blob origin. azblob/azidentity are pinned to the versions already used by the e2e module.
Adams Anaglo (adamsanaglo)
temporarily deployed
to
test
July 7, 2026 16:52 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the Azure Container Linux (ACL) VHD → COSI flow by adding a dedicated upload path to PMC via an Azure Front Door (AFD) upload endpoint, wiring the new conversion + upload steps into the VHD builder release pipeline, and introducing a small Go-based uploader that uses Azure Blob SDK block uploads to avoid single-request size limits.
Changes:
- Add an ImageCustomizer-based VHD→COSI conversion script that stages the artifact and emits
cosi-publishing-info.json(includingsha1). - Add a Go CLI (
cmd/cosi-upload) plus a wrapper script to upload large COSI artifacts via chunked block-blob upload using Azure CLI (Entra ID) auth. - Wire new “Convert ACL VHD to COSI” and “Upload COSI to PMC” steps into the builder release template and set ImageCustomizer image variables in pipeline definitions.
Reviewed changes
Copilot reviewed 8 out of 10 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
vhdbuilder/packer/imagecustomizer/scripts/convert-vhd-to-cosi.sh |
Downloads the staged ACL VHD, converts it to COSI via ImageCustomizer, stages the COSI, and generates cosi-publishing-info.json with hashes. |
vhdbuilder/packer/imagecustomizer/scripts/upload-cosi-to-pmc.sh |
Validates expected environment + artifacts and invokes the Go uploader to push to the PMC AFD upload endpoint. |
cmd/cosi-upload/main.go |
Implements block/chunked upload using azblob with Azure CLI credential for pipeline auth. |
packer.mk |
Adds convert-vhd-to-cosi, build-cosi-upload, and upload-cosi-to-pmc targets used by pipeline steps. |
.pipelines/templates/.builder-release-template.yaml |
Adds pipeline tasks to convert ACL VHD to COSI and upload COSI to PMC, and publishes cosi-publishing-info.json. |
.pipelines/.vsts-vhd-builder.yaml |
Sets ImageCustomizer container image variables (primary + GHCR fallback) for relevant stages. |
.pipelines/.vsts-vhd-builder-release.yaml |
Sets ImageCustomizer container image variables (primary + GHCR fallback) for relevant stages. |
go.mod |
Adds Azure Blob SDK + Azure Identity dependencies required by the new uploader tool. |
go.sum |
Updates module checksums for newly introduced Go dependencies. |
Copilot started reviewing on behalf of
Adams Anaglo (adamsanaglo)
September 8, 2026 16:18
View session
Co-authored-by: adamsanaglo <56308410+adamsanaglo@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new arm64 conversion job bootstraps tooling by executing unpinned remote install scripts/binaries without integrity verification, which is a supply-chain security risk.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
.pipelines/templates/.builder-cosi-convert-template.yaml:93
- The arm64 convert bootstrap downloads and executes a remote Azure CLI installer script as root (curl + sudo bash). That creates an avoidable supply-chain risk and makes the job behavior dependent on a mutable external script. Prefer installing Azure CLI via explicit, reviewed package-repo steps (or preinstalling az on the pool image), rather than executing a downloaded script.
tmp="$(mktemp -d)"
curl -fsSL https://aka.ms/InstallAzureCLIDeb -o "$tmp/install-azure-cli.sh"
sudo bash "$tmp/install-azure-cli.sh"
rm -rf "$tmp"
- Files reviewed: 23/24 changed files
- Comments generated: 1
- Review effort level: Lite
Copilot started reviewing on behalf of
Adams Anaglo (adamsanaglo)
September 8, 2026 16:24
View session
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new pipeline/make targets have confirmed build-time failures on clean agents (missing output dir for bin/cosi-upload and missing Go install path for apt-based arm64 convert jobs).
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
packer.mk:112
build-cosi-uploadwrites tobin/cosi-uploadbut the repo root does not include abin/directory and the target doesn’t create it, sogo build -o bin/cosi-upload ...will fail on a clean checkout (and thenupload-cosi-to-pmc.shwon’t find the uploader). Create the output directory before building.
build-cosi-upload:
@echo "Building cosi-upload binary"
@GOEXPERIMENT=ms_nocgo_opensslcrypto CGO_ENABLED=0 go build -o bin/cosi-upload ./cmd/cosi-upload
- Files reviewed: 23/24 changed files
- Comments generated: 1
- Review effort level: Lite
Co-authored-by: adamsanaglo <56308410+adamsanaglo@users.noreply.github.com>
Copilot started reviewing on behalf of
Adams Anaglo (adamsanaglo)
September 8, 2026 16:43
View session
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It modifies the release/publishing pipeline and introduces new artifact upload mechanics and bootstrap steps, which warrants careful human validation in the real build environment.
Review details
Suppressed comments (2)
Previously missed (2) — in code that hasn't changed since the last review.
vhdbuilder/packer/imagecustomizer/scripts/convert-vhd-to-cosi.sh:60
- Same as upload-cosi-to-pmc.sh: failing required env vars currently uses a plain
echo, while later failures use##vso[task.logissue type=error].... Emitting logissue here makes diagnosis consistent when a pipeline variable is missing or renamed.
vhdbuilder/packer/imagecustomizer/scripts/upload-cosi-to-pmc.sh:21 - The missing-required-env-var branch prints a plain message, but other failures in this script use Azure DevOps logissue formatting. Using
##vso[task.logissue type=error]...here makes the error show up consistently in the pipeline UI and logs.
- Files reviewed: 23/24 changed files
- Comments generated: 1
- Review effort level: Lite
Co-authored-by: adamsanaglo <56308410+adamsanaglo@users.noreply.github.com>
Contributor
Created the |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new conversion/upload scripts and arm64 pipeline path introduce CI-breaking shell linting/toolchain risks that should be resolved before approval.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (2)
vhdbuilder/packer/imagecustomizer/scripts/upload-cosi-to-pmc.sh:14
make validate-shellruns a POSIX ShellCheck pass (shellcheck --shell=sh) on most*.shfiles, and this env-var check uses bash-only array syntax and indirect expansion (${!v}), which will fail CI. Rewrite the validation in POSIX-compatible syntax (or add this script toBASH_ONLY_LISTin.pipelines/scripts/verify_shell.sh).
required_env_vars=(
"CAPTURED_SIG_VERSION"
"AFD_UPLOAD_ENDPOINT"
"COSI_CONTAINER"
)
vhdbuilder/packer/imagecustomizer/scripts/convert-vhd-to-cosi.sh:51
- This script uses multiple bash-only constructs (arrays,
local, here-strings<<<,${var,,},shopt, etc.). CI’smake validate-shellruns a POSIX ShellCheck pass (shellcheck --shell=sh) on*.shfiles not listed inBASH_ONLY_LIST(.pipelines/scripts/verify_shell.sh), so this will fail unless it’s explicitly marked bash-only there or rewritten to be POSIX-compliant.
required_env_vars=(
"DESTINATION_STORAGE_CONTAINER"
"CAPTURED_SIG_VERSION"
"IMG_CUSTOMIZER_CONTAINER"
"AFD_DOWNLOAD_HOSTNAME"
- Files reviewed: 23/24 changed files
- Comments generated: 1
- Review effort level: Lite
Co-authored-by: adamsanaglo <56308410+adamsanaglo@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The updated CSE-command goldens appear to skip init-aks-cloud.sh entirely (missing INIT_AKS_CLOUD_FILEPATH/env wiring), which is a high-risk provisioning regression, and the pipeline changes are substantial.
Review details
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
.pipelines/templates/.builder-release-template.yaml:27
tar --exclude='./.git'only matches the.gitdirectory entry itself, but it does not exclude.git/*, so the source bundle can still capture the entire Git history and bloat the artifact. Exclude the.gitsubtree explicitly to keep the bundle small and avoid leaking repo metadata into the arm64 conversion job artifact.
- Files reviewed: 23/24 changed files
- Comments generated: 13
- Review effort level: Lite
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It introduces a new publishing tool and modifies release pipeline flows (including a new arm64 conversion job), which warrants manual validation of CI behavior and rollout impact.
Review details
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
.pipelines/templates/.builder-cosi-convert-template.yaml:126
- The AzCopy bootstrap checksum verification uses
sha256sum --check --status, which suppresses all output even on failure. If the pinned URL changes or the download is corrupted, the step will exit non-zero without any clue why, making troubleshooting difficult. Consider printing the mismatch and emitting a VSO error message when verification fails.
- Files reviewed: 14/15 changed files
- Comments generated: 0 new
- Review effort level: Lite
azcopyvnext.azureedge.net no longer resolves after the Edgio azureedge.net CDN retirement, breaking the arm64 convert bootstrap. Repoint the azcopy download to GitHub releases; same v10.22.1 and same pinned SHA256 (tarballs are byte-identical, checksum verification unchanged).
Contributor
Changes cached containers or packages on windows VHDsPlease get a Windows SIG member to approve. The following dif file shows any additions or deletions from what will be cached on windows VHDs organised by VHD type.
diff --git a/vhd_files/2022-containerd-gen2.txt b/vhd_files/2022-containerd-gen2.txt
index 4e05767..20066f0 100644
--- a/vhd_files/2022-containerd-gen2.txt
+++ b/vhd_files/2022-containerd-gen2.txt
@@ -18,6 +17,0 @@ c:\akse-cache\csi-proxy\: https://packages.aks.azure.com/csi-proxy/v1.1.2-hotfix
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.102-akslts/windowszip/v1.28.102-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.103-akslts/windowszip/v1.28.103-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.100-akslts/windowszip/v1.29.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.101-akslts/windowszip/v1.29.101-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.100-akslts/windowszip/v1.30.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.101-akslts/windowszip/v1.30.101-akslts-1int.zip
@@ -25 +18,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.14/windowszip/v1.31.14-1int.zip
@@ -27,2 +19,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.11/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windowszip/v1.32.12-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.11/windowszip/v1.33.11-1int.zip
@@ -30,2 +21,4 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.7/windowszip/v1.34.7-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.9/windowszip/v1.34.9-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.11/windowszip/v1.34.11-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.35.8/windowszip/v1.35.8-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.36.4/windowszip/v1.36.4-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.37.0/windowszip/v1.37.0-1int.zip
@@ -127 +119,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-7
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.16-windows-hpc-1
@@ -129 +121 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.17-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.12-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.18-windows-hpc-1
@@ -131 +123 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.13-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.7-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.14-windows-hpc-1
@@ -133 +125 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.8-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.4-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.9-windows-hpc-1
@@ -134,0 +127 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.5-windows-hpc
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.6-windows-hpc-1
@@ -138 +130,0 @@ mcr.microsoft.com/windows/nanoserver:ltsc2022
-mcr.microsoft.com/windows/servercore:10.0.20348.5386
@@ -139,0 +132 @@ mcr.microsoft.com/windows/servercore:10.0.20348.5499
+mcr.microsoft.com/windows/servercore:10.0.20348.5622
@@ -145 +138 @@ Windows 2022-containerd-gen2 base image sku: 2022-datacenter-core-smalldisk-g2
-Windows 2022-containerd-gen2 base version: 20348.5499.260809
+Windows 2022-containerd-gen2 base version: 20348.5622.260906
diff --git a/vhd_files/2022-containerd.txt b/vhd_files/2022-containerd.txt
index a8c76d7..d47f9d3 100644
--- a/vhd_files/2022-containerd.txt
+++ b/vhd_files/2022-containerd.txt
@@ -18,6 +17,0 @@ c:\akse-cache\csi-proxy\: https://packages.aks.azure.com/csi-proxy/v1.1.2-hotfix
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.102-akslts/windowszip/v1.28.102-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.103-akslts/windowszip/v1.28.103-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.100-akslts/windowszip/v1.29.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.101-akslts/windowszip/v1.29.101-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.100-akslts/windowszip/v1.30.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.101-akslts/windowszip/v1.30.101-akslts-1int.zip
@@ -25 +18,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.14/windowszip/v1.31.14-1int.zip
@@ -27,2 +19,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.11/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windowszip/v1.32.12-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.11/windowszip/v1.33.11-1int.zip
@@ -30,2 +21,4 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.7/windowszip/v1.34.7-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.9/windowszip/v1.34.9-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.11/windowszip/v1.34.11-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.35.8/windowszip/v1.35.8-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.36.4/windowszip/v1.36.4-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.37.0/windowszip/v1.37.0-1int.zip
@@ -127 +119,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-7
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.16-windows-hpc-1
@@ -129 +121 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.17-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.12-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.18-windows-hpc-1
@@ -131 +123 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.13-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.7-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.14-windows-hpc-1
@@ -133 +125 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.8-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.4-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.9-windows-hpc-1
@@ -134,0 +127 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.5-windows-hpc
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.6-windows-hpc-1
@@ -138 +130,0 @@ mcr.microsoft.com/windows/nanoserver:ltsc2022
-mcr.microsoft.com/windows/servercore:10.0.20348.5386
@@ -139,0 +132 @@ mcr.microsoft.com/windows/servercore:10.0.20348.5499
+mcr.microsoft.com/windows/servercore:10.0.20348.5622
@@ -145 +138 @@ Windows 2022-containerd base image sku: 2022-Datacenter-Core-smalldisk
-Windows 2022-containerd base version: 20348.5499.260809
+Windows 2022-containerd base version: 20348.5622.260906
diff --git a/vhd_files/2025-gen2-tl.txt b/vhd_files/2025-gen2-tl.txt
index e49ede0..13735dd 100644
--- a/vhd_files/2025-gen2-tl.txt
+++ b/vhd_files/2025-gen2-tl.txt
@@ -15,7 +15 @@ c:\akse-cache\csi-proxy\: https://packages.aks.azure.com/csi-proxy/v1.1.2-hotfix
-c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.7.1-cpu-arch
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.102-akslts/windowszip/v1.28.102-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.103-akslts/windowszip/v1.28.103-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.100-akslts/windowszip/v1.29.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.101-akslts/windowszip/v1.29.101-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.100-akslts/windowszip/v1.30.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.101-akslts/windowszip/v1.30.101-akslts-1int.zip
+c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.8.0-cpu-arch
@@ -23 +16,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.14/windowszip/v1.31.14-1int.zip
@@ -25,2 +17,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.11/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windowszip/v1.32.12-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.11/windowszip/v1.33.11-1int.zip
@@ -28,2 +19,4 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.7/windowszip/v1.34.7-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.9/windowszip/v1.34.9-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.11/windowszip/v1.34.11-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.35.8/windowszip/v1.35.8-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.36.4/windowszip/v1.36.4-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.37.0/windowszip/v1.37.0-1int.zip
@@ -58 +50,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-7
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.16-windows-hpc-1
@@ -60 +52 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.17-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.12-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.18-windows-hpc-1
@@ -62 +54 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.13-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.7-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.14-windows-hpc-1
@@ -64 +56 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.8-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.4-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.9-windows-hpc-1
@@ -65,0 +58 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.5-windows-hpc
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.6-windows-hpc-1
@@ -70 +62,0 @@ mcr.microsoft.com/windows/nanoserver:ltsc2025
-mcr.microsoft.com/windows/servercore:10.0.20348.5386
@@ -72 +64 @@ mcr.microsoft.com/windows/servercore:10.0.20348.5499
-mcr.microsoft.com/windows/servercore:10.0.26100.33158
+mcr.microsoft.com/windows/servercore:10.0.20348.5622
@@ -73,0 +66 @@ mcr.microsoft.com/windows/servercore:10.0.26100.33296
+mcr.microsoft.com/windows/servercore:10.0.26100.33438
@@ -80 +73 @@ Windows 2025-gen2-tl base image sku: 2025-datacenter-core-smalldisk-g2
-Windows 2025-gen2-tl base version: 26100.33296.260809
+Windows 2025-gen2-tl base version: 26100.33438.260905
diff --git a/vhd_files/2025-gen2.txt b/vhd_files/2025-gen2.txt
index eec1d89..6fd7e0f 100644
--- a/vhd_files/2025-gen2.txt
+++ b/vhd_files/2025-gen2.txt
@@ -15,7 +15 @@ c:\akse-cache\csi-proxy\: https://packages.aks.azure.com/csi-proxy/v1.1.2-hotfix
-c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.7.1-cpu-arch
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.102-akslts/windowszip/v1.28.102-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.103-akslts/windowszip/v1.28.103-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.100-akslts/windowszip/v1.29.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.101-akslts/windowszip/v1.29.101-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.100-akslts/windowszip/v1.30.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.101-akslts/windowszip/v1.30.101-akslts-1int.zip
+c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.8.0-cpu-arch
@@ -23 +16,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.14/windowszip/v1.31.14-1int.zip
@@ -25,2 +17,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.11/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windowszip/v1.32.12-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.11/windowszip/v1.33.11-1int.zip
@@ -28,2 +19,4 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.7/windowszip/v1.34.7-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.9/windowszip/v1.34.9-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.11/windowszip/v1.34.11-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.35.8/windowszip/v1.35.8-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.36.4/windowszip/v1.36.4-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.37.0/windowszip/v1.37.0-1int.zip
@@ -58 +50,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-7
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.16-windows-hpc-1
@@ -60 +52 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.17-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.12-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.18-windows-hpc-1
@@ -62 +54 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.13-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.7-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.14-windows-hpc-1
@@ -64 +56 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.8-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.4-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.9-windows-hpc-1
@@ -65,0 +58 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.5-windows-hpc
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.6-windows-hpc-1
@@ -70 +62,0 @@ mcr.microsoft.com/windows/nanoserver:ltsc2025
-mcr.microsoft.com/windows/servercore:10.0.20348.5386
@@ -72 +64 @@ mcr.microsoft.com/windows/servercore:10.0.20348.5499
-mcr.microsoft.com/windows/servercore:10.0.26100.33158
+mcr.microsoft.com/windows/servercore:10.0.20348.5622
@@ -73,0 +66 @@ mcr.microsoft.com/windows/servercore:10.0.26100.33296
+mcr.microsoft.com/windows/servercore:10.0.26100.33438
@@ -80 +73 @@ Windows 2025-gen2 base image sku: 2025-datacenter-core-smalldisk-g2
-Windows 2025-gen2 base version: 26100.33296.260809
+Windows 2025-gen2 base version: 26100.33438.260905
diff --git a/vhd_files/2025.txt b/vhd_files/2025.txt
index 5997647..09e5f1c 100644
--- a/vhd_files/2025.txt
+++ b/vhd_files/2025.txt
@@ -15,7 +15 @@ c:\akse-cache\csi-proxy\: https://packages.aks.azure.com/csi-proxy/v1.1.2-hotfix
-c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.7.1-cpu-arch
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.102-akslts/windowszip/v1.28.102-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.28.103-akslts/windowszip/v1.28.103-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.100-akslts/windowszip/v1.29.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.29.101-akslts/windowszip/v1.29.101-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.100-akslts/windowszip/v1.30.100-akslts-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.30.101-akslts/windowszip/v1.30.101-akslts-1int.zip
+c:\akse-cache\wcn\: mcr.microsoft.com/wcn/package:1.8.0-cpu-arch
@@ -23 +16,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.31.14/windowszip/v1.31.14-1int.zip
@@ -25,2 +17,0 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.11/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.32.12/windowszip/v1.32.12-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.11/windowszip/v1.33.11-1int.zip
@@ -28,2 +19,4 @@ c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.33.13/windo
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.7/windowszip/v1.34.7-1int.zip
-c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.9/windowszip/v1.34.9-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.34.11/windowszip/v1.34.11-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.35.8/windowszip/v1.35.8-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.36.4/windowszip/v1.36.4-1int.zip
+c:\akse-cache\win-k8s\: https://packages.aks.azure.com/kubernetes/v1.37.0/windowszip/v1.37.0-1int.zip
@@ -58 +50,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-7
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.16-windows-hpc-1
@@ -60 +52 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.17-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.12-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.33.18-windows-hpc-1
@@ -62 +54 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.13-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.7-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.34.14-windows-hpc-1
@@ -64 +56 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.8-windows-hpc
-mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.4-windows-hpc-1
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.35.9-windows-hpc-1
@@ -65,0 +58 @@ mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.5-windows-hpc
+mcr.microsoft.com/oss/v2/kubernetes/azure-cloud-node-manager:v1.36.6-windows-hpc-1
@@ -70 +62,0 @@ mcr.microsoft.com/windows/nanoserver:ltsc2025
-mcr.microsoft.com/windows/servercore:10.0.20348.5386
@@ -72 +64 @@ mcr.microsoft.com/windows/servercore:10.0.20348.5499
-mcr.microsoft.com/windows/servercore:10.0.26100.33158
+mcr.microsoft.com/windows/servercore:10.0.20348.5622
@@ -73,0 +66 @@ mcr.microsoft.com/windows/servercore:10.0.26100.33296
+mcr.microsoft.com/windows/servercore:10.0.26100.33438
@@ -80 +73 @@ Windows 2025 base image sku: 2025-datacenter-core-smalldisk
-Windows 2025 base version: 26100.33296.260809
+Windows 2025 base version: 26100.33438.260905 |
Contributor
|
Contributor
|
Contributor
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved pipeline gating, asynchronous blob-copy cleanup, environment selection, and image-version handoff issues block approval.
Get a fresh assessment by requesting another Copilot review.
Review details
Suppressed comments (4)
.pipelines/.vsts-vhd-builder-release.yaml:927
- This job is not gated on
GENERATE_PUBLISHING_INFO. When publishing is disabled, the parent skips COSI conversion, but this child still bootstraps Docker/Azure CLI and downloads the source bundle; any bootstrap failure can fail an otherwise valid non-publishing release and it needlessly consumes the native pool. Add the publishing flag to the job condition so the job is skipped as a whole.
condition: and(succeeded(), eq('${{ parameters.buildaclarm64tlgen2 }}', true))
.pipelines/.vsts-vhd-builder-release.yaml:956
- This FIPS native conversion job has the same unconditional job-level execution: with
GENERATE_PUBLISHING_INFOdisabled, it still runs the bootstrap and artifact-download steps even though every COSI step is later skipped. That can fail or waste a release that does not request publishing; include the publishing flag in this job condition as well.
condition: and(succeeded(), eq('${{ parameters.buildaclarm64fipstlgen2 }}', true))
.pipelines/templates/.builder-cosi-convert-template.yaml:186
- The parent build selects
CLASSIC_BLOB_STAGINGonly forENVIRONMENT=tmeand otherwise uploads the VHD toCLASSIC_BLOB, but this native job always setsDESTINATION_STORAGE_CONTAINERto the staging URL. In a non-TME run the convert step will therefore download from an empty or wrong location and fail; mirror the environment-dependent selection used by the parent template.
echo "##vso[task.setvariable variable=DESTINATION_STORAGE_CONTAINER]${CLASSIC_BLOB_STAGING}"
echo "DESTINATION_STORAGE_CONTAINER is set to ${CLASSIC_BLOB_STAGING}"
.pipelines/templates/.builder-release-template.yaml:193
- 🟡 Medium Risk — This handoff exports only
CAPTURED_SIG_VERSIONto the native-arm64 job, butconvert-vhd-to-cosi.shderivescosi-publishing-info.json.image_versionfromIMAGE_VERSIONand falls back to the conversion date when that variable is absent. The native job therefore cannot preserve a build-scoped/overridden image version (and can publish a different package version if conversion crosses a date boundary). ExportIMAGE_VERSIONalongside the captured SIG version and bind that output in the native job, or fail instead of silently defaulting.
echo "##vso[task.setvariable variable=CAPTURED_SIG_VERSION;isOutput=true]${CAPTURED_SIG_VERSION}"
- Files reviewed: 14/15 changed files
- Comments generated: 1
- Review effort level: Lite
Comment on lines
+234
to
+237
| az storage blob copy start --account-name "$STORAGE_ACCOUNT_NAME" --destination-blob "${CAPTURED_SIG_VERSION}.vhd" --destination-container "$VHD_CONTAINER_NAME" --source-uri "${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.vhd" --auth-mode login || exit 1 | ||
| echo "Successfully copied to immutable container" | ||
| # Remove old VHD from staging container after copy to immutable container is complete | ||
| azcopy remove "${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.vhd" --recursive=true |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Builds on the ACL VHD->COSI conversion work to upload the COSI directly to PMC via its AFD upload endpoint under PMC's service connection.
upload-cosi-to-pmc.shand packer.mk targets.cosi-publishing-info.jsonuses the AFD download URL and addssha1.202608.06.0→202608.6.0) and appends-fipsfor FIPS builds (driven byENABLE_FIPS, never duplicated), writing the result tocosi-publishing-info.json.image_version.IMAGE_VERSION, SIG versions, and blob names are untouched. Covered by ShellSpec tests.azblobandazidentitydependencies.Which issue(s) this PR fixes:
Fixes #