feat: alter lo_export & lo_import owner

.github/workflows/ami-release.yml

@@ -50,28 +50,24 @@ jobs:
           endpoint: builders
       - uses: docker/build-push-action@v5
         with:
-          load: true
           build-args: |
             ${{ steps.args.outputs.result }}
           target: extensions
           tags: supabase/postgres:extensions
           platforms: linux/${{ matrix.arch }}
+          outputs: type=tar,dest=/tmp/extensions.tar
           cache-from: type=gha,scope=${{ github.ref_name }}-latest-${{ matrix.arch }}
           # No need to export extensions cache because latest depends on it
       - name: Extract built packages
         run: |
-          mkdir -p /tmp/extensions ansible/files/extensions
-          docker save supabase/postgres:extensions | tar xv -C /tmp/extensions
-          for layer in /tmp/extensions/*/layer.tar; do
-            tar xvf "$layer" -C ansible/files/extensions --strip-components 1
-          done
+          mkdir -p ansible/files/extensions
+          tar xvf /tmp/extensions.tar -C ansible/files/extensions --strip-components 1
 
       - id: version
         run: echo "${{ steps.args.outputs.result }}" | grep "postgresql" >> "$GITHUB_OUTPUT"
       - name: Build Postgres deb
         uses: docker/build-push-action@v5
         with:
-          load: true
           file: docker/Dockerfile
           target: pg-deb
           build-args: |
@@ -82,15 +78,13 @@ jobs:
             CPPFLAGS=-mcpu=${{ matrix.mcpu }}
           tags: supabase/postgres:deb
           platforms: linux/${{ matrix.arch }}
+          outputs: type=tar,dest=/tmp/pg-deb.tar
           cache-from: type=gha,scope=${{ github.ref_name }}-deb
           cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-deb
       - name: Extract Postgres deb
         run: |
-          mkdir -p /tmp/build ansible/files/postgres
-          docker save supabase/postgres:deb | tar xv -C /tmp/build
-          for layer in /tmp/build/*/layer.tar; do
-            tar xvf "$layer" -C ansible/files/postgres --strip-components 1
-          done
+          mkdir -p ansible/files/postgres
+          tar xvf /tmp/pg-deb.tar -C ansible/files/postgres --strip-components 1
 
       - name: Build AMI
         run: |

.github/workflows/testinfra.yml

@@ -72,12 +72,12 @@ jobs:
 
       - uses: docker/build-push-action@v5
         with:
-          load: true
           build-args: |
             ${{ steps.args.outputs.result }}
           target: extensions
           tags: supabase/postgres:extensions
           platforms: linux/${{ matrix.arch }}
+          outputs: type=tar,dest=/tmp/extensions.tar
           cache-from: |
             type=gha,scope=${{ github.ref_name }}-extensions
             type=gha,scope=${{ github.base_ref }}-extensions
@@ -86,19 +86,15 @@ jobs:
 
       - name: Extract built packages
         run: |
-          mkdir -p /tmp/extensions ansible/files/extensions
-          docker save supabase/postgres:extensions | tar xv -C /tmp/extensions
-          for layer in /tmp/extensions/*/layer.tar; do
-            tar xvf "$layer" -C ansible/files/extensions --strip-components 1
-          done
+          mkdir -p ansible/files/extensions
+          tar xvf /tmp/extensions.tar -C ansible/files/extensions --strip-components 1
 
       - id: version
         run: echo "${{ steps.args.outputs.result }}" | grep "postgresql" >> "$GITHUB_OUTPUT"
 
       - name: Build Postgres deb
         uses: docker/build-push-action@v5
         with:
-          load: true
           file: docker/Dockerfile
           target: pg-deb
           build-args: |
@@ -109,6 +105,7 @@ jobs:
             CPPFLAGS=-mcpu=${{ matrix.mcpu }}
           tags: supabase/postgres:deb
           platforms: linux/${{ matrix.arch }}
+          outputs: type=tar,dest=/tmp/pg-deb.tar
           cache-from: |
             type=gha,scope=${{ github.ref_name }}-deb
             type=gha,scope=${{ github.base_ref }}-deb
@@ -117,11 +114,8 @@ jobs:
 
       - name: Extract Postgres deb
         run: |
-          mkdir -p /tmp/build ansible/files/postgres
-          docker save supabase/postgres:deb | tar xv -C /tmp/build
-          for layer in /tmp/build/*/layer.tar; do
-            tar xvf "$layer" -C ansible/files/postgres --strip-components 1
-          done
+          mkdir -p ansible/files/postgres
+          tar xvf /tmp/pg-deb.tar -C ansible/files/postgres --strip-components 1
 
       # Packer doesn't support skipping registering the AMI for the ebssurrogate
       # builder, so we register an AMI with a fixed name and run tests on an

ansible/files/postgresql_config/supautils.conf.j2

@@ -1,7 +1,7 @@
-# full list:                                 address_standardizer, address_standardizer_data_us, adminpack, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, file_fdw, fuzzystrmatch, hstore, http, hypopg, insert_username, intagg, intarray, isn, lo, ltree, moddatetime, old_snapshot, pageinspect, pg_buffercache, pg_cron, pg_freespacemap, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_stat_monitor, pg_stat_statements, pg_surgery, pg_tle, pg_trgm, pg_visibility, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers, xml2
+# full list:                                 address_standardizer, address_standardizer_data_us, adminpack, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, file_fdw, fuzzystrmatch, hstore, http, hypopg, insert_username, intagg, intarray, isn, lo, ltree, moddatetime, old_snapshot, orioledb, pageinspect, pg_buffercache, pg_cron, pg_freespacemap, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_stat_monitor, pg_stat_statements, pg_surgery, pg_tle, pg_trgm, pg_visibility, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers, xml2
 # omitted because may be unsafe:             adminpack, amcheck, file_fdw, lo, old_snapshot, pageinspect, pg_buffercache, pg_freespacemap, pg_prewarm, pg_surgery, pg_visibility, pgstattuple
 # omitted because deprecated:                intagg, xml2
-supautils.privileged_extensions = 'address_standardizer, address_standardizer_data_us, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, fuzzystrmatch, hstore, http, hypopg, insert_username, intarray, isn, ltree, moddatetime, pg_cron, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_stat_monitor, pg_stat_statements, pg_tle, pg_trgm, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers, orioledb'
+supautils.privileged_extensions = 'address_standardizer, address_standardizer_data_us, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, fuzzystrmatch, hstore, http, hypopg, insert_username, intarray, isn, ltree, moddatetime, orioledb, pg_cron, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_stat_monitor, pg_stat_statements, pg_tle, pg_trgm, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers'
 supautils.privileged_extensions_custom_scripts_path = '/etc/postgresql-custom/extension-custom-scripts'
 supautils.privileged_extensions_superuser = 'supabase_admin'
 supautils.privileged_role = 'postgres'

common.vars.pkr.hcl

@@ -1 +1 @@
-postgres-version = "15.1.1.5"
+postgres-version = "15.1.1.6"

migrations/db/migrations/20231130133139_set_lock_timeout_to_authenticator_role.sql

@@ -1 +1,4 @@
+-- migrate:up
 ALTER ROLE authenticator set lock_timeout to '8s';
+
+-- migrate:down

migrations/db/migrations/20240124080435_alter_lo_export_lo_import_owner.sql

@@ -0,0 +1,6 @@
+-- migrate:up
+alter function pg_catalog.lo_export owner to supabase_admin;
+alter function pg_catalog.lo_import(text) owner to supabase_admin;
+alter function pg_catalog.lo_import(text, oid) owner to supabase_admin;
+
+-- migrate:down