fix: reference supabase postgres flake through flakeref instead of local path

also postpone nix cleanup to after sbom generation, in order to
leverage the existing nix derivations in /nix/store

Author: o-santi

ebssurrogate/scripts/nix-provision.sh

@@ -66,6 +66,10 @@ function execute_stage2_playbook {
 		$ARGS
 }
 
+function generate_and_upload_sbom {
+    nix run github:supabase/postgres#ubuntu-sbom -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json
+}
+
 function cleanup_packages {
 	apt-get remove --purge --yes ansible
 }
@@ -79,7 +83,6 @@ function report_packages {
 	# shellcheck disable=SC2016
 	dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort
 	find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2
-	nix run .#ubuntu-sbom -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json
 }
 
 function report_disk_usage {
@@ -93,9 +96,10 @@ update_and_upgrade_apt
 install_packages
 install_nix
 execute_stage2_playbook
+generate_and_upload_sbom
 cleanup_packages
-cleanup_nix
 update_and_upgrade_apt
 cleanup_apt
 report_packages
+cleanup_nix
 report_disk_usage

ebssurrogate/scripts/qemu-bootstrap-nix.sh

@@ -162,6 +162,11 @@ function execute_stage2_playbook {
 		--extra-vars @./ansible/qemu-vars.yaml
 }
 
+
+function generate_and_upload_sbom {
+    nix run github:supabase/postgres#ubuntu-sbom -- --nix-target /nix/var/nix/profiles/default --include-files --no-progress --output /tmp/ami-system-sbom.json
+}
+
 function clean_legacy_things {
 	# removes things that are bundled for legacy reasons, but we can start without for our newer artifacts
 	apt-mark auto zlib1g* # TODO (darora): need to make sure that there aren't other things that still need this
@@ -268,6 +273,7 @@ execute_playbook
 
 install_nix
 execute_stage2_playbook
+generate_and_upload_sbom
 clean_legacy_things
 clean_system
 clean_nix

nix/apps.nix

@@ -34,7 +34,7 @@
         cli-smoke-test = mkApp "cli-smoke-test";
         ubuntu-sbom = {
           type = "app";
-          program = "${self'.packages.ubuntu-sbom}/bin/ubuntu-sbom";
+          program = "${self'.packages.sbom}/bin/ubuntu-sbom";
         };
       };
     };

nix/packages/default.nix

@@ -120,8 +120,7 @@
             inherit (pkgs) yq;
             postgresql_15 = self'.packages."postgresql_15";
           };
-          ubuntu-sbom =
-            inputs.ubuntu-nix-sbom.packages.${pkgs.stdenv.hostPlatform.system}.ubuntu-sbom-generator;
+          sbom = inputs.ubuntu-nix-sbom.packages.${pkgs.stdenv.hostPlatform.system}.sbom;
           inherit (pkgs.callPackage ./wal-g.nix { }) wal-g-2 wal-g-3;
           inherit (supascan-pkgs) goss supascan supascan-specs;
           inherit (pg-startup-profiler-pkgs) pg-startup-profiler;