[BRONSOLO]

Important

Manual image build and push needed after merge. No CI pushes this image to quay. The inherited publish-ghcr-container.yaml only targets ghcr.io and failed on its one run. The 5.8 image is quay.io/plotly/spilo:17.10-4.0-p3, a single-arch amd64 image built by hand. The new image gets the next patch tag, 17.10-4.0-p4. Do not overwrite 17.10-4.0-p3, because running installs pull it.

Steps, on an amd64 host (the build compiles wal-g and is slow under emulation):

1. Check out 5.8-release after this PR merges:

   git clone -b 5.8-release https://github.com/plotly/spilo.git && cd spilo/postgres-appliance
   

2. Log in to quay with an account that can push to quay.io/plotly/spilo:

   docker login quay.io
   

3. Build and push for amd64, matching the current image:

   docker buildx build --platform linux/amd64 -t quay.io/plotly/spilo:17.10-4.0-p4 --push .
   

4. Check the fixed packages in the pushed image:

   docker run --rm --entrypoint dpkg-query quay.io/plotly/spilo:17.10-4.0-p4 \
     -W libbrotli1 ca-certificates
   

   Expect libbrotli1 1.0.9-2ubuntu0.1 and ca-certificates 20260816ubuntu0.22.04.1.
5. In dek-deployment 5.8-release, replace 17.10-4.0-p3 with 17.10-4.0-p4 in every file that names it:

   git grep -l 'spilo:17.10-4.0-p3' -- installations | xargs sed -i 's/spilo:17.10-4.0-p3/spilo:17.10-4.0-p4/g'
   

   That covers application.yaml, imageswap/imageswap-map.yaml, postgres-cluster/postgresql.yaml, postgres-operator.yaml, postgres-operator/values.yaml and the operator configuration CRD default.

Upgrades libbrotli1 and brotli for CVE-2026-111497 (DASH-2660) in the DE 5.8 spilo image, quay.io/plotly/spilo:17.10-4.0-p3.

Change

A step after base.sh upgrades both packages and fails the build unless libbrotli1 is at least 1.0.9-2ubuntu0.1. base.sh installs packages but does not upgrade ones that are already installed. The step sits before the COMPRESS stage, so it covers both build modes.

POSTGIS_VERSION moves from 3.6 to 3.7. PGDG now installs PostGIS 3.7.0 by default, so base.sh failed on the missing contrib/postgis-3.6 directory. DE does not use PostGIS.

wal-g statically links its own brotli, which libbrotli1 does not cover. WALG_REF moves to wal-g 67cb69a4, which bundles brotli v1.2.1 with the CVE-2026-111497 fix. That commit needs Go 1.27.3, which also fixes CVE-2026-111943. wal-g is now built with USE_LZO=1, so it can restore LZO backups again; liblzo2-dev was already installed for this. The tests now use SeaweedFS instead of MinIO, as upstream did in zalando#1218, because the MinIO image can no longer be pulled.

base.sh now keeps the timescaledb libraries that every PG major shares with the oldest one, from zalando#1173. The current timescaledb packages pruned 2.19 from PG 15, so the in-place 14 to 15 upgrade test failed on a missing library. DE does not use timescaledb or in-place major upgrades.

Testing

On ubuntu:22.04 (arm64), I installed the vulnerable 1.0.9-2build6 packages and then ran the step. Both packages ended at 1.0.9-2ubuntu0.1.

After merge

See the build and push steps at the top.

CVE-2026-114406, eMudhra roots (DASH-2715)

The leaked eMudhra intermediates chain to emSign ECC Root CA - G3 and to Comodo AAA Certificate Services, which cross-signed them. emSign Root CA - C1 and emSign ECC Root CA - C3 stay trusted, as in the distribution's package and in DE6 (dash-enterprise#883).

• A step upgrades ca-certificates to Ubuntu's fixed 20260816ubuntu0.22.04.1, which drops both.
• patroni_wale.sh upgrades certifi to 2026.10.23 or later. Patroni's Kubernetes client uses certifi. 2026.10.19 is the first release without G3 and Comodo AAA, and 2026.10.23 also drops C1 and C3.

Tested on ubuntu:22.04: the bundle contains neither G3 nor Comodo AAA.

[antoinerg]

I was just about to push something like 0cecd86 😅

[antoinerg]

I was just about to push something like 0cecd86 😅

It made it further but it's still failing.

[BRONSOLO]

Postgres having a GIS extension for geographic data is new to me 🙃. Bumping it is a CI fix only -- we don't actually make use of it in DE 5.