Skip to content

v2.10.13-windows.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 23:02
v2.10.13-windows.1
d057a38
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

plpgsql_check Windows x64 binaries

English

These are unofficial Windows x64 binaries of plpgsql_check, built from pinned upstream source references defined by this repository's manifest. PACKAGE-INFO.txt is the human-readable package summary, while PACKAGE-INFO.json is the machine-readable source/build identity.

Every ZIP is compiled and functionally smoke-tested on GitHub Actions against the PostgreSQL major version in its filename. The build matrix includes only PostgreSQL versions that are both allowed by this extension's manifest and still under PostgreSQL community maintenance.

Documentation

For extension behavior, SQL APIs, configuration, limitations, and licensing, the upstream project remains authoritative.

Package metadata and verification

  • PACKAGE-INFO.txt: human-readable compatibility summary and extension-specific notes inside each ZIP.
  • PACKAGE-INFO.json: machine-readable package, upstream, packaging-repository, shared-build, PostgreSQL, toolchain, runner, and workflow-run identity inside each ZIP.
  • <zip-basename>.spdx.json: SPDX 2.3 SBOM generated by Syft from the final ZIP.
  • <zip-basename>.vulnerabilities.json: Grype report-only analysis of that SBOM against the vulnerability database available at release-build time. This is a point-in-time result and is not guaranteed to remain current.
  • SHA256SUMS.txt: external SHA-256 digest list for the published ZIPs, SPDX JSON files, and vulnerability JSON reports.
  • Build Provenance Attestation: signed evidence of which pinned workflow built the final ZIP.
  • SBOM Attestation: signed binding between the final ZIP digest and its SPDX 2.3 SBOM.

PACKAGE-INFO.json does not contain the ZIP's own SHA-256 or an Attestation ID/URL. Those values are intentionally external so the final ZIP can be attested without a digest cycle.

File verification

Use the attached SHA256SUMS.txt to verify each ZIP.

Build provenance

ZIPs built by the Step 6 release build path have a GitHub Artifact Attestation generated by the pinned pgextwin/build reusable workflow. Verify a downloaded ZIP with GitHub CLI:

gh attestation verify <zip-file> \
  --repo pgextwin/plpgsql_check \
  --signer-workflow pgextwin/build/.github/workflows/build-extension-attested.yml

SBOM attestation

Verify the signed binding between the same ZIP digest and its SPDX 2.3 SBOM:

gh attestation verify <zip-file> \
  --repo pgextwin/plpgsql_check \
  --signer-workflow pgextwin/build/.github/workflows/build-extension-attested.yml \
  --predicate-type https://spdx.dev/Document/v2.3

The standalone *.spdx.json file is also published for inspection and offline tooling. A vulnerability report with zero matches means only that no known vulnerability matched packages represented in that SBOM and the scan-time database; it does not prove the binary is vulnerability-free. Historical releases are not modified retroactively.

日本語

plpgsql_check の 非公式 Windows x64 バイナリです。このrepositoryのmanifestで固定したupstreamソースからビルドしています。PACKAGE-INFO.txt は人間向けpackage summary、PACKAGE-INFO.json は機械可読なsource/build identityです。

各ZIPは、ファイル名に記載されたPostgreSQLメジャーバージョンに対してGitHub Actions上でコンパイルし、Extension固有の機能スモークテストまで実施しています。対象は、そのExtensionのmanifestで許可され、かつPostgreSQLコミュニティのメンテナンス期間内にあるバージョンのみです。

ドキュメント

Extension本体の機能仕様、SQL API、設定、制限事項、ライセンスについてはupstreamプロジェクトを正規の情報源としてください。

Package metadataと検証

  • PACKAGE-INFO.txt: ZIP内部の人間向け互換性summary・Extension固有注意事項。
  • PACKAGE-INFO.json: ZIP内部の機械可読なpackage / upstream / packaging repository / shared build / PostgreSQL / toolchain / runner / workflow run identity。
  • <zip-basename>.spdx.json: final ZIPをSyftでscanして生成するSPDX 2.3 SBOM。
  • <zip-basename>.vulnerabilities.json: そのSBOMをRelease build時点の脆弱性DBと照合したGrypeのreport-only分析結果。point-in-time resultであり、継続的に最新である保証はありません。
  • SHA256SUMS.txt: 公開ZIP、SPDX JSON、vulnerability JSONのdownload integrity確認用SHA-256 digest一覧。
  • Build Provenance Attestation: どのpin済みworkflowがfinal ZIPをbuildしたかを示す署名付きevidence。
  • SBOM Attestation: final ZIP digestとSPDX 2.3 SBOMを署名付きで結び付けるevidence。

PACKAGE-INFO.json にはZIP自身のSHA-256やAttestation ID/URLを入れません。final ZIPを変更せずAttestation対象にできるよう、これらは意図的に外部へ分離しています。

ファイル検証

Releaseに添付した SHA256SUMS.txt で各ZIPのSHA-256を確認できます。

ビルドProvenance

Step 6導入後のrelease build pathで生成したZIPには、full SHAへpinされた pgextwin/build Reusable WorkflowがGitHub Artifact Attestationを生成します。ダウンロードしたZIPはGitHub CLIで検証できます。

gh attestation verify <zip-file> \
  --repo pgextwin/plpgsql_check \
  --signer-workflow pgextwin/build/.github/workflows/build-extension-attested.yml

SBOM Attestation

同じZIP digestとSPDX 2.3 SBOMの署名付きbindingを検証します。

gh attestation verify <zip-file> \
  --repo pgextwin/plpgsql_check \
  --signer-workflow pgextwin/build/.github/workflows/build-extension-attested.yml \
  --predicate-type https://spdx.dev/Document/v2.3

*.spdx.json は人間による確認やoffline tool利用向けにも独立assetとして公開します。vulnerability reportが0件でも「SBOMに表現されたpackageとscan時点DBに既知脆弱性matchがなかった」という意味に限定され、バイナリの安全性証明ではありません。既存のhistorical Releaseは変更しません。

Assets 15
Loading