[Artur Khantimirov (r2k1)]

What this PR does / why we need it:

Summary

Add an offline eMudhra root-removal check to the existing Linux VHD content test, before test setup can update CA packages.

read generated Linux CA bundles
require DigiCert Global Root G2 as a read-control
fail on unreadable data or either emSign ECC G3 / AAA signing root

The change adds 48 lines across two files: 20 script lines and 28 ShellSpec lines. Scope is Linux host trust only. It does not inspect components, containers, or custom CA stores, and it does not modify trust stores.

Removed the earlier Windows check and README section as requested. Windows images lacked the registry-cached EncodedCtl; that check failed before reaching a trust verdict. This PR no longer adds Windows certificate coverage.

Evidence

• Before: no eMudhra-specific Linux host trust assertion.
• After: six focused cases cover a valid control root, each signing-root path, empty output, failed parsing, and a missing bundle.
• Rebased onto main at 48e4c052f2. Published head: 68a991a94b0d2b207a2f7d60bcdc2506b31ba7ac.
• shellspec --shell bash spec/vhdbuilder/packer/test/linux_vhd_content_test_helpers_spec.sh spec/vhdbuilder/packer/test/run_test_spec.sh spec/vhdbuilder/packer/trivy_scan_spec.sh: passed, 68 examples after rebase.
• pwsh -NoLogo -NoProfile -Command 'function global:curl.exe { "127.0.0.1" }; Import-Module Pester -RequiredVersion 5.7.1; $c = New-PesterConfiguration; $c.Run.Path = "./vhdbuilder/packer/test/windows-vhd-content-test.tests.ps1", "./vhdbuilder/packer/test/windows-files-check.tests.ps1"; $c.Run.Exit = $true; Invoke-Pester -Configuration $c': passed, 12 tests after rebase, with Windows operations mocked on macOS. This is not native Windows validation.
• git diff --check: passed. Windows files and README match main.
• Fresh Linux VHD build 188260377 ran merge commit f47ae7ff6f10b05bc305c7c03068bfa017176283 for this head. All 12 image jobs and all 12 Test, Scan, and Cleanup tasks passed. Log 562 confirms Run Command used the current Linux content script and reached Test Script Completed after the mandatory root check.
• Fresh Go tests, ShellSpec, ShellCheck, and Pester: passed. The previous Go size failure did not recur after the rebase. Windows VHD testing was skipped for this Linux-only diff.
• The overall Linux gate failed in the later E2E stage. Test run 724925544 reports two failures: AzureLinuxV3_CustomCA rejected an unexpected iptables rule with eBPF host routing enabled; Ubuntu2204_SecondaryNIC_DualStack could not resolve the secondary NIC interface name. Neither failure is the eMudhra root-removal assertion. Their underlying causes and flake status are not established.
• No checks remain pending. The PR remains blocked by the E2E failures; no rerun or merge was requested.

Merge Danger

Door: two-way; revert the added check.

Blast Radius: CI.

This conservative root-removal policy can block an image that another mechanism already protects, such as an intermediate blocklist or revocation. It covers both signing-root paths, including AAA, but does not perform full chain verification or prove protection for application-specific trust stores.

Which issue(s) this PR fixes:

N/A. Related advisory: GO-2026-6809.

[github-actions]

Windows Unit Test Results

  3 files   18 suites   1m 3s ⏱️
662 tests 662 ✅ 0 💤 0 ❌
685 runs  685 ✅ 0 💤 0 ❌

Results for commit 68a991a.

♻️ This comment has been updated with latest results.

[Copilot]

🔵 Needs a closer look

Live Windows PowerShell 5.1 and remote VHD validation remain pending for mandatory checks that can block image release jobs.

No open issues 🎉

What changed in this PR

Adds offline eMudhra host trust checks to AgentBaker’s Linux and Windows VHD content tests, without changing trust stores or node provisioning.

Changes:

• Rejects emSign ECC Root CA - G3 and AAA Certificate Services roots, using DigiCert Global Root G2 as a read-control.
• Adds ShellSpec and Pester coverage for root detection, missing trust data, and read failures.
• Documents the conservative root-removal policy and its host-only scope.

File	Description
vhdbuilder/​packer/​test/​windows-vhd-content-test.tests.ps1	Tests installed and cached root checks with mocked Windows stores.
vhdbuilder/​packer/​test/​windows-vhd-content-test.ps1	Gates content tests on installed roots and the cached AuthRoot list.
vhdbuilder/​packer/​test/​linux-vhd-content-test.sh	Checks CA bundles before test setup can upgrade packages.
vhdbuilder/​packer/​README.md	Explains the policy, scope, and limitations.
spec/​vhdbuilder/​packer/​test/​linux_vhd_content_test_helpers_spec.sh	Tests Linux root detection and missing or unreadable bundles.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the offline CA-bundle checks and accompanying test coverage.

No open issues 🎉

_{Review effort: Balanced}

[github-actions]

Package	Line Rate	Health
test	0%	❌
windows	27%	❌
staging_cse_windows Package 1	68%	➖
debug	0%	❌
provisioningscripts	2%	❌
parts_windows Package 1	73%	➖
Summary	39% (1819 / 7001)	❌

[github-actions]

Package	Line Rate	Health
github.com/Azure/agentbaker/aks-node-controller	73%	➖
github.com/Azure/agentbaker/aks-node-controller/common	100%	✔
github.com/Azure/agentbaker/aks-node-controller/helpers	68%	➖
github.com/Azure/agentbaker/aks-node-controller/parser	88%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/gpu	100%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/nodeconfigutils	89%	✔
github.com/Azure/agentbaker/aks-node-controller/utils	0%	❌
github.com/Azure/agentbaker/apiserver	24%	❌
github.com/Azure/agentbaker/cmd	0%	❌
github.com/Azure/agentbaker/cmd/starter	0%	❌
github.com/Azure/agentbaker/fuzz/api	0%	❌
github.com/Azure/agentbaker/hotfix/render-nodecustomdata	35%	❌
github.com/Azure/agentbaker/pkg/agent	78%	➖
github.com/Azure/agentbaker/pkg/agent/datamodel	77%	➖
github.com/Azure/agentbaker/pkg/agent/toggles	0%	❌
github.com/Azure/agentbaker/pkg/vhdbuilder/datamodel	87%	✔
Summary	75% (6032 / 8001)	➖

[github-actions]

Package	Line Rate	Health
shellspec spec	29%	❌
Summary	29% (4702 / 16381)	❌