[Build issue]: postgresql-{16,17,18}-oci-entrypoint packages broken
needs-triage
### Package name
postgresql-16-oci-entrypoint-base, postgresql-17-oci-entrypoint-base, postgresql-18-oci-entrypoint-base
### Current version in Wolfi
_No response_
### Requested version
_No response_
### Upstream project URL
https://github.com/postgres/postgres
### Problem
The builds for all postgresql oci-entrypoint-base packages are currently broken. The entrypoint files downloaded from the Docker, Inc. upstream repository during build time only contain the text "404: Not found."
### Steps to reproduce
- Create a new docker image based on `cgr.dev/chainguard/wolfi-base:latest`
- Install (for example) `postgresql-oci-entrypoint~=17`
- Observe that `/usr/libexec/postgresql17/docker-entrypoint.sh` and `/usr/libexec/postgresql17/docker-ensure-initdb.sh` only contain the text "404: Not found."
Minimal Dockerfile to reproduce follows:
```Dockerfile
FROM cgr.dev/chainguard/wolfi-base:latest AS my-org/postgresql-17
RUN apk add --no-cache shadow gosu glibc-locale-en glibc-locale-de \
"postgresql~=17" \
"postgresql-contrib~=17" \
"postgresql-client~=17" \
"postgresql-oci-entrypoint~=17" \
&& useradd -rm postgres \
&& apk del --no-cache shadow
WORKDIR "/home/postgres"
ENV PGDATA="/var/lib/postgresql/data"
ENV POSTGRES_INITDB_ARGS="-E UTF8"
ENTRYPOINT ["/usr/bin/docker-entrypoint.sh", "postgres"]
```
### Root cause (if known)
- Docker, Inc. has ceased providing Docker images based on alpine 3.21, so requests for these files result in 404 errors.
- The build silently continues if there is an issue downloading the files that the OCI entrypoint package is built upon.
### Proposed solution
- Increasing `ALPINE_VERSION` in the build files to 3.23 (or at least 3.22) alleviates the immediate issue.
- Adding `--fail-with-body` or at least `--fail` to the curl calls for the entrypoint files will ensure the build fails if there is an issue downloading these files in the future.
### Testing performed
Manual attempts to download the files used in the build script, but with `3.23` and `3.22` substituted for `${ALPINE_VERSION}`, succeed.
### Acceptance criteria
- [x] The requested version is the **latest stable upstream release** (no pre-releases or RCs)
- [x] The upstream project uses an **OSI-approved license**
- [x] The change aligns with Wolfi’s packaging and security model
- [x] The package can be reasonably maintained over time
- [x] There are no known unresolved security or supply-chain concerns
关闭于 2026-02-11 1 条评论