From db6e7e9553d2faa02793543d951e7bda9f483d13 Mon Sep 17 00:00:00 2001
From: Sarah Chen <sarah.chen@datadoghq.com>
Date: Tue, 14 Jul 2026 14:04:16 -0400
Subject: [PATCH 1/3] Add retry for downloading install_script_agent

---
 utils/build/ssi/base/install_script_ssi.sh     | 18 ++++++++++++++++--
 .../ssi/base/install_script_ssi_installer.sh   | 17 ++++++++++++++++-
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/utils/build/ssi/base/install_script_ssi.sh b/utils/build/ssi/base/install_script_ssi.sh
index 03fdb896889..153799a6199 100755
--- a/utils/build/ssi/base/install_script_ssi.sh
+++ b/utils/build/ssi/base/install_script_ssi.sh
@@ -42,11 +42,25 @@ fi
 
 if [ -f "install_script_agent7.sh" ]; then
     echo "[TRACE] install_script_agent7.sh exists"
-    DD_REPO_URL=${DD_injection_repo_url}  DD_INSTALL_ONLY=true DD_APM_INSTRUMENTATION_ENABLED=host  bash -c "$(cat install_script_agent7.sh)"
 else
-    DD_REPO_URL=${DD_injection_repo_url}  DD_INSTALL_ONLY=true DD_APM_INSTRUMENTATION_ENABLED=host  bash -c "$(curl -L https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh)"
+    for attempt in 1 2 3 4 5; do
+        echo "[TRACE] downloading install_script_agent7.sh (attempt ${attempt})"
+        if curl --fail --retry 3 --retry-delay 2 -sSL -o install_script_agent7.sh https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh && [ -s install_script_agent7.sh ]; then
+            break
+        fi
+        echo "[TRACE] download failed or produced an empty file; retrying"
+        rm -f install_script_agent7.sh
+        sleep 2
+    done
 fi
 
+if [ ! -s "install_script_agent7.sh" ]; then
+    echo "[ERROR] install_script_agent7.sh is missing or empty; aborting SSI install" >&2
+    exit 1
+fi
+
+DD_REPO_URL=${DD_injection_repo_url} DD_INSTALL_ONLY=true DD_APM_INSTRUMENTATION_ENABLED=host bash ./install_script_agent7.sh
+
 if [ -f /etc/debian_version ] || [ "$DISTRIBUTION" == "Debian" ] || [ "$DISTRIBUTION" == "Ubuntu" ]; then
     OS="Debian"
 elif [ -f /etc/redhat-release ] || [ "$DISTRIBUTION" == "RedHat" ] || [ "$DISTRIBUTION" == "CentOS" ] || [ "$DISTRIBUTION" == "Amazon" ] || [ "$DISTRIBUTION" == "Rocky" ] || [ "$DISTRIBUTION" == "AlmaLinux" ]; then
diff --git a/utils/build/ssi/base/install_script_ssi_installer.sh b/utils/build/ssi/base/install_script_ssi_installer.sh
index 94acb7d14ff..ab682d73f1d 100755
--- a/utils/build/ssi/base/install_script_ssi_installer.sh
+++ b/utils/build/ssi/base/install_script_ssi_installer.sh
@@ -1,3 +1,18 @@
 #!/bin/bash
 
-DD_INSTALL_ONLY=true DD_INSTALLER=true bash -c "$(curl -L https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh)"
+for attempt in 1 2 3 4 5; do
+    echo "[TRACE] downloading install_script_agent7.sh (attempt ${attempt})"
+    if curl --fail --retry 3 --retry-delay 2 -sSL -o install_script_agent7.sh https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh && [ -s install_script_agent7.sh ]; then
+        break
+    fi
+    echo "[TRACE] download failed or produced an empty file; retrying"
+    rm -f install_script_agent7.sh
+    sleep 2
+done
+
+if [ ! -s "install_script_agent7.sh" ]; then
+    echo "[ERROR] install_script_agent7.sh is missing or empty; aborting installer setup" >&2
+    exit 1
+fi
+
+DD_INSTALL_ONLY=true DD_INSTALLER=true bash ./install_script_agent7.sh

From 5f44ae226c526218c52cc480591d8860822e4c79 Mon Sep 17 00:00:00 2001
From: Sarah Chen <sarah.chen@datadoghq.com>
Date: Wed, 15 Jul 2026 12:18:26 -0400
Subject: [PATCH 2/3] Separate retry into reusable script

---
 utils/build/ssi/base/base_ssi.Dockerfile      |  2 +-
 .../ssi/base/base_ssi_installer.Dockerfile    |  2 +-
 utils/build/ssi/base/download_with_retry.sh   | 26 +++++++++++++++++++
 utils/build/ssi/base/install_script_ssi.sh    | 13 +++-------
 .../ssi/base/install_script_ssi_installer.sh  | 16 +++---------
 5 files changed, 35 insertions(+), 24 deletions(-)
 create mode 100644 utils/build/ssi/base/download_with_retry.sh

diff --git a/utils/build/ssi/base/base_ssi.Dockerfile b/utils/build/ssi/base/base_ssi.Dockerfile
index df4ab20d6d1..cd71af45ddc 100644
--- a/utils/build/ssi/base/base_ssi.Dockerfile
+++ b/utils/build/ssi/base/base_ssi.Dockerfile
@@ -4,7 +4,7 @@ FROM ${BASE_IMAGE}
 
 WORKDIR /workdir
 
-COPY ./base/install_script_ssi.sh ./base/binaries/* ./
+COPY ./base/install_script_ssi.sh ./base/download_with_retry.sh ./base/binaries/* ./
 
 ARG DD_API_KEY=deadbeef
 
diff --git a/utils/build/ssi/base/base_ssi_installer.Dockerfile b/utils/build/ssi/base/base_ssi_installer.Dockerfile
index 7ad8aa299be..8fb13107073 100755
--- a/utils/build/ssi/base/base_ssi_installer.Dockerfile
+++ b/utils/build/ssi/base/base_ssi_installer.Dockerfile
@@ -4,7 +4,7 @@ FROM ${BASE_IMAGE}
 
 WORKDIR /workdir
 
-COPY ./base/install_script_ssi_installer.sh ./
+COPY ./base/install_script_ssi_installer.sh ./base/download_with_retry.sh ./
 
 ARG DD_API_KEY=deadbeef
 
diff --git a/utils/build/ssi/base/download_with_retry.sh b/utils/build/ssi/base/download_with_retry.sh
new file mode 100644
index 00000000000..a6352daee96
--- /dev/null
+++ b/utils/build/ssi/base/download_with_retry.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+download_with_retry() {
+    local url="$1"
+    local output
+    output="$(basename "$url")"
+
+    local max_attempts=5
+    local attempt
+    for (( attempt = 1; attempt <= max_attempts; attempt++ )); do
+        echo "[TRACE] downloading ${output} (attempt ${attempt}/${max_attempts})"
+        if curl --fail --retry 3 --retry-delay 2 -sSL -o "$output" "$url" && [ -s "$output" ]; then
+            return 0
+        fi
+        rm -f "$output"
+        if [ "$attempt" -lt "$max_attempts" ]; then
+            local delay
+            delay="$(printf '%d.%03d' "$(( 2 ** (attempt - 1) ))" "$(( RANDOM % 1000 ))")"
+            echo "[TRACE] download failed or produced an empty file; retrying in ${delay}s"
+            sleep "$delay"
+        fi
+    done
+
+    echo "[ERROR] ${output} is missing or empty after ${max_attempts} attempts" >&2
+    return 1
+}
diff --git a/utils/build/ssi/base/install_script_ssi.sh b/utils/build/ssi/base/install_script_ssi.sh
index 153799a6199..1bac8e44551 100755
--- a/utils/build/ssi/base/install_script_ssi.sh
+++ b/utils/build/ssi/base/install_script_ssi.sh
@@ -40,18 +40,13 @@ if [ -n "${DD_INSTALLER_INJECTOR_VERSION}" ]; then
     export DD_INSTALLER_DEFAULT_PKG_VERSION_DATADOG_APM_INJECT="${DD_INSTALLER_INJECTOR_VERSION}"
 fi
 
+# shellcheck source=utils/build/ssi/base/download_with_retry.sh
+source ./download_with_retry.sh
+
 if [ -f "install_script_agent7.sh" ]; then
     echo "[TRACE] install_script_agent7.sh exists"
 else
-    for attempt in 1 2 3 4 5; do
-        echo "[TRACE] downloading install_script_agent7.sh (attempt ${attempt})"
-        if curl --fail --retry 3 --retry-delay 2 -sSL -o install_script_agent7.sh https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh && [ -s install_script_agent7.sh ]; then
-            break
-        fi
-        echo "[TRACE] download failed or produced an empty file; retrying"
-        rm -f install_script_agent7.sh
-        sleep 2
-    done
+    download_with_retry https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh
 fi
 
 if [ ! -s "install_script_agent7.sh" ]; then
diff --git a/utils/build/ssi/base/install_script_ssi_installer.sh b/utils/build/ssi/base/install_script_ssi_installer.sh
index ab682d73f1d..336bda6ede2 100755
--- a/utils/build/ssi/base/install_script_ssi_installer.sh
+++ b/utils/build/ssi/base/install_script_ssi_installer.sh
@@ -1,18 +1,8 @@
 #!/bin/bash
 
-for attempt in 1 2 3 4 5; do
-    echo "[TRACE] downloading install_script_agent7.sh (attempt ${attempt})"
-    if curl --fail --retry 3 --retry-delay 2 -sSL -o install_script_agent7.sh https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh && [ -s install_script_agent7.sh ]; then
-        break
-    fi
-    echo "[TRACE] download failed or produced an empty file; retrying"
-    rm -f install_script_agent7.sh
-    sleep 2
-done
+# shellcheck source=utils/build/ssi/base/download_with_retry.sh
+source ./download_with_retry.sh
 
-if [ ! -s "install_script_agent7.sh" ]; then
-    echo "[ERROR] install_script_agent7.sh is missing or empty; aborting installer setup" >&2
-    exit 1
-fi
+download_with_retry https://dd-agent.s3.amazonaws.com/scripts/install_script_agent7.sh || exit 1
 
 DD_INSTALL_ONLY=true DD_INSTALLER=true bash ./install_script_agent7.sh

From 8badeca9c116f48f116a43444aadafd80f9b4408 Mon Sep 17 00:00:00 2001
From: Sarah Chen <sarah.chen@datadoghq.com>
Date: Wed, 15 Jul 2026 16:13:59 -0400
Subject: [PATCH 3/3] Use curl built-in exponential backoff

---
 utils/build/ssi/base/download_with_retry.sh | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/utils/build/ssi/base/download_with_retry.sh b/utils/build/ssi/base/download_with_retry.sh
index a6352daee96..c06e6249595 100644
--- a/utils/build/ssi/base/download_with_retry.sh
+++ b/utils/build/ssi/base/download_with_retry.sh
@@ -9,16 +9,10 @@ download_with_retry() {
     local attempt
     for (( attempt = 1; attempt <= max_attempts; attempt++ )); do
         echo "[TRACE] downloading ${output} (attempt ${attempt}/${max_attempts})"
-        if curl --fail --retry 3 --retry-delay 2 -sSL -o "$output" "$url" && [ -s "$output" ]; then
+        if curl --fail --retry 3 -sSL -o "$output" "$url" && [ -s "$output" ]; then
             return 0
         fi
         rm -f "$output"
-        if [ "$attempt" -lt "$max_attempts" ]; then
-            local delay
-            delay="$(printf '%d.%03d' "$(( 2 ** (attempt - 1) ))" "$(( RANDOM % 1000 ))")"
-            echo "[TRACE] download failed or produced an empty file; retrying in ${delay}s"
-            sleep "$delay"
-        fi
     done
 
     echo "[ERROR] ${output} is missing or empty after ${max_attempts} attempts" >&2