Repository navigation
Fix Rocky 9 CI (PGDG repo pin and path); document validation trust boundaries - #6
Merged
Merged
Conversation
postgresql.org no longer serves pgdg-redhat-repo-42.0-66, so the Rocky Linux 9 compatibility job fails with a 404 while installing dependencies, independent of any source change. Pin 42.0-70 and its SHA-256. Verified before pinning, in the pinned Rocky 9 image: the RPM's header and payload digests and its RSA/SHA256 signature check out against the PGDG RPM key (fingerprint D4BF 08AE 67A0 B4C7 A1DB CCD2 40BC A2B4 08B4 0D20). The upstream file rotates, so this pin will need refreshing again; mirroring the reviewed RPM is the durable fix. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add a header to the validator, envelope, JWKS, signature, and policy sources saying what each stage trusts and must never do, plus inline notes where an ordering or rejection is deliberate (claims only after signature, libjwt time checks disabled in favor of the injectable-clock claims stage, exact-case algorithm allowlist, two-sided delegation check). Comments only; no code change. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
PGDG repo RPM 42.0-70 builds the repository URL from the OS minor release (rhel-$releasever_major.$releasever_minor). The Rocky 9 image used here is 9.3, and PGDG now publishes only the recent minors (9.6-9.8) plus the unversioned rhel-9-x86_64 tree that earlier repo RPMs used, so the pgdg18 repository returned 404 after the pin bump. Rewrite the installed repo definition to the unversioned path and fail the script if the expected pattern is not present, so a future repo RPM layout change is noticed instead of silently ignored. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Unblocks the Rocky Linux 9 compatibility job, which fails on
maintoday independent of any source change, and adds trust-boundary comments to the validation sources. Three commits, separable:postgresql.orgno longer serves 42.0-66 (404). The new RPM was verified in the pinned Rocky 9 image before pinning: header and payload digests and the RSA/SHA256 signature check against the PGDG RPM key (fingerprintD4BF 08AE 67A0 B4C7 A1DB CCD2 40BC A2B4 08B4 0D20).rhel-9.3-x86_64on our pinned image), and PGDG now publishes only 9.6-9.8 plus the unversionedrhel-9-x86_64. The script rewrites the repo definition to the unversioned path and fails if the expected pattern is absent, so a future layout change is noticed.validator.c,jwt_envelope.c,jwks.c,signature.c,policy.cstating what each stage trusts and must never do, plus inline notes where an ordering or rejection is deliberate (claims only after signature; libjwt time checks disabled in favor of the injectable-clock claims stage; exact-case algorithm allowlist; two-sided delegation check).No behavior, policy, or release change. Independent of #5.
Trust boundary and risk
CI-only change (a pinned bootstrap RPM and repo path). The pin is still hash-checked before install, and repo and package GPG checks remain enforced. The base image stays pinned. The unversioned PGDG tree tracks the newest 9.x builds, which is how earlier repo RPMs behaved. This is a compatibility signal, not a release builder.
The pin will break again when PGDG next rotates the file. Mirroring the reviewed RPM, and moving off the 9.3 base image, are the durable fixes and are left for a deliberate follow-up.
Verification
In the pinned PostgreSQL 18 container:
dev-verify-pg18pass,scripts/format-c.sh --checkpass (comments reflowed to pgindent's layout).Locally on Rocky 9 (amd64 emulated on an Apple-silicon Mac): dependency install now succeeds, the image builds, and the strict build plus
verify-devpass.packagecheckthen hit a segmentation fault insidemake install(pgxs.mk:256). I believe this is an emulation artifact, because the same step passed natively on GitHub runners whenmainlast ran (2026-09-22), but I could not confirm it locally. This PR's Rocky 9 check on native runners is the real verification; if it fails atinstall, the cause is something else.Not run locally: Fedora 44 job, PostgreSQL 19, static analysis, sanitizers.
🤖 Generated with Claude Code