fix: update waagent during boot of firsttime

[awesomenix]

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

[Copilot]

Pull request overview

Updates the VHD build process to install a specific WALinuxAgent version during the pre-install phase.

Changes:

• Invoke a new updateWALinuxAgent step during pre-install-dependencies.sh.
• Add updateWALinuxAgent implementation that purges existing agent and installs WALinuxAgent 2.15.0.1 from GitHub source.
• Remove a VMSS Custom Script Extension settings/protectedSettings swap in Ubuntu 2204 FIPS E2E scenarios.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
vhdbuilder/packer/pre-install-dependencies.sh	Calls updateWALinuxAgent early in the packer pre-install flow.
vhdbuilder/packer/packer_source.sh	Adds updateWALinuxAgent function to download/install a pinned WALinuxAgent version.
e2e/scenario_test.go	Removes FIPS scenario mutator logic that moved protected settings into settings.

[Copilot]

updateWALinuxAgent is invoked unconditionally, but its implementation uses apt-get and Debian/Ubuntu-specific Python paths. This will fail (or partially run and mutate the image unexpectedly) on non-Ubuntu distros built by this script (e.g., Mariner/AzureLinux/Flatcar). Gate this call to Ubuntu/Debian images (or implement distro-specific logic inside updateWALinuxAgent).

Suggested change

	updateWALinuxAgent || echo "WARNING: WALinuxAgent update failed"
	if [[ "$OS" == "UBUNTU" || "$OS" == "DEBIAN" ]]; then
	updateWALinuxAgent || echo "WARNING: WALinuxAgent update failed"
	fi

[r2k1]

oh, did you intentionally break it? Did copilot catch an issue?

[Copilot]

updateWALinuxAgent directly calls apt-get purge -y walinuxagent without using the repo’s retry/timeout helpers (e.g. apt_get_purge in vhdbuilder/packer/install-dependencies.sh). This makes builds more brittle and can hang/fail differently than the rest of the provisioning flow; please switch to the existing helper (and only run on apt-based distros).

Suggested change

	updateWALinuxAgent() {
	local waagent_version="2.15.0.1"
	local tarball="v${waagent_version}.tar.gz"
	local extract_dir="WALinuxAgent-${waagent_version}"
	apt-get purge -y walinuxagent
	apt_get_purge() {
	local package="$1"
	# Only attempt purge on apt-based distributions
	if ! command -v apt-get >/dev/null 2>&1; then
	echo "apt-get not found; skipping purge of ${package}"
	return 0
	}
	local retries=5
	local wait_seconds=10
	local attempt=1
	while [ "${attempt}" -le "${retries}" ]; do
	echo "Purging package '${package}' with apt-get (attempt ${attempt}/${retries})"
	DEBIAN_FRONTEND=noninteractive apt-get purge -y "${package}" && return 0
	echo "apt-get purge failed for '${package}' on attempt ${attempt}; retrying in ${wait_seconds}s..."
	sleep "${wait_seconds}"
	attempt=$((attempt + 1))
	done
	echo "Failed to purge package '${package}' with apt-get after ${retries} attempts"
	return 1
	}
	updateWALinuxAgent() {
	local waagent_version="2.15.0.1"
	local tarball="v${waagent_version}.tar.gz"
	local extract_dir="WALinuxAgent-${waagent_version}"
	apt_get_purge walinuxagent || return 1

[Copilot]

Hardcoding /usr/local/lib/python3.10/dist-packages/ is not compatible with Ubuntu 24.04 (python3.12) and can leave an older azurelinuxagent in /usr/local that shadows the newly installed one. Determine the correct site-packages path dynamically (e.g., from python3 -c 'import site; ...') and remove/install accordingly.

Suggested change

	rm -rf /usr/local/lib/python3.10/dist-packages/azurelinuxagent*
	# Dynamically determine any /usr/local site-packages directory and remove azurelinuxagent from it
	local local_site_packages
	local_site_packages=$(python3 - <<'EOF'
	import site
	paths = []
	if hasattr(site, "getsitepackages"):
	paths.extend(site.getsitepackages())
	get_user_site = getattr(site, "getusersitepackages", None)
	if callable(get_user_site):
	user_site = get_user_site()
	if isinstance(user_site, str):
	paths.append(user_site)
	for p in paths:
	if p.startswith("/usr/local/"):
	print(p)
	break
	EOF
	) || local_site_packages=""
	if [[ -n "$local_site_packages" ]]; then
	rm -rf "${local_site_packages%/}/azurelinuxagent"*
	fi

[Copilot]

The agent source is downloaded and installed as root from GitHub without any integrity verification (checksum/signature) beyond HTTPS. For a base image build step, please add a deterministic integrity check (e.g., pinned SHA256 for the tarball or verify a signed release) to reduce supply-chain risk.