From 7a857280dbe3048f0d35a03b0d753c45dd95a5d9 Mon Sep 17 00:00:00 2001 From: Florian Date: Fri, 30 Oct 2026 12:57:27 +0100 Subject: [PATCH] fix(privacy-backup): hold the PostgreSQL and PostGIS packages at the pinned image apt-get upgrade installed PostGIS 3.7.0's SQL scripts over the 3.6.4 library, which the PostgreSQL repository had not yet published, so every backup restore failed at CREATE EXTENSION postgis and CI on main broke. Hold postgresql, postgis and libpq at the pinned image's versions, keep upgrading everything else, and fail the build if the PostGIS library and scripts ever differ. --- services/ops-agent/privacy-backup/Dockerfile | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/services/ops-agent/privacy-backup/Dockerfile b/services/ops-agent/privacy-backup/Dockerfile index 95b765060..6ee785e7a 100644 --- a/services/ops-agent/privacy-backup/Dockerfile +++ b/services/ops-agent/privacy-backup/Dockerfile @@ -6,9 +6,20 @@ FROM ghcr.io/baosystems/postgis:18-3.6@sha256:dd7515b7d8b8b8bac3516a9c3e12584df5 # Apply distribution security fixes; this non-root entrypoint does not use gosu. # The minimum Brotli version (CVE-2026-111497) fails a stale mirror and, when # raised, invalidates this layer in the registry build cache. -RUN apt-get update && apt-get upgrade -y && \ +# PostgreSQL, PostGIS and libpq stay at the pinned image's versions: the restore +# engine must match the deployment's, and the PostgreSQL repository can publish +# a PostGIS release's SQL scripts before its library (3.7.0 scripts over the +# 3.6.4 library made every restore fail on 2026-10-30). The build stops if the +# PostGIS library and scripts ever differ. +SHELL ["/bin/bash", "-o", "pipefail", "-c"] +RUN apt-get update && \ + dpkg-query -W -f='${db:Status-Abbrev} ${binary:Package}\n' 'postgresql*' 'postgis*' 'libpq*' | \ + awk '$1 == "ii" { print $2 }' | xargs apt-mark hold && \ + apt-get upgrade -y && \ apt-get install -y --no-install-recommends python3 ca-certificates && \ dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libbrotli1)" ge 1.1.0-2+deb13u1 && \ + [ "$(dpkg-query -W -f='${Version}' postgresql-18-postgis-3)" = \ + "$(dpkg-query -W -f='${Version}' postgresql-18-postgis-3-scripts)" ] && \ rm -rf /var/lib/apt/lists/* && \ rm -f /usr/local/bin/gosu COPY services/ops-agent/privacy-backup/openmapx-backup-subject-export.py /usr/local/bin/openmapx-backup-subject-export