mixdog 0.7.18 → 0.8.0

package/scripts/build-runtime-linux.sh

@@ -1,348 +0,0 @@
-#!/usr/bin/env bash
-# build-runtime-linux.sh — Build self-contained PostgreSQL 16 + pgvector runtime on Linux.
-# Designed to run inside ubuntu:20.04 container (glibc 2.31 floor) so produced
-# binaries run on every distro from Ubuntu 20.04 / Debian 11 / RHEL 8 forward.
-# Targets the runner's native arch (x64 or arm64).
-# Produces: dist/mixdog-runtime-linux-{arch}-pg{pgver}-pgvector{vecver}.tar.gz
-# Bundles foreign dyn deps via ldd transitive closure (binaries + ALL extension
-# modules under lib/postgresql/) + patchelf rpath rewrite. Final smoke: initdb,
-# pg_ctl start, CREATE EXTENSION vector, distance query, stop.
-
-set -euo pipefail
-
-PG_VERSION="16.4"
-PGVECTOR_VERSION="0.8.2"
-TARGET_OS="${TARGET_OS:-linux}"
-TARGET_ARCH="${TARGET_ARCH:-x64}"
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-BUILD_DIR="$ROOT_DIR/build/runtime-linux-$TARGET_ARCH"
-STAGE_DIR="$BUILD_DIR/stage"
-DIST_DIR="$ROOT_DIR/dist"
-RUNTIME_DIR="$BUILD_DIR/runtime"
-
-OUTPUT_NAME="mixdog-runtime-${TARGET_OS}-${TARGET_ARCH}-pg${PG_VERSION}-pgvector${PGVECTOR_VERSION}.tar.gz"
-
-mkdir -p "$BUILD_DIR" "$STAGE_DIR" "$DIST_DIR" "$RUNTIME_DIR"/{bin,lib,share}
-
-# ---------------------------------------------------------------------------
-# Build deps. SUDO=sudo iff non-root; inside ubuntu:20.04 container we are root.
-# ---------------------------------------------------------------------------
-SUDO=""
-if [[ "$(id -u)" -ne 0 ]]; then SUDO="sudo"; fi
-# Export rather than inline-assign before $SUDO: when SUDO is empty (root),
-# `$SUDO DEBIAN_FRONTEND=... apt-get` would parse the env-assignment as a
-# command name and fail with "command not found".
-export DEBIAN_FRONTEND=noninteractive
-
-echo "==> Installing build dependencies"
-$SUDO apt-get update -qq
-$SUDO apt-get install -y --no-install-recommends \
-  build-essential libreadline-dev zlib1g-dev libssl-dev \
-  libicu-dev libxml2-dev libzstd-dev liblz4-dev \
-  pkg-config curl git ca-certificates patchelf file \
-  bsdmainutils
-
-if [[ -x "$STAGE_DIR/bin/postgres" ]]; then
-  echo "==> Cache hit: PG already built at $STAGE_DIR — skipping configure/make"
-  unset TARGET_OS TARGET_ARCH
-else
-  echo "==> Downloading PostgreSQL $PG_VERSION source"
-  cd "$BUILD_DIR"
-  if [[ ! -f "postgresql-${PG_VERSION}.tar.gz" ]]; then
-    curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VERSION}/postgresql-${PG_VERSION}.tar.gz" \
-      -o "postgresql-${PG_VERSION}.tar.gz"
-  fi
-  rm -rf "postgresql-${PG_VERSION}"
-  tar xzf "postgresql-${PG_VERSION}.tar.gz"
-
-  echo "==> Configuring PostgreSQL"
-  cd "postgresql-${PG_VERSION}"
-  ./configure \
-    --prefix="$STAGE_DIR" \
-    --without-perl \
-    --without-python \
-    --without-tcl \
-    --with-openssl \
-    --with-libxml \
-    --with-icu \
-    --with-readline \
-    --enable-thread-safety \
-    CFLAGS="-O2"
-
-  echo "==> Building PostgreSQL"
-  # PG Makefile.global has its own TARGET_ARCH var; env-passed TARGET_ARCH=x64
-  # would collide as a make-variable override and leak into compile commands.
-  unset TARGET_OS TARGET_ARCH
-  make -j"$(nproc)"
-  make install
-  make -C contrib/pgcrypto install
-fi
-
-PG_CONFIG="$STAGE_DIR/bin/pg_config"
-export PATH="$STAGE_DIR/bin:$PATH"
-
-echo "==> Stripping PostgreSQL binaries"
-find "$STAGE_DIR" -name '*.so*' -type f -exec strip --strip-debug {} \; 2>/dev/null || true
-find "$STAGE_DIR/bin" -type f -exec strip --strip-all {} \; 2>/dev/null || true
-
-if [[ -f "$STAGE_DIR/lib/postgresql/vector.so" ]]; then
-  echo "==> Cache hit: pgvector already installed — skipping clone/build"
-else
-  echo "==> Cloning pgvector $PGVECTOR_VERSION"
-  cd "$BUILD_DIR"
-  rm -rf pgvector
-  git clone --branch "v${PGVECTOR_VERSION}" --depth 1 \
-    https://github.com/pgvector/pgvector.git pgvector
-
-  echo "==> Building pgvector"
-  cd pgvector
-  make PG_CONFIG="$PG_CONFIG" -j"$(nproc)"
-  make PG_CONFIG="$PG_CONFIG" install
-fi
-
-echo "==> Assembling runtime layout"
-rm -rf "$RUNTIME_DIR"
-mkdir -p "$RUNTIME_DIR"/{bin,lib,share}
-cp -a "$STAGE_DIR/bin/postgres"   "$RUNTIME_DIR/bin/"
-cp -a "$STAGE_DIR/bin/pg_ctl"     "$RUNTIME_DIR/bin/"
-cp -a "$STAGE_DIR/bin/pg_dump"    "$RUNTIME_DIR/bin/"
-cp -a "$STAGE_DIR/bin/pg_restore" "$RUNTIME_DIR/bin/"
-cp -a "$STAGE_DIR/bin/psql"       "$RUNTIME_DIR/bin/"
-cp -a "$STAGE_DIR/bin/initdb"     "$RUNTIME_DIR/bin/"
-
-cp -a "$STAGE_DIR/lib"/.   "$RUNTIME_DIR/lib/"   2>/dev/null || true
-cp -a "$STAGE_DIR/share"/. "$RUNTIME_DIR/share/" 2>/dev/null || true
-
-# ---------------------------------------------------------------------------
-# Bundle foreign dyn deps — seed from binaries AND every extension module
-# under lib/postgresql/. dlopen-loaded modules (extensions) need the same
-# treatment as direct binary deps; missing them = runtime "ERROR: could not
-# load library" on CREATE EXTENSION.
-# ---------------------------------------------------------------------------
-echo "==> Bundling foreign dynamic dependencies (binaries + extensions)"
-
-KEEP_RE='^(linux-vdso|ld-linux|libc\.so|libm\.so|libpthread\.so|libdl\.so|librt\.so|libnsl\.so|libresolv\.so)'
-
-collect_deps() {
-  ldd "$1" 2>/dev/null \
-    | awk '/=>/{print $3}' \
-    | grep -E '^/' \
-    | while read -r path; do
-        bn=$(basename "$path")
-        if echo "$bn" | grep -Eq "$KEEP_RE"; then
-          continue  # system lib — keep on host
-        fi
-        echo "$path"
-      done \
-    | sort -u
-}
-
-declare -A SEEN
-declare -a QUEUE
-# Seeds: binaries + every .so under lib/postgresql/ (extensions, contrib mods).
-for seed in "$RUNTIME_DIR/bin/postgres" "$RUNTIME_DIR/bin/psql" \
-            "$RUNTIME_DIR/bin/pg_ctl"; do
-  [[ -f "$seed" ]] && QUEUE+=("$seed")
-done
-while IFS= read -r -d '' ext; do
-  QUEUE+=("$ext")
-done < <(find "$RUNTIME_DIR/lib/postgresql" -name '*.so' -print0 2>/dev/null)
-
-declare -a FOREIGN
-while [[ ${#QUEUE[@]} -gt 0 ]]; do
-  current="${QUEUE[0]}"
-  QUEUE=("${QUEUE[@]:1}")
-  while IFS= read -r dep; do
-    real="$(readlink -f "$dep")"
-    [[ -n "${SEEN[$real]+x}" ]] && continue
-    SEEN[$real]=1
-    FOREIGN+=("$dep")
-    QUEUE+=("$dep")
-  done < <(collect_deps "$current")
-done
-
-# Sanity: glibc / loader must never be bundled — if KEEP_RE regresses this catches it.
-if find "$RUNTIME_DIR/lib" -maxdepth 1 \
-     \( -name 'libc.so*' -o -name 'ld-linux*' -o -name 'libpthread.so*' \) \
-   | grep -q .; then
-  echo "FATAL: bundled glibc/loader detected — KEEP_RE filter did not work"
-  exit 1
-fi
-
-echo "  bundling ${#FOREIGN[@]} foreign libraries"
-for so_path in "${FOREIGN[@]}"; do
-  real_path="$(readlink -f "$so_path")"
-  real_name="$(basename "$real_path")"
-  if [[ ! -f "$RUNTIME_DIR/lib/$real_name" ]]; then
-    cp -L "$real_path" "$RUNTIME_DIR/lib/$real_name"
-    chmod u+w "$RUNTIME_DIR/lib/$real_name"
-    echo "    + $real_name"
-  fi
-  link="$so_path"
-  while [[ -L "$link" ]]; do
-    link_name="$(basename "$link")"
-    link_target="$(readlink "$link")"
-    if [[ ! -e "$RUNTIME_DIR/lib/$link_name" ]]; then
-      ln -sf "$(basename "$link_target")" "$RUNTIME_DIR/lib/$link_name"
-    fi
-    link="$(dirname "$link")/$link_target"
-  done
-done
-
-echo "==> Stripping static archives from lib/"
-find "$RUNTIME_DIR/lib" -name '*.a' -delete
-
-echo "==> Patching rpath"
-# Binaries: $ORIGIN/../lib (from bin/ to lib/)
-find "$RUNTIME_DIR/bin" -type f -executable | while read -r bin; do
-  if file "$bin" 2>/dev/null | grep -q ELF; then
-    patchelf --set-rpath '$ORIGIN/../lib' "$bin" 2>/dev/null || true
-  fi
-done
-# Top-level lib/*.so*: $ORIGIN
-find "$RUNTIME_DIR/lib" -maxdepth 1 -type f -name '*.so*' | while read -r so; do
-  if file "$so" 2>/dev/null | grep -q ELF; then
-    patchelf --set-rpath '$ORIGIN' "$so" 2>/dev/null || true
-  fi
-done
-# Every extension module under lib/postgresql/: $ORIGIN/.. (=lib/) and $ORIGIN/../.. (=runtime root)
-find "$RUNTIME_DIR/lib/postgresql" -name '*.so' 2>/dev/null | while read -r ext; do
-  if file "$ext" 2>/dev/null | grep -q ELF; then
-    patchelf --set-rpath '$ORIGIN/..:$ORIGIN/../..' "$ext" 2>/dev/null || true
-  fi
-done
-
-# ---------------------------------------------------------------------------
-# Self-contained smoke — full PG lifecycle, not just --version
-# ---------------------------------------------------------------------------
-echo "==> Self-contained smoke test (initdb + CREATE EXTENSION vector + distance query)"
-unset LD_LIBRARY_PATH
-SMOKE_DATA="$BUILD_DIR/smoke-pgdata"
-SMOKE_LOG="$BUILD_DIR/smoke-pg.log"
-SMOKE_PORT=55899
-
-# PG initdb refuses to run as root. Inside ubuntu:20.04 container we are root,
-# so create an unprivileged user and run the smoke under it.
-if [[ "$(id -u)" -eq 0 ]]; then
-  if ! id pguser >/dev/null 2>&1; then useradd -m -s /bin/bash pguser; fi
-  chown -R pguser:pguser "$BUILD_DIR"
-  RUN_AS=(runuser -u pguser --)
-else
-  RUN_AS=()
-fi
-
-"${RUN_AS[@]}" "$RUNTIME_DIR/bin/postgres" --version || { echo "FAIL: postgres --version"; exit 1; }
-MISSING="$(ldd "$RUNTIME_DIR/bin/postgres" 2>&1 | grep 'not found' || true)"
-if [[ -n "$MISSING" ]]; then echo "FAIL: missing deps in postgres:"; echo "$MISSING"; exit 1; fi
-
-SMOKE_OK=""
-for attempt in 1 2 3; do
-  echo "==> Self-contained smoke (attempt $attempt/3)"
-  rm -rf "$SMOKE_DATA"
-  set +e
-  (
-    set -e
-    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/initdb" -D "$SMOKE_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
-    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -o "-p $SMOKE_PORT -h 127.0.0.1" -l "$SMOKE_LOG" -w start
-    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
-    EXTV="$("${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';")"
-    DIST="$("${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT '[1,2,3]'::vector <-> '[1,2,4]'::vector;")"
-    echo "  vector extension version: $EXTV"
-    echo "  distance query result:    $DIST"
-    [[ "$EXTV" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extversion=$EXTV expected=$PGVECTOR_VERSION"; exit 1; }
-    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m fast stop > /dev/null
-  )
-  attempt_rc=$?
-  set -e
-  if [[ $attempt_rc -eq 0 ]]; then
-    rm -rf "$SMOKE_DATA"
-    echo "  PASS smoke (extension load + vector distance)"
-    SMOKE_OK=1
-    break
-  fi
-  echo "  attempt $attempt failed (rc=$attempt_rc) — cleaning up"
-  echo "  -- last 20 lines of $SMOKE_LOG --"
-  tail -20 "$SMOKE_LOG" 2>/dev/null || true
-  "${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m immediate stop > /dev/null 2>&1 || true
-  pkill -f "$RUNTIME_DIR/bin/postgres" > /dev/null 2>&1 || true
-  rm -rf "$SMOKE_DATA"
-done
-if [[ -z "${SMOKE_OK:-}" ]]; then
-  echo "FAIL: smoke failed all 3 attempts"
-  exit 1
-fi
-
-# Licenses
-curl -fsSL "https://raw.githubusercontent.com/postgres/postgres/REL_16_STABLE/COPYRIGHT" \
-  -o "$RUNTIME_DIR/LICENSE.postgresql"
-cp "$BUILD_DIR/pgvector/LICENSE" "$RUNTIME_DIR/LICENSE.pgvector"
-
-echo "==> Creating tarball: $OUTPUT_NAME"
-tar czf "$DIST_DIR/$OUTPUT_NAME" -C "$RUNTIME_DIR" .
-
-echo "==> Generating sha256 sidecar"
-cd "$DIST_DIR"
-sha256sum "$OUTPUT_NAME" > "${OUTPUT_NAME}.sha256"
-
-# ---------------------------------------------------------------------------
-# Phase A: Re-smoke from EXTRACTED tarball with hostile env. Catches false-pass
-# where the build host happens to satisfy a dep that the tarball is missing.
-# Uses `env -i` to clear all variables, minimal PATH, fresh data dir.
-# ---------------------------------------------------------------------------
-echo "==> Re-smoke from extracted tarball (hostile env, verify self-contained)"
-EXTRACT_DIR="$BUILD_DIR/extract-smoke"
-rm -rf "$EXTRACT_DIR"; mkdir -p "$EXTRACT_DIR"
-tar xzf "$DIST_DIR/$OUTPUT_NAME" -C "$EXTRACT_DIR"
-if [[ "$(id -u)" -eq 0 ]]; then chown -R pguser:pguser "$EXTRACT_DIR"; fi
-EXTRACT_DATA="$EXTRACT_DIR/extract-pgdata"
-EXTRACT_LOG="$EXTRACT_DIR/extract-pg.log"
-EXTRACT_PORT=55898
-
-"${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-  "$EXTRACT_DIR/bin/postgres" --version
-
-EXTRACT_SMOKE_OK=""
-for attempt in 1 2 3; do
-  echo "==> Re-smoke from extracted tarball (attempt $attempt/3)"
-  rm -rf "$EXTRACT_DATA"
-  set +e
-  (
-    set -e
-    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/initdb" -D "$EXTRACT_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
-    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -o "-p $EXTRACT_PORT -h 127.0.0.1" -l "$EXTRACT_LOG" -w start
-    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
-    EXTV2="$("${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -tAc \
-      "SELECT extversion FROM pg_extension WHERE extname='vector';")"
-    [[ "$EXTV2" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extracted-smoke extversion=$EXTV2"; exit 1; }
-    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m fast stop > /dev/null
-  )
-  attempt_rc=$?
-  set -e
-  if [[ $attempt_rc -eq 0 ]]; then
-    rm -rf "$EXTRACT_DIR"
-    echo "  PASS extracted-tarball smoke"
-    EXTRACT_SMOKE_OK=1
-    break
-  fi
-  echo "  attempt $attempt failed (rc=$attempt_rc) — cleaning up"
-  echo "  -- last 20 lines of $EXTRACT_LOG --"
-  tail -20 "$EXTRACT_LOG" 2>/dev/null || true
-  "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-    "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m immediate stop > /dev/null 2>&1 || true
-  pkill -f "$EXTRACT_DIR/bin/postgres" > /dev/null 2>&1 || true
-  rm -rf "$EXTRACT_DATA"
-done
-if [[ -z "${EXTRACT_SMOKE_OK:-}" ]]; then
-  echo "FAIL: extracted-tarball smoke failed all 3 attempts"
-  exit 1
-fi
-
-echo "==> Done: $DIST_DIR/$OUTPUT_NAME"
-ls -lh "$DIST_DIR/$OUTPUT_NAME"

package/scripts/build-runtime-macos.sh

@@ -1,217 +0,0 @@
-#!/usr/bin/env bash
-# build-runtime-macos.sh — Build self-contained PostgreSQL 16 + pgvector runtime on macOS.
-# Uses dylibbundler — the canonical macOS dependency-bundling tool — for @rpath
-# / install_name / transitive dyld closure (auriamg/macdylibbundler). Replaces
-# 200 lines of hand-rolled otool + install_name_tool walking.
-# Produces: dist/mixdog-runtime-darwin-{arch}-pg{pgver}-pgvector{vecver}.tar.gz
-
-set -euo pipefail
-
-PG_VERSION="16.4"
-PGVECTOR_VERSION="0.8.2"
-TARGET_OS="${TARGET_OS:-darwin}"
-TARGET_ARCH="${TARGET_ARCH:-$(uname -m | sed 's/x86_64/x64/')}"
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-BUILD_DIR="$ROOT_DIR/build/runtime-darwin-$TARGET_ARCH"
-STAGE_DIR="$BUILD_DIR/stage"
-DIST_DIR="$ROOT_DIR/dist"
-RUNTIME_DIR="$BUILD_DIR/runtime"
-
-OUTPUT_NAME="mixdog-runtime-${TARGET_OS}-${TARGET_ARCH}-pg${PG_VERSION}-pgvector${PGVECTOR_VERSION}.tar.gz"
-
-mkdir -p "$BUILD_DIR" "$STAGE_DIR" "$DIST_DIR" "$RUNTIME_DIR"/{bin,lib,share}
-
-echo "==> Installing build dependencies via Homebrew"
-brew install readline icu4c openssl@3 pkg-config curl git dylibbundler
-
-BREW_PREFIX="$(brew --prefix)"
-export CPPFLAGS="-I${BREW_PREFIX}/opt/readline/include -I${BREW_PREFIX}/opt/openssl@3/include -I${BREW_PREFIX}/opt/icu4c/include"
-export LDFLAGS="-L${BREW_PREFIX}/opt/readline/lib -L${BREW_PREFIX}/opt/openssl@3/lib -L${BREW_PREFIX}/opt/icu4c/lib"
-export PKG_CONFIG_PATH="${BREW_PREFIX}/opt/openssl@3/lib/pkgconfig:${BREW_PREFIX}/opt/icu4c/lib/pkgconfig"
-
-if [[ -x "$STAGE_DIR/bin/postgres" ]]; then
-  echo "==> Cache hit: PG already built at $STAGE_DIR — skipping configure/make"
-  unset TARGET_OS TARGET_ARCH
-else
-  echo "==> Downloading PostgreSQL $PG_VERSION source"
-  cd "$BUILD_DIR"
-  if [[ ! -f "postgresql-${PG_VERSION}.tar.gz" ]]; then
-    curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VERSION}/postgresql-${PG_VERSION}.tar.gz" \
-      -o "postgresql-${PG_VERSION}.tar.gz"
-  fi
-  rm -rf "postgresql-${PG_VERSION}"
-  tar xzf "postgresql-${PG_VERSION}.tar.gz"
-
-  # macOS 15.4+ SDKs declare strchrnul (non-static, availability-floored at
-  # 15.4). PG 16.4 predates that: with HAVE_STRCHRNUL its unconditional use
-  # trips -Werror=unguarded-availability-new; without it (the ac_cv override
-  # below) its static-inline fallback collides with the SDK declaration
-  # ("static declaration follows non-static declaration"). Rename the
-  # file-local fallback so the build never touches the libc symbol — also
-  # keeps the binary loadable on macOS < 15.4. Upstream fixed this after
-  # 16.4; drop both hunks on the next PG version bump.
-  sed -i '' 's/strchrnul/pg_strchrnul/g' "postgresql-${PG_VERSION}/src/port/snprintf.c"
-
-  echo "==> Configuring + building PostgreSQL"
-  cd "postgresql-${PG_VERSION}"
-  # Xcode 16.4 SDK (macOS 15.5) declares strchrnul with an availability
-  # floor of macOS 15.4; configure's link test passes but compilation under
-  # -Werror=unguarded-availability-new fails when the deployment target is
-  # older (PG 16.4 predates the guard upstream added later). Force-disable
-  # detection so PG uses its portable fallback — keeps the binary loadable
-  # on every macOS the deployment target allows.
-  ./configure \
-    --prefix="$STAGE_DIR" \
-    --without-perl --without-python --without-tcl \
-    --with-openssl --with-icu --with-readline \
-    --enable-thread-safety \
-    ac_cv_func_strchrnul=no \
-    CFLAGS="-O2"
-  unset TARGET_OS TARGET_ARCH
-  make -j"$(sysctl -n hw.logicalcpu)"
-  make install
-  make -C contrib/pgcrypto install
-fi
-
-PG_CONFIG="$STAGE_DIR/bin/pg_config"
-export PATH="$STAGE_DIR/bin:$PATH"
-
-if [[ -f "$STAGE_DIR/lib/postgresql/vector.dylib" ]]; then
-  echo "==> Cache hit: pgvector already installed — skipping clone/build"
-else
-  echo "==> Cloning + building pgvector $PGVECTOR_VERSION"
-  cd "$BUILD_DIR"
-  rm -rf pgvector
-  git clone --branch "v${PGVECTOR_VERSION}" --depth 1 \
-    https://github.com/pgvector/pgvector.git pgvector
-  cd pgvector
-  make PG_CONFIG="$PG_CONFIG" -j"$(sysctl -n hw.logicalcpu)"
-  make PG_CONFIG="$PG_CONFIG" install
-fi
-
-echo "==> Stripping macOS binaries"
-find "$STAGE_DIR/bin" -type f -exec strip -S -x {} \; 2>/dev/null || true
-find "$STAGE_DIR/lib" -name '*.dylib' -type f -exec strip -S -x {} \; 2>/dev/null || true
-
-echo "==> Assembling runtime layout"
-rm -rf "$RUNTIME_DIR"
-mkdir -p "$RUNTIME_DIR"/{bin,lib,share}
-for BIN in postgres pg_ctl pg_dump pg_restore psql initdb; do
-  cp -a "$STAGE_DIR/bin/$BIN" "$RUNTIME_DIR/bin/" 2>/dev/null || echo "WARN: $BIN not found"
-done
-cp -a "$STAGE_DIR/lib"/.   "$RUNTIME_DIR/lib/"   2>/dev/null || true
-cp -a "$STAGE_DIR/share"/. "$RUNTIME_DIR/share/" 2>/dev/null || true
-
-# ---------------------------------------------------------------------------
-# Bundle foreign Homebrew dylibs via dylibbundler. This is the canonical
-# macOS tool: walks transitive deps including @rpath, copies into a target
-# dir, rewrites install_name + LC_RPATH on every Mach-O. Replaces the
-# hand-rolled otool/install_name_tool loop that missed @rpath references.
-#
-# Flags:
-#   -of   overwrite existing files in target dir
-#   -b    bundle (don't only print)
-#   -cd   create-dest if missing
-#   -ns   no-codesign (we ad-hoc sign at the end ourselves)
-#   -p    rpath to use in rewritten install_names (relative to binary)
-#   -d    target lib dir
-#   -x    Mach-O input to scan (repeatable)
-# ---------------------------------------------------------------------------
-echo "==> Bundling foreign deps via dylibbundler"
-DYLIBBUNDLER_ARGS=(-of -b -cd -ns -d "$RUNTIME_DIR/lib/" -p '@executable_path/../lib/')
-for BIN in postgres pg_ctl pg_dump pg_restore psql initdb; do
-  [[ -f "$RUNTIME_DIR/bin/$BIN" ]] && DYLIBBUNDLER_ARGS+=(-x "$RUNTIME_DIR/bin/$BIN")
-done
-while IFS= read -r -d '' ext; do
-  DYLIBBUNDLER_ARGS+=(-x "$ext")
-done < <(find "$RUNTIME_DIR/lib/postgresql" -name '*.dylib' -print0 2>/dev/null)
-dylibbundler "${DYLIBBUNDLER_ARGS[@]}"
-
-echo "==> Stripping static archives from lib/"
-find "$RUNTIME_DIR/lib" -name '*.a' -delete
-
-echo "==> Ad-hoc re-codesign every Mach-O (dylibbundler invalidates signature)"
-while IFS= read -r -d '' macho; do
-  if file "$macho" 2>/dev/null | grep -q 'Mach-O'; then
-    codesign --force --sign - "$macho" 2>/dev/null || true
-  fi
-done < <(find "$RUNTIME_DIR/bin" "$RUNTIME_DIR/lib" -type f -print0)
-
-echo "==> Self-contained smoke test (initdb + CREATE EXTENSION vector + distance query)"
-unset DYLD_FALLBACK_LIBRARY_PATH DYLD_LIBRARY_PATH
-SMOKE_DATA="$BUILD_DIR/smoke-pgdata"
-SMOKE_LOG="$BUILD_DIR/smoke-pg.log"
-SMOKE_PORT=55899
-rm -rf "$SMOKE_DATA"
-
-"$RUNTIME_DIR/bin/postgres" --version
-BAD="$(otool -L "$RUNTIME_DIR/bin/postgres" | grep -E '(/opt/homebrew|/usr/local/Cellar|/opt/local|'"$STAGE_DIR"')' || true)"
-if [[ -n "$BAD" ]]; then echo "FAIL: stray paths in postgres:"; echo "$BAD"; exit 1; fi
-VECTOR_DYLIB="$RUNTIME_DIR/lib/postgresql/vector.dylib"
-if [[ -f "$VECTOR_DYLIB" ]]; then
-  VBAD="$(otool -L "$VECTOR_DYLIB" | grep -E '(/opt/homebrew|/usr/local/Cellar|/opt/local|'"$STAGE_DIR"')' || true)"
-  if [[ -n "$VBAD" ]]; then echo "FAIL: stray paths in vector.dylib:"; echo "$VBAD"; exit 1; fi
-fi
-
-"$RUNTIME_DIR/bin/initdb" -D "$SMOKE_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
-"$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -o "-p $SMOKE_PORT -h 127.0.0.1" -l "$SMOKE_LOG" -w start
-trap '"$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m fast stop > /dev/null 2>&1 || true' EXIT
-
-"$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
-EXTV="$("$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';")"
-DIST="$("$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT '[1,2,3]'::vector <-> '[1,2,4]'::vector;")"
-echo "  vector extension version: $EXTV"
-echo "  distance query result:    $DIST"
-[[ "$EXTV" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extversion=$EXTV expected=$PGVECTOR_VERSION"; exit 1; }
-"$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m fast stop > /dev/null
-trap - EXIT
-rm -rf "$SMOKE_DATA"
-echo "  PASS smoke (extension load + vector distance)"
-
-# Licenses
-curl -fsSL "https://raw.githubusercontent.com/postgres/postgres/REL_16_STABLE/COPYRIGHT" \
-  -o "$RUNTIME_DIR/LICENSE.postgresql"
-cp "$BUILD_DIR/pgvector/LICENSE" "$RUNTIME_DIR/LICENSE.pgvector"
-
-echo "==> Creating tarball: $OUTPUT_NAME"
-cd "$BUILD_DIR"
-tar czf "$DIST_DIR/$OUTPUT_NAME" -C "$RUNTIME_DIR" .
-
-echo "==> Generating sha256 sidecar"
-cd "$DIST_DIR"
-shasum -a 256 "$OUTPUT_NAME" > "${OUTPUT_NAME}.sha256"
-
-# ---------------------------------------------------------------------------
-# Phase A: Re-smoke from EXTRACTED tarball with hostile env. Catches false-pass
-# from build-host having Homebrew formulae that bundled tarball might be
-# missing — dylibbundler should have rewritten everything, this is the proof.
-# ---------------------------------------------------------------------------
-echo "==> Re-smoke from extracted tarball (hostile env)"
-EXTRACT_DIR="$BUILD_DIR/extract-smoke"
-rm -rf "$EXTRACT_DIR"; mkdir -p "$EXTRACT_DIR"
-tar xzf "$DIST_DIR/$OUTPUT_NAME" -C "$EXTRACT_DIR"
-EXTRACT_DATA="$EXTRACT_DIR/extract-pgdata"
-EXTRACT_LOG="$EXTRACT_DIR/extract-pg.log"
-EXTRACT_PORT=55898
-
-env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-  "$EXTRACT_DIR/bin/postgres" --version
-env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-  "$EXTRACT_DIR/bin/initdb" -D "$EXTRACT_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
-env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-  "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -o "-p $EXTRACT_PORT -h 127.0.0.1" -l "$EXTRACT_LOG" -w start
-trap 'env -i HOME="'"$EXTRACT_DIR"'" PATH=/usr/bin:/bin "'"$EXTRACT_DIR"'/bin/pg_ctl" -D "'"$EXTRACT_DATA"'" -m fast stop > /dev/null 2>&1 || true' EXIT
-env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-  "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
-EXTV2="$(env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';")"
-[[ "$EXTV2" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extracted-smoke extversion=$EXTV2"; exit 1; }
-env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-  "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m fast stop > /dev/null
-trap - EXIT
-rm -rf "$EXTRACT_DIR"
-echo "  PASS extracted-tarball smoke"
-
-echo "==> Done: $DIST_DIR/$OUTPUT_NAME"
-ls -lh "$DIST_DIR/$OUTPUT_NAME"