rbrooks/Quest-Board
Watch
1
0
Fork
You've already forked Quest-Board
 0
Code Issues 58 Pull requests 7 Projects Releases 76 Packages Wiki Activity Actions

CI: the PGDG signing key is kept in the repo (#1346) #1356

Merged
claude-bot merged 2 commits from fix/1346-pgdg-key into main 2026-11-06 21:03:53 +00:00
Conversation 0 Commits 2 Files changed 4 +187 -5
claude-bot commented 2026-11-06 08:06:49 +00:00
Collaborator
Copy link

Closes #1346. The backend-base stage no longer downloads the PostgreSQL apt key at build time. Two 4.7.0 runs (#1333, #1338) needed a re-run because that download timed out.

  • docker/keys/pgdg.asc: the key from postgresql.org. Fingerprint checked with gpg: B97B 0AFC AA1A 47F0 44F2 44A0 7FCC 7D46 ACCC 4CF8 (rsa4096, "PostgreSQL Debian Repository").
  • Dockerfile:
    • COPY the key in;
    • point signed-by= at it (apt reads armoured keys directly and still verifies every package);
    • record the fingerprint and the file's SHA-256 in a comment;
    • drop gnupg, which existed only to dearmor the download.
  • tests/test_pgdg_key_in_repo.py:
    • works out the key's fingerprint in Python (no gpg in the image) and compares it, and the SHA-256, with the Dockerfile comment;
    • asserts that no key download or gpg --dearmor remains.
    • A changed key is caught, not trusted.
  • Only backend-base fetched the key. bot-base and e2e-db need nothing.

Checks (docker-test, committed code):

  • The backend-dev image builds, including the apt install and pg_dump --version.
  • tests/test_pgdg_key_in_repo.py and tests/test_backup_client_version.py: 22 passed.
  • lint is clean.
  • check_version_sync.py and changelog.py check pass.
  • Not run: the full backend, frontend, bot and synthetic suites. CI covers them.

🤖 Generated with Claude Code

Closes #1346. The `backend-base` stage no longer downloads the PostgreSQL apt key at build time. Two 4.7.0 runs (#1333, #1338) needed a re-run because that download timed out. - `docker/keys/pgdg.asc`: the key from postgresql.org. Fingerprint checked with gpg: **B97B 0AFC AA1A 47F0 44F2 44A0 7FCC 7D46 ACCC 4CF8** (rsa4096, "PostgreSQL Debian Repository"). - `Dockerfile`: - `COPY` the key in; - point `signed-by=` at it (apt reads armoured keys directly and still verifies every package); - record the fingerprint and the file's SHA-256 in a comment; - drop `gnupg`, which existed only to dearmor the download. - `tests/test_pgdg_key_in_repo.py`: - works out the key's fingerprint in Python (no gpg in the image) and compares it, and the SHA-256, with the Dockerfile comment; - asserts that no key download or `gpg --dearmor` remains. - A changed key is caught, not trusted. - Only `backend-base` fetched the key. `bot-base` and `e2e-db` need nothing. **Checks (docker-test, committed code):** - The `backend-dev` image builds, including the apt install and `pg_dump --version`. - `tests/test_pgdg_key_in_repo.py` and `tests/test_backup_client_version.py`: 22 passed. - `lint` is clean. - `check_version_sync.py` and `changelog.py check` pass. - Not run: the full backend, frontend, bot and synthetic suites. CI covers them. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
style: ruff format the PGDG key test (#1346)
All checks were successful
CI / Backend lint (ruff) (pull_request) Successful in 34s
Details
CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 2m24s
Details
CI / Bot/backend version sync (pull_request) Successful in 46s
Details
CI / Feedback site tests (pull_request) Successful in 55s
Details
CI / Does this change touch the recording path? (pull_request) Successful in 19s
Details
CI / Which journeys does this change need? (pull_request) Successful in 22s
Details
CI / Bot tests and audit (pull_request) Successful in 4m24s
Details
CI / Frontend (shard 2/2) (pull_request) Successful in 10m18s
Details
CI / Frontend (shard 1/2) (pull_request) Successful in 11m40s
Details
CI / Docker image build (pull_request) Successful in 8m54s
Details
CI / Synthetic session harness (no GPU, no LLM) (pull_request) Successful in 11m52s
Details
CI / Backend migration, tests, and audit (pull_request) Successful in 45m29s
Details
CI / End-to-end journeys (phone) (pull_request) Successful in 16m0s
Details
CI / End-to-end journeys (keyboard) (pull_request) Successful in 16m50s
Details
CI / End-to-end journeys (desktop) (pull_request) Successful in 24m8s
Details
c2c841e920 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backend
Issue related to the backend

  
bot
Issue related to the bot

  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
frontend
Issue related to the frontend

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
recording
Issue related to the recording system

  
security
Security hardening / vulnerability work

  
wontfix
This won't be fixed

No labels
backend
bot
bug
duplicate
enhancement
frontend
help wanted
invalid
question
recording
security
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/Quest-Board!1356
No description provided.