From be67ef0c97597a00b8b79607569760b4e21ccfc6 Mon Sep 17 00:00:00 2001 From: phil Date: Tue, 6 Oct 2026 10:22:34 +0900 Subject: [PATCH] Replace Citus curl-pipe-bash with signed apt source Scorecard PinnedDependencies flagged downloadThenRun in the pg 16/17/18 images: deb.sh was fetched and executed unverified. Write the apt source and dearmored repo key directly, as deb.sh does, so no remote script runs. Package set is unchanged; verified by building pg/16 (citus 13.0) and pg/18 (CITUS_VERSION=14.2). Co-Authored-By: Claude Fable 5.1 Signed-off-by: phil --- build/images/pg/16/Dockerfile | 6 +++++- build/images/pg/17/Dockerfile | 6 +++++- build/images/pg/18/Dockerfile | 6 +++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/build/images/pg/16/Dockerfile b/build/images/pg/16/Dockerfile index 71e29e5..9d728e1 100644 --- a/build/images/pg/16/Dockerfile +++ b/build/images/pg/16/Dockerfile @@ -25,7 +25,11 @@ RUN set -eux; \ postgresql-${PG_MAJOR}-pgaudit \ ; \ # Citus apt repo - curl -fsSL https://install.citusdata.com/community/deb.sh | bash; \ + curl -fsSL https://repos.citusdata.com/community/gpgkey \ + | gpg --dearmor -o /usr/share/keyrings/citusdata-community.gpg; \ + echo "deb [signed-by=/usr/share/keyrings/citusdata-community.gpg] https://repos.citusdata.com/community/debian/ $(. /etc/os-release; echo "$VERSION_CODENAME") main" \ + > /etc/apt/sources.list.d/citusdata_community.list; \ + apt-get update; \ apt-get install -y --no-install-recommends \ postgresql-${PG_MAJOR}-citus-${CITUS_VERSION} \ ; \ diff --git a/build/images/pg/17/Dockerfile b/build/images/pg/17/Dockerfile index c22275a..70364e8 100644 --- a/build/images/pg/17/Dockerfile +++ b/build/images/pg/17/Dockerfile @@ -22,7 +22,11 @@ RUN set -eux; \ ca-certificates curl gnupg lsb-release \ postgresql-${PG_MAJOR}-pgaudit \ ; \ - curl -fsSL https://install.citusdata.com/community/deb.sh | bash; \ + curl -fsSL https://repos.citusdata.com/community/gpgkey \ + | gpg --dearmor -o /usr/share/keyrings/citusdata-community.gpg; \ + echo "deb [signed-by=/usr/share/keyrings/citusdata-community.gpg] https://repos.citusdata.com/community/debian/ $(. /etc/os-release; echo "$VERSION_CODENAME") main" \ + > /etc/apt/sources.list.d/citusdata_community.list; \ + apt-get update; \ apt-get install -y --no-install-recommends \ postgresql-${PG_MAJOR}-citus-${CITUS_VERSION} \ ; \ diff --git a/build/images/pg/18/Dockerfile b/build/images/pg/18/Dockerfile index 44c987b..f56e4d5 100644 --- a/build/images/pg/18/Dockerfile +++ b/build/images/pg/18/Dockerfile @@ -29,7 +29,11 @@ RUN set -eux; \ ca-certificates curl gnupg lsb-release \ postgresql-${PG_MAJOR}-pgaudit \ ; \ - curl -fsSL https://install.citusdata.com/community/deb.sh | bash; \ + curl -fsSL https://repos.citusdata.com/community/gpgkey \ + | gpg --dearmor -o /usr/share/keyrings/citusdata-community.gpg; \ + echo "deb [signed-by=/usr/share/keyrings/citusdata-community.gpg] https://repos.citusdata.com/community/debian/ $(. /etc/os-release; echo "$VERSION_CODENAME") main" \ + > /etc/apt/sources.list.d/citusdata_community.list; \ + apt-get update; \ apt-get install -y --no-install-recommends \ postgresql-${PG_MAJOR}-citus-${CITUS_VERSION} \ ; \