From 7ce7248faddde062c9717c8b47e2b0d70d5b12d3 Mon Sep 17 00:00:00 2001 From: Pascal Zimmermann Date: Tue, 22 Sep 2026 23:15:48 +0200 Subject: [PATCH 1/2] fix: Vendor libicu as a BOSH package to fix postgres-16/17/18 on Ubuntu Resolute libicu-dev was dropped from the Ubuntu Resolute stemcell, breaking postgres-16/17/18 compilation which requires ICU at build time. - Add postgres-libicu BOSH package that compiles ICU4C 78.3 from a vendored source tarball (static-only, --disable-shared) so postgres links ICU statically with no runtime .so dependency - Update postgres-15, -16, -17, -18 to support aarch64 in packaging scripts - Update postgres-16, -17, -18 to declare postgres-libicu as a dependency and use ${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu in configure flags with -lstdc++ to satisfy C++ runtime symbols from static ICU Closes #98 --- ci/pipeline.yml | 24 +++++++++++++++ ci/tasks/bump-libicu-package/task.sh | 44 +++++++++++++++++++++++++++ ci/tasks/bump-libicu-package/task.yml | 17 +++++++++++ packages/postgres-15/packaging | 5 +-- packages/postgres-16/packaging | 19 +++++++----- packages/postgres-16/spec | 2 ++ packages/postgres-17/packaging | 19 +++++++----- packages/postgres-17/spec | 2 ++ packages/postgres-18/packaging | 19 +++++++----- packages/postgres-18/spec | 2 ++ packages/postgres-libicu/packaging | 12 ++++++++ packages/postgres-libicu/spec | 4 +++ 12 files changed, 143 insertions(+), 26 deletions(-) create mode 100755 ci/tasks/bump-libicu-package/task.sh create mode 100644 ci/tasks/bump-libicu-package/task.yml create mode 100644 packages/postgres-libicu/packaging create mode 100644 packages/postgres-libicu/spec diff --git a/ci/pipeline.yml b/ci/pipeline.yml index 7941de99..da549a56 100644 --- a/ci/pipeline.yml +++ b/ci/pipeline.yml @@ -45,6 +45,11 @@ jobs: trigger: true - get: postgres-18-src trigger: true + - get: icu-src + trigger: true + params: + globs: + - icu4c-*-src.tgz - get: yq-release trigger: true params: @@ -61,6 +66,15 @@ jobs: options: access_key_id: ((postgres-release-blobstore-user.username)) secret_access_key: ((postgres-release-blobstore-user.password)) + - task: bump-libicu-package + file: postgres-release/ci/tasks/bump-libicu-package/task.yml + image: bosh-integration-image + params: + PRIVATE_YML: | + blobstore: + options: + access_key_id: ((postgres-release-blobstore-user.username)) + secret_access_key: ((postgres-release-blobstore-user.password)) - task: bump-postgres-15-package file: postgres-release/ci/tasks/bump-postgres-packages/task.yml image: bosh-integration-image @@ -321,6 +335,16 @@ resources: regex: 'href="v(?P18\.[0-9.]+)/"' uri: "https://ftp.postgresql.org/pub/source/v{version}/postgresql-{version}.tar.gz" + - name: icu-src + type: github-release + source: + owner: unicode-org + repository: icu + tag_filter: release-([0-9]+-[0-9]+) + access_token: ((github_public_repo_token)) + globs: + - icu4c-*-src.tgz + - name: yq-release type: github-release source: diff --git a/ci/tasks/bump-libicu-package/task.sh b/ci/tasks/bump-libicu-package/task.sh new file mode 100755 index 00000000..46f90e23 --- /dev/null +++ b/ci/tasks/bump-libicu-package/task.sh @@ -0,0 +1,44 @@ +#!/usr/bin/env bash +NEED_COMMIT=false + +set -euo pipefail + +echo "${PRIVATE_YML}" > postgres-release/config/private.yml + +get_old_blob_path() { + local blobs_file="config/blobs.yml" + if grep -q "^icu/" "$blobs_file"; then + grep "^icu/" "$blobs_file" | head -1 | cut -f1 -d: + else + echo "" + fi +} + +pushd postgres-release + CURRENT_BLOBS=$(bosh blobs) + BLOB_PATH=$(echo ../icu-src/icu4c-*-src.tgz) + FILENAME=$(basename "${BLOB_PATH}") + OLD_BLOB_PATH=$(get_old_blob_path) + + if ! echo "${CURRENT_BLOBS}" | grep -q "${FILENAME}"; then + NEED_COMMIT=true + echo "adding ${FILENAME}" + bosh add-blob --sha2 "${BLOB_PATH}" "icu/${FILENAME}" + if [[ -n "${OLD_BLOB_PATH}" ]]; then + bosh remove-blob "${OLD_BLOB_PATH}" + fi + bosh upload-blobs + fi + + if [ "${NEED_COMMIT}" = "true" ]; then + echo "-----> $(date): Creating git commit" + git config user.name "$GIT_USER_NAME" + git config user.email "$GIT_USER_EMAIL" + git add . + + git --no-pager diff --cached + if [[ "$( git status --porcelain )" != "" ]]; then + git commit -am "Bump packages" + fi + fi +popd diff --git a/ci/tasks/bump-libicu-package/task.yml b/ci/tasks/bump-libicu-package/task.yml new file mode 100644 index 00000000..9df4bbab --- /dev/null +++ b/ci/tasks/bump-libicu-package/task.yml @@ -0,0 +1,17 @@ +--- +platform: linux + +inputs: +- name: postgres-release +- name: icu-src + +outputs: +- name: postgres-release + +run: + path: postgres-release/ci/tasks/bump-libicu-package/task.sh + +params: + PRIVATE_YML: + GIT_USER_NAME: CI Bot + GIT_USER_EMAIL: bots@cloudfoundry.org diff --git a/packages/postgres-15/packaging b/packages/postgres-15/packaging index 33a429e4..2d280dd5 100644 --- a/packages/postgres-15/packaging +++ b/packages/postgres-15/packaging @@ -17,10 +17,11 @@ function extract_archive() { function compile() { pushd postgresql-* > /dev/null - if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then + ARCH=$(uname -m) + if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl else - CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl + CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl fi pushd src/bin/pg_config > /dev/null diff --git a/packages/postgres-16/packaging b/packages/postgres-16/packaging index 4d1f88ae..f36bafe6 100644 --- a/packages/postgres-16/packaging +++ b/packages/postgres-16/packaging @@ -1,25 +1,28 @@ -#!/bin/bash -exu +#!/bin/bash + +set -euo pipefail function main() { extract_archive compile - } function extract_archive() { - echo "Extracting archive..." tar xzf postgres/postgresql-* - } function compile() { - pushd postgresql-* > /dev/null - if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then - ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl + ARCH=$(uname -m) + if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then + ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \ + ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \ + ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl else - ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl + ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \ + ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \ + CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl fi pushd src/bin/pg_config > /dev/null diff --git a/packages/postgres-16/spec b/packages/postgres-16/spec index 4bc9b485..bf6797fd 100644 --- a/packages/postgres-16/spec +++ b/packages/postgres-16/spec @@ -1,4 +1,6 @@ --- name: postgres-16 +dependencies: + - postgres-libicu files: - postgres/postgresql-16.*.tar.gz diff --git a/packages/postgres-17/packaging b/packages/postgres-17/packaging index 4d1f88ae..f36bafe6 100644 --- a/packages/postgres-17/packaging +++ b/packages/postgres-17/packaging @@ -1,25 +1,28 @@ -#!/bin/bash -exu +#!/bin/bash + +set -euo pipefail function main() { extract_archive compile - } function extract_archive() { - echo "Extracting archive..." tar xzf postgres/postgresql-* - } function compile() { - pushd postgresql-* > /dev/null - if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then - ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl + ARCH=$(uname -m) + if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then + ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \ + ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \ + ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl else - ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl + ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \ + ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \ + CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl fi pushd src/bin/pg_config > /dev/null diff --git a/packages/postgres-17/spec b/packages/postgres-17/spec index 3741cb65..a85ddf5e 100644 --- a/packages/postgres-17/spec +++ b/packages/postgres-17/spec @@ -1,4 +1,6 @@ --- name: postgres-17 +dependencies: + - postgres-libicu files: - postgres/postgresql-17.*.tar.gz diff --git a/packages/postgres-18/packaging b/packages/postgres-18/packaging index dc6af30e..b5acbd43 100755 --- a/packages/postgres-18/packaging +++ b/packages/postgres-18/packaging @@ -1,25 +1,28 @@ -#!/bin/bash -exu +#!/bin/bash + +set -euo pipefail function main() { extract_archive compile - } function extract_archive() { - echo "Extracting archive..." tar xzf postgres/postgresql-* - } function compile() { - pushd postgresql-* > /dev/null - if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then - ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl + ARCH=$(uname -m) + if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then + ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \ + ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \ + ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl else - ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl + ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \ + ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \ + CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl fi pushd src/bin/pg_config > /dev/null diff --git a/packages/postgres-18/spec b/packages/postgres-18/spec index f8a10685..5ff2cbd3 100644 --- a/packages/postgres-18/spec +++ b/packages/postgres-18/spec @@ -1,5 +1,7 @@ --- name: postgres-18 +dependencies: + - postgres-libicu files: - postgres/postgresql-18.*.tar.gz diff --git a/packages/postgres-libicu/packaging b/packages/postgres-libicu/packaging new file mode 100644 index 00000000..46f8f8bb --- /dev/null +++ b/packages/postgres-libicu/packaging @@ -0,0 +1,12 @@ +#!/bin/bash + +set -euo pipefail + +echo "Extracting ICU4C source..." +tar xzf icu/icu4c-*.tgz + +pushd icu/source > /dev/null + ./configure --prefix="${BOSH_INSTALL_TARGET}" --enable-static --disable-shared --disable-samples --disable-tests + make -j$(nproc) + make install +popd > /dev/null diff --git a/packages/postgres-libicu/spec b/packages/postgres-libicu/spec new file mode 100644 index 00000000..0c35db82 --- /dev/null +++ b/packages/postgres-libicu/spec @@ -0,0 +1,4 @@ +--- +name: postgres-libicu +files: + - icu/icu4c-*.tgz From 9bc3214a075fcc14b5637237223067521651ba1c Mon Sep 17 00:00:00 2001 From: Pascal Zimmermann Date: Wed, 23 Sep 2026 12:00:46 +0200 Subject: [PATCH 2/2] fix: Adjust the pipeline config and add SHA validation support --- ci/pipeline.yml | 7 ++++--- ci/tasks/bump-libicu-package/task.sh | 13 ++++++++++++- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/ci/pipeline.yml b/ci/pipeline.yml index da549a56..918c6a9e 100644 --- a/ci/pipeline.yml +++ b/ci/pipeline.yml @@ -49,7 +49,8 @@ jobs: trigger: true params: globs: - - icu4c-*-src.tgz + - icu4c-*-sources.tgz + - SHASUM512.txt - get: yq-release trigger: true params: @@ -340,10 +341,10 @@ resources: source: owner: unicode-org repository: icu - tag_filter: release-([0-9]+-[0-9]+) + tag_filter: release-([0-9]+\.[0-9]+) access_token: ((github_public_repo_token)) globs: - - icu4c-*-src.tgz + - icu4c-*-sources.tgz - name: yq-release type: github-release diff --git a/ci/tasks/bump-libicu-package/task.sh b/ci/tasks/bump-libicu-package/task.sh index 46f90e23..e9c23dca 100755 --- a/ci/tasks/bump-libicu-package/task.sh +++ b/ci/tasks/bump-libicu-package/task.sh @@ -16,8 +16,19 @@ get_old_blob_path() { pushd postgres-release CURRENT_BLOBS=$(bosh blobs) - BLOB_PATH=$(echo ../icu-src/icu4c-*-src.tgz) + BLOB_PATH=$(echo ../icu-src/icu4c-*-sources.tgz) FILENAME=$(basename "${BLOB_PATH}") + + expected_sha512=$(awk -v fname="${FILENAME}" '$0 ~ ("\\*" fname "$") {print $1}' ../icu-src/SHASUM512.txt) + actual_sha512=$(sha512sum "${BLOB_PATH}" | awk '{print $1}') + if [ "$expected_sha512" != "$actual_sha512" ]; then + echo "SHA-512 verification failed for ${FILENAME}" + echo "Expected: $expected_sha512" + echo "Actual: $actual_sha512" + exit 1 + fi + echo "SHA-512 verified: $actual_sha512" + OLD_BLOB_PATH=$(get_old_blob_path) if ! echo "${CURRENT_BLOBS}" | grep -q "${FILENAME}"; then