Skip to content

Commit 172849e

Browse files
pcncpcnc
authored
chore: use saved GPG key for Postgres' PPA; update pg_upgrade version detection regexp (#749)
* chore: use saved GPG key for Postgres' PPA; update pg_upgrade version detection regexp
1 parent fcad5c7 commit 172849e

File tree

6 files changed

+89
-17
lines changed

6 files changed

+89
-17
lines changed

‎.github/workflows/collect-u18-binaries.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ jobs:
9696
- name: Build surrogate Docker image
9797
uses: docker/build-push-action@v5
9898
with:
99+
context: .
99100
load: true
100101
file: Dockerfile-u18
101102
target: pg_binary_collection
@@ -112,7 +113,7 @@ jobs:
112113
- name: Copy binary tarball
113114
run: |
114115
CONTAINER_ID=$(docker create supabase/postgres:u18-binaries)
115-
docker cp "${CONTAINER_ID}:/tmp/pg_binaries/${{ matrix.ubuntu_version }}.tar.gz" > /tmp/pg_binaries.tar.gz
116+
docker cp "${CONTAINER_ID}:/tmp/pg_binaries/${{ matrix.ubuntu_version }}.tar.gz" - > /tmp/pg_binaries.tar.gz
116117
docker rm "${CONTAINER_ID}"
117118
118119
- name: configure aws credentials - staging

‎Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
4949
ca-certificates \
5050
&& rm -rf /var/lib/apt/lists/*
5151
# Add Postgres PPA
52-
ARG postgresql_gpg_key=B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8
53-
RUN mkdir -p /root/.gnupg && chmod 700 /root/.gnupg && \
54-
gpg --recv-keys --no-default-keyring --keyring /tmp/pgdg.key --keyserver keyserver.ubuntu.com --recv-keys "${postgresql_gpg_key}" && \
55-
gpg --no-default-keyring --keyring /tmp/pgdg.key --export "${postgresql_gpg_key}" > /etc/apt/trusted.gpg.d/pgdg.gpg && \
52+
# In the off-chance that the key in the repository expires, it can be replaced by running the following in the repository's root:
53+
# gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys $NEW_POSTGRESQL_GPG_KEY
54+
# gpg --export --armor $NEW_POSTGRESQL_GPG_KEY > postgresql.gpg.key
55+
COPY postgresql.gpg.key /tmp/postgresql.gpg.key
56+
RUN apt-key add /tmp/postgresql.gpg.key && \
5657
echo "deb https://apt-archive.postgresql.org/pub/repos/apt focal-pgdg-archive main" > /etc/apt/sources.list.d/pgdg.list
5758

5859
####################

‎Dockerfile-u18

+10-5
Original file line numberDiff line numberDiff line change
@@ -131,10 +131,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
131131
ca-certificates \
132132
&& rm -rf /var/lib/apt/lists/*
133133
# Add Postgres PPA
134-
ARG postgresql_gpg_key=B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8
135-
RUN mkdir -p /root/.gnupg && chmod 700 /root/.gnupg && \
136-
gpg --recv-keys --no-default-keyring --keyring /tmp/pgdg.key --keyserver keyserver.ubuntu.com --recv-keys "${postgresql_gpg_key}" && \
137-
gpg --no-default-keyring --keyring /tmp/pgdg.key --export "${postgresql_gpg_key}" > /etc/apt/trusted.gpg.d/pgdg.gpg && \
134+
# In the off-chance that the key in the repository expires, it can be replaced by running the following in the repository's root:
135+
# gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys $NEW_POSTGRESQL_GPG_KEY
136+
# gpg --export --armor $NEW_POSTGRESQL_GPG_KEY > postgresql.gpg.key
137+
COPY postgresql.gpg.key /tmp/postgresql.gpg.key
138+
RUN apt-key add /tmp/postgresql.gpg.key && \
138139
echo "deb https://apt-archive.postgresql.org/pub/repos/apt bionic-pgdg-archive main" > /etc/apt/sources.list.d/pgdg.list
139140

140141
####################
@@ -1004,9 +1005,11 @@ FROM scratch as buildcache
10041005
COPY --from=stats /tmp /
10051006

10061007
FROM ubuntu:bionic as pg_binary_collection_base
1008+
ARG postgresql_major
1009+
ARG postgresql_release
10071010
ENV DEBIAN_FRONTEND=noninteractive
10081011

1009-
COPY ansible/files/extensions/* /tmp/build/extensions/
1012+
COPY --from=extensions /tmp/* /tmp/build/extensions/
10101013
COPY ansible/files/postgres/* /tmp/build/
10111014

10121015
RUN echo "deb [ trusted=yes ] file:///tmp/build ./" > /etc/apt/sources.list.d/temp.list
@@ -1020,6 +1023,8 @@ RUN rm -f /tmp/build/extensions/postgis* && \
10201023
dpkg -i /tmp/build/extensions/*
10211024

10221025
FROM ubuntu:bionic as pg_binary_collection
1026+
ARG postgresql_major
1027+
ARG postgresql_release
10231028

10241029
RUN mkdir -p /tmp/pg_binaries/${postgresql_major}
10251030
COPY --from=pg_binary_collection_base /usr/lib/postgresql/${postgresql_major} /tmp/pg_binaries/${postgresql_major}

‎ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh

+3-3
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,11 @@ POSTGRES_CONFIG_PATH="/etc/postgresql/postgresql.conf"
4848
PGBINOLD="/usr/lib/postgresql/bin"
4949

5050
# If upgrading from older major PG versions, disable specific extensions
51-
if [[ "$OLD_PGVERSION" =~ 14* ]]; then
51+
if [[ "$OLD_PGVERSION" =~ ^14.* ]]; then
5252
EXTENSIONS_TO_DISABLE+=("${PG14_EXTENSIONS_TO_DISABLE[@]}")
53-
elif [[ "$OLD_PGVERSION" =~ 13* ]]; then
53+
elif [[ "$OLD_PGVERSION" =~ ^13.* ]]; then
5454
EXTENSIONS_TO_DISABLE+=("${PG13_EXTENSIONS_TO_DISABLE[@]}")
55-
elif [[ "$OLD_PGVERSION" =~ 12* ]]; then
55+
elif [[ "$OLD_PGVERSION" =~ ^12.* ]]; then
5656
POSTGRES_CONFIG_PATH="/etc/postgresql/12/main/postgresql.conf"
5757
PGBINOLD="/usr/lib/postgresql/12/bin"
5858
fi

‎docker/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
1616
&& rm -rf /var/lib/apt/lists/*
1717

1818
# Add Postgres PPA
19-
ARG postgresql_gpg_key=B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8
20-
RUN mkdir -p /root/.gnupg && chmod 700 /root/.gnupg && \
21-
gpg --recv-keys --no-default-keyring --keyring /tmp/pgdg.key --keyserver keyserver.ubuntu.com --recv-keys "${postgresql_gpg_key}" && \
22-
gpg --no-default-keyring --keyring /tmp/pgdg.key --export "${postgresql_gpg_key}" > /etc/apt/trusted.gpg.d/pgdg.gpg && \
19+
# In the off-chance that the key in the repository expires, it can be replaced by running the following in the repository's root:
20+
# gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys $NEW_POSTGRESQL_GPG_KEY
21+
# gpg --export --armor $NEW_POSTGRESQL_GPG_KEY > postgresql.gpg.key
22+
COPY postgresql.gpg.key /tmp/postgresql.gpg.key
23+
RUN apt-key add /tmp/postgresql.gpg.key && \
2324
echo "deb https://apt-archive.postgresql.org/pub/repos/apt ${ubuntu_release}-pgdg-archive main" > /etc/apt/sources.list.d/pgdg.list && \
2425
echo "deb-src https://apt-archive.postgresql.org/pub/repos/apt ${ubuntu_release}-pgdg-archive main" > /etc/apt/sources.list.d/pgdg.list
2526

‎postgresql.gpg.key

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
-----BEGIN PGP PUBLIC KEY BLOCK-----
2+
3+
mQINBE6XR8IBEACVdDKT2HEH1IyHzXkb4nIWAY7echjRxo7MTcj4vbXAyBKOfjja
4+
UrBEJWHN6fjKJXOYWXHLIYg0hOGeW9qcSiaa1/rYIbOzjfGfhE4x0Y+NJHS1db0V
5+
G6GUj3qXaeyqIJGS2z7m0Thy4Lgr/LpZlZ78Nf1fliSzBlMo1sV7PpP/7zUO+aA4
6+
bKa8Rio3weMXQOZgclzgeSdqtwKnyKTQdXY5MkH1QXyFIk1nTfWwyqpJjHlgtwMi
7+
c2cxjqG5nnV9rIYlTTjYG6RBglq0SmzF/raBnF4Lwjxq4qRqvRllBXdFu5+2pMfC
8+
IZ10HPRdqDCTN60DUix+BTzBUT30NzaLhZbOMT5RvQtvTVgWpeIn20i2NrPWNCUh
9+
hj490dKDLpK/v+A5/i8zPvN4c6MkDHi1FZfaoz3863dylUBR3Ip26oM0hHXf4/2U
10+
A/oA4pCl2W0hc4aNtozjKHkVjRx5Q8/hVYu+39csFWxo6YSB/KgIEw+0W8DiTII3
11+
RQj/OlD68ZDmGLyQPiJvaEtY9fDrcSpI0Esm0i4sjkNbuuh0Cvwwwqo5EF1zfkVj
12+
Tqz2REYQGMJGc5LUbIpk5sMHo1HWV038TWxlDRwtOdzw08zQA6BeWe9FOokRPeR2
13+
AqhyaJJwOZJodKZ76S+LDwFkTLzEKnYPCzkoRwLrEdNt1M7wQBThnC5z6wARAQAB
14+
tBxQb3N0Z3JlU1FMIERlYmlhbiBSZXBvc2l0b3J5iQJOBBMBCAA4AhsDBQsJCAcD
15+
BRUKCQgLBRYCAwEAAh4BAheAFiEEuXsK/KoaR/BE8kSgf8x9RqzMTPgFAlhtCD8A
16+
CgkQf8x9RqzMTPgECxAAk8uL+dwveTv6eH21tIHcltt8U3Ofajdo+D/ayO53LiYO
17+
xi27kdHD0zvFMUWXLGxQtWyeqqDRvDagfWglHucIcaLxoxNwL8+e+9hVFIEskQAY
18+
kVToBCKMXTQDLarz8/J030Pmcv3ihbwB+jhnykMuyyNmht4kq0CNgnlcMCdVz0d3
19+
z/09puryIHJrD+A8y3TD4RM74snQuwc9u5bsckvRtRJKbP3GX5JaFZAqUyZNRJRJ
20+
Tn2OQRBhCpxhlZ2afkAPFIq2aVnEt/Ie6tmeRCzsW3lOxEH2K7MQSfSu/kRz7ELf
21+
Cz3NJHj7rMzC+76Rhsas60t9CjmvMuGONEpctijDWONLCuch3Pdj6XpC+MVxpgBy
22+
2VUdkunb48YhXNW0jgFGM/BFRj+dMQOUbY8PjJjsmVV0joDruWATQG/M4C7O8iU0
23+
B7o6yVv4m8LDEN9CiR6r7H17m4xZseT3f+0QpMe7iQjz6XxTUFRQxXqzmNnloA1T
24+
7VjwPqIIzkj/u0V8nICG/ktLzp1OsCFatWXh7LbU+hwYl6gsFH/mFDqVxJ3+DKQi
25+
vyf1NatzEwl62foVjGUSpvh3ymtmtUQ4JUkNDsXiRBWczaiGSuzD9Qi0ONdkAX3b
26+
ewqmN4TfE+XIpCPxxHXwGq9Rv1IFjOdCX0iG436GHyTLC1tTUIKF5xV4Y0+cXIOJ
27+
Aj0EEwEIACcCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlLpFRkFCQ6EJy0A
28+
CgkQf8x9RqzMTPjOZA//Zp0e25pcvle7cLc0YuFr9pBv2JIkLzPm83nkcwKmxaWa
29+
yUIG4Sv6pH6hm8+S/CHQij/yFCX+o3ngMw2J9HBUvafZ4bnbI0RGJ70GsAwraQ0V
30+
lkIfg7GUw3TzvoGYO42rZTru9S0K/6nFP6D1HUu+U+AsJONLeb6oypQgInfXQExP
31+
ZyliUnHdipei4WR1YFW6sjSkZT/5C3J1wkAvPl5lvOVthI9Zs6bZlJLZwusKxU0U
32+
M4Btgu1Sf3nnJcHmzisixwS9PMHE+AgPWIGSec/N27a0KmTTvImV6K6nEjXJey0K
33+
2+EYJuIBsYUNorOGBwDFIhfRk9qGlpgt0KRyguV+AP5qvgry95IrYtrOuE7307Si
34+
dEbSnvO5ezNemE7gT9Z1tM7IMPfmoKph4BfpNoH7aXiQh1Wo+ChdP92hZUtQrY2N
35+
m13cmkxYjQ4ZgMWfYMC+DA/GooSgZM5i6hYqyyfAuUD9kwRN6BqTbuAUAp+hCWYe
36+
N4D88sLYpFh3paDYNKJ+Gf7Yyi6gThcV956RUFDH3ys5Dk0vDL9NiWwdebWfRFbz
37+
oRM3dyGP889aOyLzS3mh6nHzZrNGhW73kslSQek8tjKrB+56hXOnb4HaElTZGDvD
38+
5wmrrhN94kbyGtz3cydIohvNO9d90+29h0eGEDYti7j7maHkBKUAwlcPvMg5m3aJ
39+
Aj0EEwEIACcCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlEqbZUFCQg2wEEA
40+
CgkQf8x9RqzMTPhFMQ//WxAfKMdpSIA9oIC/yPD/dJpY/+DyouOljpE6MucMy/Ar
41+
BECjFTBwi/j9NYM4ynAk34IkhuNexc1i9/05f5RM6+riLCLgAOsADDbHD4miZzoS
42+
xiVr6GQ3YXMbOGld9kV9Sy6mGNjcUov7iFcf5Hy5w3AjPfKuR9zXswyfzIU1YXOb
43+
iiZT38l55pp/BSgvGVQsvbNjsff5CbEKXS7q3xW+WzN0QWF6YsfNVhFjRGj8hKtH
44+
vwKcA02wwjLeLXVTm6915ZUKhZXUFc0vM4Pj4EgNswH8Ojw9AJaKWJIZmLyW+aP+
45+
wpu6YwVCicxBY59CzBO2pPJDfKFQzUtrErk9irXeuCCLesDyirxJhv8o0JAvmnMA
46+
KOLhNFUrSQ2m+3EnF7zhfz70gHW+EG8X8mL/EN3/dUM09j6TVrjtw43RLxBzwMDe
47+
ariFF9yC+5bLtnGgxjsB9Ik6GV5v34/NEEGf1qBiAzFmDVFRZlrNDkq6gmpvGnA5
48+
hUWNr+y0i01LjGyaLSWHYjgw2UEQOqcUtTFK9MNzbZze4mVaHMEz9/aMfX25R6qb
49+
iNqCChveIm8mYr5Ds2zdZx+G5bAKdzX7nx2IUAxFQJEE94VLSp3npAaTWv3sHr7d
50+
R8tSyUJ9poDwgw4W9BIcnAM7zvFYbLF5FNggg/26njHCCN70sHt8zGxKQINMc6SJ
51+
Aj0EEwEIACcCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlB5KywFCQPDFt8A
52+
CgkQf8x9RqzMTPhuCQ//QAjRSAOCQ02qmUAikT+mTB6baOAakkYq6uHbEO7qPZkv
53+
4E/M+HPIJ4wdnBNeSQjfvdNcZBA/x0hr5EMcBneKKPDj4hJ0panOIRQmNSTThQw9
54+
OU351gm3YQctAMPRUu1fTJAL/AuZUQf9ESmhyVtWNlH/56HBfYjE4iVeaRkkNLJy
55+
X3vkWdJSMwC/LO3Lw/0M3R8itDsm74F8w4xOdSQ52nSRFRh7PunFtREl+QzQ3EA/
56+
WB4AIj3VohIGkWDfPFCzV3cyZQiEnjAe9gG5pHsXHUWQsDFZ12t784JgkGyO5wT2
57+
6pzTiuApWM3k/9V+o3HJSgH5hn7wuTi3TelEFwP1fNzI5iUUtZdtxbFOfWMnZAyp
58+
EhaLmXNkg4zDkH44r0ss9fR0DAgUav1a25UnbOn4PgIEQy2fgHKHwRpCy20d6oCS
59+
lmgyWsR40EPPYvtGq49A2aK6ibXmdvvFT+Ts8Z+q2SkFpoYFX20mR2nsF0fbt1lf
60+
H65P64dukxeRGteWIeNakDD40bAAOH8+OaoTGVBJ2ACJfLVNM53PEoftavAwUYMr
61+
R910qvwYfd/46rh46g1Frr9SFMKYE9uvIJIgDsQB3QBp71houU4H55M5GD8XURYs
62+
+bfiQpJG1p7eB8e5jZx1SagNWc4XwL2FzQ9svrkbg1Y+359buUiP7T6QXX2zY+8=
63+
=XSRU
64+
-----END PGP PUBLIC KEY BLOCK-----

0 commit comments

Comments
 (0)