From 0ef41776f0b683750ddcd64720c500b117318235 Mon Sep 17 00:00:00 2001 From: Ross Tannenbaum Date: Fri, 15 Mar 2024 10:24:13 -0700 Subject: [PATCH] ROX-22044: postgresql 15 (#1416) --- .github/workflows/ci.yaml | 28 +++--- .openshift-ci/Dockerfile.build_root | 2 +- .openshift-ci/build/Dockerfile.build-bundle | 2 +- .../build/Dockerfile.build-db-bundle | 2 +- .../build/Dockerfile.generate-db-dump | 2 +- .../build/Dockerfile.generate-genesis-dump | 2 +- BUILD_IMAGE_VERSION | 2 +- image/db/rhel/Dockerfile | 4 +- image/db/rhel/Dockerfile.slim | 4 +- image/db/rhel/konflux.Dockerfile | 4 +- image/db/rhel/scripts/docker-entrypoint.sh | 96 ++++++++++--------- 11 files changed, 79 insertions(+), 69 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3ad41a2c1..c9853ebe3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -15,7 +15,7 @@ jobs: pre-build-updater: runs-on: ubuntu-latest container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -42,7 +42,7 @@ jobs: pre-build-scanner: runs-on: ubuntu-latest container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -69,7 +69,7 @@ jobs: style-check: runs-on: ubuntu-latest container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -90,7 +90,7 @@ jobs: needs: - pre-build-scanner container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -119,7 +119,7 @@ jobs: needs: - pre-build-scanner container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -153,7 +153,7 @@ jobs: needs: - pre-build-updater container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -194,7 +194,7 @@ jobs: needs: - generate-genesis-dump container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -236,7 +236,7 @@ jobs: always() && (needs.generate-genesis-dump.result == 'success' || needs.generate-genesis-dump.result == 'skipped') container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -289,7 +289,7 @@ jobs: always() && (needs.generate-db-dump.result == 'success' || needs.generate-db-dump.result == 'skipped') container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -334,7 +334,7 @@ jobs: - generate-scanner-db-bundle if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -400,7 +400,7 @@ jobs: needs: - generate-genesis-dump container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -436,7 +436,7 @@ jobs: needs: - generate-db-dump container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -463,7 +463,7 @@ jobs: needs: - generate-db-dump container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 @@ -495,7 +495,7 @@ jobs: needs: - generate-db-dump container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 steps: - name: Checkout uses: actions/checkout@v4 diff --git a/.openshift-ci/Dockerfile.build_root b/.openshift-ci/Dockerfile.build_root index dae06d18d..47ce2f55e 100644 --- a/.openshift-ci/Dockerfile.build_root +++ b/.openshift-ci/Dockerfile.build_root @@ -10,4 +10,4 @@ # - `make update` and commit the results # - run `/test pj-rehearse-max` on the openshift/release PR to validate the change -FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 +FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 diff --git a/.openshift-ci/build/Dockerfile.build-bundle b/.openshift-ci/build/Dockerfile.build-bundle index c15cd804d..7042c7d6c 100644 --- a/.openshift-ci/build/Dockerfile.build-bundle +++ b/.openshift-ci/build/Dockerfile.build-bundle @@ -1,4 +1,4 @@ -FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 +FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 COPY . /go/src/github.com/stackrox/scanner WORKDIR /go/src/github.com/stackrox/scanner diff --git a/.openshift-ci/build/Dockerfile.build-db-bundle b/.openshift-ci/build/Dockerfile.build-db-bundle index e0c0b8a44..2fd105198 100644 --- a/.openshift-ci/build/Dockerfile.build-db-bundle +++ b/.openshift-ci/build/Dockerfile.build-db-bundle @@ -1,4 +1,4 @@ -FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 +FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 COPY . /go/src/github.com/stackrox/scanner WORKDIR /go/src/github.com/stackrox/scanner diff --git a/.openshift-ci/build/Dockerfile.generate-db-dump b/.openshift-ci/build/Dockerfile.generate-db-dump index 9caa9cb3b..62018a7f9 100644 --- a/.openshift-ci/build/Dockerfile.generate-db-dump +++ b/.openshift-ci/build/Dockerfile.generate-db-dump @@ -1,4 +1,4 @@ -FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 +FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 COPY . /go/src/github.com/stackrox/scanner WORKDIR /go/src/github.com/stackrox/scanner diff --git a/.openshift-ci/build/Dockerfile.generate-genesis-dump b/.openshift-ci/build/Dockerfile.generate-genesis-dump index 81d432e0a..fd58726bf 100644 --- a/.openshift-ci/build/Dockerfile.generate-genesis-dump +++ b/.openshift-ci/build/Dockerfile.generate-genesis-dump @@ -1,4 +1,4 @@ -FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 +FROM quay.io/stackrox-io/apollo-ci:scanner-test-0.3.65 COPY . /go/src/github.com/stackrox/scanner WORKDIR /go/src/github.com/stackrox/scanner diff --git a/BUILD_IMAGE_VERSION b/BUILD_IMAGE_VERSION index 1bd4544ea..8c0322885 100644 --- a/BUILD_IMAGE_VERSION +++ b/BUILD_IMAGE_VERSION @@ -1 +1 @@ -scanner-build-0.3.61 +scanner-build-0.3.65 diff --git a/image/db/rhel/Dockerfile b/image/db/rhel/Dockerfile index 301f43235..3d1c35436 100644 --- a/image/db/rhel/Dockerfile +++ b/image/db/rhel/Dockerfile @@ -16,7 +16,7 @@ LABEL name="scanner-db" \ summary="Image scanner database for the StackRox Kubernetes Security Platform" \ description="This image supports image scanning in the StackRox Kubernetes Security Platform." -ENV PG_MAJOR=12 +ENV PG_MAJOR=15 ENV PATH="$PATH:/usr/pgsql-$PG_MAJOR/bin/" \ PGDATA="/var/lib/postgresql/data/pgdata" @@ -37,7 +37,7 @@ RUN curl -sSLf https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-K adduser postgres -u 70 -g 70 -d /var/lib/postgresql -s /bin/sh && \ microdnf install \ ca-certificates libicu systemd-sysv glibc-locale-source glibc-langpack-en \ - postgresql12-server && \ + postgresql15-server && \ # The removal of /usr/share/zoneinfo from UBI minimal images is intentional. # After building the image, the image is reduced in size as much as possible, # and the /usr/share/zoneinfo directory is purged as it saves space diff --git a/image/db/rhel/Dockerfile.slim b/image/db/rhel/Dockerfile.slim index f01fc7ace..ac0d26b57 100644 --- a/image/db/rhel/Dockerfile.slim +++ b/image/db/rhel/Dockerfile.slim @@ -16,7 +16,7 @@ LABEL name="scanner-db-slim" \ summary="Image scanner database for the StackRox Kubernetes Security Platform" \ description="This image supports image scanning in the StackRox Kubernetes Security Platform." -ENV PG_MAJOR=12 +ENV PG_MAJOR=15 ENV PATH="$PATH:/usr/pgsql-$PG_MAJOR/bin/" \ PGDATA="/var/lib/postgresql/data/pgdata" @@ -37,7 +37,7 @@ RUN curl -sSLf https://download.postgresql.org/pub/repos/yum/keys/PGDG-RPM-GPG-K adduser postgres -u 70 -g 70 -d /var/lib/postgresql -s /bin/sh && \ microdnf install \ ca-certificates libicu systemd-sysv glibc-locale-source glibc-langpack-en \ - postgresql12-server && \ + postgresql15-server && \ # The removal of /usr/share/zoneinfo from UBI minimal images is intentional. # After building the image, the image is reduced in size as much as possible, # and the /usr/share/zoneinfo directory is purged as it saves space diff --git a/image/db/rhel/konflux.Dockerfile b/image/db/rhel/konflux.Dockerfile index 7077477e5..0c37b572c 100644 --- a/image/db/rhel/konflux.Dockerfile +++ b/image/db/rhel/konflux.Dockerfile @@ -1,4 +1,4 @@ -FROM registry.redhat.io/rhel8/postgresql-12:latest AS scanner-db-common +FROM registry.redhat.io/rhel8/postgresql-15:latest AS scanner-db-common LABEL \ com.redhat.license_terms="https://www.redhat.com/agreements" \ @@ -35,7 +35,7 @@ RUN dnf upgrade -y --nobest && \ rm -rf /var/cache/dnf /var/cache/yum && \ chmod +x /usr/local/bin/docker-entrypoint.sh -ENV PG_MAJOR=12 \ +ENV PG_MAJOR=15 \ PGDATA="/var/lib/postgresql/data/pgdata" ENTRYPOINT ["docker-entrypoint.sh"] diff --git a/image/db/rhel/scripts/docker-entrypoint.sh b/image/db/rhel/scripts/docker-entrypoint.sh index 27491bb91..0fa992498 100755 --- a/image/db/rhel/scripts/docker-entrypoint.sh +++ b/image/db/rhel/scripts/docker-entrypoint.sh @@ -4,7 +4,7 @@ ### Community][1]. Any stackrox modification or comments are tagged with this ### comment. ### -### [1]: https://github.com/docker-library/postgres/blob/master/12/bullseye/docker-entrypoint.sh +### [1]: https://github.com/docker-library/postgres/blob/44ef8b226a40f86cf9df3f9299067db6779a3aa3/15/bookworm/docker-entrypoint.sh set -Eeo pipefail # TODO swap to -Eeuo pipefail above (after handling all potentially-unset variables) @@ -18,7 +18,7 @@ file_env() { local fileVar="${var}_FILE" local def="${2:-}" if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then - echo >&2 "error: both $var and $fileVar are set (but are exclusive)" + printf >&2 'error: both %s and %s are set (but are exclusive)\n' "$var" "$fileVar" exit 1 fi local val="$def" @@ -45,11 +45,11 @@ docker_create_db_directories() { mkdir -p "$PGDATA" # ignore failure since there are cases where we can't chmod (and PostgreSQL might fail later anyhow - it's picky about permissions of this directory) - chmod 700 "$PGDATA" || : + chmod 00700 "$PGDATA" || : # ignore failure since it will be fine when using the image provided directory; see also https://github.com/docker-library/postgres/pull/289 mkdir -p /var/run/postgresql || : - chmod 775 /var/run/postgresql || : + chmod 03775 /var/run/postgresql || : # Create the transaction log directory before initdb is run so the directory is owned by the correct user if [ -n "${POSTGRES_INITDB_WALDIR:-}" ]; then @@ -84,8 +84,8 @@ docker_init_database_dir() { NSS_WRAPPER_GROUP="$(mktemp)" export LD_PRELOAD="$wrapper" NSS_WRAPPER_PASSWD NSS_WRAPPER_GROUP local gid; gid="$(id -g)" - echo "postgres:x:$uid:$gid:PostgreSQL:$PGDATA:/bin/false" > "$NSS_WRAPPER_PASSWD" - echo "postgres:x:$gid:" > "$NSS_WRAPPER_GROUP" + printf 'postgres:x:%s:%s:PostgreSQL:%s:/bin/false\n' "$uid" "$gid" "$PGDATA" > "$NSS_WRAPPER_PASSWD" + printf 'postgres:x:%s:\n' "$gid" > "$NSS_WRAPPER_GROUP" break fi done @@ -95,7 +95,8 @@ docker_init_database_dir() { set -- --waldir "$POSTGRES_INITDB_WALDIR" "$@" fi - eval 'initdb --username="$POSTGRES_USER" --pwfile=<(echo "$POSTGRES_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"' + # --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025 + eval 'initdb --username="$POSTGRES_USER" --pwfile=<(printf "%s\n" "$POSTGRES_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"' # unset/cleanup "nss_wrapper" bits if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then @@ -109,20 +110,24 @@ docker_init_database_dir() { # print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust' # assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ] docker_verify_minimum_env() { - # check password first so we can output the warning before postgres - # messes it up - if [ "${#POSTGRES_PASSWORD}" -ge 100 ]; then - cat >&2 <<-'EOWARN' + case "${PG_MAJOR:-}" in + 12 | 13) # https://github.com/postgres/postgres/commit/67a472d71c98c3d2fa322a1b4013080b20720b98 + # check password first so we can output the warning before postgres + # messes it up + if [ "${#POSTGRES_PASSWORD}" -ge 100 ]; then + cat >&2 <<-'EOWARN' - WARNING: The supplied POSTGRES_PASSWORD is 100+ characters. + WARNING: The supplied POSTGRES_PASSWORD is 100+ characters. - This will not work if used via PGPASSWORD with "psql". + This will not work if used via PGPASSWORD with "psql". - https://www.postgresql.org/message-id/flat/E1Rqxp2-0004Qt-PL%40wrigleys.postgresql.org (BUG #6412) - https://github.com/docker-library/postgres/issues/507 + https://www.postgresql.org/message-id/flat/E1Rqxp2-0004Qt-PL%40wrigleys.postgresql.org (BUG #6412) + https://github.com/docker-library/postgres/issues/507 - EOWARN - fi + EOWARN + fi + ;; + esac if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then # The - option suppresses leading tabs but *not* spaces. :) cat >&2 <<-'EOE' @@ -164,7 +169,7 @@ docker_process_init_files() { # psql here for backwards compatibility "${psql[@]}" psql=( docker_process_sql ) - echo + printf '\n' local f for f; do case "$f" in @@ -172,20 +177,20 @@ docker_process_init_files() { # https://github.com/docker-library/postgres/issues/450#issuecomment-393167936 # https://github.com/docker-library/postgres/pull/452 if [ -x "$f" ]; then - echo "$0: running $f" + printf '%s: running %s\n' "$0" "$f" "$f" else - echo "$0: sourcing $f" + printf '%s: sourcing %s\n' "$0" "$f" . "$f" fi ;; - *.sql) echo "$0: running $f"; docker_process_sql -f "$f"; echo ;; - *.sql.gz) echo "$0: running $f"; gunzip -c "$f" | docker_process_sql; echo ;; - *.sql.xz) echo "$0: running $f"; xzcat "$f" | docker_process_sql; echo ;; - *.sql.zst) echo "$0: running $f"; zstd -dc "$f" | docker_process_sql; echo ;; - *) echo "$0: ignoring $f" ;; + *.sql) printf '%s: running %s\n' "$0" "$f"; docker_process_sql -f "$f"; printf '\n' ;; + *.sql.gz) printf '%s: running %s\n' "$0" "$f"; gunzip -c "$f" | docker_process_sql; printf '\n' ;; + *.sql.xz) printf '%s: running %s\n' "$0" "$f"; xzcat "$f" | docker_process_sql; printf '\n' ;; + *.sql.zst) printf '%s: running %s\n' "$0" "$f"; zstd -dc "$f" | docker_process_sql; printf '\n' ;; + *) printf '%s: ignoring %s\n' "$0" "$f" ;; esac - echo + printf '\n' done } @@ -216,7 +221,7 @@ docker_setup_db() { POSTGRES_DB= docker_process_sql --dbname postgres --set db="$POSTGRES_DB" <<-'EOSQL' CREATE DATABASE :"db" ; EOSQL - echo + printf '\n' fi } @@ -231,6 +236,7 @@ docker_setup_env() { : "${POSTGRES_HOST_AUTH_METHOD:=}" declare -g DATABASE_ALREADY_EXISTS + : "${DATABASE_ALREADY_EXISTS:=}" # look specifically for PG_VERSION, as it is expected in the DB dir if [ -s "$PGDATA/PG_VERSION" ]; then DATABASE_ALREADY_EXISTS='true' @@ -250,12 +256,12 @@ pg_setup_hba_conf() { auth="$(postgres -C password_encryption "$@")" : "${POSTGRES_HOST_AUTH_METHOD:=$auth}" { - echo + printf '\n' if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then - echo '# warning trust is enabled for all connections' - echo '# see https://www.postgresql.org/docs/12/auth-trust.html' + printf '# warning trust is enabled for all connections\n' + printf '# see https://www.postgresql.org/docs/12/auth-trust.html\n' fi - echo "host all all all $POSTGRES_HOST_AUTH_METHOD" + printf 'host all all all %s\n' "$POSTGRES_HOST_AUTH_METHOD" } >> "$PGDATA/pg_hba.conf" } @@ -308,9 +314,9 @@ _main() { if [ "$1" = 'postgres' ] && ! _pg_want_help "$@"; then ### STACKROX MODIFIED - If we are initializing, then ensure we start from scratch. if [ -n "$ROX_SCANNER_DB_INIT" ]; then - echo - echo 'Initializing... Clearing any previous data from directories' - echo + printf '\n' + printf 'Initializing... Clearing any previous data from directories\n' + printf '\n' rm -rf "$PGDATA" if [ -n "${POSTGRES_INITDB_WALDIR:-}" ]; then @@ -332,9 +338,9 @@ _main() { ### STACKROX MODIFIED - Sanity check the database does not exist ### upon initialization. if [ -n "$ROX_SCANNER_DB_INIT" ] && [ -n "$DATABASE_ALREADY_EXISTS" ]; then - echo - echo 'PostgreSQL Database appears to already exist upon initialization; Exiting with error...' - echo + printf '\n' + printf 'PostgreSQL Database appears to already exist upon initialization; Exiting with error...\n' + printf '\n' exit 1 fi @@ -360,16 +366,20 @@ _main() { docker_temp_server_stop unset PGPASSWORD - echo - echo 'PostgreSQL init process complete; ready for start up.' - echo + cat <<-'EOM' + + PostgreSQL init process complete; ready for start up. + + EOM ### STACKROX MODIFIED - Exit once DB is initialized. exit 0 else - echo - echo 'PostgreSQL Database directory appears to contain a database; Skipping initialization' - echo + cat <<-'EOM' + + PostgreSQL Database directory appears to contain a database; Skipping initialization + + EOM fi fi