Skip to content

fix: update nix for CVE #2109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
samrose wants to merge 5 commits into
base: develop
Choose a base branch
from
Open

fix: update nix for CVE #2109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c254ccf
fix: update nix for https://github.com/NixOS/nix/security/advisories/…
samrose Apr 8, 2026
868e467
fix: make sure we install right version
samrose Apr 8, 2026
f4b59d1
fix: print nix version on build
samrose Apr 9, 2026
033e51b
fix: use same method everywhere to control version
samrose Apr 9, 2026
b4b0509
fix: handle adding nix to path for gh action
samrose Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 24 additions & 9 deletions .github/actions/nix-install-ephemeral/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,15 +41,30 @@ runs:
sudo chmod +x /etc/nix/upload-to-cache.sh
env:
NIX_SIGN_SECRET_KEY: ${{ env.NIX_SIGN_SECRET_KEY }}
- uses: NixOS/nix-installer-action@d6ef7ecd8f685af89869e5aca0580a33e3e3150c
with:
installer-version: 2.33.2
extra-conf: |
substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
${{ inputs.push-to-cache == 'true' && 'post-build-hook = /etc/nix/upload-to-cache.sh' || '' }}
max-jobs = 4
extra-system-features = kvm
- name: Install Nix
shell: bash
run: |
sudo tee /tmp/nix-extra.conf > /dev/null <<'NIXCONF'
extra-experimental-features = nix-command flakes
substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
max-jobs = 4
extra-system-features = kvm
NIXCONF

if [ "${{ inputs.push-to-cache }}" = "true" ]; then
echo "post-build-hook = /etc/nix/upload-to-cache.sh" | sudo tee -a /tmp/nix-extra.conf > /dev/null
fi

curl -L https://releases.nixos.org/nix/nix-2.33.4/install | sh -s -- --daemon --yes --nix-extra-conf-file /tmp/nix-extra.conf

# Add nix to PATH for subsequent steps
echo "/nix/var/nix/profiles/default/bin" >> "$GITHUB_PATH"
# Source the daemon profile so nix works in this step too
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
- name: Print Nix version
shell: bash
run: nix --version
- name: Setup KVM permissions
shell: bash
run: |
Expand Down
3 changes: 3 additions & 0 deletions .github/actions/nix-install-self-hosted/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ runs:
role-session-name: gha-oidc-${{ github.run_id }}
role-duration-seconds: ${{ inputs.aws-role-duration }}

- name: Print Nix version
shell: bash
run: nix --version
- name: Write creds files
shell: bash
run: |
Expand Down
3 changes: 2 additions & 1 deletion Dockerfile-15
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,9 @@ extra-experimental-features = nix-command flakes
extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
EOF
RUN curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf
RUN curl -L https://releases.nixos.org/nix/nix-2.33.4/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf
ENV PATH="${PATH}:/nix/var/nix/profiles/default/bin"
RUN nix --version

WORKDIR /nixpg
COPY . .
Expand Down
4 changes: 2 additions & 2 deletions Dockerfile-17
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,9 @@ extra-experimental-features = nix-command flakes
extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
EOF
RUN curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf

RUN curl -L https://releases.nixos.org/nix/nix-2.33.4/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf
ENV PATH="${PATH}:/nix/var/nix/profiles/default/bin"
RUN nix --version

WORKDIR /nixpg
COPY . .
Expand Down
4 changes: 2 additions & 2 deletions Dockerfile-multigres
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ extra-experimental-features = nix-command flakes
extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
EOF
RUN curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf

RUN curl -L https://releases.nixos.org/nix/nix-2.33.4/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf
ENV PATH="${PATH}:/nix/var/nix/profiles/default/bin"
RUN nix --version

WORKDIR /nixpg
COPY . .
Expand Down
4 changes: 2 additions & 2 deletions Dockerfile-orioledb-17
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,9 @@ extra-experimental-features = nix-command flakes
extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
EOF
RUN curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf

RUN curl -L https://releases.nixos.org/nix/nix-2.33.4/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf
ENV PATH="${PATH}:/nix/var/nix/profiles/default/bin"
RUN nix --version

WORKDIR /nixpg
COPY . .
Expand Down
3 changes: 2 additions & 1 deletion ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,7 +297,7 @@ function initiate_upgrade {
--extra-conf "trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
else
echo "1.1.1. Installing Nix using the official installer"
sh <(curl -L https://releases.nixos.org/nix/nix-2.33.2/install) --yes --daemon --nix-extra-conf-file /dev/stdin <<EXTRA_NIX_CONF
sh <(curl -L https://releases.nixos.org/nix/nix-2.33.4/install) --yes --daemon --nix-extra-conf-file /dev/stdin <<EXTRA_NIX_CONF
extra-experimental-features = nix-command flakes
extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
Expand All @@ -312,6 +312,7 @@ EXTRA_NIX_CONF
echo "1.2. Fetching store path for flake revision: $NIX_FLAKE_VERSION"
# shellcheck disable=SC1091
source /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
nix --version
nix-collect-garbage -d > /tmp/pg_upgrade-nix-gc.log 2>&1 || true

# Determine system architecture
Expand Down
6 changes: 3 additions & 3 deletions ansible/vars.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ postgres_major:

# Full version strings for each major version
postgres_release:
postgresorioledb-17: "17.6.0.063-orioledb"
postgres17: "17.6.1.106"
postgres15: "15.14.1.106"
postgresorioledb-17: "17.6.0.064-orioledb"
postgres17: "17.6.1.107"
postgres15: "15.14.1.107"

# Non Postgres Extensions
pgbouncer_release: 1.25.1
Expand Down
6 changes: 3 additions & 3 deletions docs/multigres-image.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,12 +108,12 @@ extra-substituters =

**Important**: Replace `YOUR_USERNAME` with your actual username in the `trusted-users` line.

### Step 2: Install Nix 2.33.1
### Step 2: Install Nix 2.33.4

Run the following command to install Nix 2.33.1 (the version used in CI) with the custom configuration:
Run the following command to install Nix 2.33.4 (the version used in CI) with the custom configuration:

```bash
curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --yes --nix-extra-conf-file ./nix.conf
curl -L https://releases.nixos.org/nix/nix-2.33.4/install | sh -s -- --daemon --yes --nix-extra-conf-file ./nix.conf
```

This will install Nix with our build caches pre-configured, which should eliminate substituter-related errors.
Expand Down
3 changes: 2 additions & 1 deletion ebssurrogate/scripts/qemu-bootstrap-nix.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,13 +82,14 @@ execute_playbook
####################

function install_nix() {
sudo su -c "sh <(curl -L https://releases.nixos.org/nix/nix-2.33.2/install) --yes --daemon --nix-extra-conf-file /dev/stdin <<EXTRA_NIX_CONF
sudo su -c "sh <(curl -L https://releases.nixos.org/nix/nix-2.33.4/install) --yes --daemon --nix-extra-conf-file /dev/stdin <<EXTRA_NIX_CONF
extra-experimental-features = nix-command flakes
extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
EXTRA_NIX_CONF" -s /bin/bash root
#shellcheck disable=SC1091
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
nix --version
}

function execute_stage2_playbook {
Expand Down
6 changes: 3 additions & 3 deletions nix/docs/start-here.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,12 +83,12 @@ extra-substituters =

**Important**: Replace `YOUR_USERNAME` with your actual username in the `trusted-users` line.

### Step 2: Install Nix 2.33.1
### Step 2: Install Nix 2.33.4

Run the following command to install Nix 2.33.1 (the version used in CI) with the custom configuration:
Run the following command to install Nix 2.33.4 (the version used in CI) with the custom configuration:

```bash
curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --yes --nix-extra-conf-file ./nix.conf
curl -L https://releases.nixos.org/nix/nix-2.33.4/install | sh -s -- --daemon --yes --nix-extra-conf-file ./nix.conf
```

This will install Nix with our build caches pre-configured, which should eliminate substituter-related errors.
Expand Down
3 changes: 2 additions & 1 deletion scripts/nix-provision.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,14 @@ function install_packages {


function install_nix() {
sudo su -c "sh <(curl -L https://releases.nixos.org/nix/nix-2.33.2/install) --yes --daemon --nix-extra-conf-file /dev/stdin <<EXTRA_NIX_CONF
sudo su -c "sh <(curl -L https://releases.nixos.org/nix/nix-2.33.4/install) --yes --daemon --nix-extra-conf-file /dev/stdin <<EXTRA_NIX_CONF
extra-experimental-features = nix-command flakes
extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
EXTRA_NIX_CONF" -s /bin/bash root
#shellcheck disable=SC1091
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
nix --version
}


Expand Down
Loading