Skip to content

fix(privacy-backup): hold the PostgreSQL and PostGIS packages at the pinned image #688

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Medformatik merged 1 commit into from
Oct 30, 2026
Merged

fix(privacy-backup): hold the PostgreSQL and PostGIS packages at the pinned image #688

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion services/ops-agent/privacy-backup/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,20 @@ FROM ghcr.io/baosystems/postgis:18-3.6@sha256:dd7515b7d8b8b8bac3516a9c3e12584df5
# Apply distribution security fixes; this non-root entrypoint does not use gosu.
# The minimum Brotli version (CVE-2026-111497) fails a stale mirror and, when
# raised, invalidates this layer in the registry build cache.
RUN apt-get update && apt-get upgrade -y && \
# PostgreSQL, PostGIS and libpq stay at the pinned image's versions: the restore
# engine must match the deployment's, and the PostgreSQL repository can publish
# a PostGIS release's SQL scripts before its library (3.7.0 scripts over the
# 3.6.4 library made every restore fail on 2026-10-30). The build stops if the
# PostGIS library and scripts ever differ.
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN apt-get update && \
dpkg-query -W -f='${db:Status-Abbrev} ${binary:Package}\n' 'postgresql*' 'postgis*' 'libpq*' | \
awk '$1 == "ii" { print $2 }' | xargs apt-mark hold && \
apt-get upgrade -y && \
apt-get install -y --no-install-recommends python3 ca-certificates && \
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libbrotli1)" ge 1.1.0-2+deb13u1 && \
[ "$(dpkg-query -W -f='${Version}' postgresql-18-postgis-3)" = \
"$(dpkg-query -W -f='${Version}' postgresql-18-postgis-3-scripts)" ] && \
rm -rf /var/lib/apt/lists/* && \
rm -f /usr/local/bin/gosu
COPY services/ops-agent/privacy-backup/openmapx-backup-subject-export.py /usr/local/bin/openmapx-backup-subject-export
Expand Down
Loading