From c16cb2b754bfb9af9fc3c9fbcd4811cad931d842 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Mon, 14 Sep 2026 13:23:51 +0300 Subject: [PATCH 1/4] fix(cargo-pgrx): work around crates.io UA blocklist across all vendoring paths crates.io started 403'ing python-requests' default UA and rate-limiting its API endpoint (NixOS/nixpkgs#512735), breaking fetchCargoVendor, importCargoLock, and fetchCrate alike. Redirects each to static.crates.io / swaps in the fixed util script, scoped to cargo-pgrx's rustPlatform construction. Verified against Raminder's pg_graphql 1.6.2 bump (rs/bump-pg-graphql): builds clean end-to-end with these fixes applied. Co-Authored-By: Claude Sonnet 5 --- nix/cargo-pgrx/default.nix | 12 ++++-- nix/cargo-pgrx/fix-fetch-cargo.nix | 60 ++++++++++++++++++++++++++++++ nix/cargo-pgrx/mkPgrxExtension.nix | 6 ++- 3 files changed, 73 insertions(+), 5 deletions(-) create mode 100644 nix/cargo-pgrx/fix-fetch-cargo.nix diff --git a/nix/cargo-pgrx/default.nix b/nix/cargo-pgrx/default.nix index ff9b916eb9..2894eab6cb 100644 --- a/nix/cargo-pgrx/default.nix +++ b/nix/cargo-pgrx/default.nix @@ -1,5 +1,6 @@ { lib, + pkgs, fetchCrate, openssl, pkg-config, @@ -9,10 +10,11 @@ rustVersion ? "1.85.1", }: let - rustPlatform = makeRustPlatform { + # TODO: remove once nixpkgs is bumped past NixOS/nixpkgs#512735 + rustPlatform = import ./fix-fetch-cargo.nix { inherit pkgs; } (makeRustPlatform { cargo = rust-bin.stable.${rustVersion}.default; rustc = rust-bin.stable.${rustVersion}.default; - }; + }); mkCargoPgrx = { version, @@ -30,7 +32,11 @@ let auditable = false; inherit pname; inherit version; - src = fetchCrate { inherit version pname hash; }; + # TODO: remove once nixpkgs is bumped past NixOS/nixpkgs#512735 + src = fetchCrate { + inherit version pname hash; + registryDl = "https://static.crates.io/crates"; + }; inherit cargoHash; nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ]; buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ]; diff --git a/nix/cargo-pgrx/fix-fetch-cargo.nix b/nix/cargo-pgrx/fix-fetch-cargo.nix new file mode 100644 index 0000000000..13a642cc86 --- /dev/null +++ b/nix/cargo-pgrx/fix-fetch-cargo.nix @@ -0,0 +1,60 @@ +# workaround: crates.io blocks python-requests' default UA (nixpkgs#512735) +# TODO: remove once nixpkgs pin includes that fix +{ pkgs }: +rustPlatform: +let + fixedUtilBin = rustPlatform.callPackage ( + { writers, python3Packages }: + writers.writePython3Bin "fetch-cargo-vendor-util" + { + libraries = + with python3Packages; + [ + requests + tomli-w + ] + ++ requests.optional-dependencies.socks; + flakeIgnore = [ "E501" ]; + } + ( + builtins.readFile ( + pkgs.fetchurl { + url = "https://raw.githubusercontent.com/NixOS/nixpkgs/941b631956516306effaed1641bd00f2ab2e570b/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py"; + hash = "sha256-hnL0hh8vFgMBXV8kDDezRV40+CHpwtSVlzG0dyQpZXg="; + } + ) + ) + ) { }; +in +rustPlatform.overrideScope ( + _final: prev: { + fetchCargoVendor = + args: + (prev.fetchCargoVendor args).overrideAttrs (old: { + vendorStaging = old.vendorStaging.overrideAttrs (oldStaging: { + nativeBuildInputs = map ( + x: if (x.pname or x.name or "") == "fetch-cargo-vendor-util" then fixedUtilBin else x + ) oldStaging.nativeBuildInputs; + }); + }); + importCargoLock = + args: + let + orig = prev.importCargoLock ( + args + // { + extraRegistries = { + "https://github.com/rust-lang/crates.io-index" = "https://static.crates.io/crates"; + } + // (args.extraRegistries or { }); + } + ); + in + # strip the duplicate crates-io source stanza extraRegistries adds, or cargo metadata breaks + pkgs.runCommand orig.name { } '' + cp -r ${orig} $out + chmod -R u+w $out + sed -i '\|\[source\."https://github.com/rust-lang/crates.io-index"\]|,+2d' $out/.cargo/config.toml + ''; + } +) diff --git a/nix/cargo-pgrx/mkPgrxExtension.nix b/nix/cargo-pgrx/mkPgrxExtension.nix index cee5eae1a8..92e32000ae 100644 --- a/nix/cargo-pgrx/mkPgrxExtension.nix +++ b/nix/cargo-pgrx/mkPgrxExtension.nix @@ -1,5 +1,6 @@ { callPackage, + pkgs, rustVersion, pgrxVersion, makeRustPlatform, @@ -9,10 +10,11 @@ let inherit ((callPackage ./default.nix { inherit rustVersion; })) mkCargoPgrx; - rustPlatform = makeRustPlatform { + # TODO: remove once nixpkgs is bumped past NixOS/nixpkgs#512735 + rustPlatform = import ./fix-fetch-cargo.nix { inherit pkgs; } (makeRustPlatform { cargo = rust-bin.stable.${rustVersion}.default; rustc = rust-bin.stable.${rustVersion}.default; - }; + }); versions = builtins.fromJSON (builtins.readFile ./versions.json); From 29d02a6c01bb67c06215454ca7c8336aa044a6c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rton=20Boros?= Date: Mon, 14 Sep 2026 13:28:05 +0300 Subject: [PATCH 2/4] chore(cargo-pgrx): rename fix-fetch-cargo.nix to fix-cargo.nix It fixes fetchCrate too, not just cargo vendoring. Co-Authored-By: Claude Sonnet 5 --- nix/cargo-pgrx/default.nix | 2 +- nix/cargo-pgrx/{fix-fetch-cargo.nix => fix-cargo.nix} | 0 nix/cargo-pgrx/mkPgrxExtension.nix | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) rename nix/cargo-pgrx/{fix-fetch-cargo.nix => fix-cargo.nix} (100%) diff --git a/nix/cargo-pgrx/default.nix b/nix/cargo-pgrx/default.nix index 2894eab6cb..8ae8a23e8e 100644 --- a/nix/cargo-pgrx/default.nix +++ b/nix/cargo-pgrx/default.nix @@ -11,7 +11,7 @@ }: let # TODO: remove once nixpkgs is bumped past NixOS/nixpkgs#512735 - rustPlatform = import ./fix-fetch-cargo.nix { inherit pkgs; } (makeRustPlatform { + rustPlatform = import ./fix-cargo.nix { inherit pkgs; } (makeRustPlatform { cargo = rust-bin.stable.${rustVersion}.default; rustc = rust-bin.stable.${rustVersion}.default; }); diff --git a/nix/cargo-pgrx/fix-fetch-cargo.nix b/nix/cargo-pgrx/fix-cargo.nix similarity index 100% rename from nix/cargo-pgrx/fix-fetch-cargo.nix rename to nix/cargo-pgrx/fix-cargo.nix diff --git a/nix/cargo-pgrx/mkPgrxExtension.nix b/nix/cargo-pgrx/mkPgrxExtension.nix index 92e32000ae..bb8a601e07 100644 --- a/nix/cargo-pgrx/mkPgrxExtension.nix +++ b/nix/cargo-pgrx/mkPgrxExtension.nix @@ -11,7 +11,7 @@ let inherit ((callPackage ./default.nix { inherit rustVersion; })) mkCargoPgrx; # TODO: remove once nixpkgs is bumped past NixOS/nixpkgs#512735 - rustPlatform = import ./fix-fetch-cargo.nix { inherit pkgs; } (makeRustPlatform { + rustPlatform = import ./fix-cargo.nix { inherit pkgs; } (makeRustPlatform { cargo = rust-bin.stable.${rustVersion}.default; rustc = rust-bin.stable.${rustVersion}.default; }); From 6623eff2eab12e0ccd1dfb5a7cba1cb22e948d00 Mon Sep 17 00:00:00 2001 From: Raminder Singh Date: Fri, 28 Aug 2026 18:19:40 +0530 Subject: [PATCH 3/4] chore: bump pg_graphql to version 1.6.2 --- flake.lock | 6 +++--- nix/cargo-pgrx/default.nix | 10 ++++++++++ nix/cargo-pgrx/versions.json | 8 ++++++++ nix/ext/versions.json | 9 +++++++++ 4 files changed, 30 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index f0b72bcfca..b48d1c2940 100644 --- a/flake.lock +++ b/flake.lock @@ -316,11 +316,11 @@ ] }, "locked": { - "lastModified": 1765248027, - "narHash": "sha256-ngar+yP06x3+2k2Iey29uU0DWx5ur06h3iPBQXlU+yI=", + "lastModified": 1787834454, + "narHash": "sha256-jXSvqn04IOecJCvSvl8+g3PsbDVNP6qKs6dKUs/b16k=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "7b50ad68415ae5be7ee4cc68fa570c420741b644", + "rev": "dc2fd1acc537f3583744e1373597a5731ff7a6e3", "type": "github" }, "original": { diff --git a/nix/cargo-pgrx/default.nix b/nix/cargo-pgrx/default.nix index 8ae8a23e8e..d1c890fcc6 100644 --- a/nix/cargo-pgrx/default.nix +++ b/nix/cargo-pgrx/default.nix @@ -51,6 +51,11 @@ let checkFlags = [ # requires pgrx to be properly initialized with cargo pgrx init "--skip=command::schema::tests::test_parse_managed_postmasters" + "--skip=object_utils::tests::parses_managed_postmasters" + # require test fixtures not included in the crates.io source tarball + "--skip=command::upgrade::tests::find_package_manifest_in_workspace" + "--skip=command::upgrade::tests::process_workspace_manifest" + "--skip=command::upgrade::tests::process_workspace_package_manifest" ]; meta = with lib; { description = "Build Postgres Extensions with Rust"; @@ -87,5 +92,10 @@ in hash = "sha256-3TsNpEqNm3Uol5XPW1i0XEbP2fF2+RKB2d7lO6BDnvQ="; cargoHash = "sha256-LZUXhjMxkBs3O5feH4X5NQC7Qk4Ja6M5+sAYaSCikrY="; }; + cargo-pgrx_0_19_2 = mkCargoPgrx { + version = "0.19.2"; + hash = "sha256-PANc819AhIE9yJ6NFHGJxHJHWZyR2Srmj2cEz3vQmJk="; + cargoHash = "sha256-cTD7x36FvFUIwVLuAqrOJ75vLDppITiDrY8Fs3RjPqU="; + }; inherit mkCargoPgrx; } diff --git a/nix/cargo-pgrx/versions.json b/nix/cargo-pgrx/versions.json index 7f28c940b9..47da9e7df8 100644 --- a/nix/cargo-pgrx/versions.json +++ b/nix/cargo-pgrx/versions.json @@ -115,5 +115,13 @@ "cargoHash": "sha256-95DHq5GLnAqb3bbKwwaeBeKEmkfRh81ZTRaJ7L59DAg=" } } + }, + "0.19.2": { + "hash": "sha256-PANc819AhIE9yJ6NFHGJxHJHWZyR2Srmj2cEz3vQmJk=", + "rust": { + "1.97.1": { + "cargoHash": "sha256-cTD7x36FvFUIwVLuAqrOJ75vLDppITiDrY8Fs3RjPqU=" + } + } } } diff --git a/nix/ext/versions.json b/nix/ext/versions.json index 78a51b5f64..8bac5a7eff 100644 --- a/nix/ext/versions.json +++ b/nix/ext/versions.json @@ -259,6 +259,15 @@ "hash": "sha256-DOmxdLuYlRoQRprN4tni6JyXZ3nWaEqVQU0DNSYRYTc=", "pgrx": "0.16.1", "rust": "1.88.0" + }, + "1.6.2": { + "postgresql": [ + "15", + "17" + ], + "hash": "sha256-/qpAfou/shsLKyUmJsya/Zph9nhdtQwXOcXpqmsOnIw=", + "pgrx": "0.19.2", + "rust": "1.97.1" } }, "pg_net": { From 081229ce7daf1a1d723c8242581656a885a6ee63 Mon Sep 17 00:00:00 2001 From: Raminder Singh Date: Tue, 15 Sep 2026 13:23:49 +0530 Subject: [PATCH 4/4] chore: bump AMI versions --- ansible/vars.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ansible/vars.yml b/ansible/vars.yml index 3a6e1abdbb..9c212016ed 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -7,9 +7,9 @@ postgres_major: - "17" - orioledb-17 postgres_release: - postgresorioledb-17: "17.9.0.024-orioledb" - postgres17: "17.6.1.171" - postgres15: "15.14.1.171" + postgresorioledb-17: "17.9.0.025-orioledb" + postgres17: "17.6.1.172" + postgres15: "15.14.1.172" supabase_admin_agent_splay: 30s ############################################################################################################### # The following block of yaml is for get_url and co throughout the playbook #