mixdog 0.9.171 → 0.9.173

package/scripts/build-runtime-linux.sh

@@ -39,46 +39,46 @@ export DEBIAN_FRONTEND=noninteractive
 echo "==> Installing build dependencies"
 $SUDO apt-get update -qq
 $SUDO apt-get install -y --no-install-recommends \
-  build-essential libreadline-dev zlib1g-dev libssl-dev \
-  libicu-dev libxml2-dev libzstd-dev liblz4-dev \
-  pkg-config curl git ca-certificates patchelf file \
-  bsdmainutils
+	build-essential libreadline-dev zlib1g-dev libssl-dev \
+	libicu-dev libxml2-dev libzstd-dev liblz4-dev \
+	pkg-config curl git ca-certificates patchelf file \
+	bsdmainutils
 
 if [[ -x "$STAGE_DIR/bin/postgres" ]]; then
-  echo "==> Cache hit: PG already built at $STAGE_DIR — skipping configure/make"
-  unset TARGET_OS TARGET_ARCH
+	echo "==> Cache hit: PG already built at $STAGE_DIR — skipping configure/make"
+	unset TARGET_OS TARGET_ARCH
 else
-  echo "==> Downloading PostgreSQL $PG_VERSION source"
-  cd "$BUILD_DIR"
-  if [[ ! -f "postgresql-${PG_VERSION}.tar.gz" ]]; then
-    curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VERSION}/postgresql-${PG_VERSION}.tar.gz" \
-      -o "postgresql-${PG_VERSION}.tar.gz"
-  fi
-  rm -rf "postgresql-${PG_VERSION}"
-  tar xzf "postgresql-${PG_VERSION}.tar.gz"
-
-  echo "==> Configuring PostgreSQL"
-  cd "postgresql-${PG_VERSION}"
-  ./configure \
-    --prefix="$STAGE_DIR" \
-    --without-perl \
-    --without-python \
-    --without-tcl \
-    --with-openssl \
-    --with-libxml \
-    --with-icu \
-    --with-readline \
-    --enable-thread-safety \
-    CFLAGS="-O2"
-
-  echo "==> Building PostgreSQL"
-  # PG Makefile.global has its own TARGET_ARCH var; env-passed TARGET_ARCH=x64
-  # would collide as a make-variable override and leak into compile commands.
-  unset TARGET_OS TARGET_ARCH
-  make -j"$(nproc)"
-  make install
-  make -C contrib/pgcrypto install
-  make -C contrib/pg_trgm install
+	echo "==> Downloading PostgreSQL $PG_VERSION source"
+	cd "$BUILD_DIR"
+	if [[ ! -f "postgresql-${PG_VERSION}.tar.gz" ]]; then
+		curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VERSION}/postgresql-${PG_VERSION}.tar.gz" \
+			-o "postgresql-${PG_VERSION}.tar.gz"
+	fi
+	rm -rf "postgresql-${PG_VERSION}"
+	tar xzf "postgresql-${PG_VERSION}.tar.gz"
+
+	echo "==> Configuring PostgreSQL"
+	cd "postgresql-${PG_VERSION}"
+	./configure \
+		--prefix="$STAGE_DIR" \
+		--without-perl \
+		--without-python \
+		--without-tcl \
+		--with-openssl \
+		--with-libxml \
+		--with-icu \
+		--with-readline \
+		--enable-thread-safety \
+		CFLAGS="-O2"
+
+	echo "==> Building PostgreSQL"
+	# PG Makefile.global has its own TARGET_ARCH var; env-passed TARGET_ARCH=x64
+	# would collide as a make-variable override and leak into compile commands.
+	unset TARGET_OS TARGET_ARCH
+	make -j"$(nproc)"
+	make install
+	make -C contrib/pgcrypto install
+	make -C contrib/pg_trgm install
 fi
 
 PG_CONFIG="$STAGE_DIR/bin/pg_config"
@@ -89,34 +89,34 @@ find "$STAGE_DIR" -name '*.so*' -type f -exec strip --strip-debug {} \; 2>/dev/n
 find "$STAGE_DIR/bin" -type f -exec strip --strip-all {} \; 2>/dev/null || true
 
 if [[ -f "$STAGE_DIR/lib/postgresql/vector.so" ]]; then
-  echo "==> Cache hit: pgvector already installed — skipping clone/build"
+	echo "==> Cache hit: pgvector already installed — skipping clone/build"
 else
-  echo "==> Cloning pgvector $PGVECTOR_VERSION"
-  cd "$BUILD_DIR"
-  rm -rf pgvector
-  git clone --branch "v${PGVECTOR_VERSION}" --depth 1 \
-    https://github.com/pgvector/pgvector.git pgvector
-
-  echo "==> Building pgvector"
-  cd pgvector
-  # Release assets must run on CPUs other than the GitHub runner that built
-  # them. pgvector defaults to -march=native, which can otherwise emit AVX
-  # instructions and crash with SIGILL ("Illegal instruction") downstream.
-  make OPTFLAGS="" PG_CONFIG="$PG_CONFIG" -j"$(nproc)"
-  make OPTFLAGS="" PG_CONFIG="$PG_CONFIG" install
+	echo "==> Cloning pgvector $PGVECTOR_VERSION"
+	cd "$BUILD_DIR"
+	rm -rf pgvector
+	git clone --branch "v${PGVECTOR_VERSION}" --depth 1 \
+		https://github.com/pgvector/pgvector.git pgvector
+
+	echo "==> Building pgvector"
+	cd pgvector
+	# Release assets must run on CPUs other than the GitHub runner that built
+	# them. pgvector defaults to -march=native, which can otherwise emit AVX
+	# instructions and crash with SIGILL ("Illegal instruction") downstream.
+	make OPTFLAGS="" PG_CONFIG="$PG_CONFIG" -j"$(nproc)"
+	make OPTFLAGS="" PG_CONFIG="$PG_CONFIG" install
 fi
 
 echo "==> Assembling runtime layout"
 rm -rf "$RUNTIME_DIR"
 mkdir -p "$RUNTIME_DIR"/{bin,lib,share}
-cp -a "$STAGE_DIR/bin/postgres"   "$RUNTIME_DIR/bin/"
-cp -a "$STAGE_DIR/bin/pg_ctl"     "$RUNTIME_DIR/bin/"
-cp -a "$STAGE_DIR/bin/pg_dump"    "$RUNTIME_DIR/bin/"
+cp -a "$STAGE_DIR/bin/postgres" "$RUNTIME_DIR/bin/"
+cp -a "$STAGE_DIR/bin/pg_ctl" "$RUNTIME_DIR/bin/"
+cp -a "$STAGE_DIR/bin/pg_dump" "$RUNTIME_DIR/bin/"
 cp -a "$STAGE_DIR/bin/pg_restore" "$RUNTIME_DIR/bin/"
-cp -a "$STAGE_DIR/bin/psql"       "$RUNTIME_DIR/bin/"
-cp -a "$STAGE_DIR/bin/initdb"     "$RUNTIME_DIR/bin/"
+cp -a "$STAGE_DIR/bin/psql" "$RUNTIME_DIR/bin/"
+cp -a "$STAGE_DIR/bin/initdb" "$RUNTIME_DIR/bin/"
 
-cp -a "$STAGE_DIR/lib"/.   "$RUNTIME_DIR/lib/"   2>/dev/null || true
+cp -a "$STAGE_DIR/lib"/. "$RUNTIME_DIR/lib/" 2>/dev/null || true
 cp -a "$STAGE_DIR/share"/. "$RUNTIME_DIR/share/" 2>/dev/null || true
 
 # ---------------------------------------------------------------------------
@@ -130,69 +130,69 @@ echo "==> Bundling foreign dynamic dependencies (binaries + extensions)"
 KEEP_RE='^(linux-vdso|ld-linux|libc\.so|libm\.so|libpthread\.so|libdl\.so|librt\.so|libnsl\.so|libresolv\.so)'
 
 collect_deps() {
-  ldd "$1" 2>/dev/null \
-    | awk '/=>/{print $3}' \
-    | grep -E '^/' \
-    | while read -r path; do
-        bn=$(basename "$path")
-        if echo "$bn" | grep -Eq "$KEEP_RE"; then
-          continue  # system lib — keep on host
-        fi
-        echo "$path"
-      done \
-    | sort -u
+	ldd "$1" 2>/dev/null |
+		awk '/=>/{print $3}' |
+		grep -E '^/' |
+		while read -r path; do
+			bn=$(basename "$path")
+			if echo "$bn" | grep -Eq "$KEEP_RE"; then
+				continue # system lib — keep on host
+			fi
+			echo "$path"
+		done |
+		sort -u
 }
 
 declare -A SEEN
 declare -a QUEUE
 # Seeds: binaries + every .so under lib/postgresql/ (extensions, contrib mods).
 for seed in "$RUNTIME_DIR/bin/postgres" "$RUNTIME_DIR/bin/psql" \
-            "$RUNTIME_DIR/bin/pg_ctl"; do
-  [[ -f "$seed" ]] && QUEUE+=("$seed")
+	"$RUNTIME_DIR/bin/pg_ctl"; do
+	[[ -f "$seed" ]] && QUEUE+=("$seed")
 done
 while IFS= read -r -d '' ext; do
-  QUEUE+=("$ext")
+	QUEUE+=("$ext")
 done < <(find "$RUNTIME_DIR/lib/postgresql" -name '*.so' -print0 2>/dev/null)
 
 declare -a FOREIGN
 while [[ ${#QUEUE[@]} -gt 0 ]]; do
-  current="${QUEUE[0]}"
-  QUEUE=("${QUEUE[@]:1}")
-  while IFS= read -r dep; do
-    real="$(readlink -f "$dep")"
-    [[ -n "${SEEN[$real]+x}" ]] && continue
-    SEEN[$real]=1
-    FOREIGN+=("$dep")
-    QUEUE+=("$dep")
-  done < <(collect_deps "$current")
+	current="${QUEUE[0]}"
+	QUEUE=("${QUEUE[@]:1}")
+	while IFS= read -r dep; do
+		real="$(readlink -f "$dep")"
+		[[ -n "${SEEN[$real]+x}" ]] && continue
+		SEEN[$real]=1
+		FOREIGN+=("$dep")
+		QUEUE+=("$dep")
+	done < <(collect_deps "$current")
 done
 
 # Sanity: glibc / loader must never be bundled — if KEEP_RE regresses this catches it.
 if find "$RUNTIME_DIR/lib" -maxdepth 1 \
-     \( -name 'libc.so*' -o -name 'ld-linux*' -o -name 'libpthread.so*' \) \
-   | grep -q .; then
-  echo "FATAL: bundled glibc/loader detected — KEEP_RE filter did not work"
-  exit 1
+	\( -name 'libc.so*' -o -name 'ld-linux*' -o -name 'libpthread.so*' \) |
+	grep -q .; then
+	echo "FATAL: bundled glibc/loader detected — KEEP_RE filter did not work"
+	exit 1
 fi
 
 echo "  bundling ${#FOREIGN[@]} foreign libraries"
 for so_path in "${FOREIGN[@]}"; do
-  real_path="$(readlink -f "$so_path")"
-  real_name="$(basename "$real_path")"
-  if [[ ! -f "$RUNTIME_DIR/lib/$real_name" ]]; then
-    cp -L "$real_path" "$RUNTIME_DIR/lib/$real_name"
-    chmod u+w "$RUNTIME_DIR/lib/$real_name"
-    echo "    + $real_name"
-  fi
-  link="$so_path"
-  while [[ -L "$link" ]]; do
-    link_name="$(basename "$link")"
-    link_target="$(readlink "$link")"
-    if [[ ! -e "$RUNTIME_DIR/lib/$link_name" ]]; then
-      ln -sf "$(basename "$link_target")" "$RUNTIME_DIR/lib/$link_name"
-    fi
-    link="$(dirname "$link")/$link_target"
-  done
+	real_path="$(readlink -f "$so_path")"
+	real_name="$(basename "$real_path")"
+	if [[ ! -f "$RUNTIME_DIR/lib/$real_name" ]]; then
+		cp -L "$real_path" "$RUNTIME_DIR/lib/$real_name"
+		chmod u+w "$RUNTIME_DIR/lib/$real_name"
+		echo "    + $real_name"
+	fi
+	link="$so_path"
+	while [[ -L "$link" ]]; do
+		link_name="$(basename "$link")"
+		link_target="$(readlink "$link")"
+		if [[ ! -e "$RUNTIME_DIR/lib/$link_name" ]]; then
+			ln -sf "$(basename "$link_target")" "$RUNTIME_DIR/lib/$link_name"
+		fi
+		link="$(dirname "$link")/$link_target"
+	done
 done
 
 echo "==> Stripping static archives from lib/"
@@ -200,22 +200,25 @@ find "$RUNTIME_DIR/lib" -name '*.a' -delete
 
 echo "==> Patching rpath"
 # Binaries: $ORIGIN/../lib (from bin/ to lib/)
+# shellcheck disable=SC2016  # $ORIGIN is a literal rpath token for the loader
 find "$RUNTIME_DIR/bin" -type f -executable | while read -r bin; do
-  if file "$bin" 2>/dev/null | grep -q ELF; then
-    patchelf --set-rpath '$ORIGIN/../lib' "$bin" 2>/dev/null || true
-  fi
+	if file "$bin" 2>/dev/null | grep -q ELF; then
+		patchelf --set-rpath '$ORIGIN/../lib' "$bin" 2>/dev/null || true
+	fi
 done
 # Top-level lib/*.so*: $ORIGIN
+# shellcheck disable=SC2016
 find "$RUNTIME_DIR/lib" -maxdepth 1 -type f -name '*.so*' | while read -r so; do
-  if file "$so" 2>/dev/null | grep -q ELF; then
-    patchelf --set-rpath '$ORIGIN' "$so" 2>/dev/null || true
-  fi
+	if file "$so" 2>/dev/null | grep -q ELF; then
+		patchelf --set-rpath '$ORIGIN' "$so" 2>/dev/null || true
+	fi
 done
 # Every extension module under lib/postgresql/: $ORIGIN/.. (=lib/) and $ORIGIN/../.. (=runtime root)
+# shellcheck disable=SC2016
 find "$RUNTIME_DIR/lib/postgresql" -name '*.so' 2>/dev/null | while read -r ext; do
-  if file "$ext" 2>/dev/null | grep -q ELF; then
-    patchelf --set-rpath '$ORIGIN/..:$ORIGIN/../..' "$ext" 2>/dev/null || true
-  fi
+	if file "$ext" 2>/dev/null | grep -q ELF; then
+		patchelf --set-rpath '$ORIGIN/..:$ORIGIN/../..' "$ext" 2>/dev/null || true
+	fi
 done
 
 # ---------------------------------------------------------------------------
@@ -230,61 +233,74 @@ SMOKE_PORT=55899
 # PG initdb refuses to run as root. Inside ubuntu:20.04 container we are root,
 # so create an unprivileged user and run the smoke under it.
 if [[ "$(id -u)" -eq 0 ]]; then
-  if ! id pguser >/dev/null 2>&1; then useradd -m -s /bin/bash pguser; fi
-  chown -R pguser:pguser "$BUILD_DIR"
-  RUN_AS=(runuser -u pguser --)
+	if ! id pguser >/dev/null 2>&1; then useradd -m -s /bin/bash pguser; fi
+	chown -R pguser:pguser "$BUILD_DIR"
+	RUN_AS=(runuser -u pguser --)
 else
-  RUN_AS=()
+	RUN_AS=()
 fi
 
-"${RUN_AS[@]}" "$RUNTIME_DIR/bin/postgres" --version || { echo "FAIL: postgres --version"; exit 1; }
+"${RUN_AS[@]}" "$RUNTIME_DIR/bin/postgres" --version || {
+	echo "FAIL: postgres --version"
+	exit 1
+}
 MISSING="$(ldd "$RUNTIME_DIR/bin/postgres" 2>&1 | grep 'not found' || true)"
-if [[ -n "$MISSING" ]]; then echo "FAIL: missing deps in postgres:"; echo "$MISSING"; exit 1; fi
+if [[ -n "$MISSING" ]]; then
+	echo "FAIL: missing deps in postgres:"
+	echo "$MISSING"
+	exit 1
+fi
 
 SMOKE_OK=""
 for attempt in 1 2 3; do
-  echo "==> Self-contained smoke (attempt $attempt/3)"
-  rm -rf "$SMOKE_DATA"
-  set +e
-  (
-    set -e
-    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/initdb" -D "$SMOKE_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
-    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -o "-p $SMOKE_PORT -h 127.0.0.1" -l "$SMOKE_LOG" -w start
-    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
-    EXTV="$("${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';")"
-    DIST="$("${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT '[1,2,3]'::vector <-> '[1,2,4]'::vector;")"
-    echo "  vector extension version: $EXTV"
-    echo "  distance query result:    $DIST"
-    [[ "$EXTV" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extversion=$EXTV expected=$PGVECTOR_VERSION"; exit 1; }
-    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -c "CREATE EXTENSION pg_trgm;" > /dev/null
-    SIM="$("${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT similarity('mixdog','mixdig') > 0;")"
-    echo "  pg_trgm similarity probe: $SIM"
-    [[ "$SIM" == "t" ]] || { echo "FAIL: pg_trgm similarity=$SIM"; exit 1; }
-    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m fast stop > /dev/null
-  )
-  attempt_rc=$?
-  set -e
-  if [[ $attempt_rc -eq 0 ]]; then
-    rm -rf "$SMOKE_DATA"
-    echo "  PASS smoke (extension load + vector distance)"
-    SMOKE_OK=1
-    break
-  fi
-  echo "  attempt $attempt failed (rc=$attempt_rc) — cleaning up"
-  echo "  -- last 20 lines of $SMOKE_LOG --"
-  tail -20 "$SMOKE_LOG" 2>/dev/null || true
-  "${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m immediate stop > /dev/null 2>&1 || true
-  pkill -f "$RUNTIME_DIR/bin/postgres" > /dev/null 2>&1 || true
-  rm -rf "$SMOKE_DATA"
+	echo "==> Self-contained smoke (attempt $attempt/3)"
+	rm -rf "$SMOKE_DATA"
+	set +e
+	(
+		set -e
+		"${RUN_AS[@]}" "$RUNTIME_DIR/bin/initdb" -D "$SMOKE_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres >/dev/null
+		"${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -o "-p $SMOKE_PORT -h 127.0.0.1" -l "$SMOKE_LOG" -w start
+		"${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" >/dev/null
+		EXTV="$("${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';")"
+		DIST="$("${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT '[1,2,3]'::vector <-> '[1,2,4]'::vector;")"
+		echo "  vector extension version: $EXTV"
+		echo "  distance query result:    $DIST"
+		[[ "$EXTV" == "$PGVECTOR_VERSION" ]] || {
+			echo "FAIL: extversion=$EXTV expected=$PGVECTOR_VERSION"
+			exit 1
+		}
+		"${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -c "CREATE EXTENSION pg_trgm;" >/dev/null
+		SIM="$("${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT similarity('mixdog','mixdig') > 0;")"
+		echo "  pg_trgm similarity probe: $SIM"
+		[[ "$SIM" == "t" ]] || {
+			echo "FAIL: pg_trgm similarity=$SIM"
+			exit 1
+		}
+		"${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m fast stop >/dev/null
+	)
+	attempt_rc=$?
+	set -e
+	if [[ $attempt_rc -eq 0 ]]; then
+		rm -rf "$SMOKE_DATA"
+		echo "  PASS smoke (extension load + vector distance)"
+		SMOKE_OK=1
+		break
+	fi
+	echo "  attempt $attempt failed (rc=$attempt_rc) — cleaning up"
+	echo "  -- last 20 lines of $SMOKE_LOG --"
+	tail -20 "$SMOKE_LOG" 2>/dev/null || true
+	"${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m immediate stop >/dev/null 2>&1 || true
+	pkill -f "$RUNTIME_DIR/bin/postgres" >/dev/null 2>&1 || true
+	rm -rf "$SMOKE_DATA"
 done
 if [[ -z "${SMOKE_OK:-}" ]]; then
-  echo "FAIL: smoke failed all 3 attempts"
-  exit 1
+	echo "FAIL: smoke failed all 3 attempts"
+	exit 1
 fi
 
 # Licenses
 curl -fsSL "https://raw.githubusercontent.com/postgres/postgres/REL_16_STABLE/COPYRIGHT" \
-  -o "$RUNTIME_DIR/LICENSE.postgresql"
+	-o "$RUNTIME_DIR/LICENSE.postgresql"
 cp "$BUILD_DIR/pgvector/LICENSE" "$RUNTIME_DIR/LICENSE.pgvector"
 
 echo "==> Creating tarball: $OUTPUT_NAME"
@@ -292,7 +308,7 @@ tar czf "$DIST_DIR/$OUTPUT_NAME" -C "$RUNTIME_DIR" .
 
 echo "==> Generating sha256 sidecar"
 cd "$DIST_DIR"
-sha256sum "$OUTPUT_NAME" > "${OUTPUT_NAME}.sha256"
+sha256sum "$OUTPUT_NAME" >"${OUTPUT_NAME}.sha256"
 
 # ---------------------------------------------------------------------------
 # Phase A: Re-smoke from EXTRACTED tarball with hostile env. Catches false-pass
@@ -301,7 +317,8 @@ sha256sum "$OUTPUT_NAME" > "${OUTPUT_NAME}.sha256"
 # ---------------------------------------------------------------------------
 echo "==> Re-smoke from extracted tarball (hostile env, verify self-contained)"
 EXTRACT_DIR="$BUILD_DIR/extract-smoke"
-rm -rf "$EXTRACT_DIR"; mkdir -p "$EXTRACT_DIR"
+rm -rf "$EXTRACT_DIR"
+mkdir -p "$EXTRACT_DIR"
 tar xzf "$DIST_DIR/$OUTPUT_NAME" -C "$EXTRACT_DIR"
 if [[ "$(id -u)" -eq 0 ]]; then chown -R pguser:pguser "$EXTRACT_DIR"; fi
 EXTRACT_DATA="$EXTRACT_DIR/extract-pgdata"
@@ -309,49 +326,52 @@ EXTRACT_LOG="$EXTRACT_DIR/extract-pg.log"
 EXTRACT_PORT=55898
 
 "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-  "$EXTRACT_DIR/bin/postgres" --version
+	"$EXTRACT_DIR/bin/postgres" --version
 
 EXTRACT_SMOKE_OK=""
 for attempt in 1 2 3; do
-  echo "==> Re-smoke from extracted tarball (attempt $attempt/3)"
-  rm -rf "$EXTRACT_DATA"
-  set +e
-  (
-    set -e
-    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/initdb" -D "$EXTRACT_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
-    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -o "-p $EXTRACT_PORT -h 127.0.0.1" -l "$EXTRACT_LOG" -w start
-    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
-    EXTV2="$("${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -tAc \
-      "SELECT extversion FROM pg_extension WHERE extname='vector';")"
-    [[ "$EXTV2" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extracted-smoke extversion=$EXTV2"; exit 1; }
-    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION pg_trgm;" > /dev/null
-    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-      "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m fast stop > /dev/null
-  )
-  attempt_rc=$?
-  set -e
-  if [[ $attempt_rc -eq 0 ]]; then
-    rm -rf "$EXTRACT_DIR"
-    echo "  PASS extracted-tarball smoke"
-    EXTRACT_SMOKE_OK=1
-    break
-  fi
-  echo "  attempt $attempt failed (rc=$attempt_rc) — cleaning up"
-  echo "  -- last 20 lines of $EXTRACT_LOG --"
-  tail -20 "$EXTRACT_LOG" 2>/dev/null || true
-  "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
-    "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m immediate stop > /dev/null 2>&1 || true
-  pkill -f "$EXTRACT_DIR/bin/postgres" > /dev/null 2>&1 || true
-  rm -rf "$EXTRACT_DATA"
+	echo "==> Re-smoke from extracted tarball (attempt $attempt/3)"
+	rm -rf "$EXTRACT_DATA"
+	set +e
+	(
+		set -e
+		"${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+			"$EXTRACT_DIR/bin/initdb" -D "$EXTRACT_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres >/dev/null
+		"${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+			"$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -o "-p $EXTRACT_PORT -h 127.0.0.1" -l "$EXTRACT_LOG" -w start
+		"${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+			"$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" >/dev/null
+		EXTV2="$("${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+			"$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -tAc \
+			"SELECT extversion FROM pg_extension WHERE extname='vector';")"
+		[[ "$EXTV2" == "$PGVECTOR_VERSION" ]] || {
+			echo "FAIL: extracted-smoke extversion=$EXTV2"
+			exit 1
+		}
+		"${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+			"$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION pg_trgm;" >/dev/null
+		"${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+			"$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m fast stop >/dev/null
+	)
+	attempt_rc=$?
+	set -e
+	if [[ $attempt_rc -eq 0 ]]; then
+		rm -rf "$EXTRACT_DIR"
+		echo "  PASS extracted-tarball smoke"
+		EXTRACT_SMOKE_OK=1
+		break
+	fi
+	echo "  attempt $attempt failed (rc=$attempt_rc) — cleaning up"
+	echo "  -- last 20 lines of $EXTRACT_LOG --"
+	tail -20 "$EXTRACT_LOG" 2>/dev/null || true
+	"${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+		"$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m immediate stop >/dev/null 2>&1 || true
+	pkill -f "$EXTRACT_DIR/bin/postgres" >/dev/null 2>&1 || true
+	rm -rf "$EXTRACT_DATA"
 done
 if [[ -z "${EXTRACT_SMOKE_OK:-}" ]]; then
-  echo "FAIL: extracted-tarball smoke failed all 3 attempts"
-  exit 1
+	echo "FAIL: extracted-tarball smoke failed all 3 attempts"
+	exit 1
 fi
 
 echo "==> Done: $DIST_DIR/$OUTPUT_NAME"