feat: Vendor libicu as a BOSH package to fix postgres-16/17/18 on Ubuntu Resolute

ci/pipeline.yml

@@ -45,6 +45,12 @@ jobs:
           trigger: true
         - get: postgres-18-src
           trigger: true
+        - get: icu-src
+          trigger: true
+          params:
+            globs:
+              - icu4c-*-sources.tgz
+              - SHASUM512.txt
         - get: yq-release
           trigger: true
           params:
@@ -61,6 +67,15 @@ jobs:
             options:
               access_key_id: ((postgres-release-blobstore-user.username))
               secret_access_key: ((postgres-release-blobstore-user.password))
+    - task: bump-libicu-package
+      file: postgres-release/ci/tasks/bump-libicu-package/task.yml
+      image: bosh-integration-image
+      params:
+        PRIVATE_YML: |
+          blobstore:
+            options:
+              access_key_id: ((postgres-release-blobstore-user.username))
+              secret_access_key: ((postgres-release-blobstore-user.password))
     - task: bump-postgres-15-package
       file: postgres-release/ci/tasks/bump-postgres-packages/task.yml
       image: bosh-integration-image
@@ -321,6 +336,16 @@ resources:
       regex: 'href="v(?P<version>18\.[0-9.]+)/"'
       uri: "https://ftp.postgresql.org/pub/source/v{version}/postgresql-{version}.tar.gz"
 
+  - name: icu-src
+    type: github-release
+    source:
+      owner: unicode-org
+      repository: icu
+      tag_filter: release-([0-9]+\.[0-9]+)
+      access_token: ((github_public_repo_token))
+      globs:
+        - icu4c-*-sources.tgz
+
   - name: yq-release
     type: github-release
     source:

ci/tasks/bump-libicu-package/task.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+NEED_COMMIT=false
+
+set -euo pipefail
+
+echo "${PRIVATE_YML}" > postgres-release/config/private.yml
+
+get_old_blob_path() {
+  local blobs_file="config/blobs.yml"
+  if grep -q "^icu/" "$blobs_file"; then
+    grep "^icu/" "$blobs_file" | head -1 | cut -f1 -d:
+  else
+    echo ""
+  fi
+}
+
+pushd postgres-release
+  CURRENT_BLOBS=$(bosh blobs)
+  BLOB_PATH=$(echo ../icu-src/icu4c-*-sources.tgz)
+  FILENAME=$(basename "${BLOB_PATH}")
+
+  expected_sha512=$(awk -v fname="${FILENAME}" '$0 ~ ("\\*" fname "$") {print $1}' ../icu-src/SHASUM512.txt)
+  actual_sha512=$(sha512sum "${BLOB_PATH}" | awk '{print $1}')
+  if [ "$expected_sha512" != "$actual_sha512" ]; then
+    echo "SHA-512 verification failed for ${FILENAME}"
+    echo "Expected: $expected_sha512"
+    echo "Actual:   $actual_sha512"
+    exit 1
+  fi
+  echo "SHA-512 verified: $actual_sha512"
+
+  OLD_BLOB_PATH=$(get_old_blob_path)
+
+  if ! echo "${CURRENT_BLOBS}" | grep -q "${FILENAME}"; then
+    NEED_COMMIT=true
+    echo "adding ${FILENAME}"
+    bosh add-blob --sha2 "${BLOB_PATH}" "icu/${FILENAME}"
+    if [[ -n "${OLD_BLOB_PATH}" ]]; then
+      bosh remove-blob "${OLD_BLOB_PATH}"
+    fi
+    bosh upload-blobs
+  fi
+
+  if [ "${NEED_COMMIT}" = "true" ]; then
+    echo "-----> $(date): Creating git commit"
+    git config user.name "$GIT_USER_NAME"
+    git config user.email "$GIT_USER_EMAIL"
+    git add .
+
+    git --no-pager diff --cached
+    if [[ "$( git status --porcelain )" != "" ]]; then
+      git commit -am "Bump packages"
+    fi
+  fi
+popd

ci/tasks/bump-libicu-package/task.yml

@@ -0,0 +1,17 @@
+---
+platform: linux
+
+inputs:
+- name: postgres-release
+- name: icu-src
+
+outputs:
+- name: postgres-release
+
+run:
+  path: postgres-release/ci/tasks/bump-libicu-package/task.sh
+
+params:
+  PRIVATE_YML:
+  GIT_USER_NAME: CI Bot
+  GIT_USER_EMAIL: bots@cloudfoundry.org

packages/postgres-15/packaging

@@ -17,10 +17,11 @@ function extract_archive() {
 function compile() {
 
   pushd postgresql-* > /dev/null
-    if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then
+    ARCH=$(uname -m)
+    if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then
       ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     else
-      CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}"  --with-openssl
+      CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     fi
 
     pushd src/bin/pg_config > /dev/null

packages/postgres-16/packaging

@@ -1,25 +1,28 @@
-#!/bin/bash -exu
+#!/bin/bash
+
+set -euo pipefail
 
 function main() {
   extract_archive
   compile
-
 }
 
 function extract_archive() {
-
   echo "Extracting archive..."
   tar xzf postgres/postgresql-*
-
 }
 
 function compile() {
-
   pushd postgresql-* > /dev/null
-    if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+    ARCH=$(uname -m)
+    if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \
+        ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     else
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \
+        CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     fi
 
     pushd src/bin/pg_config > /dev/null

packages/postgres-16/spec

@@ -1,4 +1,6 @@
 ---
 name: postgres-16
+dependencies:
+  - postgres-libicu
 files:
   - postgres/postgresql-16.*.tar.gz

packages/postgres-17/packaging

@@ -1,25 +1,28 @@
-#!/bin/bash -exu
+#!/bin/bash
+
+set -euo pipefail
 
 function main() {
   extract_archive
   compile
-
 }
 
 function extract_archive() {
-
   echo "Extracting archive..."
   tar xzf postgres/postgresql-*
-
 }
 
 function compile() {
-
   pushd postgresql-* > /dev/null
-    if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+    ARCH=$(uname -m)
+    if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \
+        ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     else
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \
+        CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     fi
 
     pushd src/bin/pg_config > /dev/null

packages/postgres-17/spec

@@ -1,4 +1,6 @@
 ---
 name: postgres-17
+dependencies:
+  - postgres-libicu
 files:
   - postgres/postgresql-17.*.tar.gz

packages/postgres-18/packaging

@@ -1,25 +1,28 @@
-#!/bin/bash -exu
+#!/bin/bash
+
+set -euo pipefail
 
 function main() {
   extract_archive
   compile
-
 }
 
 function extract_archive() {
-
   echo "Extracting archive..."
   tar xzf postgres/postgresql-*
-
 }
 
 function compile() {
-
   pushd postgresql-* > /dev/null
-    if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+    ARCH=$(uname -m)
+    if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \
+        ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     else
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH:-/var/vcap/packages}/postgres-libicu/lib -licui18n -licuuc -licudata -lstdc++" \
+        CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     fi
 
     pushd src/bin/pg_config > /dev/null

packages/postgres-18/spec

@@ -1,5 +1,7 @@
 ---
 name: postgres-18
+dependencies:
+  - postgres-libicu
 files:
   - postgres/postgresql-18.*.tar.gz
 

packages/postgres-libicu/packaging

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -euo pipefail
+
+echo "Extracting ICU4C source..."
+tar xzf icu/icu4c-*.tgz
+
+pushd icu/source > /dev/null
+  ./configure --prefix="${BOSH_INSTALL_TARGET}" --enable-static --disable-shared --disable-samples --disable-tests
+  make -j$(nproc)
+  make install
+popd > /dev/null

packages/postgres-libicu/spec

@@ -0,0 +1,4 @@
+---
+name: postgres-libicu
+files:
+  - icu/icu4c-*.tgz