From 18db5b1e64c0c04c77f0ee8a9ce03a1debfdd9a9 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Thu, 27 Aug 2026 14:44:55 -0300 Subject: [PATCH 1/7] chore(ci): update postgres version tag to manually build AMI --- ansible/vars.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ansible/vars.yml b/ansible/vars.yml index afd34a9d3f..59a0b4fda9 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -11,9 +11,9 @@ postgres_major: # This is the source of truth for Postgres versions used in the Dockerfiles, and # is used to derive image tags and base images in the release matrix. postgres_release: - postgresorioledb-17: "17.9.0.021-orioledb" - postgres17: "17.6.1.168" - postgres15: "15.14.1.168" + postgresorioledb-17: "17.9.0.021-orioledb-sbom" + postgres17: "17.6.1.168-sbom" + postgres15: "15.14.1.168-sbom" # Docker release matrix — base images built first, layered images built on top. # tag and base_tag are derived at build time from postgres_release via release_key. # tag_suffix is appended to the release version to form the final image tag. From a9843f0fe6423db1f060acfa5fb1eff66d6429f4 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Mon, 31 Aug 2026 16:34:31 -0300 Subject: [PATCH 2/7] feat: add step to run ubuntu-nix-sbom --- ansible/tasks/stage2-setup-postgres.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index d4823238a7..46da860997 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -240,6 +240,11 @@ src: '/usr/lib/postgresql/bin/pgsodium_getkey.sh' state: 'link' + - name: Generate SBOM for nix and ubuntu + ansible.builtin.shell: | + nix run github:supabase/ubuntu-nix-sbom#sbom-combined -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json + + - name: Append GRN_PLUGINS_DIR to /etc/environment.d/postgresql.env ansible.builtin.lineinfile: line: 'GRN_PLUGINS_DIR=/var/lib/postgresql/.nix-profile/lib/groonga/plugins' From 933e44b649a4598823f253367283e527530bbf82 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Tue, 1 Sep 2026 10:02:15 -0300 Subject: [PATCH 3/7] fix(ami): add nix-gc call after running sbom generator --- ansible/tasks/stage2-setup-postgres.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index 46da860997..1cca2a4adc 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -243,6 +243,10 @@ - name: Generate SBOM for nix and ubuntu ansible.builtin.shell: | nix run github:supabase/ubuntu-nix-sbom#sbom-combined -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json + + - name: Nix collect garbage after SBOM generation + ansible.builtin.shell: + cmd: sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d" - name: Append GRN_PLUGINS_DIR to /etc/environment.d/postgresql.env From c6118ad3eecd5ba5c18965954b3cb0a0026eaf44 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Tue, 1 Sep 2026 13:49:54 -0300 Subject: [PATCH 4/7] chore: add ubuntu-sbom-nix as flake input this avoids having to copy all the dependencies again into the machine. --- ansible/tasks/stage2-setup-postgres.yml | 9 -- ebssurrogate/scripts/nix-provision.sh | 1 + flake.lock | 199 +++++++++++++++++++++++- flake.nix | 6 + nix/apps.nix | 4 + nix/packages/default.nix | 2 + 6 files changed, 211 insertions(+), 10 deletions(-) diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml index 1cca2a4adc..d4823238a7 100644 --- a/ansible/tasks/stage2-setup-postgres.yml +++ b/ansible/tasks/stage2-setup-postgres.yml @@ -240,15 +240,6 @@ src: '/usr/lib/postgresql/bin/pgsodium_getkey.sh' state: 'link' - - name: Generate SBOM for nix and ubuntu - ansible.builtin.shell: | - nix run github:supabase/ubuntu-nix-sbom#sbom-combined -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json - - - name: Nix collect garbage after SBOM generation - ansible.builtin.shell: - cmd: sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d" - - - name: Append GRN_PLUGINS_DIR to /etc/environment.d/postgresql.env ansible.builtin.lineinfile: line: 'GRN_PLUGINS_DIR=/var/lib/postgresql/.nix-profile/lib/groonga/plugins' diff --git a/ebssurrogate/scripts/nix-provision.sh b/ebssurrogate/scripts/nix-provision.sh index 4063ddca96..1f120053cf 100755 --- a/ebssurrogate/scripts/nix-provision.sh +++ b/ebssurrogate/scripts/nix-provision.sh @@ -79,6 +79,7 @@ function report_packages { # shellcheck disable=SC2016 dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2 + nix run .#ubuntu-sbom -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json } function report_disk_usage { diff --git a/flake.lock b/flake.lock index 3a0c359bee..aec08a998d 100644 --- a/flake.lock +++ b/flake.lock @@ -36,6 +36,22 @@ "type": "github" } }, + "flake-compat_2": { + "flake": false, + "locked": { + "lastModified": 1746162366, + "narHash": "sha256-5SSSZ/oQkwfcAz/o/6TlejlVGqeK08wyREBQ5qFFPhM=", + "owner": "nix-community", + "repo": "flake-compat", + "rev": "0f158086a2ecdbb138cd0429410e44994f1b7e4b", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "flake-compat", + "type": "github" + } + }, "flake-parts": { "inputs": { "nixpkgs-lib": "nixpkgs-lib" @@ -54,6 +70,39 @@ "type": "github" } }, + "flake-parts_2": { + "inputs": { + "nixpkgs-lib": "nixpkgs-lib_2" + }, + "locked": { + "lastModified": 1760948891, + "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-root": { + "locked": { + "lastModified": 1723604017, + "narHash": "sha256-rBtQ8gg+Dn4Sx/s+pvjdq3CB2wQNzx9XGFq/JVGCB6k=", + "owner": "srid", + "repo": "flake-root", + "rev": "b759a56851e10cb13f6b8e5698af7b59c44be26e", + "type": "github" + }, + "original": { + "owner": "srid", + "repo": "flake-root", + "type": "github" + } + }, "flake-utils": { "inputs": { "systems": "systems" @@ -94,6 +143,34 @@ "type": "github" } }, + "git-hooks-nix": { + "inputs": { + "flake-compat": [ + "ubuntu-nix-sbom", + "sbomnix", + "flake-compat" + ], + "gitignore": "gitignore_2", + "nixpkgs": [ + "ubuntu-nix-sbom", + "sbomnix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1760663237, + "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=", + "owner": "cachix", + "repo": "git-hooks.nix", + "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "git-hooks.nix", + "type": "github" + } + }, "gitignore": { "inputs": { "nixpkgs": [ @@ -115,6 +192,29 @@ "type": "github" } }, + "gitignore_2": { + "inputs": { + "nixpkgs": [ + "ubuntu-nix-sbom", + "sbomnix", + "git-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "multigres": { "flake": false, "locked": { @@ -263,6 +363,21 @@ "type": "github" } }, + "nixpkgs-lib_2": { + "locked": { + "lastModified": 1754788789, + "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=", + "owner": "nix-community", + "repo": "nixpkgs.lib", + "rev": "a73b9c743612e4244d865a2fdee11865283c04e6", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nixpkgs.lib", + "type": "github" + } + }, "nixpkgs-oldstable": { "locked": { "lastModified": 1712666087, @@ -306,7 +421,8 @@ "nixpkgs": "nixpkgs_2", "nixpkgs-oldstable": "nixpkgs-oldstable", "rust-overlay": "rust-overlay", - "treefmt-nix": "treefmt-nix" + "treefmt-nix": "treefmt-nix", + "ubuntu-nix-sbom": "ubuntu-nix-sbom" } }, "rust-overlay": { @@ -329,6 +445,32 @@ "type": "github" } }, + "sbomnix": { + "inputs": { + "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts_2", + "flake-root": "flake-root", + "git-hooks-nix": "git-hooks-nix", + "nixpkgs": [ + "ubuntu-nix-sbom", + "nixpkgs" + ], + "treefmt-nix": "treefmt-nix_2" + }, + "locked": { + "lastModified": 1761217593, + "narHash": "sha256-SXBdaMtx3JZgbbx64t9HotT9CrWl4+3t7eELaS0/uVQ=", + "owner": "tiiuae", + "repo": "sbomnix", + "rev": "32133d609e8c29ac7e29f30ebe84f5c86081694d", + "type": "github" + }, + "original": { + "owner": "tiiuae", + "repo": "sbomnix", + "type": "github" + } + }, "systems": { "locked": { "lastModified": 1681028828, @@ -363,6 +505,61 @@ "repo": "treefmt-nix", "type": "github" } + }, + "treefmt-nix_2": { + "inputs": { + "nixpkgs": [ + "ubuntu-nix-sbom", + "sbomnix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1760945191, + "narHash": "sha256-ZRVs8UqikBa4Ki3X4KCnMBtBW0ux1DaT35tgsnB1jM4=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "f56b1934f5f8fcab8deb5d38d42fd692632b47c2", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } + }, + "ubuntu-nix-sbom": { + "inputs": { + "flake-parts": [ + "flake-parts" + ], + "flake-utils": [ + "flake-utils" + ], + "git-hooks": [ + "git-hooks" + ], + "nixpkgs": [ + "nixpkgs" + ], + "sbomnix": "sbomnix", + "treefmt-nix": [ + "treefmt-nix" + ] + }, + "locked": { + "lastModified": 1762617903, + "narHash": "sha256-YvmAiwpIYqiQNeIalALzal6hQOqw8y/tmTZzKK293cE=", + "owner": "supabase", + "repo": "ubuntu-nix-sbom", + "rev": "9c988098b60ecfc704b481060279f749e43f10f2", + "type": "github" + }, + "original": { + "owner": "supabase", + "repo": "ubuntu-nix-sbom", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 828a384e95..0a384f7867 100644 --- a/flake.nix +++ b/flake.nix @@ -31,6 +31,12 @@ rust-overlay.url = "github:oxalica/rust-overlay"; treefmt-nix.inputs.nixpkgs.follows = "nixpkgs"; treefmt-nix.url = "github:numtide/treefmt-nix"; + ubuntu-nix-sbom.url = "github:supabase/ubuntu-nix-sbom"; + ubuntu-nix-sbom.inputs.nixpkgs.follows = "nixpkgs"; + ubuntu-nix-sbom.inputs.flake-utils.follows = "flake-utils"; + ubuntu-nix-sbom.inputs.flake-parts.follows = "flake-parts"; + ubuntu-nix-sbom.inputs.treefmt-nix.follows = "treefmt-nix"; + ubuntu-nix-sbom.inputs.git-hooks.follows = "git-hooks"; }; outputs = diff --git a/nix/apps.nix b/nix/apps.nix index 43817dba35..1d422386e3 100644 --- a/nix/apps.nix +++ b/nix/apps.nix @@ -32,6 +32,10 @@ pg-startup-profiler = mkApp "pg-startup-profiler"; docker-image-test = mkApp "docker-image-test"; cli-smoke-test = mkApp "cli-smoke-test"; + ubuntu-sbom = { + type = "app"; + program = "${self'.packages.ubuntu-sbom}/bin/ubuntu-sbom"; + }; }; }; } diff --git a/nix/packages/default.nix b/nix/packages/default.nix index c6f1a29399..a12ce337de 100644 --- a/nix/packages/default.nix +++ b/nix/packages/default.nix @@ -120,6 +120,8 @@ inherit (pkgs) yq; postgresql_15 = self'.packages."postgresql_15"; }; + ubuntu-sbom = + inputs.ubuntu-nix-sbom.packages.${pkgs.stdenv.hostPlatform.system}.ubuntu-sbom-generator; inherit (pkgs.callPackage ./wal-g.nix { }) wal-g-2 wal-g-3; inherit (supascan-pkgs) goss supascan supascan-specs; inherit (pg-startup-profiler-pkgs) pg-startup-profiler; From 7b72f7832d678c729078c5c10059e843fccc5d09 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Thu, 3 Sep 2026 10:21:20 -0300 Subject: [PATCH 5/7] fix: reference supabase postgres flake through flakeref instead of local path also postpone nix cleanup to after sbom generation, in order to leverage the existing nix derivations in /nix/store --- ebssurrogate/scripts/nix-provision.sh | 8 ++++++-- ebssurrogate/scripts/qemu-bootstrap-nix.sh | 6 ++++++ nix/apps.nix | 9 +++------ nix/packages/default.nix | 2 -- 4 files changed, 15 insertions(+), 10 deletions(-) diff --git a/ebssurrogate/scripts/nix-provision.sh b/ebssurrogate/scripts/nix-provision.sh index 1f120053cf..780b9ecb72 100755 --- a/ebssurrogate/scripts/nix-provision.sh +++ b/ebssurrogate/scripts/nix-provision.sh @@ -66,6 +66,10 @@ function execute_stage2_playbook { $ARGS } +function generate_and_upload_sbom { + nix run "github:supabase/postgres/$GIT_SHA#ubuntu-sbom" -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json +} + function cleanup_packages { apt-get remove --purge --yes ansible } @@ -79,7 +83,6 @@ function report_packages { # shellcheck disable=SC2016 dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2 - nix run .#ubuntu-sbom -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json } function report_disk_usage { @@ -93,9 +96,10 @@ update_and_upgrade_apt install_packages install_nix execute_stage2_playbook +generate_and_upload_sbom cleanup_packages -cleanup_nix update_and_upgrade_apt cleanup_apt report_packages +cleanup_nix report_disk_usage diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh index c064454b0d..b1933316e7 100755 --- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh +++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh @@ -162,6 +162,11 @@ function execute_stage2_playbook { --extra-vars @./ansible/qemu-vars.yaml } + +function generate_and_upload_sbom { + nix run github:supabase/postgres#ubuntu-sbom -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json +} + function clean_legacy_things { # removes things that are bundled for legacy reasons, but we can start without for our newer artifacts apt-mark auto zlib1g* # TODO (darora): need to make sure that there aren't other things that still need this @@ -268,6 +273,7 @@ execute_playbook install_nix execute_stage2_playbook +generate_and_upload_sbom clean_legacy_things clean_system clean_nix diff --git a/nix/apps.nix b/nix/apps.nix index 1d422386e3..ddba449c8c 100644 --- a/nix/apps.nix +++ b/nix/apps.nix @@ -1,7 +1,7 @@ -{ ... }: +{ inputs, ... }: { perSystem = - { self', lib, ... }: + { self', lib, pkgs, ... }: let mkApp = attrName: { type = "app"; @@ -32,10 +32,7 @@ pg-startup-profiler = mkApp "pg-startup-profiler"; docker-image-test = mkApp "docker-image-test"; cli-smoke-test = mkApp "cli-smoke-test"; - ubuntu-sbom = { - type = "app"; - program = "${self'.packages.ubuntu-sbom}/bin/ubuntu-sbom"; - }; + sbom = inputs.ubuntu-nix-sbom.apps.${pkgs.stdenv.hostPlatform.system}.sbom-generator; }; }; } diff --git a/nix/packages/default.nix b/nix/packages/default.nix index a12ce337de..c6f1a29399 100644 --- a/nix/packages/default.nix +++ b/nix/packages/default.nix @@ -120,8 +120,6 @@ inherit (pkgs) yq; postgresql_15 = self'.packages."postgresql_15"; }; - ubuntu-sbom = - inputs.ubuntu-nix-sbom.packages.${pkgs.stdenv.hostPlatform.system}.ubuntu-sbom-generator; inherit (pkgs.callPackage ./wal-g.nix { }) wal-g-2 wal-g-3; inherit (supascan-pkgs) goss supascan supascan-specs; inherit (pg-startup-profiler-pkgs) pg-startup-profiler; From a13dcdb54e8ee9f10de18747717ccb9291149014 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Thu, 3 Sep 2026 12:53:04 -0300 Subject: [PATCH 6/7] fix: add git_sha to flake reference otherwise it won't use the current git commit to run the program, and will just fetch latest --- ebssurrogate/scripts/nix-provision.sh | 2 +- ebssurrogate/scripts/qemu-bootstrap-nix.sh | 3 +-- nix/apps.nix | 7 ++++++- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/ebssurrogate/scripts/nix-provision.sh b/ebssurrogate/scripts/nix-provision.sh index 780b9ecb72..9fd12e4036 100755 --- a/ebssurrogate/scripts/nix-provision.sh +++ b/ebssurrogate/scripts/nix-provision.sh @@ -67,7 +67,7 @@ function execute_stage2_playbook { } function generate_and_upload_sbom { - nix run "github:supabase/postgres/$GIT_SHA#ubuntu-sbom" -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json + nix run "github:supabase/postgres/$GIT_SHA#ubuntu-sbom" -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json } function cleanup_packages { diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh index b1933316e7..915d0ecff8 100755 --- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh +++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh @@ -162,9 +162,8 @@ function execute_stage2_playbook { --extra-vars @./ansible/qemu-vars.yaml } - function generate_and_upload_sbom { - nix run github:supabase/postgres#ubuntu-sbom -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json + nix run "github:supabase/postgres/$GIT_SHA#ubuntu-sbom" -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json } function clean_legacy_things { diff --git a/nix/apps.nix b/nix/apps.nix index ddba449c8c..c2bec4ee65 100644 --- a/nix/apps.nix +++ b/nix/apps.nix @@ -1,7 +1,12 @@ { inputs, ... }: { perSystem = - { self', lib, pkgs, ... }: + { + self', + lib, + pkgs, + ... + }: let mkApp = attrName: { type = "app"; From 19d81e680c25b7d956a34103367479d877711129 Mon Sep 17 00:00:00 2001 From: Leonardo Santiago Date: Thu, 3 Sep 2026 14:44:03 -0300 Subject: [PATCH 7/7] chore: bump ubuntu-nix-sbom version --- flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index aec08a998d..f044dd5e4c 100644 --- a/flake.lock +++ b/flake.lock @@ -548,11 +548,11 @@ ] }, "locked": { - "lastModified": 1762617903, - "narHash": "sha256-YvmAiwpIYqiQNeIalALzal6hQOqw8y/tmTZzKK293cE=", + "lastModified": 1788457735, + "narHash": "sha256-Qf9xRzHXQBRWdr+V5cfHSftYNMUuuRBP8Zr9Dhb8XXU=", "owner": "supabase", "repo": "ubuntu-nix-sbom", - "rev": "9c988098b60ecfc704b481060279f749e43f10f2", + "rev": "52daec35a5610fd4e96a5f993affa7d7a41d52aa", "type": "github" }, "original": {