[Artur Khantimirov (r2k1)]

What this PR does / why we need it:

Summary

Add offline host-OS checks for the eMudhra incident to the existing Linux and Windows VHD content tests.

VHD content test
  read Linux CA bundles / Windows installed roots and cached AuthRoot list
  require DigiCert Global Root G2 as a read-control
  fail if emSign ECC Root CA - G3 or AAA Certificate Services remains

Host OS only: no component or container checks, downloads, certificate fixtures, native helper, or trust-store changes. The patch adds 104 lines, including 36 lines in the pipeline test scripts.

Evidence

• Before: no eMudhra-specific host trust assertion in these content tests.
• After: focused cases cover each signing root, missing/empty trust data, and read failures. Real OpenSSL checks accept a DigiCert-only bundle and reject an empty bundle or a bundle containing the signing roots.
• shellspec --shell bash spec/vhdbuilder/packer/test/linux_vhd_content_test_helpers_spec.sh spec/vhdbuilder/packer/test/run_test_spec.sh — passed, 41 examples.
• pwsh -NoLogo -NoProfile -Command 'function global:curl.exe { "127.0.0.1" }; Import-Module Pester -RequiredVersion 5.7.1; $c = New-PesterConfiguration; $c.Run.Path = "./vhdbuilder/packer/test/windows-vhd-content-test.tests.ps1"; $c.Run.Exit = $true; Invoke-Pester -Configuration $c' — passed, 15 tests, using mocked Windows stores on macOS.
• Targeted ShellCheck with repository exclusions, Bash syntax, and git diff --check — passed. No new POSIX findings compared with the parent.
• Remote Pester, ShellCheck, and full ShellSpec — passed for head 809061d99a6bc916c0df0a1253e7a784dae5053f.
• Linux VHD build 187266626 — passed: all 12 image jobs, their Test, Scan, and Cleanup tasks, and the E2E stage succeeded. Ubuntu 22.04 log 600 confirms Run Command used the PR merge SHA 4e67bb482539a31e2431303aa807219781eaa042 and completed the content tests after the mandatory root guard. The earlier Ubuntu 22.04 build retry recovered.
• Remote Go unit tests — failed on the existing TestLivePatchingUsesVHDInsteadOfCustomData size assertion: 87404 is not less than 87380. The focused command go test ./pkg/agent -run '^TestLivePatchingUsesVHDInsteadOfCustomData$' -count=1 also failed locally, at 87988. The PR leaves pkg, parts, go.mod, and go.sum unchanged from parent f3163c3013e53591c930cb64bbcafc2c6b390b9b, where this failure was previously reproduced. No assertion was weakened.
• Windows VHD build 187266638 — failed. All three executed variants (2022-containerd, 2025-gen2, 2025-gen2-tl) failed in Run VHD cache test; logs 69, 86, and 93 show the same error. The new helper stopped because EncodedCtl does not exist under HKLM:\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate. This exposes an unavailable-data assumption in the check; none reached a certificate-trust verdict. This is not evidence of compromise. Other Windows variants and all Windows E2E stages were skipped. The check remains fail-closed.
• No checks remain pending. The PR is not ready to merge because of the Windows check failure and the existing Go size failure.

Merge Danger

Door: two-way; revert the added test assertions.

Blast Radius: CI.

This is a conservative root-removal policy, not full chain verification. It can block VHD jobs even when intermediate blocklists, revocation, or another mechanism already protects the OS. It deliberately covers both signing-root paths, including AAA. It does not change node provisioning or OS trust stores.

Which issue(s) this PR fixes:

N/A. Related advisory: GO-2026-6809.

[github-actions]

Windows Unit Test Results

  3 files   18 suites   1m 8s ⏱️
571 tests 571 ✅ 0 💤 0 ❌
593 runs  593 ✅ 0 💤 0 ❌

Results for commit 809061d.

[github-actions]

Package	Line Rate	Health
test	0%	❌
windows	27%	❌
staging_cse_windows Package 1	65%	➖
debug	0%	❌
provisioningscripts	2%	❌
parts_windows Package 1	73%	➖
Summary	38% (1652 / 6844)	❌

[github-actions]

Package	Line Rate	Health
shellspec spec	28%	❌
Summary	28% (4591 / 16094)	❌

[Copilot]

🔵 Needs a closer look

Live Windows PowerShell 5.1 and remote VHD validation remain pending for mandatory checks that can block image release jobs.

No open issues 🎉

What changed in this PR

Adds offline eMudhra host trust checks to AgentBaker’s Linux and Windows VHD content tests, without changing trust stores or node provisioning.

Changes:

• Rejects emSign ECC Root CA - G3 and AAA Certificate Services roots, using DigiCert Global Root G2 as a read-control.
• Adds ShellSpec and Pester coverage for root detection, missing trust data, and read failures.
• Documents the conservative root-removal policy and its host-only scope.

File	Description
vhdbuilder/​packer/​test/​windows-vhd-content-test.tests.ps1	Tests installed and cached root checks with mocked Windows stores.
vhdbuilder/​packer/​test/​windows-vhd-content-test.ps1	Gates content tests on installed roots and the cached AuthRoot list.
vhdbuilder/​packer/​test/​linux-vhd-content-test.sh	Checks CA bundles before test setup can upgrade packages.
vhdbuilder/​packer/​README.md	Explains the policy, scope, and limitations.
spec/​vhdbuilder/​packer/​test/​linux_vhd_content_test_helpers_spec.sh	Tests Linux root detection and missing or unreadable bundles.

_{Review effort: Balanced}