feat: add postdownload script support for agent types

Author: vjripoll

.github/workflows/poc_ebpf.yml

@@ -0,0 +1,97 @@
+name: eBPF PoC Pipeline
+
+# Runs on push to feat/poc_ebpf_package branch and can be triggered manually
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - feat/poc_ebpf_package
+      - main
+  pull_request:
+    branches:
+      - feat/poc_ebpf_package
+      - main
+  schedule:
+    # Scheduled to run at 4 a.m on every day-of-week from Monday through Friday.
+    - cron: "0 4 * * 1-5"
+
+permissions:
+  contents: read
+
+jobs:
+  build-packages:
+    name: Build packages
+    uses: ./.github/workflows/component_packages.yml
+    with:
+      pre-release: false
+      tag_name: 0.100.${{ github.run_id }}
+    secrets:
+      gh_token: ${{ secrets.GITHUB_TOKEN }}
+      gpg_private_key_base64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }}
+      gpg_passphrase: ${{ secrets.OHAI_GPG_PASSPHRASE }}
+      pfx_certificate_base64: ${{ secrets.OHAI_PFX_CERTIFICATE_BASE64 }}
+      pfx_passphrase: ${{ secrets.OHAI_PFX_PASSPHRASE }}
+
+  build-image:
+    name: Build and Push nightly image
+    uses: ./.github/workflows/component_image.yml
+    with:
+      # the packages are created with 0.100.run_id, however we still push the image with nightly
+      image-tag: nightly
+      ac-version: nightly
+      push: true
+    secrets: inherit
+
+  security-image:
+    name: Security scan
+    needs: [ build-image ]
+    uses: ./.github/workflows/component_image_security.yml
+    with:
+      # the packages are created with 0.100.run_id, however we still push the image with nightly
+      image-tag: nightly
+    secrets: inherit
+
+  security-source-code:
+    uses: ./.github/workflows/component_security.yml
+
+  # This is currently required for canaries
+  upload-packages-s3:
+    runs-on: ubuntu-latest
+    needs: [ build-packages ]
+    name: Upload packages to testing bucket
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: built-binaries-0.100.${{ github.run_id }}
+          path: ./
+
+      - name: Publish deb to S3 action
+        uses: newrelic/infrastructure-publish-action@26d9d8604b2cf2e7343dc287c958e8bbc1a3f750 # v1
+        with:
+          tag: 0.100.${{ github.run_id }}
+          app_name: "newrelic-agent-control"
+          repo_name: ${{ github.repository }}
+          schema: "custom-local"
+          schema_path: "/srv/build/upload-schema-linux-deb-nightly.yml"
+          aws_access_key_id: ${{ secrets.OHAI_AWS_ACCESS_KEY_ID_TESTING }}
+          aws_secret_access_key: ${{ secrets.OHAI_AWS_SECRET_ACCESS_KEY_TESTING }}
+          aws_s3_bucket_name: "nr-downloads-ohai-testing"
+          aws_s3_lock_bucket_name: "onhost-ci-lock-testing"
+          access_point_host: "testing"
+          run_id: ${{ github.run_id }}
+          aws_region: "us-east-1"
+          aws_role_session_name: ${{ secrets.OHAI_AWS_ROLE_SESSION_NAME_TESTING }}
+          aws_role_arn: ${{ secrets.OHAI_AWS_ROLE_ARN_TESTING }}
+          # used for signing package stuff
+          gpg_passphrase: ${{ secrets.OHAI_GPG_PASSPHRASE }}
+          gpg_private_key_base64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }} # base64 encoded
+          disable_lock: false
+          dest_prefix: "poc_ebpf/"
+          local_packages_path: "/srv/dist/"
+          apt_skip_mirror: true
+

CHANGELOG.md

@@ -16,6 +16,7 @@ Remember that the keywords that you can use are the following:
 
 ### enhancement
 - Added support for JP endpoints.
+- add post-download script support for OCI packages.
 - Agent type definitions now use a flat per-platform schema (one YAML file per `(platform, operating_system)` pair). 
   Agent type FQNs and configuration values are unchanged, so this is **not a breaking change** for end users.
   Internal authors of custom agent type definitions need to migrate their YAMLs — see [docs/INTEGRATING_AGENTS.md](docs/INTEGRATING_AGENTS.md).

agent-control/agent-type-registry/newrelic/host-linux-com.newrelic.ebpf-0.1.0.yaml

@@ -204,103 +204,83 @@ variables:
     type: bool
     required: false
     default: false
+  oci:
+    repository:
+      description: "OCI package repository name"
+      type: string
+      required: false
+      default: vjripoll/newrelic-agent-control-poc
+      variants:
+        ac_config_field: "oci_repository_urls"
+        values: [ "vjripoll/newrelic-agent-control-poc" ]
+  version:
+    description: "eBPF Agent package version"
+    type: string
+    required: true
 deployment:
+  packages:
+    ebpf-agent:
+      download:
+        oci:
+          repository: ${nr-var:oci.repository}
+          version: ${nr-var:version}
+      postdownload:
+        args:
+          - "/bin/bash"
+          - "postdownload.sh"
+        env:
+          PACKAGE_VERSION: "${nr-var:version}"
+        timeout: "300s"
   enable_file_logging: ${nr-var:enable_file_logging}
   version:
-    path: /usr/bin/nr-ebpf-agent-client
+    path: ${nr-sub:packages.ebpf-agent.dir}/lib/newrelic-ebpf-agent/bin/nr-ebpf-agent
     args:
       - --version
     regex: \d+\.\d+\.\d+
   executables:
-    - id: nr-ebpf-agent-client
-      path: /usr/bin/nr-ebpf-agent-client
-      env:
-        NEW_RELIC_LICENSE_KEY: "${nr-env:NEW_RELIC_LICENSE_KEY}"
-        DEPLOYMENT_NAME: "${nr-var:config_agent.DEPLOYMENT_NAME}"
-        OTLP_ENDPOINT: "${nr-var:config_agent.OTLP_ENDPOINT}"
-        NEW_RELIC_LOG_LEVEL: "${nr-var:config_agent.LOG_LEVEL}"
-        NEW_RELIC_LOG_FILE_PATH: "${nr-var:config_agent.LOG_FILE_PATH}"
-        DROP_DATA_FOR_ENTITY: "${nr-var:config_agent.DROP_DATA_FOR_ENTITY}"
-        TLS_ENABLED: "${nr-var:config_agent.TLS_ENABLED}"
-        TLS_AUTOGENERATE_CERT_ENABLED: "${nr-var:config_agent.TLS_AUTOGENERATE_CERT_ENABLED}"
-        TLS_CERT_PATH: "${nr-var:config_agent.TLS_CERT_PATH}"
-        TLS_CERT_FILE: "${nr-var:config_agent.TLS_CERT_FILE}"
-        TLS_KEY_FILE: "${nr-var:config_agent.TLS_KEY_FILE}"
-        TLS_CA_FILE: "${nr-var:config_agent.TLS_CA_FILE}"
-        TABLE_STORE_DATA_LIMIT_MB: "${nr-var:config_agent.TABLE_STORE_DATA_LIMIT_MB}"
-        PROTOCOLS_HTTP_ENABLED: "${nr-var:config_agent.PROTOCOLS_HTTP_ENABLED}"
-        PROTOCOLS_HTTP_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_HTTP_SPANS_ENABLED}"
-        PROTOCOLS_HTTP_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_HTTP_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_HTTP_SPANS_SAMPLING_ERROR_RATE: "${nr-var:config_agent.PROTOCOLS_HTTP_SPANS_SAMPLING_ERROR_RATE}"
-        PROTOCOLS_MYSQL_ENABLED: "${nr-var:config_agent.PROTOCOLS_MYSQL_ENABLED}"
-        PROTOCOLS_MYSQL_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_MYSQL_SPANS_ENABLED}"
-        PROTOCOLS_MYSQL_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_MYSQL_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_PGSQL_ENABLED: "${nr-var:config_agent.PROTOCOLS_PGSQL_ENABLED}"
-        PROTOCOLS_PGSQL_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_PGSQL_SPANS_ENABLED}"
-        PROTOCOLS_PGSQL_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_PGSQL_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_CASS_ENABLED: "${nr-var:config_agent.PROTOCOLS_CASS_ENABLED}"
-        PROTOCOLS_CASS_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_CASS_SPANS_ENABLED}"
-        PROTOCOLS_CASS_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_CASS_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_REDIS_ENABLED: "${nr-var:config_agent.PROTOCOLS_REDIS_ENABLED}"
-        PROTOCOLS_REDIS_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_REDIS_SPANS_ENABLED}"
-        PROTOCOLS_REDIS_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_REDIS_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_MONGODB_ENABLED: "${nr-var:config_agent.PROTOCOLS_MONGODB_ENABLED}"
-        PROTOCOLS_MONGODB_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_MONGODB_SPANS_ENABLED}"
-        PROTOCOLS_MONGODB_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_MONGODB_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_KAFKA_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_KAFKA_SPANS_ENABLED}"
-        PROTOCOLS_KAFKA_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_KAFKA_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_AMQP_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_AMQP_SPANS_ENABLED}"
-        PROTOCOLS_AMQP_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_AMQP_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_DNS_ENABLED: "${nr-var:config_agent.PROTOCOLS_DNS_ENABLED}"
-        PROTOCOLS_DNS_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_DNS_SPANS_ENABLED}"
-        PROTOCOLS_DNS_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_DNS_SPANS_SAMPLING_LATENCY}"
-      restart_policy:
-        backoff_strategy:
-          type: fixed
-          backoff_delay: ${nr-var:backoff_delay}
-    - id: nr-ebpf-agent
-      path: /usr/bin/nr-ebpf-agent
-      env:
-        NEW_RELIC_LICENSE_KEY: "${nr-env:NEW_RELIC_LICENSE_KEY}"
-        DEPLOYMENT_NAME: "${nr-var:config_agent.DEPLOYMENT_NAME}"
-        OTLP_ENDPOINT: "${nr-var:config_agent.OTLP_ENDPOINT}"
-        NEW_RELIC_LOG_LEVEL: "${nr-var:config_agent.LOG_LEVEL}"
-        NEW_RELIC_LOG_FILE_PATH: "${nr-var:config_agent.LOG_FILE_PATH}"
-        DROP_DATA_FOR_ENTITY: "${nr-var:config_agent.DROP_DATA_FOR_ENTITY}"
-        TLS_ENABLED: "${nr-var:config_agent.TLS_ENABLED}"
-        TLS_AUTOGENERATE_CERT_ENABLED: "${nr-var:config_agent.TLS_AUTOGENERATE_CERT_ENABLED}"
-        TLS_CERT_PATH: "${nr-var:config_agent.TLS_CERT_PATH}"
-        TLS_CERT_FILE: "${nr-var:config_agent.TLS_CERT_FILE}"
-        TLS_KEY_FILE: "${nr-var:config_agent.TLS_KEY_FILE}"
-        TLS_CA_FILE: "${nr-var:config_agent.TLS_CA_FILE}"
-        TABLE_STORE_DATA_LIMIT_MB: "${nr-var:config_agent.TABLE_STORE_DATA_LIMIT_MB}"
-        PROTOCOLS_HTTP_ENABLED: "${nr-var:config_agent.PROTOCOLS_HTTP_ENABLED}"
-        PROTOCOLS_HTTP_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_HTTP_SPANS_ENABLED}"
-        PROTOCOLS_HTTP_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_HTTP_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_HTTP_SPANS_SAMPLING_ERROR_RATE: "${nr-var:config_agent.PROTOCOLS_HTTP_SPANS_SAMPLING_ERROR_RATE}"
-        PROTOCOLS_MYSQL_ENABLED: "${nr-var:config_agent.PROTOCOLS_MYSQL_ENABLED}"
-        PROTOCOLS_MYSQL_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_MYSQL_SPANS_ENABLED}"
-        PROTOCOLS_MYSQL_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_MYSQL_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_PGSQL_ENABLED: "${nr-var:config_agent.PROTOCOLS_PGSQL_ENABLED}"
-        PROTOCOLS_PGSQL_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_PGSQL_SPANS_ENABLED}"
-        PROTOCOLS_PGSQL_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_PGSQL_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_CASS_ENABLED: "${nr-var:config_agent.PROTOCOLS_CASS_ENABLED}"
-        PROTOCOLS_CASS_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_CASS_SPANS_ENABLED}"
-        PROTOCOLS_CASS_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_CASS_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_REDIS_ENABLED: "${nr-var:config_agent.PROTOCOLS_REDIS_ENABLED}"
-        PROTOCOLS_REDIS_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_REDIS_SPANS_ENABLED}"
-        PROTOCOLS_REDIS_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_REDIS_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_MONGODB_ENABLED: "${nr-var:config_agent.PROTOCOLS_MONGODB_ENABLED}"
-        PROTOCOLS_MONGODB_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_MONGODB_SPANS_ENABLED}"
-        PROTOCOLS_MONGODB_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_MONGODB_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_KAFKA_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_KAFKA_SPANS_ENABLED}"
-        PROTOCOLS_KAFKA_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_KAFKA_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_AMQP_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_AMQP_SPANS_ENABLED}"
-        PROTOCOLS_AMQP_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_AMQP_SPANS_SAMPLING_LATENCY}"
-        PROTOCOLS_DNS_ENABLED: "${nr-var:config_agent.PROTOCOLS_DNS_ENABLED}"
-        PROTOCOLS_DNS_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_DNS_SPANS_ENABLED}"
-        PROTOCOLS_DNS_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_DNS_SPANS_SAMPLING_LATENCY}"
-      restart_policy:
-        backoff_strategy:
-          type: fixed
-          backoff_delay: ${nr-var:backoff_delay}
+      - id: nr-ebpf-agent
+        path: ${nr-sub:packages.ebpf-agent.dir}/lib/newrelic-ebpf-agent/bin/nr-ebpf-agent
+        env:
+          NEW_RELIC_LICENSE_KEY: "${nr-env:NEW_RELIC_LICENSE_KEY}"
+          DEPLOYMENT_NAME: "${nr-var:config_agent.DEPLOYMENT_NAME}"
+          OTLP_ENDPOINT: "${nr-var:config_agent.OTLP_ENDPOINT}"
+          NEW_RELIC_LOG_LEVEL: "${nr-var:config_agent.LOG_LEVEL}"
+          NEW_RELIC_LOG_FILE_PATH: "${nr-var:config_agent.LOG_FILE_PATH}"
+          DROP_DATA_FOR_ENTITY: "${nr-var:config_agent.DROP_DATA_FOR_ENTITY}"
+          TLS_ENABLED: "${nr-var:config_agent.TLS_ENABLED}"
+          TLS_AUTOGENERATE_CERT_ENABLED: "${nr-var:config_agent.TLS_AUTOGENERATE_CERT_ENABLED}"
+          TLS_CERT_PATH: "${nr-var:config_agent.TLS_CERT_PATH}"
+          TLS_CERT_FILE: "${nr-var:config_agent.TLS_CERT_FILE}"
+          TLS_KEY_FILE: "${nr-var:config_agent.TLS_KEY_FILE}"
+          TLS_CA_FILE: "${nr-var:config_agent.TLS_CA_FILE}"
+          TABLE_STORE_DATA_LIMIT_MB: "${nr-var:config_agent.TABLE_STORE_DATA_LIMIT_MB}"
+          PROTOCOLS_HTTP_ENABLED: "${nr-var:config_agent.PROTOCOLS_HTTP_ENABLED}"
+          PROTOCOLS_HTTP_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_HTTP_SPANS_ENABLED}"
+          PROTOCOLS_HTTP_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_HTTP_SPANS_SAMPLING_LATENCY}"
+          PROTOCOLS_HTTP_SPANS_SAMPLING_ERROR_RATE: "${nr-var:config_agent.PROTOCOLS_HTTP_SPANS_SAMPLING_ERROR_RATE}"
+          PROTOCOLS_MYSQL_ENABLED: "${nr-var:config_agent.PROTOCOLS_MYSQL_ENABLED}"
+          PROTOCOLS_MYSQL_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_MYSQL_SPANS_ENABLED}"
+          PROTOCOLS_MYSQL_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_MYSQL_SPANS_SAMPLING_LATENCY}"
+          PROTOCOLS_PGSQL_ENABLED: "${nr-var:config_agent.PROTOCOLS_PGSQL_ENABLED}"
+          PROTOCOLS_PGSQL_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_PGSQL_SPANS_ENABLED}"
+          PROTOCOLS_PGSQL_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_PGSQL_SPANS_SAMPLING_LATENCY}"
+          PROTOCOLS_CASS_ENABLED: "${nr-var:config_agent.PROTOCOLS_CASS_ENABLED}"
+          PROTOCOLS_CASS_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_CASS_SPANS_ENABLED}"
+          PROTOCOLS_CASS_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_CASS_SPANS_SAMPLING_LATENCY}"
+          PROTOCOLS_REDIS_ENABLED: "${nr-var:config_agent.PROTOCOLS_REDIS_ENABLED}"
+          PROTOCOLS_REDIS_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_REDIS_SPANS_ENABLED}"
+          PROTOCOLS_REDIS_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_REDIS_SPANS_SAMPLING_LATENCY}"
+          PROTOCOLS_MONGODB_ENABLED: "${nr-var:config_agent.PROTOCOLS_MONGODB_ENABLED}"
+          PROTOCOLS_MONGODB_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_MONGODB_SPANS_ENABLED}"
+          PROTOCOLS_MONGODB_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_MONGODB_SPANS_SAMPLING_LATENCY}"
+          PROTOCOLS_KAFKA_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_KAFKA_SPANS_ENABLED}"
+          PROTOCOLS_KAFKA_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_KAFKA_SPANS_SAMPLING_LATENCY}"
+          PROTOCOLS_AMQP_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_AMQP_SPANS_ENABLED}"
+          PROTOCOLS_AMQP_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_AMQP_SPANS_SAMPLING_LATENCY}"
+          PROTOCOLS_DNS_ENABLED: "${nr-var:config_agent.PROTOCOLS_DNS_ENABLED}"
+          PROTOCOLS_DNS_SPANS_ENABLED: "${nr-var:config_agent.PROTOCOLS_DNS_SPANS_ENABLED}"
+          PROTOCOLS_DNS_SPANS_SAMPLING_LATENCY: "${nr-var:config_agent.PROTOCOLS_DNS_SPANS_SAMPLING_LATENCY}"
+        restart_policy:
+          backoff_strategy:
+            type: fixed
+            backoff_delay: ${nr-var:backoff_delay}

agent-control/src/agent_control/version_updater/on_host.rs

@@ -136,6 +136,7 @@ where
                 version: new_version,
                 public_key_url: Some(self.pub_key_url.clone()),
             },
+            postdownload: None,
         }
     }
 }

agent-control/src/agent_type/definition.rs

@@ -303,6 +303,7 @@ pub fn include_packages_variables(
         let package_data = PackageData {
             id: package_id.to_string(),
             oci: package.download.oci.clone(),
+            postdownload: package.postdownload.clone(),
         };
         let path =
             get_package_path(Path::new(remote_dir), &agent_id, &package_data).map_err(|e| {

agent-control/src/agent_type/runtime_config/on_host.rs

@@ -169,6 +169,7 @@ mod tests {
                     )),
                 },
             },
+            postdownload: None,
         };
 
         let expected_packages = HashMap::from([

agent-control/src/agent_type/runtime_config/on_host/package.rs

@@ -14,6 +14,9 @@ pub mod rendered;
 pub(super) struct Package {
     /// Download defines the supported repository sources for the packages.
     pub download: Download,
+    /// Postdownload script to execute after downloading and extracting the package.
+    /// All validations, checks, and installation steps should go here.
+    pub postdownload: Option<Postdownload>,
 }
 
 pub type PackageID = String;
@@ -35,11 +38,37 @@ pub struct Oci {
     pub public_key_url: Option<TemplateableValue<String>>,
 }
 
+#[derive(Debug, Deserialize, Clone, PartialEq)]
+pub struct Postdownload {
+    /// Arguments where first element is the command/executable (e.g., "bash", "sh", "python3"),
+    /// second element is the script path, followed by additional arguments.
+    /// Example: ["bash", "postdownload.sh", "--verbose"]
+    pub args: Vec<TemplateableValue<String>>,
+
+    /// Environmental variables passed to the process.
+    #[serde(default)]
+    pub env: std::collections::HashMap<String, TemplateableValue<String>>,
+
+    /// Maximum time to wait for the script to complete.
+    #[serde(default = "default_postdownload_timeout")]
+    pub timeout: TemplateableValue<String>,
+}
+
+fn default_postdownload_timeout() -> TemplateableValue<String> {
+    TemplateableValue::new("300s".to_string())
+}
+
 impl Templateable for Package {
     type Output = rendered::Package;
     fn template_with(self, variables: &Variables) -> Result<Self::Output, AgentTypeError> {
+        let postdownload = self
+            .postdownload
+            .map(|pd| pd.template_with(variables))
+            .transpose()?;
+
         Ok(Self::Output {
             download: self.download.template_with(variables)?,
+            postdownload,
         })
     }
 }
@@ -86,6 +115,38 @@ impl Templateable for Oci {
     }
 }
 
+impl Templateable for Postdownload {
+    type Output = rendered::Postdownload;
+    fn template_with(self, variables: &Variables) -> Result<Self::Output, AgentTypeError> {
+        let timeout_str = self.timeout.template_with(variables)?;
+
+        let args: Vec<String> = self
+            .args
+            .into_iter()
+            .map(|arg| arg.template_with(variables))
+            .collect::<Result<Vec<String>, AgentTypeError>>()?;
+
+        if args.len() < 2 {
+            return Err(AgentTypeError::OCIReferenceParsingError(
+                "postdownload args must have at least 2 elements: command and script path"
+                    .to_string(),
+            ));
+        }
+
+        let env: std::collections::HashMap<String, String> = self
+            .env
+            .into_iter()
+            .map(|(k, v)| v.template_with(variables).map(|templated| (k, templated)))
+            .collect::<Result<std::collections::HashMap<_, _>, AgentTypeError>>()?;
+
+        let timeout = duration_str::parse(&timeout_str).map_err(|err| {
+            AgentTypeError::OCIReferenceParsingError(format!("invalid timeout format: {err}"))
+        })?;
+
+        Ok(Self::Output { args, env, timeout })
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use std::str::FromStr;