This repo keeps PostgreSQL packaging reproducible and reviewable. Changes should be small, pinned, and easy to audit.
- Nix with flakes enabled.
- Docker or Podman only when loading/running the OCI image locally.
Enter the dev shell:
nix developRun the full local check:
just checkInstall local hooks:
just install-hooks- Pin upstream source versions and hashes.
- Do not use unpinned moving tags for extension sources.
- Do not enable extensions globally just because they are present in the image.
- Keep CloudNativePG base images pinned by manifest.
- Do not require private SSH builders. Public builds must work with local Nix builders and public caches.
- Run
just check. - Run
just build-image. - Load and smoke test locally with
just build-cnpg-image. - Generate an SBOM with
just sbom. - Push with
PUSH=1 just build-cnpg-image. - Tag the repo with the PostgreSQL major and extension set.