feat: add postdownload script support for agent types

Author: vjripoll

.github/workflows/poc_ebpf.yml

@@ -0,0 +1,97 @@
+name: eBPF PoC Pipeline
+
+# Runs on push to feat/poc_ebpf_package branch and can be triggered manually
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - feat/poc_ebpf_package
+      - main
+  pull_request:
+    branches:
+      - feat/poc_ebpf_package
+      - main
+  schedule:
+    # Scheduled to run at 4 a.m on every day-of-week from Monday through Friday.
+    - cron: "0 4 * * 1-5"
+
+permissions:
+  contents: read
+
+jobs:
+  build-packages:
+    name: Build packages
+    uses: ./.github/workflows/component_packages.yml
+    with:
+      pre-release: false
+      tag_name: 0.100.${{ github.run_id }}
+    secrets:
+      gh_token: ${{ secrets.GITHUB_TOKEN }}
+      gpg_private_key_base64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }}
+      gpg_passphrase: ${{ secrets.OHAI_GPG_PASSPHRASE }}
+      pfx_certificate_base64: ${{ secrets.OHAI_PFX_CERTIFICATE_BASE64 }}
+      pfx_passphrase: ${{ secrets.OHAI_PFX_PASSPHRASE }}
+
+  build-image:
+    name: Build and Push nightly image
+    uses: ./.github/workflows/component_image.yml
+    with:
+      # the packages are created with 0.100.run_id, however we still push the image with nightly
+      image-tag: nightly
+      ac-version: nightly
+      push: true
+    secrets: inherit
+
+  security-image:
+    name: Security scan
+    needs: [ build-image ]
+    uses: ./.github/workflows/component_image_security.yml
+    with:
+      # the packages are created with 0.100.run_id, however we still push the image with nightly
+      image-tag: nightly
+    secrets: inherit
+
+  security-source-code:
+    uses: ./.github/workflows/component_security.yml
+
+  # This is currently required for canaries
+  upload-packages-s3:
+    runs-on: ubuntu-latest
+    needs: [ build-packages ]
+    name: Upload packages to testing bucket
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: built-binaries-0.100.${{ github.run_id }}
+          path: ./
+
+      - name: Publish deb to S3 action
+        uses: newrelic/infrastructure-publish-action@26d9d8604b2cf2e7343dc287c958e8bbc1a3f750 # v1
+        with:
+          tag: 0.100.${{ github.run_id }}
+          app_name: "newrelic-agent-control"
+          repo_name: ${{ github.repository }}
+          schema: "custom-local"
+          schema_path: "/srv/build/upload-schema-linux-deb-nightly.yml"
+          aws_access_key_id: ${{ secrets.OHAI_AWS_ACCESS_KEY_ID_TESTING }}
+          aws_secret_access_key: ${{ secrets.OHAI_AWS_SECRET_ACCESS_KEY_TESTING }}
+          aws_s3_bucket_name: "nr-downloads-ohai-testing"
+          aws_s3_lock_bucket_name: "onhost-ci-lock-testing"
+          access_point_host: "testing"
+          run_id: ${{ github.run_id }}
+          aws_region: "us-east-1"
+          aws_role_session_name: ${{ secrets.OHAI_AWS_ROLE_SESSION_NAME_TESTING }}
+          aws_role_arn: ${{ secrets.OHAI_AWS_ROLE_ARN_TESTING }}
+          # used for signing package stuff
+          gpg_passphrase: ${{ secrets.OHAI_GPG_PASSPHRASE }}
+          gpg_private_key_base64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }} # base64 encoded
+          disable_lock: false
+          dest_prefix: "poc_ebpf/"
+          local_packages_path: "/srv/dist/"
+          apt_skip_mirror: true
+

CHANGELOG.md

@@ -14,7 +14,8 @@ Remember that the keywords that you can use are the following:
 
 ## Unreleased
 
-### enhancement
+### enhancements
+- add post-download script support for OCI packages.
 - Agent type definitions now use a flat per-platform schema (one YAML file per `(platform, operating_system)` pair). 
   Agent type FQNs and configuration values are unchanged, so this is **not a breaking change** for end users.
   Internal authors of custom agent type definitions need to migrate their YAMLs — see [docs/INTEGRATING_AGENTS.md](docs/INTEGRATING_AGENTS.md).

agent-control/src/agent_control/version_updater/on_host.rs

@@ -135,6 +135,7 @@ where
                 repository: self.repository.clone(),
                 version: new_version,
                 public_key_url: Some(self.pub_key_url.clone()),
+                postdownload: None,
             },
         }
     }

agent-control/src/agent_type/runtime_config/on_host.rs

@@ -167,6 +167,7 @@ mod tests {
                     public_key_url: Some(TemplateableValue::from_template(
                         "${nr-var:public-key-url}".to_string(),
                     )),
+                    postdownload: None,
                 },
             },
         };

agent-control/src/agent_type/runtime_config/on_host/package.rs

@@ -33,6 +33,29 @@ pub struct Oci {
     pub version: TemplateableValue<String>,
     /// Public key url is expected to be a jwks.
     pub public_key_url: Option<TemplateableValue<String>>,
+    /// Postdownload script to execute after downloading and extracting the package.
+    /// All validations, checks, and installation steps should go here.
+    pub postdownload: Option<Postdownload>,
+}
+
+#[derive(Debug, Deserialize, Clone, PartialEq)]
+pub struct Postdownload {
+    /// Arguments where first element is the command/executable (e.g., "bash", "sh", "python3"),
+    /// followed by script path and additional arguments.
+    /// Example: ["bash", "./scripts/postdownload.sh", "-e"]
+    pub args: Vec<TemplateableValue<String>>,
+
+    /// Environmental variables passed to the process.
+    #[serde(default)]
+    pub env: std::collections::HashMap<String, TemplateableValue<String>>,
+
+    /// Maximum time to wait for the script to complete.
+    #[serde(default = "default_postdownload_timeout")]
+    pub timeout: TemplateableValue<String>,
+}
+
+fn default_postdownload_timeout() -> TemplateableValue<String> {
+    TemplateableValue::new("300s".to_string())
 }
 
 impl Templateable for Package {
@@ -78,14 +101,52 @@ impl Templateable for Oci {
                 AgentTypeError::OCIReferenceParsingError(format!("invalid public_key_url: {err}"))
             })?;
 
+        let postdownload = self
+            .postdownload
+            .map(|pd| pd.template_with(variables))
+            .transpose()?;
+
         Ok(Self::Output {
             repository,
             version,
             public_key_url,
+            postdownload,
         })
     }
 }
 
+impl Templateable for Postdownload {
+    type Output = rendered::Postdownload;
+    fn template_with(self, variables: &Variables) -> Result<Self::Output, AgentTypeError> {
+        let timeout_str = self.timeout.template_with(variables)?;
+
+        let args: Vec<String> = self
+            .args
+            .into_iter()
+            .map(|arg| arg.template_with(variables))
+            .collect::<Result<Vec<String>, AgentTypeError>>()?;
+
+        if args.is_empty() {
+            return Err(AgentTypeError::OCIReferenceParsingError(
+                "postdownload args cannot be empty, first element must be the command/executable"
+                    .to_string(),
+            ));
+        }
+
+        let env: std::collections::HashMap<String, String> = self
+            .env
+            .into_iter()
+            .map(|(k, v)| v.template_with(variables).map(|templated| (k, templated)))
+            .collect::<Result<std::collections::HashMap<_, _>, AgentTypeError>>()?;
+
+        let timeout = duration_str::parse(&timeout_str).map_err(|err| {
+            AgentTypeError::OCIReferenceParsingError(format!("invalid timeout format: {err}"))
+        })?;
+
+        Ok(Self::Output { args, env, timeout })
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use std::str::FromStr;
@@ -130,6 +191,7 @@ mod tests {
             public_key_url: public_key_url
                 .clone()
                 .map(|_| TemplateableValue::from_template("${nr-var:public-key}".to_string())),
+            postdownload: None,
         };
 
         let rendered_oci = oci.template_with(&variables).unwrap();

agent-control/src/agent_type/runtime_config/on_host/package/rendered.rs

@@ -1,4 +1,4 @@
-use std::{fmt::Display, str::FromStr};
+use std::{fmt::Display, str::FromStr, time::Duration};
 
 use oci_client::Reference;
 use serde::{Deserialize, Serialize};
@@ -26,6 +26,18 @@ pub struct Oci {
     pub repository: Repository,
     pub version: Version,
     pub public_key_url: Option<Url>,
+    pub postdownload: Option<Postdownload>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Postdownload {
+    /// Arguments where first element is the command/executable, followed by arguments.
+    /// Example: ["bash", "./scripts/postdownload.sh", "-e"]
+    pub args: Vec<String>,
+    /// Environmental variables
+    pub env: std::collections::HashMap<String, String>,
+    /// Timeout duration
+    pub timeout: Duration,
 }
 
 const DEFAULT_TAG: &str = "latest";
@@ -268,6 +280,7 @@ mod tests {
                 repository: Repository::from_str(repository).unwrap(),
                 version: Version::from_str(version).unwrap(),
                 public_key_url: None,
+                postdownload: None,
             };
             let reference = oci.to_reference(&registry);
             assert_eq!(expected_whole, reference.whole());

agent-control/src/package.rs

@@ -1,2 +1,3 @@
 pub mod manager;
 pub mod oci;
+pub mod postdownload_executor;

agent-control/src/package/oci/downloader.rs

@@ -203,6 +203,7 @@ pub mod tests {
                 repository: Repository::from_str(REPOSITORY).unwrap(),
                 version: Version::from_str(VERSION).unwrap(),
                 public_key_url,
+                postdownload: None,
             },
         }
     }
@@ -450,6 +451,7 @@ pub mod tests {
                 version: Version::from_str(&format!("v1.0.0@{}", oci_mock.manifest_digest()))
                     .unwrap(),
                 public_key_url: None,
+                postdownload: None,
             },
         };
 

agent-control/src/package/oci/package_manager.rs

@@ -4,6 +4,7 @@ use crate::agent_control::defaults::PACKAGES_FOLDER_NAME;
 use crate::package::manager::{InstalledPackageData, PackageData, PackageManager};
 use crate::package::oci::artifact_definitions::LocalAgentPackage;
 use crate::package::oci::downloader::OCIArtifactDownloader;
+use crate::package::postdownload_executor::PostdownloadExecutor;
 use fs::directory_manager::{DirectoryManager, DirectoryManagerFs};
 use fs::file::LocalFile;
 use fs::file::reader::FileReader;
@@ -13,7 +14,7 @@ use std::io;
 use std::path::{Component, Path, PathBuf};
 use std::sync::Mutex;
 use thiserror::Error;
-use tracing::{debug, error, warn};
+use tracing::{debug, error, info, warn};
 
 pub type DefaultOCIPackageManager = OCIPackageManager<OCIArtifactDownloader, DirectoryManagerFs>;
 
@@ -106,6 +107,20 @@ where
         self.extract_package(&downloaded_package, install_path)
             .inspect_err(|e| warn!("OCI package installation failed: {}", e))?;
 
+        if let Some(postdownload) = &package_data.oci.postdownload {
+            info!(
+                "Executing postdownload script for package {}",
+                package_data.id
+            );
+            let executor = PostdownloadExecutor::new(install_path.to_path_buf());
+            executor.execute(postdownload).map_err(|e| {
+                OCIPackageManagerError::Install(io::Error::other(format!(
+                    "Postdownload script failed: {}",
+                    e
+                )))
+            })?;
+        }
+
         debug!("OCI package installed at {}", install_path.display());
         Ok(InstalledPackageData {
             id: package_data.id.clone(),
@@ -401,6 +416,7 @@ mod tests {
                 )
                 .unwrap(),
                 public_key_url: None,
+                postdownload: None,
             },
         }
     }
@@ -416,6 +432,7 @@ mod tests {
                 repository: Repository::from_str("newrelic/fake-agent").unwrap(),
                 version: Version::from_str(version).unwrap(),
                 public_key_url: None,
+                postdownload: None,
             },
         }
     }