chore: add new pg_repack 1.5.2 version

RHINENG-21738

Author: RostyslavKachan

.hermetic_builds/redhat.repo

@@ -1,4 +1,9 @@
-packages: [python312, python3.12-pip, python3.12-devel, libpq-devel, gcc, libpq, shadow-utils, git-core, postgresql, pg_repack, cargo, rust, zlib-devel, gcc-c++]
+packages: [
+  python312, python3.12-pip, python3.12-devel, gcc, libpq, shadow-utils, git-core, postgresql, pg_repack, cargo, rust, zlib-devel, gcc-c++, tar, redhat-rpm-config, postgresql-server-devel, make, postgresql-static, readline-devel, openssl-devel, libedit-devel, lz4-devel, libzstd-devel,
+  dwz, efi-srpm-macros, elfutils-libelf, file, findutils, fonts-srpm-macros, ghc-srpm-macros, glibc-gconv-extra, go-srpm-macros, groff-base, kernel-srpm-macros, lua-srpm-macros, ncurses, ocaml-srpm-macros, openblas-srpm-macros,
+  perl-AutoLoader, perl-B, perl-Carp, perl-Class-Struct, perl-Data-Dumper, perl-Digest, perl-Digest-MD5, perl-Encode, perl-Errno, perl-Exporter, perl-Fcntl, perl-File-Basename, perl-File-Path, perl-File-Temp, perl-File-stat, perl-FileHandle, perl-Getopt-Long, perl-Getopt-Std, perl-HTTP-Tiny, perl-IO, perl-IO-Socket-IP, perl-IO-Socket-SSL, perl-IPC-Open3, perl-MIME-Base64, perl-Mozilla-CA, perl-NDBM_File, perl-Net-SSLeay, perl-POSIX, perl-PathTools, perl-Pod-Escapes, perl-Pod-Perldoc, perl-Pod-Simple, perl-Pod-Usage, perl-Scalar-List-Utils, perl-SelectSaver, perl-Socket, perl-Storable, perl-Symbol, perl-Term-ANSIColor, perl-Term-Cap, perl-Text-ParseWords, perl-Text-Tabs+Wrap, perl-Time-Local, perl-URI, perl-base, perl-constant, perl-if, perl-interpreter, perl-libnet, perl-libs, perl-mro, perl-overload, perl-overloading, perl-parent, perl-podlators, perl-srpm-macros, perl-subs, perl-vars,
+  pyproject-srpm-macros, python-srpm-macros, qt5-srpm-macros, rust-srpm-macros, unzip, zip
+]
 contentOrigin:
   repofiles: ["./redhat.repo"]
 arches: [x86_64]

.hermetic_builds/rpms.in.yaml

@@ -34,7 +34,7 @@ spec:
   - name: hermetic
     value: "true"
   - name: prefetch-input
-    value: '[{"type": "pip", "path": ".", "requirements_files": ["requirements.txt", "requirements-build.txt", "requirements-extras.txt"]}, {"type": "rpm", "path": "./.hermetic_builds"}]'
+    value: '[{"type": "pip", "path": ".", "requirements_files": ["requirements.txt", "requirements-build.txt", "requirements-extras.txt"]}, {"type": "rpm", "path": "./.hermetic_builds"}, {"type": "generic", "path": "."}]'
   - name: prefetch-dev-package-managers
     value: "true"
   pipelineRef:

.hermetic_builds/rpms.lock.yaml

@@ -31,7 +31,7 @@ spec:
   - name: hermetic
     value: "true"
   - name: prefetch-input
-    value: '[{"type": "pip", "path": ".", "requirements_files": ["requirements.txt", "requirements-build.txt", "requirements-extras.txt"]}, {"type": "rpm", "path": "./.hermetic_builds"}]'
+    value: '[{"type": "pip", "path": ".", "requirements_files": ["requirements.txt", "requirements-build.txt", "requirements-extras.txt"]}, {"type": "rpm", "path": "./.hermetic_builds"}, {"type": "generic", "path": "."}]'
   - name: prefetch-dev-package-managers
     value: "true"
   pipelineRef:

.tekton/vulnerability-engine-pull-request.yaml

@@ -1,10 +1,43 @@
 ARG ALT_REPO
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal AS buildimg
+# ===== BUILDER STAGE FOR PG_REPACK =====
+FROM registry.access.redhat.com/ubi9/ubi AS pg_repack_builder
+
+ARG ALT_REPO
+
+RUN (dnf module enable -y postgresql:16 || curl -o /etc/yum.repos.d/postgresql.repo $ALT_REPO) && \
+    dnf install -y --setopt=install_weak_deps=0 --setopt=tsflags=nodocs \
+        gcc make tar redhat-rpm-config \
+        postgresql postgresql-server-devel \
+        postgresql-static \
+        readline-devel \
+        zlib-devel openssl-devel libedit-devel lz4-devel libzstd-devel && \
+    dnf clean all
+
+
+# Download pg_repack 1.5.2 source (use pre-fetched by Cachi2 if available, otherwise download from GitHub)
+RUN if [ -f /cachi2/output/deps/generic/pg_repack-1.5.2.tar.gz ]; then \
+        echo "Using pre-fetched pg_repack from Cachi2"; \
+        tar xzf /cachi2/output/deps/generic/pg_repack-1.5.2.tar.gz; \
+    else \
+        echo "Downloading pg_repack from GitHub"; \
+        curl -L https://github.com/reorg/pg_repack/archive/ver_1.5.2.tar.gz | tar xz; \
+    fi && \
+    cd pg_repack-ver_1.5.2 && \
+    make && make install
 
-RUN microdnf install -y --setopt=install_weak_deps=0 --setopt=tsflags=nodocs \
-    python312 python3.12-pip python3.12-devel libpq-devel gcc cargo rust zlib-devel gcc-c++ && \
-    microdnf clean all
+
+FROM registry.access.redhat.com/ubi9/ubi AS buildimg
+
+ARG ALT_REPO
+
+
+RUN (dnf module enable -y postgresql:16 || curl -o /etc/yum.repos.d/postgresql.repo $ALT_REPO) && \
+    dnf install -y --setopt=install_weak_deps=0 --setopt=tsflags=nodocs \
+        python312 python3.12-pip python3.12-devel \
+        postgresql-server-devel libpq \
+        gcc cargo rust zlib-devel gcc-c++ && \
+    dnf clean all
 
 WORKDIR /engine
 
@@ -24,12 +57,17 @@ ARG ALT_REPO
 # support for alternative RPM name (in case not compatible version available in RHEL)
 ARG PG_REPACK_RPM=pg_repack-1.5.1
 
-# try to install $PG_REPACK_RPM from module, if it fails, use $ALT_REPO
+# Install PostgreSQL without pg_repack (will copy from builder)
 RUN (microdnf module enable -y postgresql:16 || curl -o /etc/yum.repos.d/postgresql.repo $ALT_REPO) && \
     microdnf install -y --setopt=install_weak_deps=0 --setopt=tsflags=nodocs \
-        python312 libpq shadow-utils git-core postgresql $PG_REPACK_RPM && \
+        python312 libpq shadow-utils git-core postgresql && \
     microdnf clean all
 
+# Copy pg_repack 1.5.2 from builder stage
+COPY --from=pg_repack_builder /usr/bin/pg_repack /usr/local/bin/pg_repack
+COPY --from=pg_repack_builder /usr/lib64/pgsql/pg_repack.so /usr/local/lib/postgresql/
+COPY --from=pg_repack_builder /usr/share/pgsql/extension/ /usr/local/share/postgresql/extension/
+
 WORKDIR /engine
 
 RUN adduser --gid 0 -d /engine --no-create-home insights

.tekton/vulnerability-engine-push.yaml

@@ -0,0 +1,7 @@
+---
+metadata:
+  version: "1.0"
+artifacts:
+  - download_url: "https://github.com/reorg/pg_repack/archive/ver_1.5.2.tar.gz"
+    checksum: "sha256:4516cad42251ed3ad53ff619733004db47d5755acac83f75924cd94d1c4fb681"
+    filename: "pg_repack-1.5.2.tar.gz"