From 04938cd5d6bd23cb2fa49e74d196688adc94be05 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Thu, 27 Aug 2026 14:44:55 -0300 Subject: [PATCH 1/4] chore(ci): update postgres version tag to manually build AMI --- ansible/vars.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ansible/vars.yml b/ansible/vars.yml index 7d465d395..0b9d475d7 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -11,9 +11,9 @@ postgres_major: # This is the source of truth for Postgres versions used in the Dockerfiles, and # is used to derive image tags and base images in the release matrix. postgres_release: - postgresorioledb-17: "17.9.0.020-orioledb" - postgres17: "17.6.1.167" - postgres15: "15.14.1.167" + postgresorioledb-17: "17.9.0.020-orioledb-sbom" + postgres17: "17.6.1.167-sbom" + postgres15: "15.14.1.167-sbom" # Docker release matrix — base images built first, layered images built on top. # tag and base_tag are derived at build time from postgres_release via release_key. # tag_suffix is appended to the release version to form the final image tag. From c300d859f1d28e47b9d3769ff0ae9cfed5f47d26 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Mon, 31 Aug 2026 16:34:31 -0300 Subject: [PATCH 2/4] feat: add step to run ubuntu-nix-sbom --- ansible/tasks/stage2-setup-postgres.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index d4823238a..46da86099 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -240,6 +240,11 @@ src: '/usr/lib/postgresql/bin/pgsodium_getkey.sh' state: 'link' + - name: Generate SBOM for nix and ubuntu + ansible.builtin.shell: | + nix run github:supabase/ubuntu-nix-sbom#sbom-combined -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json + + - name: Append GRN_PLUGINS_DIR to /etc/environment.d/postgresql.env ansible.builtin.lineinfile: line: 'GRN_PLUGINS_DIR=/var/lib/postgresql/.nix-profile/lib/groonga/plugins' From a11dc3ea6deb41cbc7230e9390a38bea840e6854 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Tue, 1 Sep 2026 10:02:15 -0300 Subject: [PATCH 3/4] fix(ami): add nix-gc call after running sbom generator --- ansible/tasks/stage2-setup-postgres.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index 46da86099..1cca2a4ad 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -243,6 +243,10 @@ - name: Generate SBOM for nix and ubuntu ansible.builtin.shell: | nix run github:supabase/ubuntu-nix-sbom#sbom-combined -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json + + - name: Nix collect garbage after SBOM generation + ansible.builtin.shell: + cmd: sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d" - name: Append GRN_PLUGINS_DIR to /etc/environment.d/postgresql.env From 9b8a0aed759f58d64ce0d5267eb3c3564cd7cd97 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Tue, 1 Sep 2026 13:49:54 -0300 Subject: [PATCH 4/4] chore: add ubuntu-sbom-nix as flake input this avoids having to copy all the dependencies again into the machine. --- ansible/tasks/stage2-setup-postgres.yml | 9 -- ebssurrogate/scripts/nix-provision.sh | 1 + flake.lock | 199 +++++++++++++++++++++++- flake.nix | 6 + nix/apps.nix | 4 + nix/packages/default.nix | 2 + 6 files changed, 211 insertions(+), 10 deletions(-) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index 1cca2a4ad..d4823238a 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -240,15 +240,6 @@ src: '/usr/lib/postgresql/bin/pgsodium_getkey.sh' state: 'link' - - name: Generate SBOM for nix and ubuntu - ansible.builtin.shell: | - nix run github:supabase/ubuntu-nix-sbom#sbom-combined -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json - - - name: Nix collect garbage after SBOM generation - ansible.builtin.shell: - cmd: sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d" - - - name: Append GRN_PLUGINS_DIR to /etc/environment.d/postgresql.env ansible.builtin.lineinfile: line: 'GRN_PLUGINS_DIR=/var/lib/postgresql/.nix-profile/lib/groonga/plugins' diff --git a/ebssurrogate/scripts/nix-provision.sh b/ebssurrogate/scripts/nix-provision.sh index 4063ddca9..1f120053c 100755 --- a/ebssurrogate/scripts/nix-provision.sh +++ b/ebssurrogate/scripts/nix-provision.sh @@ -79,6 +79,7 @@ function report_packages { # shellcheck disable=SC2016 dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2 + nix run .#ubuntu-sbom -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json } function report_disk_usage { diff --git a/flake.lock b/flake.lock index 3a0c359be..aec08a998 100644 --- a/flake.lock +++ b/flake.lock @@ -36,6 +36,22 @@ "type": "github" } }, + "flake-compat_2": { + "flake": false, + "locked": { + "lastModified": 1746162366, + "narHash": "sha256-5SSSZ/oQkwfcAz/o/6TlejlVGqeK08wyREBQ5qFFPhM=", + "owner": "nix-community", + "repo": "flake-compat", + "rev": "0f158086a2ecdbb138cd0429410e44994f1b7e4b", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "flake-compat", + "type": "github" + } + }, "flake-parts": { "inputs": { "nixpkgs-lib": "nixpkgs-lib" @@ -54,6 +70,39 @@ "type": "github" } }, + "flake-parts_2": { + "inputs": { + "nixpkgs-lib": "nixpkgs-lib_2" + }, + "locked": { + "lastModified": 1760948891, + "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-root": { + "locked": { + "lastModified": 1723604017, + "narHash": "sha256-rBtQ8gg+Dn4Sx/s+pvjdq3CB2wQNzx9XGFq/JVGCB6k=", + "owner": "srid", + "repo": "flake-root", + "rev": "b759a56851e10cb13f6b8e5698af7b59c44be26e", + "type": "github" + }, + "original": { + "owner": "srid", + "repo": "flake-root", + "type": "github" + } + }, "flake-utils": { "inputs": { "systems": "systems" @@ -94,6 +143,34 @@ "type": "github" } }, + "git-hooks-nix": { + "inputs": { + "flake-compat": [ + "ubuntu-nix-sbom", + "sbomnix", + "flake-compat" + ], + "gitignore": "gitignore_2", + "nixpkgs": [ + "ubuntu-nix-sbom", + "sbomnix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1760663237, + "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=", + "owner": "cachix", + "repo": "git-hooks.nix", + "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "git-hooks.nix", + "type": "github" + } + }, "gitignore": { "inputs": { "nixpkgs": [ @@ -115,6 +192,29 @@ "type": "github" } }, + "gitignore_2": { + "inputs": { + "nixpkgs": [ + "ubuntu-nix-sbom", + "sbomnix", + "git-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "multigres": { "flake": false, "locked": { @@ -263,6 +363,21 @@ "type": "github" } }, + "nixpkgs-lib_2": { + "locked": { + "lastModified": 1754788789, + "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=", + "owner": "nix-community", + "repo": "nixpkgs.lib", + "rev": "a73b9c743612e4244d865a2fdee11865283c04e6", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nixpkgs.lib", + "type": "github" + } + }, "nixpkgs-oldstable": { "locked": { "lastModified": 1712666087, @@ -306,7 +421,8 @@ "nixpkgs": "nixpkgs_2", "nixpkgs-oldstable": "nixpkgs-oldstable", "rust-overlay": "rust-overlay", - "treefmt-nix": "treefmt-nix" + "treefmt-nix": "treefmt-nix", + "ubuntu-nix-sbom": "ubuntu-nix-sbom" } }, "rust-overlay": { @@ -329,6 +445,32 @@ "type": "github" } }, + "sbomnix": { + "inputs": { + "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts_2", + "flake-root": "flake-root", + "git-hooks-nix": "git-hooks-nix", + "nixpkgs": [ + "ubuntu-nix-sbom", + "nixpkgs" + ], + "treefmt-nix": "treefmt-nix_2" + }, + "locked": { + "lastModified": 1761217593, + "narHash": "sha256-SXBdaMtx3JZgbbx64t9HotT9CrWl4+3t7eELaS0/uVQ=", + "owner": "tiiuae", + "repo": "sbomnix", + "rev": "32133d609e8c29ac7e29f30ebe84f5c86081694d", + "type": "github" + }, + "original": { + "owner": "tiiuae", + "repo": "sbomnix", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1681028828, @@ -363,6 +505,61 @@ "repo": "treefmt-nix", "type": "github" } + }, + "treefmt-nix_2": { + "inputs": { + "nixpkgs": [ + "ubuntu-nix-sbom", + "sbomnix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1760945191, + "narHash": "sha256-ZRVs8UqikBa4Ki3X4KCnMBtBW0ux1DaT35tgsnB1jM4=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "f56b1934f5f8fcab8deb5d38d42fd692632b47c2", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } + }, + "ubuntu-nix-sbom": { + "inputs": { + "flake-parts": [ + "flake-parts" + ], + "flake-utils": [ + "flake-utils" + ], + "git-hooks": [ + "git-hooks" + ], + "nixpkgs": [ + "nixpkgs" + ], + "sbomnix": "sbomnix", + "treefmt-nix": [ + "treefmt-nix" + ] + }, + "locked": { + "lastModified": 1762617903, + "narHash": "sha256-YvmAiwpIYqiQNeIalALzal6hQOqw8y/tmTZzKK293cE=", + "owner": "supabase", + "repo": "ubuntu-nix-sbom", + "rev": "9c988098b60ecfc704b481060279f749e43f10f2", + "type": "github" + }, + "original": { + "owner": "supabase", + "repo": "ubuntu-nix-sbom", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 828a384e9..0a384f786 100644 --- a/flake.nix +++ b/flake.nix @@ -31,6 +31,12 @@ rust-overlay.url = "github:oxalica/rust-overlay"; treefmt-nix.inputs.nixpkgs.follows = "nixpkgs"; treefmt-nix.url = "github:numtide/treefmt-nix"; + ubuntu-nix-sbom.url = "github:supabase/ubuntu-nix-sbom"; + ubuntu-nix-sbom.inputs.nixpkgs.follows = "nixpkgs"; + ubuntu-nix-sbom.inputs.flake-utils.follows = "flake-utils"; + ubuntu-nix-sbom.inputs.flake-parts.follows = "flake-parts"; + ubuntu-nix-sbom.inputs.treefmt-nix.follows = "treefmt-nix"; + ubuntu-nix-sbom.inputs.git-hooks.follows = "git-hooks"; }; outputs = diff --git a/nix/apps.nix b/nix/apps.nix index 43817dba3..1d422386e 100644 --- a/nix/apps.nix +++ b/nix/apps.nix @@ -32,6 +32,10 @@ pg-startup-profiler = mkApp "pg-startup-profiler"; docker-image-test = mkApp "docker-image-test"; cli-smoke-test = mkApp "cli-smoke-test"; + ubuntu-sbom = { + type = "app"; + program = "${self'.packages.ubuntu-sbom}/bin/ubuntu-sbom"; + }; }; }; } diff --git a/nix/packages/default.nix b/nix/packages/default.nix index c6f1a2939..a12ce337d 100644 --- a/nix/packages/default.nix +++ b/nix/packages/default.nix @@ -120,6 +120,8 @@ inherit (pkgs) yq; postgresql_15 = self'.packages."postgresql_15"; }; + ubuntu-sbom = + inputs.ubuntu-nix-sbom.packages.${pkgs.stdenv.hostPlatform.system}.ubuntu-sbom-generator; inherit (pkgs.callPackage ./wal-g.nix { }) wal-g-2 wal-g-3; inherit (supascan-pkgs) goss supascan supascan-specs; inherit (pg-startup-profiler-pkgs) pg-startup-profiler;