diff --git a/ansible/vars.yml b/ansible/vars.yml index afd34a9d3f..59a0b4fda9 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -11,9 +11,9 @@ postgres_major: # This is the source of truth for Postgres versions used in the Dockerfiles, and # is used to derive image tags and base images in the release matrix. postgres_release: - postgresorioledb-17: "17.9.0.021-orioledb" - postgres17: "17.6.1.168" - postgres15: "15.14.1.168" + postgresorioledb-17: "17.9.0.021-orioledb-sbom" + postgres17: "17.6.1.168-sbom" + postgres15: "15.14.1.168-sbom" # Docker release matrix — base images built first, layered images built on top. # tag and base_tag are derived at build time from postgres_release via release_key. # tag_suffix is appended to the release version to form the final image tag. diff --git a/ebssurrogate/scripts/nix-provision.sh b/ebssurrogate/scripts/nix-provision.sh index 4063ddca96..9fd12e4036 100755 --- a/ebssurrogate/scripts/nix-provision.sh +++ b/ebssurrogate/scripts/nix-provision.sh @@ -66,6 +66,10 @@ function execute_stage2_playbook { $ARGS } +function generate_and_upload_sbom { + nix run "github:supabase/postgres/$GIT_SHA#ubuntu-sbom" -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json +} + function cleanup_packages { apt-get remove --purge --yes ansible } @@ -92,9 +96,10 @@ update_and_upgrade_apt install_packages install_nix execute_stage2_playbook +generate_and_upload_sbom cleanup_packages -cleanup_nix update_and_upgrade_apt cleanup_apt report_packages +cleanup_nix report_disk_usage diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh index c064454b0d..915d0ecff8 100755 --- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh +++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh @@ -162,6 +162,10 @@ function execute_stage2_playbook { --extra-vars @./ansible/qemu-vars.yaml } +function generate_and_upload_sbom { + nix run "github:supabase/postgres/$GIT_SHA#ubuntu-sbom" -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json +} + function clean_legacy_things { # removes things that are bundled for legacy reasons, but we can start without for our newer artifacts apt-mark auto zlib1g* # TODO (darora): need to make sure that there aren't other things that still need this @@ -268,6 +272,7 @@ execute_playbook install_nix execute_stage2_playbook +generate_and_upload_sbom clean_legacy_things clean_system clean_nix diff --git a/flake.lock b/flake.lock index 3a0c359bee..f044dd5e4c 100644 --- a/flake.lock +++ b/flake.lock @@ -36,6 +36,22 @@ "type": "github" } }, + "flake-compat_2": { + "flake": false, + "locked": { + "lastModified": 1746162366, + "narHash": "sha256-5SSSZ/oQkwfcAz/o/6TlejlVGqeK08wyREBQ5qFFPhM=", + "owner": "nix-community", + "repo": "flake-compat", + "rev": "0f158086a2ecdbb138cd0429410e44994f1b7e4b", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "flake-compat", + "type": "github" + } + }, "flake-parts": { "inputs": { "nixpkgs-lib": "nixpkgs-lib" @@ -54,6 +70,39 @@ "type": "github" } }, + "flake-parts_2": { + "inputs": { + "nixpkgs-lib": "nixpkgs-lib_2" + }, + "locked": { + "lastModified": 1760948891, + "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-root": { + "locked": { + "lastModified": 1723604017, + "narHash": "sha256-rBtQ8gg+Dn4Sx/s+pvjdq3CB2wQNzx9XGFq/JVGCB6k=", + "owner": "srid", + "repo": "flake-root", + "rev": "b759a56851e10cb13f6b8e5698af7b59c44be26e", + "type": "github" + }, + "original": { + "owner": "srid", + "repo": "flake-root", + "type": "github" + } + }, "flake-utils": { "inputs": { "systems": "systems" @@ -94,6 +143,34 @@ "type": "github" } }, + "git-hooks-nix": { + "inputs": { + "flake-compat": [ + "ubuntu-nix-sbom", + "sbomnix", + "flake-compat" + ], + "gitignore": "gitignore_2", + "nixpkgs": [ + "ubuntu-nix-sbom", + "sbomnix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1760663237, + "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=", + "owner": "cachix", + "repo": "git-hooks.nix", + "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "git-hooks.nix", + "type": "github" + } + }, "gitignore": { "inputs": { "nixpkgs": [ @@ -115,6 +192,29 @@ "type": "github" } }, + "gitignore_2": { + "inputs": { + "nixpkgs": [ + "ubuntu-nix-sbom", + "sbomnix", + "git-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "multigres": { "flake": false, "locked": { @@ -263,6 +363,21 @@ "type": "github" } }, + "nixpkgs-lib_2": { + "locked": { + "lastModified": 1754788789, + "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=", + "owner": "nix-community", + "repo": "nixpkgs.lib", + "rev": "a73b9c743612e4244d865a2fdee11865283c04e6", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nixpkgs.lib", + "type": "github" + } + }, "nixpkgs-oldstable": { "locked": { "lastModified": 1712666087, @@ -306,7 +421,8 @@ "nixpkgs": "nixpkgs_2", "nixpkgs-oldstable": "nixpkgs-oldstable", "rust-overlay": "rust-overlay", - "treefmt-nix": "treefmt-nix" + "treefmt-nix": "treefmt-nix", + "ubuntu-nix-sbom": "ubuntu-nix-sbom" } }, "rust-overlay": { @@ -329,6 +445,32 @@ "type": "github" } }, + "sbomnix": { + "inputs": { + "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts_2", + "flake-root": "flake-root", + "git-hooks-nix": "git-hooks-nix", + "nixpkgs": [ + "ubuntu-nix-sbom", + "nixpkgs" + ], + "treefmt-nix": "treefmt-nix_2" + }, + "locked": { + "lastModified": 1761217593, + "narHash": "sha256-SXBdaMtx3JZgbbx64t9HotT9CrWl4+3t7eELaS0/uVQ=", + "owner": "tiiuae", + "repo": "sbomnix", + "rev": "32133d609e8c29ac7e29f30ebe84f5c86081694d", + "type": "github" + }, + "original": { + "owner": "tiiuae", + "repo": "sbomnix", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1681028828, @@ -363,6 +505,61 @@ "repo": "treefmt-nix", "type": "github" } + }, + "treefmt-nix_2": { + "inputs": { + "nixpkgs": [ + "ubuntu-nix-sbom", + "sbomnix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1760945191, + "narHash": "sha256-ZRVs8UqikBa4Ki3X4KCnMBtBW0ux1DaT35tgsnB1jM4=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "f56b1934f5f8fcab8deb5d38d42fd692632b47c2", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } + }, + "ubuntu-nix-sbom": { + "inputs": { + "flake-parts": [ + "flake-parts" + ], + "flake-utils": [ + "flake-utils" + ], + "git-hooks": [ + "git-hooks" + ], + "nixpkgs": [ + "nixpkgs" + ], + "sbomnix": "sbomnix", + "treefmt-nix": [ + "treefmt-nix" + ] + }, + "locked": { + "lastModified": 1788457735, + "narHash": "sha256-Qf9xRzHXQBRWdr+V5cfHSftYNMUuuRBP8Zr9Dhb8XXU=", + "owner": "supabase", + "repo": "ubuntu-nix-sbom", + "rev": "52daec35a5610fd4e96a5f993affa7d7a41d52aa", + "type": "github" + }, + "original": { + "owner": "supabase", + "repo": "ubuntu-nix-sbom", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 828a384e95..0a384f7867 100644 --- a/flake.nix +++ b/flake.nix @@ -31,6 +31,12 @@ rust-overlay.url = "github:oxalica/rust-overlay"; treefmt-nix.inputs.nixpkgs.follows = "nixpkgs"; treefmt-nix.url = "github:numtide/treefmt-nix"; + ubuntu-nix-sbom.url = "github:supabase/ubuntu-nix-sbom"; + ubuntu-nix-sbom.inputs.nixpkgs.follows = "nixpkgs"; + ubuntu-nix-sbom.inputs.flake-utils.follows = "flake-utils"; + ubuntu-nix-sbom.inputs.flake-parts.follows = "flake-parts"; + ubuntu-nix-sbom.inputs.treefmt-nix.follows = "treefmt-nix"; + ubuntu-nix-sbom.inputs.git-hooks.follows = "git-hooks"; }; outputs = diff --git a/nix/apps.nix b/nix/apps.nix index 43817dba35..c2bec4ee65 100644 --- a/nix/apps.nix +++ b/nix/apps.nix @@ -1,7 +1,12 @@ -{ ... }: +{ inputs, ... }: { perSystem = - { self', lib, ... }: + { + self', + lib, + pkgs, + ... + }: let mkApp = attrName: { type = "app"; @@ -32,6 +37,7 @@ pg-startup-profiler = mkApp "pg-startup-profiler"; docker-image-test = mkApp "docker-image-test"; cli-smoke-test = mkApp "cli-smoke-test"; + sbom = inputs.ubuntu-nix-sbom.apps.${pkgs.stdenv.hostPlatform.system}.sbom-generator; }; }; }