Elastic Defend cannot run in emulation (#6095)

* Elastic Defend cannot run in emulation

* add changelog

* Update specs/endpoint-security.spec.yml

Co-authored-by: Blake Rouse <[email protected]>

* remove compiled changelog

* Prevent running Elastic Defend in rosetta on macOS

---------

Co-authored-by: Blake Rouse <[email protected]>

changelog/fragments/1732110636-elastic-defend-cannot-run-in-emulation.yaml

@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: bug-fix
+
+# Change summary; a 80ish characters long description of the change.
+summary: Prevent installing Elastic Defend on non native architecture
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: elastic-agent
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+#pr: https://github.com/owner/repo/1234
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234

specs/endpoint-security.spec.yml

@@ -14,6 +14,8 @@ inputs:
       - UPGRADE
     runtime:
       preventions:
+        - condition: ${runtime.arch} != ${runtime.native_arch}
+          message: "Elastic Defend cannot run on an emulated architecture"
         - condition: ${runtime.arch} == 'arm64' and ${runtime.family} == 'redhat' and ${runtime.major} == 7
           message: "Elastic Defend doesn't support RHEL7 on arm64"
         - condition: ${user.root} == false
@@ -57,6 +59,8 @@ inputs:
     proxied_actions: *proxied_actions
     runtime:
       preventions:
+        - condition: ${runtime.arch} != ${runtime.native_arch}
+          message: "Elastic Defend cannot run on an emulated architecture"
         - condition: ${user.root} == false
           message: "Elastic Defend requires Elastic Agent be running as root"
         - condition: ${install.in_default} == false