[vcerenu]

|---|---|---|---|---|
| 5.0.0 (also 5.0.1 and main) | wazuh/wazuh-agent image, FIM report_changes | Agent | Docker (wazuh-cicd/wazuh/wazuh-agent:5.0.0-latest) | amazonlinux:2023-minimal base image |

Description

#2620 added diffutils to the Wazuh agent image so FIM report_changes can run diff (src/syscheckd/src/fim_diff_changes.c:747,759). Commit 1096acaf (#2749) moved the final stage to amazonlinux:2023-minimal and rewrote its install line without the package:

-RUN dnf install diffutils findutils procps shadow-utils -y && \
+RUN dnf install --setopt=install_weak_deps=0 findutils procps shadow-utils -y && \

5.0.0 (Dockerfile:121), 5.0.1 and main (Dockerfile:109) are affected. The 5.0 manager image needs no change, as it ships no wazuh-syscheckd.

Current behavior

wazuh-agent:5.0.0-latest (sha256:99c9c3c3…) enrolled to a 5.0.0-latest single-node stack, with report_changes="yes" on /fimtest and one line appended:

2026/11/02 13:11:40 wazuh-syscheckd: ERROR: (6714): Command diff output an error
.ds-wazuh-events-v5-system-activity-000001    modified  file.size=23 file.diff=null
.ds-wazuh-findings-v5-system-activity-000001  Wazuh FIM - File modified - /fimtest/keep.txt  file.diff=null

Proposed fix

Add diffutils back to the final-stage dnf install, and name it in the comment above the line so the next base-image change keeps it. Merge up to 5.0.1 and main. The event and the finding then carry file.diff with the appended line again.

[github-actions]

Docker Integration Tests — single-node

✅ All tests passed!

Results

Devops Integration Tests Results

Summary for DOCKER-SINGLE-NODE

Status: PASS 🟢

Metric	Count
Total Tests	12
Passed	10
Failed	0
Warnings	0
Skipped	2

Passed Tests

Connectivity

• Connectivity: Service connectivity 🟢

• Connectivity: Wazuh api connectivity 🟢

Docker_services

• Docker_services: Containers running 🟢

• Docker_services: Containers healthy 🟢

• Docker_services: Ports listening 🟢

• Docker_services: Health endpoints 🟢

• Docker_services: Container restart 🟢

Logs

• Logs: Logs for errors 🟢

• Logs: Recent logs 🟢

Version

• Version: Services versions 🟢

Skipped Tests 🔵

Logs

Logs: Log files exist 🔵

Reason:

('/home/runner/work/wazuh-docker/wazuh-docker/wazuh-automation/integration-test-module/src/test_runner/tests/test_logs.py', 55, 'Skipped: No log files are configured for this deployment.')

Version

Version: Services revisions 🔵

Reason:

('/home/runner/work/wazuh-docker/wazuh-docker/wazuh-automation/integration-test-module/src/test_runner/tests/test_version.py', 176, 'Skipped: No revision commands were executed successfully.')

• Workflow: View Details

[github-actions]

Docker Integration Tests — multi-node

✅ All tests passed!

Results

Devops Integration Tests Results

Summary for DOCKER-MULTI-NODE

Status: PASS 🟢

Metric	Count
Total Tests	12
Passed	10
Failed	0
Warnings	0
Skipped	2

Passed Tests

Connectivity

• Connectivity: Service connectivity 🟢

• Connectivity: Wazuh api connectivity 🟢

Docker_services

• Docker_services: Containers running 🟢

• Docker_services: Containers healthy 🟢

• Docker_services: Ports listening 🟢

• Docker_services: Health endpoints 🟢

• Docker_services: Container restart 🟢

Logs

• Logs: Logs for errors 🟢

• Logs: Recent logs 🟢

Version

• Version: Services versions 🟢

Skipped Tests 🔵

Logs

Logs: Log files exist 🔵

Reason:

('/home/runner/work/wazuh-docker/wazuh-docker/wazuh-automation/integration-test-module/src/test_runner/tests/test_logs.py', 55, 'Skipped: No log files are configured for this deployment.')

Version

Version: Services revisions 🔵

Reason:

('/home/runner/work/wazuh-docker/wazuh-docker/wazuh-automation/integration-test-module/src/test_runner/tests/test_version.py', 176, 'Skipped: No revision commands were executed successfully.')

• Workflow: View Details

[mjbonacci]

LGTM