From bd81814b2b5d6d89d0b8a2b711e77fb8329284b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= Date: Tue, 10 Feb 2026 10:53:52 +0100 Subject: [PATCH 1/2] fix: create AWS config file to suppress post-build-hook errors The post-build-hook runs `nix copy --to s3://...` which now uses libcurl AWS authentication since the last 2.33 release (see https://releases.nixos.org/nix/nix-2.33.0/manual/release-notes/rl-2.33.html#s3-improvements). It attempts to read /root/.aws/config for profile configuration, but only /root/.aws/credentials was created by `aws configure set` (credential keys write to the credentials file, not the config file). This produced errors in CI logs: [ERROR] static: Failed to open file. path:'/root/.aws/config' [ERROR] Failed to build config profile collection from file Setting the region via `aws configure set region` creates the config file, resolving the missing file errors. --- .github/actions/nix-install-ephemeral/action.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index 71139cd4b8..72697b7727 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -27,6 +27,7 @@ runs: sudo -H aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID sudo -H aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY sudo -H aws configure set aws_session_token $AWS_SESSION_TOKEN + sudo -H aws configure set region ${{ inputs.aws-region }} sudo mkdir -p /etc/nix sudo -E python -c "import os; file = open('/etc/nix/nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()" cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null From 3ec3a079a2651d3d09b0b66ae1eaf98235bb1c2f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= Date: Tue, 10 Feb 2026 12:09:21 +0100 Subject: [PATCH 2/2] feat: upgrade nix to 2.33.2 2.33.2 has a fix to improve aws logs: https://github.com/NixOS/nix/pull/15059 It should suppress logging error like: ``` [AuthCredentialsProvider] - Failed to resolve role arn during sts web identity provider initialization. ``` Note that it doesn't prevent the copy operation from succeeding, so it's not a critical issue, but it does make logs cleaner and easier to read. --- .github/actions/nix-install-ephemeral/action.yml | 2 +- Dockerfile-15 | 2 +- Dockerfile-17 | 2 +- Dockerfile-orioledb-17 | 2 +- ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh | 2 +- ebssurrogate/scripts/qemu-bootstrap-nix.sh | 2 +- nix/docs/start-here.md | 2 +- scripts/nix-provision.sh | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index 72697b7727..5dbdabe8e8 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -43,7 +43,7 @@ runs: NIX_SIGN_SECRET_KEY: ${{ env.NIX_SIGN_SECRET_KEY }} - uses: NixOS/nix-installer-action@d6ef7ecd8f685af89869e5aca0580a33e3e3150c with: - installer-version: 2.33.1 + installer-version: 2.33.2 extra-conf: | substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= diff --git a/Dockerfile-15 b/Dockerfile-15 index 2ed967a71e..03b76d4a45 100644 --- a/Dockerfile-15 +++ b/Dockerfile-15 @@ -106,7 +106,7 @@ extra-experimental-features = nix-command flakes extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= EOF -RUN curl -L https://releases.nixos.org/nix/nix-2.33.1/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf +RUN curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf ENV PATH="${PATH}:/nix/var/nix/profiles/default/bin" COPY . /nixpg diff --git a/Dockerfile-17 b/Dockerfile-17 index 075a7bfb65..f3491b2663 100644 --- a/Dockerfile-17 +++ b/Dockerfile-17 @@ -108,7 +108,7 @@ extra-experimental-features = nix-command flakes extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= EOF -RUN curl -L https://releases.nixos.org/nix/nix-2.33.1/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf +RUN curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf ENV PATH="${PATH}:/nix/var/nix/profiles/default/bin" diff --git a/Dockerfile-orioledb-17 b/Dockerfile-orioledb-17 index fc9e35b8bf..8120bba8fe 100644 --- a/Dockerfile-orioledb-17 +++ b/Dockerfile-orioledb-17 @@ -108,7 +108,7 @@ extra-experimental-features = nix-command flakes extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= EOF -RUN curl -L https://releases.nixos.org/nix/nix-2.33.1/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf +RUN curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf ENV PATH="${PATH}:/nix/var/nix/profiles/default/bin" diff --git a/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh b/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh index c8b45a63b4..6998376a58 100755 --- a/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh +++ b/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh @@ -297,7 +297,7 @@ function initiate_upgrade { --extra-conf "trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" else echo "1.1.1. Installing Nix using the official installer" - sh <(curl -L https://releases.nixos.org/nix/nix-2.33.1/install) --yes --daemon --nix-extra-conf-file /dev/stdin <