On Fri, Oct 16, 2026 at 11:22 PM Noah Misch <[email protected]> wrote:
>
> On 2026-10-08, Anthropic launched its "OSS Scanner"
> (https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source).
> The plan is to enroll [email protected] for automated notification of
> vulnerabilities it finds. One of the steps is to provide a Dockerfile that
> the scanner will use to get a PostgreSQL build. The attached patch adds one
> to postgresql.git. It mimics CI.
I tried v1 on master (6a2edf2a1e6) using the recipe in the header
comment and the enroll-postgresql branch. tools/check built it in
about seven minutes on my 16-core box.
I ran the full suite inside the finished image, without network access,
as the postgres user:
Ok: 402 Skipped: 24 Fail: 3
The three failures were test_aio 001_aio, 003_initdb, and
004_read_stream, all reporting:
FATAL: could not setup io_uring queue: Operation not permitted
Docker's default seccomp profile blocks io_uring. With liburing-dev
installed, meson enables io_uring support, but the tests fail when they
attempt to use it.
I removed liburing-dev and added -Dliburing=disabled. All four test_aio
tests then passed, and the full suite was clean:
Ok: 405 Skipped: 24 Fail: 0
Attached v2 also puts the packages one per line, sorted, to minimize
future diffs.
I thought about adding this to pg-ci.yml too, but it'd be mostly the
same as linux-meson-64. If we want a check, maybe a separate workflow
job limited to src/tools/oss-scanner changes. And I think it sends out
it failures too so you'll get notified regardless.
Regards,
-- Sehrope Sarkuni
Founder & CEO | JackDB, Inc. | https://www.jackdb.com/
From c606d1c709934b412a842a7f6cc7f0d050d12a90 Mon Sep 17 00:00:00 2001
From: Noah Misch <[email protected]>
Date: Sat, 17 Oct 2026 12:05:50 +0000
Subject: [PATCH v2] Add Dockerfile for github.com/anthropics/oss-scanner.
This has no effect on normal use of this repository. The scanner clones
this repository and locates this file. While we could store it in the
scanner configuration, storing it here simplifies keeping CI and this in
sync. References to postgresql/project.yaml are forward-looking; see
github.com/nmisch/oss-scanner/blob/enroll-postgresql/projects/postgresql/project.yaml
for the planned future content. Claude wrote much of this.
Reviewed-by: FIXME
Discussion: https://postgr.es/m/FIXME
---
src/tools/oss-scanner/Dockerfile | 124 +++++++++++++++++++++++++++++++
1 file changed, 124 insertions(+)
create mode 100644 src/tools/oss-scanner/Dockerfile
diff --git a/src/tools/oss-scanner/Dockerfile b/src/tools/oss-scanner/Dockerfile
new file mode 100644
index 00000000000..28256d42fe9
--- /dev/null
+++ b/src/tools/oss-scanner/Dockerfile
@@ -0,0 +1,124 @@
+# OSS Scanner (red.anthropic.com/oss-scanner) build of PostgreSQL. This
+# should remain aligned with CI, building PostgreSQL with as many optional
+# features as practical.
+#
+# github.com/anthropics/oss-scanner/blob/main/projects/postgresql/project.yaml
+# directs the scanner to use this file. Authority on writing this file:
+# github.com/anthropics/oss-scanner/blob/main/templates/Dockerfile
+#
+# Test changes to this file as follows, editing the MY_* vars.
+# oss-scanner/tools/check insists on an https:// URL, hence the use of the git
+# insteadOf mechanism to trick it into testing a local repo.
+#
+# MY_REPO=$HOME/src/pg/postgresql
+# MY_BRANCH=dockerfile-oss-scanner
+# git clone https://github.com/anthropics/oss-scanner/
+# sed -i "s|^repo:.*|repo: https://local.invalid/postgresql#$MY_BRANCH|" \
+# oss-scanner/projects/postgresql/project.yaml
+# GIT_CONFIG_COUNT=2 \
+# GIT_CONFIG_KEY_0="url.file://$MY_REPO.insteadOf" \
+# GIT_CONFIG_VALUE_0="https://local.invalid/postgresql"; \
+# GIT_CONFIG_KEY_1="protocol.file.allow" \
+# GIT_CONFIG_VALUE_1="always" \
+# oss-scanner/tools/check postgresql
+
+FROM debian:trixie
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install CI "base" and "normal" OS package sets. Source:
+# github.com/anarazel/pg-vm-images
+RUN apt-get update && apt-get install -y --no-install-recommends \
+ bison \
+ build-essential \
+ ca-certificates \
+ clang \
+ flex \
+ g++ \
+ gcc \
+ gdb \
+ gettext \
+ git \
+ krb5-admin-server \
+ krb5-kdc \
+ krb5-user \
+ ldap-utils \
+ libcurl4-openssl-dev \
+ libicu-dev \
+ libio-pty-perl \
+ libipc-run-perl \
+ libkrb5-dev \
+ libldap2-dev \
+ liblz4-dev \
+ libnuma-dev \
+ libpam-dev \
+ libperl-dev \
+ libpython3-dev \
+ libreadline-dev \
+ libselinux-dev \
+ libssl-dev \
+ libsystemd-dev \
+ libxml2-dev \
+ libxslt1-dev \
+ libzstd-dev \
+ llvm-dev \
+ locales-all \
+ lz4 \
+ make \
+ meson \
+ ninja-build \
+ openssl \
+ perl \
+ pkg-config \
+ procps \
+ python3 \
+ slapd \
+ tcl-dev \
+ time \
+ uuid-dev \
+ zlib1g-dev \
+ zstd \
+ && rm -rf /var/lib/apt/lists/*
+
+# PostgreSQL won't start as root, so make an unprivileged user for build and
+# smoke test. The scan runs git as root, so configure it to accept the
+# non-root-owned /src as safe.
+RUN useradd --create-home --shell /bin/bash postgres \
+ && git config --system --add safe.directory /src
+
+# scanner contract: the checkout lives inside the image, at /src
+COPY --chown=postgres:postgres . /src
+WORKDIR /src
+USER postgres
+
+# Include various settings from the CI configuration, even ones for tools and
+# tests this file isn't running. If the scanner opts to runs affected tools
+# and tests, it might benefit.
+ENV ASAN_OPTIONS=print_stacktrace=1:disable_coredump=0:abort_on_error=1:detect_leaks=0 \
+ UBSAN_OPTIONS=print_stacktrace=1:disable_coredump=0:abort_on_error=1:verbosity=2 \
+ PG_TEST_EXTRA="kerberos ldap ssl libpq_encryption load_balance oauth" \
+ PGCTLTIMEOUT=120 \
+ TEMP_CONFIG=/src/src/tools/ci/pg_ci_base.conf \
+ MESON_COMMON_PG_CONFIG_ARGS='-Dcassert=true -Dinjection_points=true' \
+ MTEST_ARGS='--print-errorlogs --no-rebuild -C build'
+
+# Per scanner contract, use -g -fno-omit-frame-pointer
+ENV CFLAGS='-O2 -g -fno-omit-frame-pointer'
+ENV CXXFLAGS=$CFLAGS
+# Build like CI job "Linux - Meson (64-bit)", minus io_method=io_uring
+# (oss-scanner seccomp blocks it), minus sanitizers. Use "testprep" so the
+# tree gets, e.g., src/test/modules binaries.
+RUN meson setup \
+ $MESON_COMMON_PG_CONFIG_ARGS \
+ -Duuid=e2fs \
+ -Dliburing=disabled \
+ --buildtype=debug \
+ -Dllvm=enabled \
+ build && \
+ ninja -C build -j"$(nproc)" all testprep
+
+# Smoke test like CI SanityCheck
+RUN meson test $MTEST_ARGS --suite setup --logbase setup
+RUN meson test $MTEST_ARGS cube/regress pg_ctl/001_start_stop || \
+ echo "WARNING: SanityCheck reported failures"
+
+USER root
--
2.43.0
