test(pg-compat): SP-3 — driver matrix expansion (Go/pgx, Java/pgjdbc, Node/pg, Prisma) #5910
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| # Keep dependency trees and generated Prisma artifacts out of the build | ||
| # context: every driver's node_modules (and Prisma's generated client) are | ||
| # produced INSIDE their multi-stage build steps, so shipping a host-built | ||
| # copy in via `COPY . .` would bloat the image and risk a wrong-platform | ||
| # query-engine binary. Report output is host-only too. | ||
| **/node_modules | ||
| pg-compat-reports |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,76 @@ | ||
| # ---- Go builder: static behavior binary (no runtime needed in final) ---- | ||
| FROM golang:1.23-bookworm AS gobuild | ||
| WORKDIR /src | ||
| COPY drivers/go/ . | ||
| RUN CGO_ENABLED=0 go build -o /out/behaviors-go . | ||
|
|
||
| # ---- Java builder: compile against a pinned pgjdbc jar ---- | ||
| FROM eclipse-temurin:21-jdk AS javabuild | ||
| WORKDIR /src | ||
| # Pin the driver version explicitly; record bumps in README's driver table. | ||
| ARG PGJDBC_VERSION=42.7.4 | ||
| RUN curl -fsSLo /pgjdbc.jar "https://repo1.maven.org/maven2/org/postgresql/postgresql/${PGJDBC_VERSION}/postgresql-${PGJDBC_VERSION}.jar" | ||
| COPY drivers/java/Behaviors.java . | ||
| RUN javac -cp /pgjdbc.jar Behaviors.java -d /out | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win Verify pgjdbc JAR integrity with a SHA-256 checksum. The pgjdbc JAR is downloaded over HTTPS from Maven Central but without checksum verification. If a mirror or the build network is compromised, a tampered JAR could be substituted undetected. Maven Central publishes SHA-256 checksums for all artifacts — adding verification is a one-line change that closes this supply chain gap. 🔒️ Proposed fix: add SHA-256 verification FROM eclipse-temurin:21-jdk AS javabuild
WORKDIR /src
# Pin the driver version explicitly; record bumps in README's driver table.
ARG PGJDBC_VERSION=42.7.4
-ARG PGJDBC_SHA256=""
+ARG PGJDBC_SHA256="f1d3e5b7d6c8a0e2f4b6d8a0e2f4b6d8a0e2f4b6d8a0e2f4b6d8a0e2f4b6"
+# Replace the placeholder above with the actual SHA-256 from:
+# https://repo1.maven.org/maven2/org/postgresql/postgresql/${PGJDBC_VERSION}/postgresql-${PGJDBC_VERSION}.jar.sha256
RUN curl -fsSLo /pgjdbc.jar "https://repo1.maven.org/maven2/org/postgresql/postgresql/${PGJDBC_VERSION}/postgresql-${PGJDBC_VERSION}.jar" \
- && echo "${PGJDBC_SHA256} /pgjdbc.jar" | sha256sum -c -
+ && echo "${PGJDBC_SHA256} /pgjdbc.jar" | sha256sum -c -🤖 Prompt for AI Agents |
||
|
|
||
| # ---- Node deps: install node-postgres against the lockfile ---- | ||
| FROM node:22-bookworm-slim AS nodebuild | ||
| WORKDIR /app | ||
| COPY drivers/node/package.json drivers/node/package-lock.json* ./ | ||
| # The `npm install` fallback must never be reached in normal operation | ||
| # (package-lock.json is committed, so `npm ci` succeeds); it exists only | ||
| # for first-bootstrap before a lockfile exists. | ||
| RUN npm ci --omit=dev || npm install --omit=dev | ||
| COPY drivers/node/behaviors.js . | ||
|
|
||
| # ---- Prisma deps + client generation (ORM tier, SP3-Task 5) ---- | ||
| # npm ci pulls prisma (CLI, a devDependency) AND @prisma/client, then | ||
| # `prisma generate` produces the client + downloads the query-engine binary | ||
| # for binaryTargets=["debian-openssl-3.0.x"] (matching the bookworm/OpenSSL-3 | ||
| # final image). This stage is bookworm/OpenSSL-3 too, so the engine it | ||
| # fetches is the exact one the final stage runs. The engine download needs | ||
| # network egress -> the build runs with --network=host (see | ||
| # run-pg-compat.bash). PGCOMPAT_PRISMA_URL only has to EXIST for `generate` | ||
| # (it does not connect); behaviors.mjs overwrites it at runtime. | ||
| FROM node:22-bookworm-slim AS prismabuild | ||
| WORKDIR /app | ||
| COPY drivers/prisma/package.json drivers/prisma/package-lock.json* ./ | ||
| # devDependencies (the prisma CLI) are REQUIRED here for `prisma generate`, | ||
| # so this is a full install, not --omit=dev. The `npm install` fallback must | ||
| # never be reached in normal operation (package-lock.json is committed). | ||
| RUN npm ci || npm install | ||
| COPY drivers/prisma/schema.prisma drivers/prisma/behaviors.mjs ./ | ||
| ENV PGCOMPAT_PRISMA_URL="postgresql://build:build@localhost:5432/build?sslmode=disable" | ||
| RUN npx prisma generate | ||
|
|
||
| # ---- Final: python base + JRE + node runtime + artifacts ---- | ||
| FROM python:3.11-slim | ||
| # openssl/libssl3: the Prisma query engine (debian-openssl-3.0.x) links | ||
| # against libssl.so.3 / libcrypto.so.3 at load time. | ||
| RUN apt-get update && apt-get install -y --no-install-recommends \ | ||
| libpq5 curl default-jre-headless openssl \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
| # Node runtime copied from the official image (bookworm-glibc compatible). | ||
| COPY --from=nodebuild /usr/local/bin/node /usr/local/bin/node | ||
| WORKDIR /pg-compat | ||
| COPY requirements.txt . | ||
| RUN pip install --no-cache-dir -r requirements.txt | ||
| COPY . . | ||
| # Language artifacts under /pg-compat/bin with uniform CLI wrappers. | ||
| COPY --from=gobuild /out/behaviors-go /pg-compat/bin/behaviors-go | ||
| COPY --from=javabuild /out/ /pg-compat/bin/java-classes/ | ||
| COPY --from=javabuild /pgjdbc.jar /pg-compat/bin/pgjdbc.jar | ||
| COPY --from=nodebuild /app /pg-compat/node-app | ||
| # Prisma app: node_modules (with the generated @prisma/client + .prisma | ||
| # client + query-engine binary), schema.prisma, behaviors.mjs. | ||
| # Known size trade-off: this copies the whole prismabuild dev tree, | ||
| # including the prisma CLI devDependency and its non-query engines | ||
| # (schema/format engines), not just what behaviors.mjs needs at runtime -- | ||
| # simple and correct over minimal. Task 6's image-size measurement accounts | ||
| # for it; prune here if the numbers demand it. | ||
| COPY --from=prismabuild /app /pg-compat/prisma-app | ||
| RUN printf '#!/bin/sh\nexec java -cp /pg-compat/bin/java-classes:/pg-compat/bin/pgjdbc.jar Behaviors "$@"\n' > /pg-compat/bin/behaviors-java \ | ||
|
Check warning on line 72 in test/pg-compat/Dockerfile
|
||
| && printf '#!/bin/sh\nexec node /pg-compat/node-app/behaviors.js "$@"\n' > /pg-compat/bin/behaviors-node \ | ||
| && printf '#!/bin/sh\nexec node /pg-compat/prisma-app/behaviors.mjs "$@"\n' > /pg-compat/bin/behaviors-prisma \ | ||
| && chmod +x /pg-compat/bin/behaviors-* | ||
| ENTRYPOINT ["pytest", "-q"] | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The Java builder stage compiles
Behaviors.javausing JDK 21 (eclipse-temurin:21-jdk), which produces class files with version 65 (Java 21) by default. However, the final stage runs the application usingdefault-jre-headlesson Debian Bookworm, which is Java 17 (class file version 61). This mismatch will cause ajava.lang.UnsupportedClassVersionErrorat runtime. To resolve this, compile the Java code with-release 17to ensure compatibility with the Java 17 runtime in the final stage.