fix: Vendor libicu as a BOSH package to fix postgres-16/17/18 on Ubuntu Resolute

libicu-dev was dropped from the Ubuntu Resolute stemcell, breaking
postgres-16/17/18 compilation which requires ICU at build time.

- Add postgres-libicu BOSH package that compiles ICU4C from a vendored
  source tarball (static-only, --disable-shared) so postgres links ICU
  statically with no runtime .so dependency
- Update postgres-16, -17, -18 to declare postgres-libicu as a
  dependency and use ${BOSH_PACKAGES_PATH}/postgres-libicu in configure
  flags instead of hardcoded system paths
- Drop ARM64/aarch64 support from all packaging scripts and CI tasks
- Fix packaging scripts: replace ignored #!/bin/bash -exu shebang with
  #!/bin/bash + set -euo pipefail per BOSH conventions
- Add bump-libicu-package CI task and icu-src Concourse resource so
  ICU blob bumps are automated in the bump-packages pipeline job

Closes #98

Author: ZPascal

ci/pipeline.yml

@@ -45,6 +45,11 @@ jobs:
           trigger: true
         - get: postgres-18-src
           trigger: true
+        - get: icu-src
+          trigger: true
+          params:
+            globs:
+              - icu4c-*-src.tgz
         - get: yq-release
           trigger: true
           params:
@@ -61,6 +66,15 @@ jobs:
             options:
               access_key_id: ((postgres-release-blobstore-user.username))
               secret_access_key: ((postgres-release-blobstore-user.password))
+    - task: bump-libicu-package
+      file: postgres-release/ci/tasks/bump-libicu-package/task.yml
+      image: bosh-integration-image
+      params:
+        PRIVATE_YML: |
+          blobstore:
+            options:
+              access_key_id: ((postgres-release-blobstore-user.username))
+              secret_access_key: ((postgres-release-blobstore-user.password))
     - task: bump-postgres-15-package
       file: postgres-release/ci/tasks/bump-postgres-packages/task.yml
       image: bosh-integration-image
@@ -321,6 +335,16 @@ resources:
       regex: 'href="v(?P<version>18\.[0-9.]+)/"'
       uri: "https://ftp.postgresql.org/pub/source/v{version}/postgresql-{version}.tar.gz"
 
+  - name: icu-src
+    type: github-release
+    source:
+      owner: unicode-org
+      repository: icu
+      tag_filter: release-([0-9]+-[0-9]+)
+      access_token: ((github_public_repo_token))
+      globs:
+        - icu4c-*-src.tgz
+
   - name: yq-release
     type: github-release
     source:

ci/tasks/bump-libicu-package/task.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+NEED_COMMIT=false
+
+set -euo pipefail
+
+echo "${PRIVATE_YML}" > postgres-release/config/private.yml
+
+get_old_blob_path() {
+  local blobs_file="config/blobs.yml"
+  if grep -q "^icu/" "$blobs_file"; then
+    grep "^icu/" "$blobs_file" | head -1 | cut -f1 -d:
+  else
+    echo ""
+  fi
+}
+
+pushd postgres-release
+  CURRENT_BLOBS=$(bosh blobs)
+  BLOB_PATH=$(echo ../icu-src/icu4c-*-src.tgz)
+  FILENAME=$(basename "${BLOB_PATH}")
+  OLD_BLOB_PATH=$(get_old_blob_path)
+
+  if ! echo "${CURRENT_BLOBS}" | grep -q "${FILENAME}"; then
+    NEED_COMMIT=true
+    echo "adding ${FILENAME}"
+    bosh add-blob --sha2 "${BLOB_PATH}" "icu/${FILENAME}"
+    if [[ -n "${OLD_BLOB_PATH}" ]]; then
+      bosh remove-blob "${OLD_BLOB_PATH}"
+    fi
+    bosh upload-blobs
+  fi
+
+  if [ "${NEED_COMMIT}" = "true" ]; then
+    echo "-----> $(date): Creating git commit"
+    git config user.name "$GIT_USER_NAME"
+    git config user.email "$GIT_USER_EMAIL"
+    git add .
+
+    git --no-pager diff --cached
+    if [[ "$( git status --porcelain )" != "" ]]; then
+      git commit -am "Bump packages"
+    fi
+  fi
+popd

ci/tasks/bump-libicu-package/task.yml

@@ -0,0 +1,17 @@
+---
+platform: linux
+
+inputs:
+- name: postgres-release
+- name: icu-src
+
+outputs:
+- name: postgres-release
+
+run:
+  path: postgres-release/ci/tasks/bump-libicu-package/task.sh
+
+params:
+  PRIVATE_YML:
+  GIT_USER_NAME: CI Bot
+  GIT_USER_EMAIL: bots@cloudfoundry.org

ci/tasks/bump-yq-packages/task.sh

@@ -10,30 +10,47 @@ pushd postgres-release
   CURRENT_VERSION=$(cat ../yq-release/version)
 
   sha256_col=$(grep -n "^SHA-256$" ../yq-release/checksums_hashes_order | cut -f1 -d:)
-  expected_sha256=$(awk -v col="$((sha256_col + 1))" '/^yq_linux_amd64[[:space:]]/{print $col}' ../yq-release/checksums)
-  actual_sha256=$(sha256sum ../yq-release/yq_linux_amd64 | awk '{print $1}')
-  if [ "$expected_sha256" != "$actual_sha256" ]; then
-    echo "SHA-256 verification failed for yq_linux_amd64"
-    echo "Expected: $expected_sha256"
-    echo "Actual:   $actual_sha256"
-    exit 1
-  fi
-  echo "SHA-256 verified: $actual_sha256"
-  cp ../yq-release/yq_linux_amd64 ../yq-bin/yq && chmod +x ../yq-bin/yq
 
-  mv ../yq-release/yq_linux_amd64 ../yq-release/postgres-yq-${CURRENT_VERSION}
-  BLOB_PATH=$(ls ../yq-release/postgres-yq-${CURRENT_VERSION})
-  FILENAME=$( basename ${BLOB_PATH} )
-  OLD_BLOB_PATH=$(cat config/blobs.yml  | grep "postgres-yq" | cut -f1 -d:)
-  if ! echo "${CURRENT_BLOBS}" | grep "${FILENAME}" ; then
+  for ARCH in amd64; do
+    src_file="yq_linux_${ARCH}"
+    blob_name="postgres-yq-${ARCH}-${CURRENT_VERSION}"
+
+    expected_sha256=$(awk -v col="$((sha256_col + 1))" "/^${src_file}[[:space:]]/{print \$col}" ../yq-release/checksums)
+    actual_sha256=$(sha256sum "../yq-release/${src_file}" | awk '{print $1}')
+    if [ "$expected_sha256" != "$actual_sha256" ]; then
+      echo "SHA-256 verification failed for ${src_file}"
+      echo "Expected: $expected_sha256"
+      echo "Actual:   $actual_sha256"
+      exit 1
+    fi
+    echo "SHA-256 verified for ${src_file}: $actual_sha256"
+
+    cp "../yq-release/${src_file}" "../yq-release/${blob_name}"
+
+    if ! echo "${CURRENT_BLOBS}" | grep -q "${blob_name}"; then
+      NEED_COMMIT=true
+      echo "adding ${blob_name}"
+      bosh add-blob --sha2 "../yq-release/${blob_name}" "yq/${blob_name}"
+    fi
+  done
+
+  # Remove any old yq blobs that are not the current amd64 blob
+  while IFS= read -r old_blob; do
+    echo "removing old blob: ${old_blob}"
+    bosh remove-blob "${old_blob}"
     NEED_COMMIT=true
-    echo "adding ${FILENAME}"
-    bosh add-blob --sha2 "${BLOB_PATH}" "yq/${FILENAME}"
-    bosh remove-blob ${OLD_BLOB_PATH}
+  done < <(grep "^yq/" config/blobs.yml \
+    | grep -vF "postgres-yq-amd64-${CURRENT_VERSION}" \
+    | cut -f1 -d:)
+
+  if [ "${NEED_COMMIT}" = "true" ]; then
     bosh upload-blobs
   fi
 
-  if ${NEED_COMMIT}; then
+  # Always populate yq-bin from amd64 binary (CI workers are x86_64)
+  cp ../yq-release/yq_linux_amd64 ../yq-bin/yq && chmod +x ../yq-bin/yq
+
+  if [ "${NEED_COMMIT}" = "true" ]; then
     echo "-----> $(date): Creating git commit"
     git config user.name "$GIT_USER_NAME"
     git config user.email "$GIT_USER_EMAIL"
@@ -44,4 +61,4 @@ pushd postgres-release
       git commit -am "Bump packages"
     fi
   fi
-popd
+popd

packages/postgres-15/packaging

@@ -17,10 +17,11 @@ function extract_archive() {
 function compile() {
 
   pushd postgresql-* > /dev/null
-    if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then
+    ARCH=$(uname -m)
+    if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then
       ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     else
-      CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}"  --with-openssl
+      CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     fi
 
     pushd src/bin/pg_config > /dev/null

packages/postgres-16/packaging

@@ -1,25 +1,28 @@
-#!/bin/bash -exu
+#!/bin/bash
+
+set -euo pipefail
 
 function main() {
   extract_archive
   compile
-
 }
 
 function extract_archive() {
-
   echo "Extracting archive..."
   tar xzf postgres/postgresql-*
-
 }
 
 function compile() {
-
   pushd postgresql-* > /dev/null
-    if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+    ARCH=$(uname -m)
+    if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH}/postgres-libicu/lib -licui18n -licuuc -licudata" \
+        ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     else
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH}/postgres-libicu/lib -licui18n -licuuc -licudata" \
+        CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     fi
 
     pushd src/bin/pg_config > /dev/null

packages/postgres-16/spec

@@ -1,4 +1,6 @@
 ---
 name: postgres-16
+dependencies:
+  - postgres-libicu
 files:
   - postgres/postgresql-16.*.tar.gz

packages/postgres-17/packaging

@@ -1,25 +1,28 @@
-#!/bin/bash -exu
+#!/bin/bash
+
+set -euo pipefail
 
 function main() {
   extract_archive
   compile
-
 }
 
 function extract_archive() {
-
   echo "Extracting archive..."
   tar xzf postgres/postgresql-*
-
 }
 
 function compile() {
-
   pushd postgresql-* > /dev/null
-    if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+    ARCH=$(uname -m)
+    if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH}/postgres-libicu/lib -licui18n -licuuc -licudata" \
+        ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     else
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH}/postgres-libicu/lib -licui18n -licuuc -licudata" \
+        CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     fi
 
     pushd src/bin/pg_config > /dev/null

packages/postgres-17/spec

@@ -1,4 +1,6 @@
 ---
 name: postgres-17
+dependencies:
+  - postgres-libicu
 files:
   - postgres/postgresql-17.*.tar.gz

packages/postgres-18/packaging

@@ -1,25 +1,28 @@
-#!/bin/bash -exu
+#!/bin/bash
+
+set -euo pipefail
 
 function main() {
   extract_archive
   compile
-
 }
 
 function extract_archive() {
-
   echo "Extracting archive..."
   tar xzf postgres/postgresql-*
-
 }
 
 function compile() {
-
   pushd postgresql-* > /dev/null
-    if [[ "$(uname -a)" =~ "x86_64" || "$(uname -a)" =~ "ppc64le" ]] ; then
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+    ARCH=$(uname -m)
+    if [[ "$ARCH" == "x86_64" || "$ARCH" == "ppc64le" ]]; then
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH}/postgres-libicu/lib -licui18n -licuuc -licudata" \
+        ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     else
-      ICU_CFLAGS=" " ICU_LIBS="-L/usr/lib/x86_64-linux-gnu -licui18n -licuuc -licudata" CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
+      ICU_CFLAGS="-I${BOSH_PACKAGES_PATH}/postgres-libicu/include" \
+      ICU_LIBS="-L${BOSH_PACKAGES_PATH}/postgres-libicu/lib -licui18n -licuuc -licudata" \
+        CFLAGS=-m32 LDFLAGS=-m32 CXXFLAGS=-m32 ./configure --prefix="${BOSH_INSTALL_TARGET}" --with-openssl
     fi
 
     pushd src/bin/pg_config > /dev/null