Skip to content

feat: generate ami SBOM #2411

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
o-santi wants to merge 4 commits into
base: develop
Choose a base branch
from
+214 −4
Draft

feat: generate ami SBOM #2411

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
04938cd
chore(ci): update postgres version tag to manually build AMI
o-santi Aug 27, 2026
c300d85
feat: add step to run ubuntu-nix-sbom
o-santi Aug 31, 2026
a11dc3e
fix(ami): add nix-gc call after running sbom generator
o-santi Sep 1, 2026
9b8a0ae
chore: add ubuntu-sbom-nix as flake input
o-santi Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ansible/vars.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@ postgres_major:
# This is the source of truth for Postgres versions used in the Dockerfiles, and
# is used to derive image tags and base images in the release matrix.
postgres_release:
postgresorioledb-17: "17.9.0.020-orioledb"
postgres17: "17.6.1.167"
postgres15: "15.14.1.167"
postgresorioledb-17: "17.9.0.020-orioledb-sbom"
postgres17: "17.6.1.167-sbom"
postgres15: "15.14.1.167-sbom"
# Docker release matrix — base images built first, layered images built on top.
# tag and base_tag are derived at build time from postgres_release via release_key.
# tag_suffix is appended to the release version to form the final image tag.
Expand Down
1 change: 1 addition & 0 deletions ebssurrogate/scripts/nix-provision.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ function report_packages {
# shellcheck disable=SC2016
dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort
find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2
nix run .#ubuntu-sbom -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json
}

function report_disk_usage {
Expand Down
199 changes: 198 additions & 1 deletion flake.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,12 @@
rust-overlay.url = "github:oxalica/rust-overlay";
treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
treefmt-nix.url = "github:numtide/treefmt-nix";
ubuntu-nix-sbom.url = "github:supabase/ubuntu-nix-sbom";
ubuntu-nix-sbom.inputs.nixpkgs.follows = "nixpkgs";
ubuntu-nix-sbom.inputs.flake-utils.follows = "flake-utils";
ubuntu-nix-sbom.inputs.flake-parts.follows = "flake-parts";
ubuntu-nix-sbom.inputs.treefmt-nix.follows = "treefmt-nix";
ubuntu-nix-sbom.inputs.git-hooks.follows = "git-hooks";
};

outputs =
Expand Down
4 changes: 4 additions & 0 deletions nix/apps.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,10 @@
pg-startup-profiler = mkApp "pg-startup-profiler";
docker-image-test = mkApp "docker-image-test";
cli-smoke-test = mkApp "cli-smoke-test";
ubuntu-sbom = {
type = "app";
program = "${self'.packages.ubuntu-sbom}/bin/ubuntu-sbom";
};
};
};
}
2 changes: 2 additions & 0 deletions nix/packages/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,8 @@
inherit (pkgs) yq;
postgresql_15 = self'.packages."postgresql_15";
};
ubuntu-sbom =
inputs.ubuntu-nix-sbom.packages.${pkgs.stdenv.hostPlatform.system}.ubuntu-sbom-generator;
inherit (pkgs.callPackage ./wal-g.nix { }) wal-g-2 wal-g-3;
inherit (supascan-pkgs) goss supascan supascan-specs;
inherit (pg-startup-profiler-pkgs) pg-startup-profiler;
Expand Down
Loading