From 49604d6db35a7d212d77ac327b59ebba526419ba Mon Sep 17 00:00:00 2001
From: Matthieu Dubet <matthieu.dubet@datadoghq.com>
Date: Mon, 14 Sep 2026 14:43:40 -0400
Subject: [PATCH] fix(install-ssi): respect custom version

---
 install_script.sh.template        | 25 +++++++++++++--
 unit_tests/test_install_script.sh | 53 +++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+), 3 deletions(-)

diff --git a/install_script.sh.template b/install_script.sh.template
index 52ec7d90..ba045b35 100644
--- a/install_script.sh.template
+++ b/install_script.sh.template
@@ -846,6 +846,9 @@ function _install_installer_script() {
 # install_apm_ssi installs APM Single Step Instrumentation.
 function install_apm_ssi() {
   local sudo_cmd="$1"
+  local installer_script="install-ssi.sh"
+  local installer_version
+  local installer_minor_version
 
   if [ -z "$DD_APM_INSTRUMENTATION_ENABLED" ]; then
     return 0
@@ -856,9 +859,25 @@ function install_apm_ssi() {
   # Technical option to test with non-production install-ssi.sh scripts
   if [ -n "$DD_APM_INSTRUMENTATION_PIPELINE_ID" ]; then
     installer_domain="${installer_domain}/pipeline-${DD_APM_INSTRUMENTATION_PIPELINE_ID}"
-  fi
-
-  installer_url="https://${installer_domain}/scripts/install-ssi.sh" # TODO: support version pinning?
+  elif [ -n "$agent_version_custom" ]; then
+    # agent_version_custom is the full version resolved by the package manager.
+    # Remove the optional epoch and package revision to match the published
+    # installer script filename.
+    installer_version="${agent_version_custom#*:}"
+    installer_version="${installer_version%-*}"
+    # Package managers can report RC versions as ~rc2, while versioned SSI
+    # scripts use the canonical ~rc.2 spelling.
+    installer_version=$(echo "$installer_version" | sed -E 's/~rc([[:digit:]]+)/~rc.\1/')
+    installer_minor_version="${installer_version#*.}"
+    installer_minor_version="${installer_minor_version%%.*}"
+    # Versioned SSI installer scripts have been published since Agent 7.68.
+    # Keep the existing unversioned behavior for older Agent versions.
+    if [ "$installer_minor_version" -ge 68 ]; then
+      installer_script="install-ssi-${installer_version}.sh"
+    fi
+  fi
+
+  installer_url="https://${installer_domain}/scripts/${installer_script}"
   
   _install_installer_script "$installer_url" || true
 }
diff --git a/unit_tests/test_install_script.sh b/unit_tests/test_install_script.sh
index d3d1f917..8f5d017c 100755
--- a/unit_tests/test_install_script.sh
+++ b/unit_tests/test_install_script.sh
@@ -418,5 +418,58 @@ testParEnabledWithoutApiKeyOnlyEnrollment() {
   assertEquals "$(sudo yq eval '.private_action_runner.api_key_only_enrollment' $config_file)" "null"
 }
 
+### install_apm_ssi
+getApmSsiInstallerURL() {
+  (
+    export DD_APM_INSTRUMENTATION_ENABLED=host
+    export DD_SITE="${1:-datadoghq.com}"
+    export DD_INSTALLER_REGISTRY_URL_INSTALLER_PACKAGE="${2:-}"
+    export DD_APM_INSTRUMENTATION_PIPELINE_ID="${3:-}"
+    export agent_version_custom="${4:-}"
+    # shellcheck disable=SC2329 # Called indirectly by install_apm_ssi.
+    _install_installer_script() {
+      # shellcheck disable=SC2317 # Function is invoked indirectly.
+      printf '%s' "$1"
+    }
+    install_apm_ssi ""
+  )
+}
+
+testApmSsiInstallerUsesLatestVersionByDefault() {
+  assertEquals \
+    "https://install.datadoghq.com/scripts/install-ssi.sh" \
+    "$(getApmSsiInstallerURL)"
+}
+
+testApmSsiInstallerUsesResolvedPinnedVersion() {
+  assertEquals \
+    "https://install.datadoghq.com/scripts/install-ssi-7.80.1.sh" \
+    "$(getApmSsiInstallerURL "datadoghq.com" "" "" "1:7.80.1-1")"
+}
+
+testApmSsiInstallerPreservesPrereleaseVersion() {
+  assertEquals \
+    "https://install.datad0g.com/scripts/install-ssi-7.80.0~rc.2.sh" \
+    "$(getApmSsiInstallerURL "datad0g.com" "" "" "7.80.0~rc.2-1")"
+}
+
+testApmSsiInstallerPreservesFutureRcVersion() {
+  assertEquals \
+    "https://install.datad0g.com/scripts/install-ssi-7.84.0~rc.2.sh" \
+    "$(getApmSsiInstallerURL "datad0g.com" "" "" "1:7.84.0~rc2-1")"
+}
+
+testApmSsiInstallerUsesLatestForVersionsBeforePinnedScripts() {
+  assertEquals \
+    "https://install.datadoghq.com/scripts/install-ssi.sh" \
+    "$(getApmSsiInstallerURL "datadoghq.com" "" "" "7.67.2-1")"
+}
+
+testApmSsiInstallerPipelineOverridesVersionPinning() {
+  assertEquals \
+    "https://installtesting.datad0g.com/pipeline-123/scripts/install-ssi.sh" \
+    "$(getApmSsiInstallerURL "datadoghq.com" "installtesting.datad0g.com" "123" "7.80.1-1")"
+}
+
 # shellcheck source=/dev/null
 . shunit2