[Windows][FIPS] Upgrade from 9.5.0-SNAPSHOT to 9.6.0-SNAPSHOT fails because .elastic-agent.active.commit is missing. #16050

Activity

1. harshitgupta-qasource

   added the

   Bug

   issue type on Aug 6, 2026
2. harshitgupta-qasource

   added

   bugSomething isn't workingSomething isn't working

   Team:Elastic-Agent-Control-PlaneLabel for the Agent Control Plane teamLabel for the Agent Control Plane team

   impact:highShort-term priority; add to current release, or definitely next.Short-term priority; add to current release, or definitely next.

   on Aug 6, 2026
3. infra-vault-gh-plugin-prod commented on Aug 6, 2026

   

   infra-vault-gh-plugin-prodbot

   on Aug 6, 2026

   More actions

   Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)
4. harshitgupta-qasource commented on Aug 6, 2026

   

   harshitgupta-qasource

   on Aug 6, 2026

   Author

   More actions

   @kishorkumar-qasource Kindly review
5. kishorkumar-qasource commented on Aug 6, 2026

   

   kishorkumar-qasource

   on Aug 6, 2026

   More actions

   Secondary review is done for this!!
6. ebeahan commented on Aug 6, 2026

   

   ebeahan

   on Aug 6, 2026

   Member

   More actions

   Claude-Generated Root Cause Analysis

   Primary Code Bug — -fips not stripped from zip fileNamePrefix

   The codebase has two separate paths for reading package metadata: one for .tar.gz (Linux/macOS) and one for .zip (Windows). They handle the -fips filename substring inconsistently.

   For .tar.gz — getFileNamePrefix in step_unpack.go:662:

   func getFileNamePrefix(archivePath string) string {
       prefix := strings.TrimSuffix(filepath.Base(archivePath), ".tar.gz") + "/"
       prefix = strings.Replace(prefix, fipsPrefix, "", 1)  // ← strips "-fips"
       return prefix
   }

   For elastic-agent-fips-9.6.0-SNAPSHOT-linux-x86_64.tar.gz → prefix becomes elastic-agent-9.6.0-SNAPSHOT-linux-x86_64/.

   For .zip — getPackageMetadataFromZip (step_unpack.go:269) and unzip (step_unpack.go:128):

   fileNamePrefix := strings.TrimSuffix(filepath.Base(archivePath), ".zip") + "/"
   // ← NO "-fips" stripping

   For elastic-agent-fips-9.6.0-SNAPSHOT-windows-x86_64.zip → prefix becomes elastic-agent-fips-9.6.0-SNAPSHOT-windows-x86_64/.

   The Windows FIPS zip archive follows the same convention as tar.gz packages: the internal directory omits -fips (i.e., elastic-agent-9.6.0-SNAPSHOT-windows-x86_64/). The code then tries to open elastic-agent-fips-9.6.0-SNAPSHOT-windows-x86_64/.elastic-agent.active.commit, which does not exist because the actual path inside the archive is elastic-agent-9.6.0-SNAPSHOT-windows-x86_64/.elastic-agent.active.commit. This is confirmed precisely by the error message:

   open elastic-agent-fips-9.6.0-SNAPSHOT-windows-x86_64/.elastic-agent.active.commit: file does not exist
   

   The manifest lookup (step_unpack.go:336–349) silently ignores fs.ErrNotExist, so the wrong prefix for the manifest does not surface as an error. The commit file lookup (step_unpack.go:352–356) treats any error including fs.ErrNotExist as fatal — so the wrong prefix causes a hard failure here.

   Why non-FIPS Windows works: the archive name elastic-agent-9.6.0-SNAPSHOT-windows-x86_64.zip already matches the internal directory name, so no stripping is needed and no prefix mismatch occurs.

   ---

   Secondary Potential Cause — Build/packaging omission

   It is also possible the FIPS Windows .zip artifact was built without .elastic-agent.active.commit at any path (i.e., the file is absent from the archive entirely rather than present at the wrong path). This would produce the same error. It is not possible to confirm without inspecting the actual artifact, but the code asymmetry above is the more likely cause.

   ---

   Contributing Factor — No FIPS zip test coverage

   TestGetFileNamePrefix (step_unpack_test.go:760) only tests .tar.gz paths. All unzip tests use non-FIPS archive names (e.g., elastic-agent-1.2.3-SNAPSHOT-someos-x86_64.zip). There is no test for getPackageMetadataFromZip or unzip with a FIPS-named .zip file, so the prefix mismatch was never caught.

   ---

   Fix Direction

   Apply the same -fips stripping to the zip code path. Both getPackageMetadataFromZip and unzip should strip -fips when computing the prefix, for example:

   fileNamePrefix := strings.TrimSuffix(strings.Replace(filepath.Base(archivePath), fipsPrefix, "", 1), ".zip") + "/"

   Or factor the logic into a shared helper analogous to getFileNamePrefix that handles both .zip and .tar.gz extensions.
7. lorienhu

   self-assigned this

   on Aug 7, 2026
8. lorienhu

   closed this as completedin #16065on Aug 7, 2026
9. harshitgupta-qasource

   added

   QA:Ready For TestingCode is merged and ready for QA to validateCode is merged and ready for QA to validate

   on Aug 10, 2026
10. harshitgupta-qasource commented on Sep 8, 2026

    

    harshitgupta-qasource

    on Sep 8, 2026

    Author

    More actions

    Hi Team,

    We have validated this ticket on the latest 9.5.3 Kibana cloud environment and found it working fine.

    Observations:

    • Windows FIPS Elastic Agent should upgrade successfully from 9.5.2 to 9.5.3

    Build details:

    VERSION: 9.5.3 
    BUILD: 107530
    COMMIT: 2169f1de4c917fce03905cc3110f3f523e2184d2
    Artifact: https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-fips-9.5.2-windows-arm64.zip
    

    Screenshot

    • Before Upgrade

    

    • After Upgrade

    20260908-1014-11.3057709.mp4

    Hence, we are marking this issue as QA: Validated.
    Thanks

    👍React with 👍1Reacted by Eric Beahan
11. harshitgupta-qasource

    added

    QA:ValidatedValidated by the QA TeamValidated by the QA Team

    and removed

    QA:Ready For TestingCode is merged and ready for QA to validateCode is merged and ready for QA to validate

    on Sep 8, 2026