remember-stack/Dockerfile.postgres at main · writeitai/remember-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
FROM postgres:19beta3-trixie@sha256:a48b19841e04b35b72a25e9a94314ac80546d32b5e2e3cd9279390cbd8a99572 AS pg_textsearch_builder

ARG PG_TEXTSEARCH_REVISION=578ff529894992fb9e67cae4c69424e65c84868e
ARG PG_TEXTSEARCH_SOURCE_SHA256=8632f91231251dc3e19395ef6a0d4d158d5f5920ba420691471771418e2a7cc7
ARG PG_TEXTSEARCH_PATCH_SHA256=a8c97f39714ab0193c82fcda3709d3e4df54bcc7f2804fde8f970710484dbdc6
ARG PG_TEXTSEARCH_LICENSE_SHA256=d33de21a123ce25b41722a5d10750984cb9c844c4d9b01add9e1b31f3ff452e5
ARG PG_TEXTSEARCH_NOTICE_SHA256=ff70cf4336c579957368a71c6b6b66ee8954011deef2b3d2c7a11f931080851d

# The prerelease base can carry an older CA bundle than the PGDG archive's
# current CloudFront chain. Debian remains usable when that source warns, so
# refresh trust first and then require a clean archive update.
RUN set -eux; \
    for pgdg_source_file in \
      /etc/apt/sources.list.d/pgdg.list \
      /etc/apt/sources.list.d/pgdg.sources; do \
      if [ -f "${pgdg_source_file}" ]; then \
        sed -i \
          -e 's|http://apt.postgresql.org/pub/repos/apt|https://apt-archive.postgresql.org/pub/repos/apt|g' \
          -e 's|https://apt.postgresql.org/pub/repos/apt|https://apt-archive.postgresql.org/pub/repos/apt|g' \
          -e 's|trixie-pgdg|trixie-pgdg-archive|g' \
          "${pgdg_source_file}"; \
      fi; \
    done; \
    grep -R 'apt-archive.postgresql.org/pub/repos/apt' \
      /etc/apt/sources.list.d/pgdg.*; \
    apt-get update; \
    apt-get install -y --reinstall --no-install-recommends ca-certificates; \
    update-ca-certificates; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
      build-essential curl patch postgresql-server-dev-19; \
    curl --fail --location --show-error \
      --output /tmp/pg_textsearch.tar.gz \
      "https://github.com/timescale/pg_textsearch/archive/${PG_TEXTSEARCH_REVISION}.tar.gz"; \
    echo "${PG_TEXTSEARCH_SOURCE_SHA256}  /tmp/pg_textsearch.tar.gz" | sha256sum --check --strict; \
    mkdir -p /src/pg_textsearch; \
    tar --extract --gzip --file /tmp/pg_textsearch.tar.gz \
      --directory /src/pg_textsearch --strip-components=1; \
    test -s /src/pg_textsearch/LICENSE; \
    test -s /src/pg_textsearch/NOTICE; \
    echo "${PG_TEXTSEARCH_LICENSE_SHA256}  /src/pg_textsearch/LICENSE" | sha256sum --check --strict; \
    echo "${PG_TEXTSEARCH_NOTICE_SHA256}  /src/pg_textsearch/NOTICE" | sha256sum --check --strict; \
    rm -rf /var/lib/apt/lists/*

COPY docker/pg_textsearch-pg19.patch /tmp/pg_textsearch-pg19.patch

RUN set -eux; \
    echo "${PG_TEXTSEARCH_PATCH_SHA256}  /tmp/pg_textsearch-pg19.patch" | sha256sum --check --strict; \
    cd /src/pg_textsearch; \
    patch --batch --forward --strip=1 < /tmp/pg_textsearch-pg19.patch; \
    make -j"$(nproc)"; \
    make install; \
    { \
      sha256sum /usr/lib/postgresql/19/lib/pg_textsearch.so; \
      find /usr/share/postgresql/19/extension -maxdepth 1 \
        -type f -name 'pg_textsearch*' -print0 | sort -z | xargs -0 sha256sum; \
    } > /tmp/pg_textsearch-artifacts.sha256

FROM postgres:19beta3-trixie@sha256:a48b19841e04b35b72a25e9a94314ac80546d32b5e2e3cd9279390cbd8a99572

# pg_textsearch uses the PostgreSQL License at the source revision pinned above. The local
# compatibility delta follows upstream PR 460 while PostgreSQL 19 support is
# unmerged: https://github.com/timescale/pg_textsearch/pull/460
COPY --from=pg_textsearch_builder /usr/lib/postgresql/19/lib/pg_textsearch.so /usr/lib/postgresql/19/lib/pg_textsearch.so
COPY --from=pg_textsearch_builder /usr/share/postgresql/19/extension/pg_textsearch* /usr/share/postgresql/19/extension/
COPY --from=pg_textsearch_builder /src/pg_textsearch/LICENSE /usr/share/doc/pg_textsearch/LICENSE
COPY --from=pg_textsearch_builder /src/pg_textsearch/NOTICE /usr/share/doc/pg_textsearch/NOTICE
COPY --from=pg_textsearch_builder /tmp/pg_textsearch-artifacts.sha256 /usr/share/doc/pg_textsearch/artifacts.sha256

# Refresh the prerelease base's trust bundle before the archive update; package
# signatures still provide apt's normal authenticity boundary.
RUN set -eux; \
    for pgdg_source_file in \
      /etc/apt/sources.list.d/pgdg.list \
      /etc/apt/sources.list.d/pgdg.sources; do \
      if [ -f "${pgdg_source_file}" ]; then \
        sed -i \
          -e 's|http://apt.postgresql.org/pub/repos/apt|https://apt-archive.postgresql.org/pub/repos/apt|g' \
          -e 's|https://apt.postgresql.org/pub/repos/apt|https://apt-archive.postgresql.org/pub/repos/apt|g' \
          -e 's|trixie-pgdg|trixie-pgdg-archive|g' \
          "${pgdg_source_file}"; \
      fi; \
    done; \
    grep -R 'apt-archive.postgresql.org/pub/repos/apt' \
      /etc/apt/sources.list.d/pgdg.*; \
    apt-get update; \
    apt-get install -y --reinstall --no-install-recommends ca-certificates; \
    update-ca-certificates; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
      postgresql-19-partman=5.5.0-1.pgdg13+1 \
      postgresql-19-pgvector=0.8.6-1.pgdg13+1; \
    rm -rf /var/lib/apt/lists/*