[AKS] az aks install-desktop: Add AKS Desktop installation

[Tom Gamble (gambtho)]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests
⚠️ None	️✔️ 130/130

⚠️AzureCLI-BreakingChangeTest

⚠️acs

rule	cmd_name	rule_message	suggest_message
⚠️ 1001 - CmdAdd	aks install-desktop	cmd aks install-desktop added

Summary

• add az aks install-desktop with latest-stable installation by default and optional --version
• select exact AKS Desktop release assets for Windows, macOS, and Linux architectures
• stream downloads over HTTPS, reject insecure redirects, verify GitHub-published SHA-256 digests, and clean temporary files
• launch native installers without shell execution or privilege escalation; install archive-only Linux builds under the current user's profile
• add help examples and mocked unit coverage for platform detection, release selection, integrity verification, installer invocation, missing artifacts, and cleanup

Validation

• Full test_custom suite: 80 tests run, 1 skipped, no failures.
• Archive extraction regressions pass in isolation on Python 3.12.3, 3.14.3 and 3.14.6, including symlink/hardlink traversal and the older-Python trailing-separator bypass.
• A real xdg-open handoff with an isolated harmless handler confirms the retained installer remains readable after the command returns.
• Modified Python files compile and pass Python 3.10 syntax checks; focused Ruff checks and git diff --check pass.
• Source CLI az aks install-desktop -h renders the arguments, examples and installer-retention guidance.
• The repository PR-title/content checker passes after correcting the title format.
• /polish and CodeRabbit reviews completed; review findings were addressed.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Critical archive traversal and other unresolved installation and validation issues must be addressed.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds cross-platform az aks install-desktop support with secure release downloads, integrity verification, native installation, and Linux archive handling.

Changes:

• Registers the command, --version, and help examples.
• Implements platform/release selection, downloads, verification, extraction, and installation.
• Adds mocked workflow tests.

File summaries

File	Summary and findings
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py	Adds installer tests. Nit (1 vote): cleanup assertion is vacuous because the mock does not create the downloaded path.
src/azure-cli/azure/cli/command_modules/acs/custom.py	Implements the installation workflow. Critical (1 vote): archive extraction remains vulnerable to traversal through symlink members. Moderate (3 votes): temporary DMG/DEB files may be deleted before desktop handlers finish consuming them. Moderate (1 vote): null digests raise TypeError instead of ClientRequestError. Moderate (1 vote): an empty --version bypasses validation and installs the latest release.
src/azure-cli/azure/cli/command_modules/acs/commands.py	Registers the new command.
src/azure-cli/azure/cli/command_modules/acs/_params.py	Adds the --version parameter.
src/azure-cli/azure/cli/command_modules/acs/_help.py	Adds command help and examples.

Review details

Suppressed comments (3)

src/azure-cli/azure/cli/command_modules/acs/custom.py:2504

• When the GitHub asset payload contains an explicit "digest": null, asset.get returns None and re.fullmatch raises TypeError instead of the intended ClientRequestError. Treat non-string values as an invalid digest so malformed or older release metadata fails cleanly.

    if not re.fullmatch(r'sha256:[0-9a-fA-F]{64}', digest):

src/azure-cli/azure/cli/command_modules/acs/custom.py:2422

• Because this guard is truthiness-based, az aks install-desktop --version "" skips semantic-version validation and silently falls through to /latest, installing a different version than the user supplied. Use an explicit is not None check so every supplied value, including an empty string, is rejected.

    if version:

src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py:1052

• This cleanup assertion is vacuous: mock_download is a mock and never creates the path, so exists is already false even if TemporaryDirectory fails to remove a downloaded artifact. Make the mock create destination before returning, then assert that the path is absent after the workflow.

        self.assertFalse(os.path.exists(mock_download.call_args[0][1]))

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).