84a76baa8e
The lock was written against the rolling tags because the per-version releases did not exist when it was generated, and the refresh tool assumed PostgreSQL was tagged by major, which it is not: the release that never changes is postgresql-18.6, whilst only the rolling one says 18. The tool now resolves a major to the version pgbuild's manifest names, and a tag that does not exist is an error rather than something to fall back from, since a lock recording an archive nobody can fetch is worse than no lock at all.
60 lines
3.7 KiB
Plaintext
60 lines
3.7 KiB
Plaintext
# pgbuild dependency lock
|
|
#
|
|
# Which build of each dependency .github/actions/install-pgbuild-deps
|
|
# downloads from pgadmin-org/pgbuild, and what it must hash to. The action
|
|
# fetches the tag named here and refuses to unpack an archive whose SHA-256
|
|
# differs, so these lines decide which PostgreSQL, OpenSSL and Kerberos
|
|
# binaries end up inside an Authenticode signed installer and a notarised
|
|
# appbundle.
|
|
#
|
|
# It matters because pgbuild also publishes rolling tags ending in -latest,
|
|
# whose assets are replaced in place on every rebuild. Building from those
|
|
# means signing whatever they happened to point at that morning, write
|
|
# access to pgbuild is write access to what pgAdmin ships, and no two
|
|
# builds of the same commit contain the same binaries. Pinning the
|
|
# per-version tag instead gives a build that can be reproduced and a change
|
|
# that can be reviewed. pgbuild publishes a .sha256 beside each archive,
|
|
# which is a convenience for people rather than a source of trust, since
|
|
# whoever rebuilds the archive rebuilds that too; this file is the only
|
|
# thing that actually pins anything, which is why the action checks against
|
|
# it and not against the published checksum.
|
|
#
|
|
# Three whitespace separated columns, one dependency per line, with # for a
|
|
# comment. Kept dull on purpose so that bash, PowerShell and a reviewer can
|
|
# all read it.
|
|
#
|
|
# 1. the dependency, as the action names it: package, platform and
|
|
# architecture, with the PostgreSQL major where there is one
|
|
# 2. the pgbuild release tag to download from, which carries the upstream
|
|
# version, so the second column is where a bump shows up in the diff
|
|
# 3. the SHA-256 of the archive in that release, in lowercase hex
|
|
#
|
|
# A build that fails on a mismatch is telling you that the bytes behind a
|
|
# pinned tag are not the bytes that were reviewed. A build that merely
|
|
# warns is telling you pgbuild has published something newer, which is
|
|
# routine and is not an error: the build carries on with the pinned
|
|
# version. Either way the fix is to refresh, read the diff and commit it:
|
|
#
|
|
# tools/refresh_pgbuild_lock.py <package>
|
|
#
|
|
# This file is generated by that script, so edit it through the script
|
|
# rather than by hand.
|
|
|
|
# macOS, arm64
|
|
krb5-macos-arm64 krb5-1.22.2-macos-arm64 d61ec76f7adc79b915bb88f55bc4755db2edb5f215431aff01959e0fe38214ea
|
|
lz4-macos-arm64 lz4-1.10.0-macos-arm64 50824e82cf864469b7d5e01d46896db07a48c4b143d7d4edb4bd7355ea5ebe29
|
|
openssl-macos-arm64 openssl-3.5.8-macos-arm64 e319fda192735b7b4f7b5742388b9b2264c6e94078f79a9dbb856d2cadcb0c4c
|
|
postgresql-18-macos-arm64 postgresql-18.6-macos-arm64 b21232335b76b3cb828839f98572da4298e19cad4a69b31f7b234d218e149c28
|
|
zstd-macos-arm64 zstd-1.5.7-macos-arm64 6703acb18b9db260df484828d0e823017742be82c87cdd3d42fde85efdd232ad
|
|
|
|
# macOS, x86_64
|
|
krb5-macos-x86_64 krb5-1.22.2-macos-x86_64 40e123c1a85dba06b1d808cecf6c1e5ac2818fb8a722122400a1ffac9494651f
|
|
lz4-macos-x86_64 lz4-1.10.0-macos-x86_64 ff1e23e0150533abf0f81c1341e7dab8e7e18dd51158084ae4ac9b847be6df7c
|
|
openssl-macos-x86_64 openssl-3.5.8-macos-x86_64 e5a947e1ddecd9a75c9c0f8f3b92d7de74958d6a3bbcea99c509fb4900dad431
|
|
postgresql-18-macos-x86_64 postgresql-18.6-macos-x86_64 b36aa6afe7515806aa9724ae6ceebed214b1fec9c2849609598b19c4ecae893e
|
|
zstd-macos-x86_64 zstd-1.5.7-macos-x86_64 77634c1dafe07882d63ace5e13e4f59f583b4763e04076611515335fe1168a41
|
|
|
|
# Windows, x86_64
|
|
krb5-windows-x86_64 krb5-1.22.2-windows-x86_64 7557cf16faf8af1ee450ef211ac8f74a513914d722c776a3645d996e7cd08dfc
|
|
postgresql-18-windows-x86_64 postgresql-18.6-windows-x86_64 4eba1f86561238348a39040809f7b1d08f434ef110c2ffe37e291d63c0407d67
|