CI: store the PGDG signing key in the repo, so image builds stop failing when its download drops #1346

New issue

Closed

opened 2026-11-06 01:34:12 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-11-06 01:34:12 +00:00

Collaborator

During 4.7.0, the Docker image build (#1333) and the phone journeys (#1338) failed when downloading the PostgreSQL apt repository's signing key timed out. The backend-base stage fetches it at build time to install postgresql-client-${PG_MAJOR}. Each failure needed a re-run.

Fix: commit the PGDG key (ASCII-armoured, under e.g. docker/keys/pgdg.asc), COPY it into the image, and point the apt source's signed-by at it. Record the key's fingerprint in the Dockerfile comment and have a test check it, so a changed key is noticed rather than trusted. Nothing else changes: apt still verifies packages against the key, and only the download of the key goes away.

Check that the bot image doesn't fetch it too, and that e2e-db (FROM postgres:18-alpine) needs nothing.

During 4.7.0, the Docker image build (#1333) and the phone journeys (#1338) failed when downloading the PostgreSQL apt repository's signing key timed out. The `backend-base` stage fetches it at build time to install `postgresql-client-${PG_MAJOR}`. Each failure needed a re-run. **Fix:** commit the PGDG key (ASCII-armoured, under e.g. `docker/keys/pgdg.asc`), `COPY` it into the image, and point the apt source's `signed-by` at it. Record the key's fingerprint in the Dockerfile comment and have a test check it, so a changed key is noticed rather than trusted. Nothing else changes: apt still verifies packages against the key, and only the download of the key goes away. Check that the bot image doesn't fetch it too, and that `e2e-db` (FROM postgres:18-alpine) needs nothing.

claude-bot added this to the v4.8.0 - A Living World Fills In milestone

2026-11-06 01:34:20 +00:00