Add Windows/arm64 support for Agent

.buildkite/bk.integration.pipeline.yml

@@ -98,11 +98,11 @@ steps:
     steps:
       - label: "Windows:2022:amd64:sudo"
         depends_on:
-          - packaging-windows
+          - packaging-windows-amd64
         env:
           TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/leak"
         command: |
-          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows'
+          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows-amd64'
           .buildkite/scripts/steps/integration_tests_tf.ps1 fleet true
         artifact_paths:
           - build/**
@@ -119,11 +119,11 @@ steps:
 
       - label: "Windows:2025:amd64:sudo"
         depends_on:
-          - packaging-windows
+          - packaging-windows-amd64
         env:
           TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/leak"
         command: |
-          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows'
+          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows-amd64'
           .buildkite/scripts/steps/integration_tests_tf.ps1 fleet true
         artifact_paths:
           - build/**
@@ -168,11 +168,11 @@ steps:
     steps:
       - label: "Win2022:sudo:{{matrix}}"
         depends_on:
-          - packaging-windows
+          - packaging-windows-amd64
         env:
           TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
         command: |
-          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows'
+          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows-amd64'
           .buildkite/scripts/steps/integration_tests_tf.ps1 {{matrix}} true
         artifact_paths:
           - build/**
@@ -198,11 +198,11 @@ steps:
 
       - label: "Win2022:non-sudo:{{matrix}}"
         depends_on:
-          - packaging-windows
+          - packaging-windows-amd64
         env:
           TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
         command: |
-          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows'
+          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows-amd64'
           .buildkite/scripts/steps/integration_tests_tf.ps1 {{matrix}} false
         artifact_paths:
           - build/**
@@ -221,11 +221,11 @@ steps:
 
       - label: "Win2025:sudo:{{matrix}}"
         depends_on:
-          - packaging-windows
+          - packaging-windows-amd64
         env:
           TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
         command: |
-          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows'
+          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows-amd64'
           .buildkite/scripts/steps/integration_tests_tf.ps1 {{matrix}} true
         artifact_paths:
           - build/**
@@ -251,11 +251,11 @@ steps:
 
       - label: "Win2025:non-sudo:{{matrix}}"
         depends_on:
-          - packaging-windows
+          - packaging-windows-amd64
         env:
           TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
         command: |
-          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows'
+          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows-amd64'
           .buildkite/scripts/steps/integration_tests_tf.ps1 {{matrix}} false
         artifact_paths:
           - build/**
@@ -555,11 +555,11 @@ steps:
     steps:
       - label: "Windows:2022:amd64:sudo"
         depends_on:
-          - packaging-windows
+          - packaging-windows-amd64
         env:
           TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/serverless"
         command: |
-          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows'
+          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows-amd64'
           .buildkite/scripts/buildkite-integration-tests.ps1 fleet true
         artifact_paths:
           - build/**
@@ -577,11 +577,11 @@ steps:
 
       - label: "Windows:2025:amd64:sudo"
         depends_on:
-          - packaging-windows
+          - packaging-windows-amd64
         env:
           TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/serverless"
         command: |
-          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows'
+          buildkite-agent artifact download build/distributions/** . --step 'packaging-windows-amd64'
           .buildkite/scripts/buildkite-integration-tests.ps1 fleet true
         artifact_paths:
           - build/**

.buildkite/integration.pipeline.yml

@@ -91,7 +91,7 @@ steps:
           image: "${IMAGE_UBUNTU_2204_ARM_64}"
 
       - label: "Packaging: windows/amd64 zip"
-        key: packaging-windows
+        key: packaging-windows-amd64
         env:
           PACKAGES: "zip"
           PLATFORMS: "windows/amd64"
@@ -106,6 +106,22 @@ steps:
           machineType: "n2-standard-8"
           image: "${IMAGE_UBUNTU_2204_X86_64}"
 
+      - label: "Packaging: windows/arm64 zip"
+        key: packaging-windows-arm64
+        env:
+          PACKAGES: "zip"
+          PLATFORMS: "windows/arm64"
+        command: ".buildkite/scripts/steps/integration-package.sh"
+        artifact_paths:
+          - build/distributions/**
+        retry:
+          automatic:
+            limit: 1
+        agents:
+          provider: "aws"
+          instanceType: "c6g.4xlarge"
+          image: "${IMAGE_UBUNTU_2204_ARM_64}"
+
       - label: "Packaging: Containers linux/amd64"
         key: packaging-containers-x86-64
         env:

.buildkite/pipeline.elastic-agent-binary-dra.yml

@@ -47,7 +47,7 @@ steps:
         PLATFORMS: "linux/amd64"
         FIPS: "true"
 
-    - label: ":package: linux/arm64 darwin/arm64 Elastic-Agent Core Snapshot"
+    - label: ":package: linux/arm64 darwin/arm64 windows/arm64 Elastic-Agent Core Snapshot"
       commands:
         - .buildkite/scripts/steps/build-agent-core.sh
       key: "build-dra-snapshot-arm"
@@ -59,7 +59,7 @@ steps:
         imagePrefix: "core-ubuntu-2204-aarch64"
       env:
         DRA_WORKFLOW: "snapshot"
-        PLATFORMS: "linux/arm64 darwin/arm64"
+        PLATFORMS: "linux/arm64 darwin/arm64 windows/arm64"
 
     - label: ":package: linux/arm64 FIPS Elastic-Agent Core Snapshot"
       commands:

.buildkite/pipeline.elastic-agent-package.yml

@@ -93,8 +93,8 @@ steps:
           imagePrefix: "core-ubuntu-2204-aarch64"
           diskSizeGb: 400
         env:
-          PLATFORMS: "linux/arm64 darwin/arm64"
-          PACKAGES: "docker,tar.gz,deb,rpm"
+          PLATFORMS: "linux/arm64 darwin/arm64 windows/arm64"
+          PACKAGES: "docker,tar.gz,deb,rpm,zip"
           FIPS: "{{matrix.fips}}"
         command: |
           echo "Add support for multiarch"

dev-tools/mage/crossbuild.go

@@ -242,6 +242,8 @@ func CrossBuildImage(platform string) (string, error) {
 		tagSuffix = "s390x-debian11"
 	case strings.HasPrefix(platform, "linux"):
 		tagSuffix = "main-debian11"
+	case platform == "windows/arm64":
+		tagSuffix = "windows-arm64-debian12"
 	}
 
 	goVersion, err := GoVersion()

dev-tools/mage/manifest/manifest.go

@@ -93,6 +93,7 @@ var PlatformPackages = map[string]string{
 	"linux/amd64":   "linux-x86_64.tar.gz",
 	"linux/arm64":   "linux-arm64.tar.gz",
 	"windows/amd64": "windows-x86_64.zip",
+	"windows/arm64": "windows-arm64.zip",
 }
 
 // DownloadManifest is going to download the given manifest file and return the ManifestResponse

dev-tools/mage/pkgtypes.go

@@ -146,6 +146,7 @@ var OSArchNames = map[string]map[PackageType]map[string]string{
 		Zip: {
 			"386":   "x86",
 			"amd64": "x86_64",
+			"arm64": "arm64",
 		},
 	},
 	"darwin": {

dev-tools/mage/platforms.go

@@ -54,6 +54,7 @@ var BuildPlatforms = BuildPlatformList{
 	{"solaris/amd64", CGOSupported},
 	{"windows/386", CGOSupported | CrossBuildSupported | Default},
 	{"windows/amd64", CGOSupported | CrossBuildSupported | Default},
+	{"windows/arm64", CGOSupported | CrossBuildSupported | Default},
 }
 
 // PlatformFeature specifies features that are supported for a platform.
@@ -244,6 +245,7 @@ func (list BuildPlatformList) Remove(name string) BuildPlatformList {
 	}
 
 	return list.filter(func(bp BuildPlatform) bool {
+		//nolint:staticcheck // leaving as-is since some find it easier to read
 		return !(bp.GOOS() == attrs.GOOS && bp.Arch() == attrs.Arch)
 	})
 }

dev-tools/mage/platforms_test.go

@@ -97,8 +97,9 @@ func TestBuildPlatformsListFilter(t *testing.T) {
 	assert.Len(t, BuildPlatforms.Filter("solaris"), 1)
 	assert.Len(t, BuildPlatforms.Defaults().Filter("solaris"), 0)
 
-	assert.Len(t, BuildPlatforms.Filter("windows"), 2)
+	assert.Len(t, BuildPlatforms.Filter("windows"), 3)
 	assert.Len(t, BuildPlatforms.Filter("windows/386"), 1)
+	assert.Len(t, BuildPlatforms.Filter("windows/arm64"), 1)
 	assert.Len(t, BuildPlatforms.Filter("!defaults"), len(BuildPlatforms)-len(BuildPlatforms.Defaults()))
 
 	defaults := BuildPlatforms.Defaults()

dev-tools/packaging/packages.yml

@@ -13,6 +13,9 @@ platforms: &all-platforms
   - &windows-amd64
     os: windows
     arch: x86_64
+  - &windows-arm64
+    os: windows
+    arch: arm64
   - &darwin-amd64
     os: darwin
     arch: x86_64
@@ -68,6 +71,7 @@ components:
     binaryName: agentbeat
     fips: false
     platforms: *all-platforms
+
     packageTypes: *all-package-types
   - &comp-apm_server
     projectName: apm-server
@@ -120,7 +124,12 @@ components:
     rootDir: fleet-server-{{.Version}}-{{.Platform}}
     binaryName: fleet-server
     fips: false
-    platforms: *all-platforms
+    platforms:
+      - *linux-amd64
+      - *linux-arm64
+      - *windows-amd64
+      - *darwin-amd64
+      - *darwin-arm64
     packageTypes: *all-package-types
   - &comp-pf-elastic-collector
     projectName: prodfiler

dev-tools/packaging/settings.go

@@ -42,6 +42,10 @@ var (
 			platform: "windows-x86_64",
 			ext:      "zip",
 		},
+		"windows/arm64": {
+			platform: "windows-arm64",
+			ext:      "zip",
+		},
 	}
 	settings *packagesConfig
 )

magefile.go

@@ -313,7 +313,7 @@ func (Build) WindowsArchiveRootBinary() error {
 		},
 		Env: map[string]string{
 			"GOOS":   "windows",
-			"GOARCH": "amd64",
+			"GOARCH": devtools.GOARCH,
 		},
 		LDFlags: []string{
 			"-s", // Strip all debug symbols from binary (does not affect Go stack traces).
@@ -1205,7 +1205,7 @@ func packageAgent(ctx context.Context, platforms []string, dependenciesVersion s
 	mg.Deps(agentBinaryTarget)
 
 	// compile the elastic-agent.exe proxy binary for the windows archive
-	if slices.Contains(platforms, "windows/amd64") {
+	if slices.Contains(platforms, "windows/amd64") || slices.Contains(platforms, "windows/arm64") {
 		mg.Deps(Build.WindowsArchiveRootBinary)
 	}
 

pkg/testing/common/config_test.go

@@ -40,10 +40,6 @@ func TestConfig_GetPlatforms(t *testing.T) {
 			Platforms: []string{"linux/arm64/centos/12/toomany"},
 			Err:       errors.New(`failed to parse platform string "linux/arm64/centos/12/toomany": more than 3 separators`),
 		},
-		{
-			Platforms: []string{"windows/arm64"},
-			Err:       errors.New(`failed to parse platform string "windows/arm64": windows on arm64 not supported`),
-		},
 		{
 			Platforms: []string{"linux/arm64/centos", "windows/arm64/toomany/2022"},
 			Err:       errors.New(`failed to parse platform string "windows/arm64/toomany/2022": more than 2 separators`),
@@ -62,6 +58,7 @@ func TestConfig_GetPlatforms(t *testing.T) {
 				"windows",
 				"windows/amd64",
 				"windows/amd64/2022",
+				"windows/arm64",
 			},
 			Results: []define.OS{
 				{
@@ -114,6 +111,10 @@ func TestConfig_GetPlatforms(t *testing.T) {
 					Arch:    define.AMD64,
 					Version: "2022",
 				},
+				{
+					Type: define.Windows,
+					Arch: define.ARM64,
+				},
 			},
 		},
 	}

pkg/testing/define/requirements.go

@@ -72,9 +72,6 @@ func (o OS) Validate() error {
 		if o.Arch != AMD64 && o.Arch != ARM64 {
 			return errors.New("arch must be either amd64 or arm64")
 		}
-		if o.Type == Windows && o.Arch == ARM64 {
-			return errors.New("windows on arm64 not supported")
-		}
 	}
 	if o.Distro != "" && (o.Type != Linux && o.Type != Kubernetes) {
 		return errors.New("distro can only be set when type is linux or kubernetes")

specs/endpoint-security.spec.yml

@@ -1,5 +1,5 @@
 version: 2
-component_files: 
+component_files:
  - endpoint-security-resources.zip
 inputs:
   - name: endpoint
@@ -83,6 +83,7 @@ inputs:
     description: "Endpoint Security"
     platforms:
       - windows/amd64
+      - windows/arm64
     outputs: *outputs
     proxied_actions: *proxied_actions
     runtime:
@@ -91,8 +92,8 @@ inputs:
           message: "Elastic Defend requires Elastic Agent be running as Administrator or SYSTEM"
         - condition: ${install.in_default} == false
           message: "Elastic Defend requires Elastic Agent be installed at the default installation path"
-        - condition: ${runtime.native_arch} != '' and ${runtime.native_arch} != 'amd64'
-          message: "Elastic Defend cannot be installed on Windows running on non-AMD64 CPU"
+        - condition: ${runtime.native_arch} != '' and ${runtime.arch} != ${runtime.native_arch}
+          message: "Elastic Defend cannot be installed on an emulated architecture"
         - condition: ${runtime.major} < 6 or (${runtime.major} == 6 and ${runtime.minor} < 2)
           message: "Elastic Defend requires Windows 10 / Server 2012 or newer."
     service: