From e5699f23086a24bb947f8184bb6d71a330e01be7 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Sat, 13 Jun 2026 11:53:42 +0200 Subject: [PATCH] postgresqlPackages.plv8: drop `plv8` depends on the outdated NodeJS 20. Upstream waits for v8-cmake to make a move (https://github.com/plv8/plv8/issues/610), but that project has been inactive for a bit more than a year. Even when allowing the insecure nodejs20, the package fails to build. Insecure and broken - we might as well drop it. --- .../modules/services/databases/postgresql.md | 2 +- .../modules/services/databases/postgresql.nix | 7 +- nixos/tests/postgresql/postgresql.nix | 14 -- pkgs/servers/sql/postgresql/ext.nix | 1 + ...001-build-Allow-using-V8-from-system.patch | 44 ------ .../sql/postgresql/ext/plv8/package.nix | 141 ------------------ 6 files changed, 3 insertions(+), 206 deletions(-) delete mode 100644 pkgs/servers/sql/postgresql/ext/plv8/0001-build-Allow-using-V8-from-system.patch delete mode 100644 pkgs/servers/sql/postgresql/ext/plv8/package.nix diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md index 27fe409579f1..96cdff8a3e82 100644 --- a/nixos/modules/services/databases/postgresql.md +++ b/nixos/modules/services/databases/postgresql.md @@ -194,7 +194,7 @@ For an upgrade, a script like this can be used to simplify the process: # XXX specify the postgresql package you'd like to upgrade to. # Do not forget to list the extensions you need. newPostgres = pkgs.postgresql_15.withPackages (pp: [ - # pp.plv8 + # pp.pl_cron ]); cfg = config.services.postgresql; in diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix index 2040d2be5bb1..2f3e0b20de8b 100644 --- a/nixos/modules/services/databases/postgresql.nix +++ b/nixos/modules/services/databases/postgresql.nix @@ -705,9 +705,6 @@ in "~@privileged" = true; "~@resources" = true; }) - (mkIf (any extensionInstalled [ "plv8" ]) { - "@pkey" = true; - }) (mkIf (any extensionInstalled [ "citus" ]) { "getpriority" = true; "setpriority" = true; @@ -807,9 +804,7 @@ in PrivateTmp = true; ProtectHome = true; ProtectSystem = "strict"; - MemoryDenyWriteExecute = lib.mkDefault ( - cfg.settings.jit == "off" && (!any extensionInstalled [ "plv8" ]) - ); + MemoryDenyWriteExecute = lib.mkDefault (cfg.settings.jit == "off"); NoNewPrivileges = true; LockPersonality = true; PrivateDevices = true; diff --git a/nixos/tests/postgresql/postgresql.nix b/nixos/tests/postgresql/postgresql.nix index d832f5caa4e9..6fa8351bcae0 100644 --- a/nixos/tests/postgresql/postgresql.nix +++ b/nixos/tests/postgresql/postgresql.nix @@ -31,17 +31,6 @@ let INSERT INTO sth (id) VALUES (1); CREATE TABLE xmltest ( doc xml ); INSERT INTO xmltest (doc) VALUES ('ok'); -- check if libxml2 enabled - - -- check if hardening gets relaxed - CREATE EXTENSION plv8; - -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute - DO $$ - let xs = []; - for (let i = 0, n = 400000; i < n; i++) { - xs.push(Math.round(Math.random() * n)) - } - console.log(xs.reduce((acc, x) => acc + x, 0)); - $$ LANGUAGE plv8; ''; in @@ -60,9 +49,6 @@ let identMap = '' postgres root postgres ''; - # TODO(@Ma27) split this off into its own VM test and move a few other - # extension tests to use postgresqlTestExtension. - extensions = ps: with ps; [ plv8 ]; }; services.postgresqlBackup = { diff --git a/pkgs/servers/sql/postgresql/ext.nix b/pkgs/servers/sql/postgresql/ext.nix index 43fee0a937f3..bbfd54fb60b6 100644 --- a/pkgs/servers/sql/postgresql/ext.nix +++ b/pkgs/servers/sql/postgresql/ext.nix @@ -24,4 +24,5 @@ in cstore_fdw = throw "PostgreSQL extension `cstore_fdw` has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05 pg_embedding = throw "PostgreSQL extension `pg_embedding` has been removed since the project has been abandoned. Upstream's recommendation is to use pgvector instead (https://neon.tech/docs/extensions/pg_embedding#migrate-from-pg_embedding-to-pgvector)"; pgvecto-rs = throw "PostgreSQL extension `pgvecto-rs` has been removed since the project has been abandoned. Upstream's recommendation is to use vectorchord instead (https://docs.vectorchord.ai/vectorchord/admin/migration.html#from-pgvecto-rs) "; # Added 2026-03-13 + plv8 = throw "PostgreSQL extension `plv8` has been removed due to depending on the insecure NodeJS 20"; # Added 2026-06-13 } diff --git a/pkgs/servers/sql/postgresql/ext/plv8/0001-build-Allow-using-V8-from-system.patch b/pkgs/servers/sql/postgresql/ext/plv8/0001-build-Allow-using-V8-from-system.patch deleted file mode 100644 index e6099771ea1a..000000000000 --- a/pkgs/servers/sql/postgresql/ext/plv8/0001-build-Allow-using-V8-from-system.patch +++ /dev/null @@ -1,44 +0,0 @@ -diff --git a/Makefile b/Makefile -index a705c11..08b952b 100644 ---- a/Makefile -+++ b/Makefile -@@ -13,11 +13,14 @@ OBJS = $(SRCS:.cc=.o) - MODULE_big = plv8-$(PLV8_VERSION) - EXTENSION = plv8 - PLV8_DATA = plv8.control plv8--$(PLV8_VERSION).sql -+USE_SYSTEM_V8 = 0 - - ifeq ($(OS),Windows_NT) - # noop for now - else -+ ifeq ($(USE_SYSTEM_V8),0) - SHLIB_LINK += -Ldeps/v8-cmake/build -+ endif - UNAME_S := $(shell uname -s) - ifeq ($(UNAME_S),Darwin) - CCFLAGS += -stdlib=libc++ -@@ -34,6 +37,7 @@ ifeq ($(NUMPROC),0) - NUMPROC = 1 - endif - -+ifeq ($(USE_SYSTEM_V8),0) - SHLIB_LINK += -Ldeps/v8-cmake/build - - all: v8 $(OBJS) -@@ -46,11 +50,16 @@ deps/v8-cmake/build/libv8_libbase.a: - @cd deps/v8-cmake && mkdir -p build && cd build && cmake -Denable-fPIC=ON -DCMAKE_BUILD_TYPE=Release ../ && make -j $(NUMPROC) - - v8: deps/v8-cmake/build/libv8_libbase.a -+else -+all: $(OBJS) -+endif - - # enable direct jsonb conversion by default - CCFLAGS += -DJSONB_DIRECT_CONVERSION - -+ifeq ($(USE_SYSTEM_V8),0) - CCFLAGS += -Ideps/v8-cmake/v8/include -std=c++17 -+endif - - ifdef EXECUTION_TIMEOUT - CCFLAGS += -DEXECUTION_TIMEOUT diff --git a/pkgs/servers/sql/postgresql/ext/plv8/package.nix b/pkgs/servers/sql/postgresql/ext/plv8/package.nix deleted file mode 100644 index ad7935687f1a..000000000000 --- a/pkgs/servers/sql/postgresql/ext/plv8/package.nix +++ /dev/null @@ -1,141 +0,0 @@ -{ - fetchFromGitHub, - lib, - nodejs-slim_20, - perl, - postgresql, - postgresqlBuildExtension, - stdenv, - # For test - coreutils, - gnugrep, - runCommand, -}: - -let - libv8 = nodejs-slim_20.libv8; -in -postgresqlBuildExtension (finalAttrs: { - pname = "plv8"; - version = "3.2.4"; - - src = fetchFromGitHub { - owner = "plv8"; - repo = "plv8"; - tag = "v${finalAttrs.version}"; - hash = "sha256-v4r/6qwDwb3+PQPYV3FqmIcDEkSr8F46PVlFnhUWUGc="; - }; - - patches = [ - # Allow building with system v8. - # https://github.com/plv8/plv8/pull/505 (rejected) - ./0001-build-Allow-using-V8-from-system.patch - ]; - - nativeBuildInputs = [ - perl - ]; - - buildInputs = [ - libv8 - ]; - - buildFlags = [ "all" ]; - - makeFlags = [ - # Nixpkgs build a v8 monolith instead of separate v8_libplatform. - "USE_SYSTEM_V8=1" - "SHLIB_LINK=-lv8" - "V8_OUTDIR=${libv8}/lib" - ]; - - # No configure script. - dontConfigure = true; - - postPatch = '' - patchShebangs ./generate_upgrade.sh - ''; - - passthru = { - tests = - let - postgresqlWithSelf = postgresql.withPackages (_: [ - finalAttrs.finalPackage - ]); - in - { - smoke = runCommand "plv8-smoke-test" { } '' - export PATH=${ - lib.makeBinPath [ - postgresqlWithSelf - coreutils - gnugrep - ] - } - db="$PWD/testdb" - initdb "$db" - postgres -k "$db" -D "$db" & - pid="$!" - - for i in $(seq 1 100); do - if psql -h "$db" -d postgres -c "" 2>/dev/null; then - break - elif ! kill -0 "$pid"; then - exit 1 - else - sleep 0.1 - fi - done - - psql -h "$db" -d postgres -c 'CREATE EXTENSION plv8; DO $$ plv8.elog(NOTICE, plv8.version); $$ LANGUAGE plv8;' 2> "$out" - grep -q "${finalAttrs.version}" "$out" - kill -0 "$pid" - ''; - - regression = stdenv.mkDerivation { - name = "plv8-regression"; - inherit (finalAttrs) - src - patches - nativeBuildInputs - buildInputs - dontConfigure - ; - - buildPhase = '' - runHook preBuild - - # The regression tests need to be run in the order specified in the Makefile. - echo -e "include Makefile\nprint_regress_files:\n\t@echo \$(REGRESS)" > Makefile.regress - REGRESS_TESTS=$(make -f Makefile.regress print_regress_files) - - ${lib.getDev postgresql}/lib/pgxs/src/test/regress/pg_regress \ - --bindir='${postgresqlWithSelf}/bin' \ - --temp-instance=regress-instance \ - --dbname=contrib_regression \ - $REGRESS_TESTS - - runHook postBuild - ''; - - installPhase = '' - runHook preInstall - - touch "$out" - - runHook postInstall - ''; - }; - }; - }; - - meta = { - description = "V8 Engine Javascript Procedural Language add-on for PostgreSQL"; - homepage = "https://plv8.github.io/"; - changelog = "https://github.com/plv8/plv8/blob/v${finalAttrs.version}/Changes"; - maintainers = [ ]; - platforms = postgresql.meta.platforms; - license = lib.licenses.postgresql; - broken = stdenv.hostPlatform.isDarwin; - }; -})