Skip to content

fix: secure PostgreSQL APT key installation in dockerfile #22391

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erikburt merged 2 commits into from
May 12, 2026
+20 −8
Merged

fix: secure PostgreSQL APT key installation in dockerfile #22391

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2a8ec08
fix: secure PostgreSQL APT key installation in dockefile
erikburt May 11, 2026
06dd9bd
empty commit
erikburt May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions core/chainlink.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,10 +102,16 @@ ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y ca-certificates gnupg lsb-release curl && rm -rf /var/lib/apt/lists/*

# Install Postgres for CLI tools, needed specifically for DB backups
RUN curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - \
&& echo "deb http://apt.postgresql.org/pub/repos/apt/ `lsb_release -cs`-pgdg main" |tee /etc/apt/sources.list.d/pgdg.list \
&& apt-get update && apt-get install -y postgresql-client-16 \
&& rm -rf /var/lib/apt/lists/*
RUN curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
| gpg --dearmor -o /usr/share/keyrings/postgresql-archive-keyring.gpg \
&& gpg --no-default-keyring \
--keyring /usr/share/keyrings/postgresql-archive-keyring.gpg \
--fingerprint B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8 \
Comment thread
erikburt marked this conversation as resolved.
&& echo "deb [signed-by=/usr/share/keyrings/postgresql-archive-keyring.gpg] \
https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" \
> /etc/apt/sources.list.d/pgdg.list \
&& apt-get update && apt-get install -y postgresql-client-16 \
&& rm -rf /var/lib/apt/lists/*

RUN if [ ${CHAINLINK_USER} != root ]; then useradd --uid 14933 --create-home ${CHAINLINK_USER}; fi
USER ${CHAINLINK_USER}
Expand Down
14 changes: 10 additions & 4 deletions plugins/chainlink.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,10 +102,16 @@ ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y ca-certificates gnupg lsb-release curl && rm -rf /var/lib/apt/lists/*

# Install Postgres for CLI tools, needed specifically for DB backups
RUN curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - \
&& echo "deb http://apt.postgresql.org/pub/repos/apt/ `lsb_release -cs`-pgdg main" |tee /etc/apt/sources.list.d/pgdg.list \
&& apt-get update && apt-get install -y postgresql-client-16 \
&& rm -rf /var/lib/apt/lists/*
RUN curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
| gpg --dearmor -o /usr/share/keyrings/postgresql-archive-keyring.gpg \
&& gpg --no-default-keyring \
--keyring /usr/share/keyrings/postgresql-archive-keyring.gpg \
--fingerprint B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8 \
Comment thread
erikburt marked this conversation as resolved.
&& echo "deb [signed-by=/usr/share/keyrings/postgresql-archive-keyring.gpg] \
https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" \
> /etc/apt/sources.list.d/pgdg.list \
&& apt-get update && apt-get install -y postgresql-client-16 \
&& rm -rf /var/lib/apt/lists/*

RUN if [ ${CHAINLINK_USER} != root ]; then useradd --uid 14933 --create-home ${CHAINLINK_USER}; fi
USER ${CHAINLINK_USER}
Expand Down
Loading