Repository navigation
Move step-ca's PostgreSQL from 18.4 to 18.6 (#1193) - #1194
Conversation
PostgreSQL 18.6 fixes several CVEs present in 18.4, among them the EXECUTE/FETCH portal memory disclosure and a to_char() overrun. 18.5 was never released. A minor release keeps the on-disk format and the image layout is unchanged, so an existing data directory starts under 18.6 with no migration step. The index digest is the one downstream consumers move to in the same step, not whatever the tag resolves to on the day it is read: Docker Hub rebuilds tags in place, and a pinned index digest stays pullable after a rebuild. Closes #1193
|
[Reviewer Round 1] No findings. I recommend approval. The diff fully matches the requested scope: the exact fixed digest, version and Compose tags are correct; unrelated images and parser examples remain unchanged; both documentation languages are updated. The tests remain meaningful: validator mutations still exercise mismatches, the smoke fixture distinguishes the moving tag from the approved digest, and the database integration tests now exercise 18.6, including TLS provisioning. The changelog accurately covers recreation on existing data, offline loading and The supplied PR body includes the required closing relationship, registry evidence and test checklist. Its “None” deviation claim matches the diff. Tests and CI were not rerun, as instructed. |
|
[Review Verdict Round 1: APPROVED] |
Summary
Moves step-ca's database from
postgres:18.4topostgres:18.6, the newest 18.x release. 18.6 fixes several CVEs present in 18.4, among them CVE-2026-16239 and ato_char()buffer overrun. It is a minor release on the same on-disk format and the same image layout, so an existing data directory starts under 18.6 unchanged. No dump and restore, migration step, configuration change or reindex is needed.deploy/runtime-images.json: thepostgresentry now declares tag18.6, version18.6.0and index digestsha256:e3d24f6906d0760bf4da0dae872415391ededefad23fd471c47dc53b0ddf3c42.repositoryandplatforms(["linux/amd64"]) are unchanged, and no other entry changes. The issue fixes this digest because consumers move to the same digest in the same step, so it was not re-resolved from the moving18.6tag.docker-compose.deploy.ymlanddocker-compose.yml: thepostgresimage is now${POSTGRES_IMAGE:-postgres:18.6}andpostgres:18.6. No other line changes, and thebootroot-http01default is left for the release bump.docs/en/cli.mdanddocs/ko/cli.md: the documented pin and comparison version now read18.6and18.6.0.scripts/validate-runtime-images.sh: every18.4and32ca0af8literal and expected message now uses its 18.6 value. Mutation targets that already differ from 18.6 (18.5,99) are unchanged.scripts/validate-deploy-no-build-smoke.sh: the fake registry's moving-tag refs now namepostgres:18.6.tests/db_provision_integration.rs:POSTGRES_IMAGEis nowpostgres:18.6, so the integration test runs PostgreSQL 18.6 with bootroot's TLS provisioning.CHANGELOG.md: adds an[Unreleased]section with a single### Changedentry, and the[Unreleased]compare link. The entry covers the recreate on the firstbootroot infra up, loading the image archive first on an air-gapped host, and a host that setsPOSTGRES_IMAGEkeeping its own image.The unit tests that use
postgres:18.4only as an example reference to parse are left as they are, insrc/runtime_image_declaration.rs,src/commands/clean.rs,src/commands/infra.rsandsrc/commands/init/paths.rs. Nothing inCargo.tomlorCargo.lockand no product code changes; a maintainer cuts0.8.3after this merges.Closes #1193
Registry evidence
Read on 2026-11-07. The pinned digest is an OCI image index, it pulls, and its
linux/amd64child issha256:e923a22ac074261dd73970c57edf659475bf0497cb9456f17d98ed7cdd3ca913. At the time of the checkpostgres:18.6also resolves to this same index digest (docker buildx imagetools inspect docker.io/library/postgres:18.6reportsDigest: sha256:e3d24f6906d0760bf4da0dae872415391ededefad23fd471c47dc53b0ddf3c42); should Docker Hub rebuild the tag later, the pin stays as it is.Deviations from the issue
None
Test plan
docker buildx imagetools inspect docker.io/library/postgres@sha256:e3d24f6906d0760bf4da0dae872415391ededefad23fd471c47dc53b0ddf3c42shows an OCI image index whoselinux/amd64child issha256:e923a22ac074261dd73970c57edf659475bf0497cb9456f17d98ed7cdd3ca913; the output is pasted into this PR description, with a note ifpostgres:18.6now resolves to a different digest. The pin stays as it is either way.git diff origin/main -- deploy/runtime-images.jsontouches only thepostgresentry'stag,versionanddigest, andgit diff origin/main -- docker-compose.yml docker-compose.deploy.ymlchanges only the twopostgresimage lines.git grep -n -E 'postgres:18\.4|18\.4\.0|32ca0af8' -- . ':!CHANGELOG.md'prints lines only insrc/runtime_image_declaration.rs,src/commands/clean.rs,src/commands/infra.rsandsrc/commands/init/paths.rs../scripts/validate-runtime-images.shpasses../scripts/validate-deploy-no-build-smoke.shpasses.cargo test --test db_provision_integration -- --include-ignoredpasses against PostgreSQL 18.6 with bootroot's TLS provisioning.cargo test runtime_image_declarationpasses.markdownlint-cli2 "**/*.md" "#node_modules" "#target"passes on the changeddocs/en/cli.md,docs/ko/cli.mdandCHANGELOG.md, and./scripts/check-docs.shpasses.