From c9e0d609c28b30b5a76b2119db3c1d4fa0183ce9 Mon Sep 17 00:00:00 2001
From: Chen Huajun <chjischj@163.com>
Date: Sat, 27 Jun 2026 00:00:55 +0800
Subject: [PATCH 01/12] use StringInfo parse input of roaringbitmap_recv

---
 roaringbitmap.c   | 13 ++++++++++---
 roaringbitmap64.c | 13 ++++++++++---
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/roaringbitmap.c b/roaringbitmap.c
index b4fb4a1..e15847d 100644
--- a/roaringbitmap.c
+++ b/roaringbitmap.c
@@ -341,13 +341,20 @@ PG_FUNCTION_INFO_V1(roaringbitmap_recv);
 
 Datum
 roaringbitmap_recv(PG_FUNCTION_ARGS) {
-    Datum dd = DirectFunctionCall1(bytearecv, PG_GETARG_DATUM(0));
-    bytea *serializedbytes = DatumGetByteaP(dd);
+    StringInfo    buf = (StringInfo) PG_GETARG_POINTER(0);
+    int           nbytes;
+    bytea *serializedbytes;
     roaring_bitmap_t *r1;
     size_t expectedsize;
     const char *reason;
 
-    r1 = roaring_bitmap_portable_deserialize_safe(VARDATA(serializedbytes), VARSIZE(serializedbytes) - VARHDRSZ);
+    nbytes = buf->len - buf->cursor;
+    if (nbytes <= 0)
+        ereport(ERROR,
+                (errcode(ERRCODE_INVALID_BINARY_REPRESENTATION),
+                 errmsg("empty roaring bitmap binary data")));
+
+    r1 = roaring_bitmap_portable_deserialize_safe(pq_getmsgbytes(buf, nbytes), nbytes);
     if (!r1)
         ereport(ERROR,
                 (errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),
diff --git a/roaringbitmap64.c b/roaringbitmap64.c
index 16a1f1d..12ce7a5 100644
--- a/roaringbitmap64.c
+++ b/roaringbitmap64.c
@@ -213,13 +213,20 @@ PG_FUNCTION_INFO_V1(roaringbitmap64_recv);
 
 Datum
 roaringbitmap64_recv(PG_FUNCTION_ARGS) {
-    Datum dd = DirectFunctionCall1(bytearecv, PG_GETARG_DATUM(0));
-    bytea *serializedbytes = DatumGetByteaP(dd);
+    StringInfo    buf = (StringInfo) PG_GETARG_POINTER(0);
+    int           nbytes;
+    bytea *serializedbytes;
     roaring64_bitmap_t *r1;
     size_t expectedsize;
     const char *reason;
 
-    r1 = roaring64_bitmap_portable_deserialize_safe(VARDATA(serializedbytes), VARSIZE(serializedbytes) - VARHDRSZ);
+    nbytes = buf->len - buf->cursor;
+    if (nbytes <= 0)
+        ereport(ERROR,
+                (errcode(ERRCODE_INVALID_BINARY_REPRESENTATION),
+                 errmsg("empty roaring bitmap binary data")));
+
+    r1 = roaring64_bitmap_portable_deserialize_safe(pq_getmsgbytes(buf, nbytes), nbytes);
     if (!r1)
         ereport(ERROR,
                 (errcode(ERRCODE_NULL_VALUE_NOT_ALLOWED),

From eee57df33df0f94085a108ec0bd1cd40d6880d8a Mon Sep 17 00:00:00 2001
From: Chen Huajun <chjischj@163.com>
Date: Sat, 27 Jun 2026 01:29:00 +0800
Subject: [PATCH 02/12] Bump the version to 1.2.0

---
 CHANGELOG.md              | 8 +++++++-
 META.json                 | 4 ++--
 docker-example/Dockerfile | 2 +-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d729983..b2a4902 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,12 @@
 
 # Change Log
 
+### v1.2.0(2026-06-27)
+1. Add rb_runoptimize(), to shrink binary size of bitmaps when called(#62 by @notoriousR-O-B and @smmathews-cision-us)
+2. Keep rb_exsit definition for backward compatible with verion less than 1.0(#63 by @harry-leq)
+3. Add postgres19 compatibility (#67 by @sibowu-aws)
+4. Validate untrusted bitmaps in the recv functions(#68 by piki)
+
 ### v1.1.0(2025-11-10)
 1. made rangeend = 0 as unlimited(in rb64_fill,rb64_clear,rb64_flip,rb64_range,rb64_range_cardinality and rb64_select)
 
@@ -79,4 +85,4 @@
 ### v0.0.3 (2018-03-31)
 
 - fork from https://github.com/zeromax007/gpdb-roaringbitmap and make roaringbitmap to be a PostgreSQL extension
-- update the CRoaring to v0.2.39.
\ No newline at end of file
+- update the CRoaring to v0.2.39.
diff --git a/META.json b/META.json
index 3551f1a..793e825 100644
--- a/META.json
+++ b/META.json
@@ -2,7 +2,7 @@
    "name": "pg_roaringbitmap",
    "abstract": "A Roaring Bitmap data type",
    "description": "This library contains a single PostgreSQL extension, a Roaring Bitmap data type called 'roaringbitmap', along with some convenience operators and functions for constructing and handling Roaring Bitmaps.",
-   "version": "1.1.0",
+   "version": "1.2.0",
    "maintainer": [
       "Chen Huajun <chjischj@163.com>"
    ],
@@ -12,7 +12,7 @@
          "abstract": "A Roaring Bitmap data type",
          "file": "roaringbitmap--1.1.sql",
          "docfile": "README.md",
-         "version": "1.1.0"
+         "version": "1.2.0"
       }
    },
    "resources": {
diff --git a/docker-example/Dockerfile b/docker-example/Dockerfile
index cd94762..a89c30c 100644
--- a/docker-example/Dockerfile
+++ b/docker-example/Dockerfile
@@ -1,5 +1,5 @@
 FROM postgres:16.0-bookworm AS builder
-ENV VERSION_TAG=1.1.0
+ENV VERSION_TAG=1.2.0
 
 WORKDIR /
 RUN apt-get update && apt-get install -y curl unzip make gcc postgresql-server-dev-16

From 896e1f49d2df478debdc670831884877b5a08766 Mon Sep 17 00:00:00 2001
From: Chen Huajun <chjischj@163.com>
Date: Sat, 27 Jun 2026 01:34:41 +0800
Subject: [PATCH 03/12] Fix formatting of contributor mentions in CHANGELOG

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2a4902..14795f7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@
 1. Add rb_runoptimize(), to shrink binary size of bitmaps when called(#62 by @notoriousR-O-B and @smmathews-cision-us)
 2. Keep rb_exsit definition for backward compatible with verion less than 1.0(#63 by @harry-leq)
 3. Add postgres19 compatibility (#67 by @sibowu-aws)
-4. Validate untrusted bitmaps in the recv functions(#68 by piki)
+4. Validate untrusted bitmaps in the recv functions(#68 by @piki)
 
 ### v1.1.0(2025-11-10)
 1. made rangeend = 0 as unlimited(in rb64_fill,rb64_clear,rb64_flip,rb64_range,rb64_range_cardinality and rb64_select)

From bdd8e95a23b62f98bd198c73083f04c5266f5d23 Mon Sep 17 00:00:00 2001
From: Chen Huajun <chjischj@163.com>
Date: Sat, 27 Jun 2026 02:28:25 +0800
Subject: [PATCH 04/12] add -Wno-missing-variable-declarations to avoid build
 error

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 4ef6ed0..086e1da 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ MODULE_big = roaringbitmap
 OBJS = roaring_buffer_reader.o roaringbitmap.o roaring64_buffer_reader.o roaringbitmap64.o
 
 $(OBJS): override CFLAGS += -std=c11 -Wno-error=maybe-uninitialized \
-	-Wno-declaration-after-statement -Wno-missing-prototypes
+	-Wno-declaration-after-statement -Wno-missing-prototypes -Wno-missing-variable-declarations
 
 PG_CONFIG = pg_config
 

From d6a2885974e82df3239341ecde633b3a6c6138c0 Mon Sep 17 00:00:00 2001
From: Chen Huajun <chjischj@163.com>
Date: Sat, 27 Jun 2026 02:32:38 +0800
Subject: [PATCH 05/12] add postgresql 19 to build-test.yml

---
 .github/workflows/build-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 1d44d20..03ad790 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        pg: [13, 14, 15, 16, 17, 18]
+        pg: [13, 14, 15, 16, 17, 18, 19]
     container:
       image: pgxn/pgxn-tools
     steps:

From 95fcdbbc7008839f9cd080be3f856b40f7f9f3f9 Mon Sep 17 00:00:00 2001
From: pthorpe92 <p.thorpe.dev@gmail.com>
Date: Mon, 5 Oct 2026 16:33:59 -0700
Subject: [PATCH 06/12] Build and test packages per PG major against pinned
 PGDG

Dockerfile.package builds the .debs for exactly one PostgreSQL major
(17, 18 or 19) on a digest-pinned Debian 12 or 13 base, from exact PGDG
pins. Component 19 and the libpq pins are enabled only on PG 19 rows, and
postgresql-all/server-dev-all are never installed. pg_buildext is
restricted to the one major via PG_SUPPORTED_VERSIONS and asserted, as
is /usr/lib/postgresql. Debian 12 assets keep the canonical names;
Debian 13 assets get the release-only pg<M>-trixie-<arch>- prefix. Each
.deb gets a `sha256sum` sidecar, as the v1.2.0-1.pscale1 release does.

scripts/test-package tests the exact assets in a clean image with only
the pinned PostgreSQL runtime: asset set and sidecars, metadata and
manifests (derived from debian/control.in and the v1.2.0-1.pscale1
assets), dpkg -i adding nothing else, then initdb, CREATE EXTENSION and
behavior probes (the postgres-private probes, rb_or/rb_and, aggregates,
roaringbitmap64 above 2^32, a binary COPY round-trip, corrupt blobs
rejected by *_recv). Finally it runs sql/*.sql against the installed
.so with postgresql-client's pg_regress. --probes-only runs the
server-side part against a local installation.
---
 .dockerignore        |  12 +-
 Dockerfile.package   | 145 +++++++++++++++++
 scripts/test-package | 379 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 533 insertions(+), 3 deletions(-)
 create mode 100644 Dockerfile.package
 create mode 100755 scripts/test-package

diff --git a/.dockerignore b/.dockerignore
index f110a87..6521ce0 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,9 +1,15 @@
+.git
+.github/
 *.o
 *.a
 *.so
 *.dylib
+*.bc
 *.pc
 results/
-regression.diffs
-regression.out
-.git
+log/
+tmp_check/
+regression.*
+packages/
+benchmark/
+docker-example/
diff --git a/Dockerfile.package b/Dockerfile.package
new file mode 100644
index 0000000..e82ca23
--- /dev/null
+++ b/Dockerfile.package
@@ -0,0 +1,145 @@
+# syntax=docker/dockerfile:1
+
+# Builds the PlanetScale pg_roaringbitmap .debs for exactly one PostgreSQL
+# major against pinned PGDG packages, then tests the exact packages in a clean
+# image.
+#
+#   build:    debian/ tree via dpkg-buildpackage (debian/rules skips
+#             dh_pgxs_test; scripts/test-package runs the suite instead)
+#   packages: release assets only (canonical names; pg<M>-trixie-<arch>- on
+#             Debian 13) plus <asset>.sha256 sidecars
+#   test:     fresh base image + pinned PostgreSQL runtime + scripts/test-package
+
+ARG BASE_IMAGE=debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
+FROM ${BASE_IMAGE} AS build
+
+ARG DEBIAN_CODENAME
+ARG DEBIAN_VERSION
+ARG PACKAGE_VERSION
+ARG PG_MAJOR
+ARG PG_PACKAGE_VERSION
+
+RUN case "$DEBIAN_VERSION:$DEBIAN_CODENAME" in \
+        12:bookworm|13:trixie) ;; \
+        *) echo "unsupported Debian target: $DEBIAN_VERSION ($DEBIAN_CODENAME)" >&2; exit 1 ;; \
+    esac \
+    && case "$PG_MAJOR" in \
+        17|18|19) ;; \
+        *) echo "unsupported PostgreSQL major: $PG_MAJOR" >&2; exit 1 ;; \
+    esac \
+    && case "$PG_PACKAGE_VERSION" in \
+        "${PG_MAJOR}"[.~]*".pgdg${DEBIAN_VERSION}+"*) ;; \
+        *) echo "PG_PACKAGE_VERSION $PG_PACKAGE_VERSION does not match PG $PG_MAJOR / Debian $DEBIAN_VERSION" >&2; exit 1 ;; \
+    esac \
+    && test -n "$PACKAGE_VERSION"
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    ca-certificates \
+    curl \
+    debhelper \
+    devscripts \
+    && rm -rf /var/lib/apt/lists/*
+
+# PGDG: component "19" only on PG 19 rows, so stable rows cannot resolve beta
+# packages. postgresql-server-dev-19 needs libpq-dev (>= 19~~), and component
+# 19 carries every beta's libpq, so pin libpq to the server version there.
+# Never install postgresql-all / postgresql-server-dev-all (unpinned 10-18).
+RUN install -d /usr/share/postgresql-common/pgdg \
+    && curl --fail --silent --show-error --output /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc \
+        https://www.postgresql.org/media/keys/ACCC4CF8.asc \
+    && pgdg_components=main \
+    && libpq_pins= \
+    && if [ "$PG_MAJOR" = 19 ]; then \
+        pgdg_components="main 19"; \
+        libpq_pins="libpq5=${PG_PACKAGE_VERSION} libpq-dev=${PG_PACKAGE_VERSION}"; \
+    fi \
+    && echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt ${DEBIAN_CODENAME}-pgdg ${pgdg_components}" \
+        > /etc/apt/sources.list.d/pgdg.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+        "postgresql-${PG_MAJOR}=${PG_PACKAGE_VERSION}" \
+        "postgresql-client-${PG_MAJOR}=${PG_PACKAGE_VERSION}" \
+        "postgresql-server-dev-${PG_MAJOR}=${PG_PACKAGE_VERSION}" \
+        postgresql-common-dev \
+        $libpq_pins \
+    && rm -rf /var/lib/apt/lists/* \
+    && majors=$(ls /usr/lib/postgresql | xargs) \
+    && if [ "$majors" != "$PG_MAJOR" ]; then \
+        echo "/usr/lib/postgresql has '$majors', expected only '$PG_MAJOR'" >&2; exit 1; \
+    fi
+
+COPY . /src/pg_roaringbitmap
+WORKDIR /src/pg_roaringbitmap
+
+# Restrict pg_buildext (debian/control, dh_pgxs_loop) to the one major this
+# row builds.
+ENV PG_SUPPORTED_VERSIONS=${PG_MAJOR}
+
+# -d: debian/control Build-Depends names postgresql-all/postgresql-server-dev-all,
+# which are deliberately not installed; the exact dependencies are above.
+RUN versions=$(pg_buildext supported-versions | xargs) \
+    && if [ "$versions" != "$PG_MAJOR" ]; then \
+        echo "pg_buildext supported-versions is '$versions', expected '$PG_MAJOR'" >&2; exit 1; \
+    fi \
+    && pg_buildext updatecontrol \
+    && test "$(grep '^Package: ' debian/control)" = "Package: postgresql-${PG_MAJOR}-roaringbitmap" \
+    && dch -v "$PACKAGE_VERSION" --distribution "$DEBIAN_CODENAME" "Custom PlanetScale build" \
+    && dpkg-buildpackage -us -uc -b -d
+
+RUN deb_arch=$(dpkg --print-architecture) \
+    && case "$deb_arch" in \
+        amd64) asset_arch=x86_64 ;; \
+        arm64) asset_arch=arm64 ;; \
+        *) echo "unsupported package architecture: $deb_arch" >&2; exit 1 ;; \
+    esac \
+    && prefix= \
+    && if [ "$DEBIAN_CODENAME" = trixie ]; then prefix="pg${PG_MAJOR}-trixie-${asset_arch}-"; fi \
+    && main="postgresql-${PG_MAJOR}-roaringbitmap_${PACKAGE_VERSION}_${deb_arch}.deb" \
+    && dbgsym="postgresql-${PG_MAJOR}-roaringbitmap-dbgsym_${PACKAGE_VERSION}_${deb_arch}.deb" \
+    && built=$(cd /src && ls -1 ./*.deb | sed 's|^\./||' | sort | xargs) \
+    && if [ "$built" != "$main $dbgsym" ] && [ "$built" != "$dbgsym $main" ]; then \
+        echo "unexpected build outputs: $built" >&2; exit 1; \
+    fi \
+    && install -d /packages \
+    && cp "/src/$main" "/packages/${prefix}${main}" \
+    && cp "/src/$dbgsym" "/packages/${prefix}${dbgsym}" \
+    && cd /packages \
+    && for f in *.deb; do sha256sum "$f" > "$f.sha256"; done \
+    && ls -l /packages
+
+FROM scratch AS packages
+COPY --from=build /packages/ /
+
+# Clean image for testing the exact packages: only the pinned PostgreSQL
+# runtime from PGDG, with no toolchain or build tree. postgresql-client-<M>
+# ships pg_config and pg_regress, so the regression suite runs against the
+# installed .so without postgresql-server-dev-<M>.
+FROM ${BASE_IMAGE} AS test
+ARG PG_MAJOR
+ARG PG_PACKAGE_VERSION
+ENV PG_MAJOR=${PG_MAJOR} \
+    PG_PACKAGE_VERSION=${PG_PACKAGE_VERSION}
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc /usr/share/postgresql-common/pgdg/
+COPY --from=build /etc/apt/sources.list.d/pgdg.list /etc/apt/sources.list.d/
+
+RUN libpq_pins= \
+    && if [ "$PG_MAJOR" = 19 ]; then libpq_pins="libpq5=${PG_PACKAGE_VERSION}"; fi \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+        "postgresql-${PG_MAJOR}=${PG_PACKAGE_VERSION}" \
+        "postgresql-client-${PG_MAJOR}=${PG_PACKAGE_VERSION}" \
+        $libpq_pins \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=packages / /packages/
+COPY sql/ /src/sql/
+COPY expected/ /src/expected/
+COPY scripts/test-package /src/scripts/
+WORKDIR /src
+ENTRYPOINT ["/src/scripts/test-package"]
diff --git a/scripts/test-package b/scripts/test-package
new file mode 100755
index 0000000..3e0a7d9
--- /dev/null
+++ b/scripts/test-package
@@ -0,0 +1,379 @@
+#!/usr/bin/env bash
+#
+# Exact-package test for the pg_roaringbitmap release assets of one build row.
+# Runs as root in the clean `test` stage of Dockerfile.package:
+#
+#   1. asset names, .sha256 sidecars, .deb metadata and exact manifests
+#      (expectations taken from debian/control.in and the v1.2.0-1.pscale1
+#      release assets)
+#   2. dpkg -i into the clean image (no extra packages may be pulled in)
+#   3. initdb + start (roaringbitmap needs no preload); CREATE EXTENSION and
+#      behavior probes: set operations, aggregates, roaringbitmap64, a binary
+#      COPY round-trip through *_recv, and corrupt blobs rejected
+#   4. the regression suite (sql/*.sql, as the Makefile's REGRESS) against the
+#      installed .so. postgresql-client-<M> ships pg_regress, so nothing is
+#      built or added; the .so checksum must not change.
+#
+# --probes-only skips 1-2 and runs 3-4 against an existing installation
+# (--bindir), as the current user unless root. This lets the probes run on a
+# developer machine against a source build, without Docker.
+
+set -euo pipefail
+
+PG_MAJOR=""
+DEBIAN_VERSION=""
+ASSET_ARCH=""
+PACKAGE_VERSION=""
+PACKAGES_DIR=/packages
+SRC_DIR=/src
+BINDIR=""
+PROBES_ONLY=false
+PG_PACKAGE_VERSION=${PG_PACKAGE_VERSION:-}
+
+usage() {
+	echo "usage: scripts/test-package --pg <17|18|19> --debian <12|13> --asset-arch <x86_64|arm64> --version <package-version> [--packages <dir>] [--src <dir>]" >&2
+	echo "       scripts/test-package --probes-only --pg <17|18|19> --bindir <dir> [--src <dir>]" >&2
+	echo "       PG_PACKAGE_VERSION must name the pinned PGDG server version (package mode)" >&2
+	exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+	case "$1" in
+	--pg) PG_MAJOR=${2:-}; shift 2 ;;
+	--debian) DEBIAN_VERSION=${2:-}; shift 2 ;;
+	--asset-arch) ASSET_ARCH=${2:-}; shift 2 ;;
+	--version) PACKAGE_VERSION=${2:-}; shift 2 ;;
+	--packages) PACKAGES_DIR=${2:-}; shift 2 ;;
+	--src) SRC_DIR=${2:-}; shift 2 ;;
+	--bindir) BINDIR=${2:-}; shift 2 ;;
+	--probes-only) PROBES_ONLY=true; shift ;;
+	*) echo "test-package: unknown argument: $1" >&2; usage ;;
+	esac
+done
+
+[[ "$PG_MAJOR" =~ ^(17|18|19)$ ]] && [[ -d "$SRC_DIR/sql" && -d "$SRC_DIR/expected" ]] || usage
+if $PROBES_ONLY; then
+	[[ -x "$BINDIR/pg_config" ]] || usage
+else
+	if [[ ! "$DEBIAN_VERSION" =~ ^(12|13)$ ]] || [[ ! "$ASSET_ARCH" =~ ^(x86_64|arm64)$ ]] ||
+		[[ -z "$PACKAGE_VERSION" ]] || [[ -z "$PG_PACKAGE_VERSION" ]] || [[ ! -d "$PACKAGES_DIR" ]]; then
+		usage
+	fi
+	BINDIR="/usr/lib/postgresql/${PG_MAJOR}/bin"
+fi
+
+fail() {
+	echo "test-package: FAIL: $*" >&2
+	exit 1
+}
+
+expect_eq() {
+	local what=$1 actual=$2 expected=$3
+	[[ "$actual" == "$expected" ]] || fail "$what: expected '$expected', got '$actual'"
+}
+
+sha256() {
+	if command -v sha256sum >/dev/null; then sha256sum "$@"; else shasum -a 256 "$@"; fi
+}
+
+PKG="postgresql-${PG_MAJOR}-roaringbitmap"
+PKGLIBDIR=$("$BINDIR/pg_config" --pkglibdir)
+
+if ! $PROBES_ONLY; then
+	case "$ASSET_ARCH" in
+	x86_64) DEB_ARCH=amd64 ;;
+	arm64) DEB_ARCH=arm64 ;;
+	esac
+	PREFIX=""
+	if [[ "$DEBIAN_VERSION" == 13 ]]; then
+		PREFIX="pg${PG_MAJOR}-trixie-${ASSET_ARCH}-"
+	fi
+	MAIN_ASSET="${PREFIX}${PKG}_${PACKAGE_VERSION}_${DEB_ARCH}.deb"
+	DBGSYM_ASSET="${PREFIX}${PKG}-dbgsym_${PACKAGE_VERSION}_${DEB_ARCH}.deb"
+	MAIN_DEB="$PACKAGES_DIR/$MAIN_ASSET"
+	DBGSYM_DEB="$PACKAGES_DIR/$DBGSYM_ASSET"
+	expect_eq "pkglibdir" "$PKGLIBDIR" "/usr/lib/postgresql/${PG_MAJOR}/lib"
+
+	echo "test-package: PG ${PG_MAJOR} / Debian ${DEBIAN_VERSION} / ${ASSET_ARCH} / ${PACKAGE_VERSION}"
+
+	# --- pinned runtime -----------------------------------------------------------
+	expect_eq "postgresql-${PG_MAJOR} version" \
+		"$(dpkg-query -W -f='${Version}' "postgresql-${PG_MAJOR}")" "$PG_PACKAGE_VERSION"
+	expect_eq "/usr/lib/postgresql" "$(find /usr/lib/postgresql -mindepth 1 -maxdepth 1 -printf '%f\n' | sort | xargs)" "$PG_MAJOR"
+	if [[ "$PG_MAJOR" != 19 ]] && grep -Eq -- '-pgdg .*\b19\b' /etc/apt/sources.list.d/pgdg.list; then
+		fail "PGDG component 19 is enabled on a PG ${PG_MAJOR} row"
+	fi
+
+	# --- 1. asset set, checksums --------------------------------------------------
+	# Same contract as v1.2.0-1.pscale1: main + dbgsym, each with a sidecar
+	# holding `sha256sum <asset>` output.
+	expected_assets=$(printf '%s\n' "$MAIN_ASSET" "$MAIN_ASSET.sha256" "$DBGSYM_ASSET" "$DBGSYM_ASSET.sha256" | sort)
+	actual_assets=$(find "$PACKAGES_DIR" -mindepth 1 -maxdepth 1 -printf '%f\n' | sort)
+	if [[ "$actual_assets" != "$expected_assets" ]]; then
+		diff <(echo "$expected_assets") <(echo "$actual_assets") >&2 || true
+		fail "asset set in $PACKAGES_DIR does not match"
+	fi
+	for asset in "$MAIN_ASSET" "$DBGSYM_ASSET"; do
+		expect_eq "$asset.sha256" "$(cat "$PACKAGES_DIR/$asset.sha256")" \
+			"$(cd "$PACKAGES_DIR" && sha256sum "$asset")"
+	done
+
+	# --- metadata -----------------------------------------------------------------
+	# From debian/control.in; matches v1.2.0-1.pscale1 (no Breaks field there).
+	field() { dpkg-deb --field "$1" "$2"; }
+	expect_eq Package "$(field "$MAIN_DEB" Package)" "$PKG"
+	expect_eq Version "$(field "$MAIN_DEB" Version)" "$PACKAGE_VERSION"
+	expect_eq Architecture "$(field "$MAIN_DEB" Architecture)" "$DEB_ARCH"
+	expect_eq Source "$(field "$MAIN_DEB" Source)" pg-roaringbitmap
+	expect_eq Section "$(field "$MAIN_DEB" Section)" libs
+	expect_eq Priority "$(field "$MAIN_DEB" Priority)" optional
+	expect_eq Maintainer "$(field "$MAIN_DEB" Maintainer)" "PlanetScale <noreply@planetscale.com>"
+	expect_eq Homepage "$(field "$MAIN_DEB" Homepage)" https://github.com/planetscale/pg_roaringbitmap
+	depends=$(field "$MAIN_DEB" Depends)
+	[[ "$depends" =~ ^postgresql-${PG_MAJOR},\ libc6\ \(\>=\ [0-9.]+\)$ ]] || fail "Depends: $depends"
+	expect_eq Breaks "$(field "$MAIN_DEB" Breaks)" ""
+
+	expect_eq dbgsym.Package "$(field "$DBGSYM_DEB" Package)" "$PKG-dbgsym"
+	expect_eq dbgsym.Version "$(field "$DBGSYM_DEB" Version)" "$PACKAGE_VERSION"
+	expect_eq dbgsym.Architecture "$(field "$DBGSYM_DEB" Architecture)" "$DEB_ARCH"
+	expect_eq dbgsym.Section "$(field "$DBGSYM_DEB" Section)" debug
+	expect_eq dbgsym.Depends "$(field "$DBGSYM_DEB" Depends)" "$PKG (= $PACKAGE_VERSION)"
+	build_id=$(field "$DBGSYM_DEB" Build-Ids)
+	[[ "$build_id" =~ ^[0-9a-f]{40}$ ]] || fail "dbgsym Build-Ids: $build_id"
+
+	# --- manifests ----------------------------------------------------------------
+	# Path column of `dpkg-deb --contents` (symlinks keep their "-> target").
+	# changelog.gz is the upstream CHANGELOG.md (dh_installchangelogs).
+	manifest() { dpkg-deb --contents "$1" | awk '{ $1 = $2 = $3 = $4 = $5 = ""; sub(/^ +/, ""); print }' | sort; }
+
+	ext=./usr/share/postgresql/${PG_MAJOR}/extension
+	expected_main=$(sort <<EOF
+./
+./usr/
+./usr/lib/
+./usr/lib/postgresql/
+./usr/lib/postgresql/${PG_MAJOR}/
+./usr/lib/postgresql/${PG_MAJOR}/lib/
+./usr/lib/postgresql/${PG_MAJOR}/lib/bitcode/
+./usr/lib/postgresql/${PG_MAJOR}/lib/bitcode/roaringbitmap/
+./usr/lib/postgresql/${PG_MAJOR}/lib/bitcode/roaringbitmap/roaring64_buffer_reader.bc
+./usr/lib/postgresql/${PG_MAJOR}/lib/bitcode/roaringbitmap/roaring_buffer_reader.bc
+./usr/lib/postgresql/${PG_MAJOR}/lib/bitcode/roaringbitmap/roaringbitmap.bc
+./usr/lib/postgresql/${PG_MAJOR}/lib/bitcode/roaringbitmap/roaringbitmap64.bc
+./usr/lib/postgresql/${PG_MAJOR}/lib/bitcode/roaringbitmap.index.bc
+./usr/lib/postgresql/${PG_MAJOR}/lib/roaringbitmap.so
+./usr/share/
+./usr/share/doc/
+./usr/share/doc/${PKG}/
+./usr/share/doc/${PKG}/README.md.gz
+./usr/share/doc/${PKG}/changelog.Debian.gz
+./usr/share/doc/${PKG}/changelog.gz
+./usr/share/doc/${PKG}/copyright
+./usr/share/postgresql/
+./usr/share/postgresql/${PG_MAJOR}/
+${ext}/
+${ext}/roaringbitmap--0.2--0.3.sql
+${ext}/roaringbitmap--0.2.sql
+${ext}/roaringbitmap--0.3--0.4.sql
+${ext}/roaringbitmap--0.4--0.5.sql
+${ext}/roaringbitmap--0.5--1.0.sql
+${ext}/roaringbitmap--1.0--1.1.sql
+${ext}/roaringbitmap--1.1--1.2.sql
+${ext}/roaringbitmap--1.2.sql
+${ext}/roaringbitmap.control
+EOF
+	)
+	expected_dbgsym=$(sort <<EOF
+./
+./usr/
+./usr/lib/
+./usr/lib/debug/
+./usr/lib/debug/.build-id/
+./usr/lib/debug/.build-id/${build_id:0:2}/
+./usr/lib/debug/.build-id/${build_id:0:2}/${build_id:2}.debug
+./usr/share/
+./usr/share/doc/
+./usr/share/doc/${PKG}-dbgsym -> ${PKG}
+EOF
+	)
+	for kind in main dbgsym; do
+		if [[ "$kind" == main ]]; then deb=$MAIN_DEB expected=$expected_main; else deb=$DBGSYM_DEB expected=$expected_dbgsym; fi
+		actual=$(manifest "$deb")
+		if [[ "$actual" != "$expected" ]]; then
+			diff <(echo "$expected") <(echo "$actual") >&2 || true
+			fail "$kind manifest differs"
+		fi
+	done
+
+	# --- 2. clean install ---------------------------------------------------------
+	before=$(dpkg-query -W -f='${Package}\n' | sort)
+	dpkg -i "$MAIN_DEB" "$DBGSYM_DEB"
+	after=$(dpkg-query -W -f='${Package}\n' | sort)
+	expect_eq "packages added by install" "$(comm -13 <(echo "$before") <(echo "$after") | xargs)" "$PKG $PKG-dbgsym"
+	expect_eq "installed version" "$(dpkg-query -W -f='${Version}' "$PKG")" "$PACKAGE_VERSION"
+	dpkg --verify "$PKG" "$PKG-dbgsym" || fail "dpkg --verify"
+fi
+
+SO=""
+for suffix in .so .dylib; do
+	[[ -f "$PKGLIBDIR/roaringbitmap$suffix" ]] && SO="$PKGLIBDIR/roaringbitmap$suffix" && break
+done
+[[ -n "$SO" ]] || fail "roaringbitmap library missing in $PKGLIBDIR"
+so_sha=$(sha256 "$SO")
+
+# --- cluster helpers ------------------------------------------------------------
+if [[ $EUID -eq 0 ]]; then
+	WORK=/tmp/roaringbitmap-test
+	RUN_AS=(runuser -u postgres --)
+else
+	WORK=$(mktemp -d)
+	RUN_AS=()
+fi
+SOCK=$WORK/sock
+PORT=55435
+PGDATA_DIR=$WORK/data
+LOG=$WORK/postgres.log
+export PGHOST=$SOCK PGPORT=$PORT
+
+as_pg_user() { ${RUN_AS[@]+"${RUN_AS[@]}"} env PATH="$BINDIR:$PATH" "$@"; }
+
+# mkdir_pg <dir>...: directories owned by the user running the server
+mkdir_pg() {
+	mkdir -p "$@"
+	[[ $EUID -ne 0 ]] || chown postgres:postgres "$@"
+}
+
+psql_q() { "$BINDIR/psql" -X -q -A -t -v ON_ERROR_STOP=1 -U postgres -d postgres "$@"; }
+
+start_cluster() {
+	stop_cluster
+	rm -rf "$PGDATA_DIR" "$SOCK" "$LOG"
+	mkdir_pg "$WORK" "$SOCK"
+	as_pg_user initdb -D "$PGDATA_DIR" -U postgres --auth=trust --no-locale -E UTF8 >/dev/null
+	local opts="-c port=$PORT -c listen_addresses='' -c unix_socket_directories=$SOCK"
+	as_pg_user pg_ctl -D "$PGDATA_DIR" -l "$LOG" -w -o "$opts" start >/dev/null ||
+		{ cat "$LOG" >&2; fail "server did not start"; }
+	expect_eq "server major" "$(psql_q -c "SELECT current_setting('server_version_num')::int / 10000")" "$PG_MAJOR"
+}
+
+stop_cluster() {
+	if [[ -f "$PGDATA_DIR/postmaster.pid" ]]; then
+		as_pg_user pg_ctl -D "$PGDATA_DIR" -m fast -w stop >/dev/null
+	fi
+	if [[ -f "$LOG" ]] && grep -E 'PANIC|TRAP:|terminated by signal|server process .* was terminated' "$LOG" >&2; then
+		fail "server log has crashes"
+	fi
+	return 0
+}
+
+cleanup() {
+	stop_cluster || true
+	[[ $EUID -eq 0 ]] || rm -rf "$WORK"
+}
+trap cleanup EXIT
+
+# probe <label> <expected> <sql>: single-value result, array output format
+probe() {
+	expect_eq "$1" "$(PGOPTIONS='-c roaringbitmap.output_format=array' psql_q -c "$3")" "$2"
+}
+
+expect_error() {
+	local sql=$1 pattern=$2 out
+	if out=$(psql_q -c "$sql" 2>&1); then
+		fail "'$sql' succeeded, expected: $pattern"
+	fi
+	grep -Fq "$pattern" <<<"$out" || fail "'$sql': unexpected error: $out"
+}
+
+# --- 3. CREATE EXTENSION + behavior probes (runtime dependencies only) ---------
+echo "test-package: behavior probes"
+start_cluster
+if grep -E 'WARNING|ERROR|FATAL' "$LOG" >&2; then fail "startup log has warnings/errors"; fi
+
+psql_q -c 'CREATE EXTENSION roaringbitmap'
+probe extversion 1.2 "SELECT extversion FROM pg_extension WHERE extname = 'roaringbitmap'"
+
+# The postgres-private consumer probes (tests/pg_regress/common/sql/roaringbitmap.sql).
+probe rb_cardinality 5 "SELECT rb_cardinality(roaringbitmap('{1,2,3,100,1000}'))"
+probe "& (and)" '{2,3}' "SELECT roaringbitmap('{1,2,3}') & roaringbitmap('{2,3,4}')"
+probe "| (or)" '{1,2,3,4,5}' "SELECT roaringbitmap('{1,2,3}') | roaringbitmap('{3,4,5}')"
+probe "# (xor)" '{1,4}' "SELECT roaringbitmap('{1,2,3}') # roaringbitmap('{2,3,4}')"
+probe "- (andnot)" '{1}' "SELECT roaringbitmap('{1,2,3}') - roaringbitmap('{2,3}')"
+probe rb_contains t "SELECT rb_contains(roaringbitmap('{1,2,3}'), 2)"
+probe "rb_contains (absent)" f "SELECT rb_contains(roaringbitmap('{1,2,3}'), 4)"
+probe "rb_min/rb_max" '5|15' "SELECT rb_min(roaringbitmap('{5,10,15}')), rb_max(roaringbitmap('{5,10,15}'))"
+probe rb_to_array '{7,8,9}' "SELECT rb_to_array(roaringbitmap('{9,7,8}'))"
+probe rb_or '{1,2,3,4,5}' "SELECT rb_or(roaringbitmap('{1,2,3}'), roaringbitmap('{3,4,5}'))"
+probe rb_and '{2,3}' "SELECT rb_and(roaringbitmap('{1,2,3}'), roaringbitmap('{2,3,4}'))"
+probe rb_build_agg 5 "SELECT rb_cardinality(rb_build_agg(id)) FROM (VALUES (1), (2), (2), (3), (5), (8)) v(id)"
+probe "rb_build_agg 100k" 100000 "SELECT rb_cardinality(rb_build_agg(i)) FROM generate_series(1, 100000) i"
+probe rb_or_agg '{1,2,3,4}' "SELECT rb_or_agg(rb) FROM (VALUES (roaringbitmap('{1,2}')), (roaringbitmap('{3,4}'))) v(rb)"
+
+# roaringbitmap64, with values above 2^32.
+probe rb64_cardinality 3 "SELECT rb64_cardinality(rb64_build('{1,4294967296,9223372036854775807}'::bigint[]))"
+probe "rb64 |" '{1,4294967296,8589934592}' \
+	"SELECT rb64_build('{1,4294967296}'::bigint[]) | rb64_build('{4294967296,8589934592}'::bigint[])"
+probe rb64_contains t "SELECT rb64_contains(rb64_build('{4294967296}'::bigint[]), 4294967296::bigint)"
+probe rb64_build_agg '4294967290|4294967300|11' \
+	"SELECT rb64_min(b), rb64_max(b), rb64_cardinality(b) FROM (SELECT rb64_build_agg(i) b FROM generate_series(4294967290::bigint, 4294967300::bigint) i) s"
+
+# Binary COPY round-trip through roaringbitmap{,64}_send/_recv.
+mkdir_pg "$WORK/copy"
+psql_q <<EOF
+CREATE TABLE rb_bin (id int, rb roaringbitmap, rb64 roaringbitmap64);
+INSERT INTO rb_bin
+    SELECT g, rb_build_agg(x), rb64_build_agg(x::bigint * 4294967296)
+    FROM generate_series(1, 5) g, generate_series(1, g * 1000) x GROUP BY g;
+INSERT INTO rb_bin VALUES (0, '{}', '{}');
+COPY rb_bin TO '$WORK/copy/rb.bin' (FORMAT binary);
+CREATE TABLE rb_bin2 (LIKE rb_bin);
+COPY rb_bin2 FROM '$WORK/copy/rb.bin' (FORMAT binary);
+EOF
+probe "binary COPY round-trip" 6 \
+	"SELECT count(*) FROM rb_bin a JOIN rb_bin2 b USING (id) WHERE rb_equals(a.rb, b.rb) AND rb64_equals(a.rb64, b.rb64)"
+
+# Corrupt blobs are rejected by *_recv and the bytea casts, without crashing.
+psql_q -c "COPY (SELECT 1, '\\x0102'::bytea, NULL::bytea) TO '$WORK/copy/bad.bin' (FORMAT binary)" \
+	-c "COPY (SELECT 1, NULL::bytea, '\\x0102'::bytea) TO '$WORK/copy/bad64.bin' (FORMAT binary)" \
+	-c "COPY (SELECT 1, ''::bytea, NULL::bytea) TO '$WORK/copy/empty.bin' (FORMAT binary)"
+for f in bad bad64 empty; do
+	expect_error "COPY rb_bin2 FROM '$WORK/copy/$f.bin' (FORMAT binary)" 'bitmap format is error'
+done
+expect_error "SELECT '\\x0102'::bytea::roaringbitmap" 'bitmap format is error'
+expect_error "SELECT '\\x0102'::bytea::roaringbitmap64" 'bitmap format is error'
+probe "rows after rejected input" 6 "SELECT count(*) FROM rb_bin2"
+psql_q -c 'DROP EXTENSION roaringbitmap CASCADE'
+stop_cluster
+
+# --- 4. regression suite against the installed .so -----------------------------
+# The Makefile's REGRESS is every sql/*.sql.
+PG_REGRESS="$(dirname "$("$BINDIR/pg_config" --pgxs)")/../test/regress/pg_regress"
+[[ -x "$PG_REGRESS" ]] || fail "$PG_REGRESS missing"
+tests=()
+for f in "$SRC_DIR"/sql/*.sql; do
+	t=$(basename "$f" .sql)
+	[[ -f "$SRC_DIR/expected/$t.out" ]] || fail "no expected/$t.out"
+	tests+=("$t")
+done
+[[ ${#tests[@]} -gt 0 ]] || fail "no regression tests in $SRC_DIR/sql"
+
+echo "test-package: REGRESS (${tests[*]})"
+start_cluster
+regress_dir=$WORK/regress
+rm -rf "$regress_dir"
+mkdir_pg "$regress_dir"
+cp -R "$SRC_DIR/sql" "$SRC_DIR/expected" "$regress_dir/"
+[[ $EUID -ne 0 ]] || chown -R postgres:postgres "$regress_dir"
+if ! (cd "$regress_dir" && as_pg_user "$PG_REGRESS" --inputdir=. --bindir="$BINDIR" \
+	--host="$SOCK" --port="$PORT" --user=postgres --dbname=contrib_regression "${tests[@]}"); then
+	cat "$regress_dir/regression.diffs" >&2 || true
+	fail "REGRESS failed"
+fi
+stop_cluster
+expect_eq "roaringbitmap library after all tests" "$(sha256 "$SO")" "$so_sha"
+
+if $PROBES_ONLY; then
+	echo "test-package: PG ${PG_MAJOR} probes against $BINDIR passed"
+else
+	echo "test-package: PG ${PG_MAJOR} / Debian ${DEBIAN_VERSION} / ${ASSET_ARCH} passed"
+fi

From 7f9d0a83efd6e5acc4a52f81bc3a668dd0a9d9e7 Mon Sep 17 00:00:00 2001
From: pthorpe92 <p.thorpe.dev@gmail.com>
Date: Mon, 5 Oct 2026 16:35:22 -0700
Subject: [PATCH 07/12] Add release inventory and fail-closed verifier

packaging/release-assets.txt lists the 10 consumed (major, Debian,
arch) rows: PG 17 on Debian 12, PG 18 and 19 on Debian 12 and 13, on
amd64 and arm64. Each row ships the main and -dbgsym .deb plus their
.sha256 sidecars, 40 files in all, as v1.2.0-1.pscale1 does for its rows.

scripts/verify-release-assets rejects missing, duplicate, unexpected or
malformed assets, orphaned or wrong sidecars, mixed versions and versions
without the Debian -1 revision. scripts/test-verify-release-assets runs it
against the good set and 20 broken sets.
---
 packaging/release-assets.txt       |  15 +++
 scripts/test-verify-release-assets | 143 +++++++++++++++++++++++++++++
 scripts/verify-release-assets      | 125 +++++++++++++++++++++++++
 3 files changed, 283 insertions(+)
 create mode 100644 packaging/release-assets.txt
 create mode 100755 scripts/test-verify-release-assets
 create mode 100755 scripts/verify-release-assets

diff --git a/packaging/release-assets.txt b/packaging/release-assets.txt
new file mode 100644
index 0000000..413dd08
--- /dev/null
+++ b/packaging/release-assets.txt
@@ -0,0 +1,15 @@
+# Release contract for planetscale/pg_roaringbitmap v<version> releases.
+# One row per build: major debian asset_arch deb_arch
+# Each row ships the main and -dbgsym .deb, each with a <asset>.sha256 sidecar
+# (4 files per row). Debian 12 assets use the canonical Debian names; Debian 13
+# assets add the release-only prefix pg<major>-trixie-<asset_arch>-.
+17 12 arm64 arm64
+17 12 x86_64 amd64
+18 12 arm64 arm64
+18 12 x86_64 amd64
+18 13 arm64 arm64
+18 13 x86_64 amd64
+19 12 arm64 arm64
+19 12 x86_64 amd64
+19 13 arm64 arm64
+19 13 x86_64 amd64
diff --git a/scripts/test-verify-release-assets b/scripts/test-verify-release-assets
new file mode 100755
index 0000000..beb9b93
--- /dev/null
+++ b/scripts/test-verify-release-assets
@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+#
+# Fixture self-tests for scripts/verify-release-assets: the full good set must
+# pass, and every broken variant must fail.
+
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+VERIFY="$ROOT/scripts/verify-release-assets"
+CONTRACT="$ROOT/packaging/release-assets.txt"
+V=1.2.0-1.pscale2-1
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+
+sha256_line() {
+	if command -v sha256sum >/dev/null; then
+		(cd "$1" && sha256sum "$2")
+	else
+		(cd "$1" && shasum -a 256 "$2")
+	fi
+}
+
+# add <dir> <asset>: an asset with distinct content and a correct sidecar
+add() {
+	echo "$2" >"$1/$2"
+	sha256_line "$1" "$2" >"$1/$2.sha256"
+}
+
+populate() {
+	local target=$1 major debian asset_arch deb_arch prefix kind
+	mkdir -p "$target"
+	while read -r major debian asset_arch deb_arch; do
+		[[ -z "$major" || "$major" == \#* ]] && continue
+		prefix=""
+		[[ "$debian" == 13 ]] && prefix="pg${major}-trixie-${asset_arch}-"
+		for kind in "" -dbgsym; do
+			add "$target" "${prefix}postgresql-${major}-roaringbitmap${kind}_${V}_${deb_arch}.deb"
+		done
+	done <"$CONTRACT"
+}
+
+case_num=0
+expect_fail() {
+	local label=$1 err
+	shift
+	if err=$("$VERIFY" "$@" 2>&1 >/dev/null); then
+		echo "test-verify-release-assets: FAIL: '$label' passed" >&2
+		exit 1
+	fi
+	echo "  rejected $label: ${err#verify-release-assets: }"
+	case_num=$((case_num + 1))
+}
+
+fixture() {
+	local dir="$workdir/$1"
+	populate "$dir"
+	echo "$dir"
+}
+
+good=$(fixture good)
+[[ $(find "$good" -type f | wc -l) -eq 40 ]]
+"$VERIFY" --version "$V" "$good" "$CONTRACT"
+
+d=$(fixture missing)
+rm "$d/postgresql-17-roaringbitmap_${V}_amd64.deb" "$d/postgresql-17-roaringbitmap_${V}_amd64.deb.sha256"
+expect_fail "missing asset" "$d" "$CONTRACT"
+
+d=$(fixture missing-dbgsym)
+rm "$d/pg19-trixie-arm64-postgresql-19-roaringbitmap-dbgsym_${V}_arm64.deb"*
+expect_fail "missing dbgsym" "$d" "$CONTRACT"
+
+d=$(fixture unexpected-pg16)
+add "$d" "postgresql-16-roaringbitmap_${V}_amd64.deb"
+expect_fail "unexpected pg16" "$d" "$CONTRACT"
+
+d=$(fixture unexpected-pg17-trixie)
+add "$d" "pg17-trixie-x86_64-postgresql-17-roaringbitmap_${V}_amd64.deb"
+expect_fail "unexpected pg17 trixie" "$d" "$CONTRACT"
+
+d=$(fixture duplicate)
+add "$d" "postgresql-19-roaringbitmap_1.2.0-1.pscale3-1_arm64.deb"
+expect_fail "duplicate tuple" "$d" "$CONTRACT"
+
+d=$(fixture canonical-on-trixie)
+rm "$d/pg19-trixie-arm64-postgresql-19-roaringbitmap_${V}_arm64.deb"*
+expect_fail "trixie row without prefix" "$d" "$CONTRACT"
+
+d=$(fixture major-mismatch)
+rm "$d/pg19-trixie-x86_64-postgresql-19-roaringbitmap_${V}_amd64.deb"*
+add "$d" "pg19-trixie-x86_64-postgresql-18-roaringbitmap_${V}_amd64.deb"
+expect_fail "prefix/package major mismatch" "$d" "$CONTRACT"
+
+d=$(fixture arch-mismatch)
+rm "$d/pg18-trixie-arm64-postgresql-18-roaringbitmap_${V}_arm64.deb"*
+add "$d" "pg18-trixie-arm64-postgresql-18-roaringbitmap_${V}_amd64.deb"
+expect_fail "prefix/package arch mismatch" "$d" "$CONTRACT"
+
+d=$(fixture orphan-sha256)
+rm "$d/postgresql-18-roaringbitmap-dbgsym_${V}_amd64.deb"
+expect_fail "orphan .sha256" "$d" "$CONTRACT"
+
+d=$(fixture missing-sha256)
+rm "$d/postgresql-18-roaringbitmap_${V}_arm64.deb.sha256"
+expect_fail "missing .sha256" "$d" "$CONTRACT"
+
+d=$(fixture bad-sha256)
+echo corrupted >>"$d/pg18-trixie-x86_64-postgresql-18-roaringbitmap_${V}_amd64.deb"
+expect_fail "corrupted .sha256" "$d" "$CONTRACT"
+
+d=$(fixture sha256-path)
+(cd "$d" && sha256_line "$d" "postgresql-17-roaringbitmap_${V}_arm64.deb" |
+	sed "s|  |  ./|" >"postgresql-17-roaringbitmap_${V}_arm64.deb.sha256")
+expect_fail ".sha256 with a path prefix" "$d" "$CONTRACT"
+
+d=$(fixture stray-buildinfo)
+touch "$d/pg-roaringbitmap_${V}_amd64.buildinfo"
+expect_fail "stray .buildinfo" "$d" "$CONTRACT"
+
+d=$(fixture stray-changes)
+touch "$d/pg-roaringbitmap_${V}_amd64.changes"
+expect_fail "stray .changes" "$d" "$CONTRACT"
+
+d=$(fixture sha256-sha256)
+sha256_line "$d" "postgresql-18-roaringbitmap_${V}_amd64.deb.sha256" >"$d/postgresql-18-roaringbitmap_${V}_amd64.deb.sha256.sha256"
+expect_fail "sidecar of a sidecar" "$d" "$CONTRACT"
+
+d=$(fixture mixed-versions)
+rm "$d/postgresql-17-roaringbitmap_${V}_arm64.deb"*
+add "$d" "postgresql-17-roaringbitmap_1.2.0-1.pscale3-1_arm64.deb"
+expect_fail "mixed versions" "$d" "$CONTRACT"
+
+d="$workdir/no-revision"
+V=1.2.0-1.pscale2 populate "$d"
+expect_fail "version without the -1 revision" "$d" "$CONTRACT"
+
+expect_fail "wrong --version" --version 1.2.0-1.pscale1-1 "$good" "$CONTRACT"
+expect_fail "--version without the -1 revision" --version 1.2.0-1.pscale2 "$good" "$CONTRACT"
+
+empty="$workdir/empty"
+mkdir -p "$empty"
+expect_fail "empty directory" "$empty" "$CONTRACT"
+
+echo "test-verify-release-assets: good set passed, $case_num broken sets rejected"
diff --git a/scripts/verify-release-assets b/scripts/verify-release-assets
new file mode 100755
index 0000000..97c5e60
--- /dev/null
+++ b/scripts/verify-release-assets
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+#
+# Fail-closed check of a release directory against packaging/release-assets.txt.
+# Every file must be a main or -dbgsym .deb for a contract row (canonical name
+# on Debian 12, pg<M>-trixie-<asset_arch>- prefix on Debian 13), or that .deb's
+# .sha256 sidecar containing exactly `sha256sum <asset>` output. Missing,
+# duplicate, unexpected or unparseable files, and mixed versions, all fail.
+# Versions must end in a Debian revision (-<n>), as `${tag#v}-1` does
+# (1.2.0-1.pscale2 -> 1.2.0-1.pscale2-1).
+
+set -euo pipefail
+
+VERSION=""
+if [[ "${1:-}" == --version ]]; then
+	VERSION=${2:-}
+	shift 2
+fi
+ROOT=${1:-}
+CONTRACT=${2:-packaging/release-assets.txt}
+
+if [[ ! -d "$ROOT" || ! -f "$CONTRACT" ]] || [[ $# -gt 2 ]] ||
+	[[ -n "$VERSION" && ! "$VERSION" =~ ^[0-9][0-9A-Za-z.+~-]*-[0-9]+$ ]]; then
+	echo "usage: scripts/verify-release-assets [--version <version>] <artifact-directory> [contract]" >&2
+	exit 1
+fi
+
+fail() {
+	echo "verify-release-assets: $*" >&2
+	exit 1
+}
+
+sha256_line() {
+	if command -v sha256sum >/dev/null; then
+		(cd "$1" && sha256sum "$2")
+	else
+		(cd "$1" && shasum -a 256 "$2")
+	fi
+}
+
+workdir=$(mktemp -d)
+expected="$workdir/expected"
+actual="$workdir/actual"
+versions="$workdir/versions"
+trap 'rm -rf "$workdir"' EXIT
+: >"$expected"
+: >"$actual"
+: >"$versions"
+
+while read -r major debian asset_arch deb_arch extra; do
+	[[ -z "$major" || "$major" == \#* ]] && continue
+	if [[ -n "${extra:-}" ]] || [[ ! "$major" =~ ^(17|18|19)$ ]] ||
+		[[ ! "$debian" =~ ^(12|13)$ ]] || [[ ! "$asset_arch:$deb_arch" =~ ^(x86_64:amd64|arm64:arm64)$ ]]; then
+		fail "invalid contract row: $major $debian $asset_arch $deb_arch ${extra:-}"
+	fi
+	for kind in main dbgsym; do
+		printf '%s|%s|%s|%s\n' "$major" "$debian" "$asset_arch" "$kind" >>"$expected"
+	done
+done <"$CONTRACT"
+
+sort -o "$expected" "$expected"
+[[ -s "$expected" ]] || fail "empty contract"
+if [[ -n $(uniq -d "$expected") ]]; then
+	fail "duplicate contract tuple: $(uniq -d "$expected" | xargs)"
+fi
+
+ver_re='([0-9][0-9A-Za-z.+~-]*-[0-9]+)'
+while IFS= read -r -d '' path; do
+	name=$(basename "$path")
+	dir=$(dirname "$path")
+	if [[ "$name" == *.deb.sha256 ]]; then
+		deb=${name%.sha256}
+		[[ -f "$dir/$deb" ]] || fail "orphan checksum: $name"
+		[[ "$(cat "$path")" == "$(sha256_line "$dir" "$deb")" ]] || fail "bad checksum file: $name"
+		continue
+	fi
+
+	if [[ "$name" =~ ^postgresql-(17|18|19)-roaringbitmap(-dbgsym)?_${ver_re}_(amd64|arm64)\.deb$ ]]; then
+		major=${BASH_REMATCH[1]}
+		debian=12
+		dbgsym=${BASH_REMATCH[2]}
+		version=${BASH_REMATCH[3]}
+		deb_arch=${BASH_REMATCH[4]}
+		asset_arch=$deb_arch
+		[[ "$deb_arch" == amd64 ]] && asset_arch=x86_64
+	elif [[ "$name" =~ ^pg(17|18|19)-trixie-(x86_64|arm64)-postgresql-(17|18|19)-roaringbitmap(-dbgsym)?_${ver_re}_(amd64|arm64)\.deb$ ]]; then
+		major=${BASH_REMATCH[1]}
+		debian=13
+		asset_arch=${BASH_REMATCH[2]}
+		dbgsym=${BASH_REMATCH[4]}
+		version=${BASH_REMATCH[5]}
+		deb_arch=${BASH_REMATCH[6]}
+		[[ "$major" == "${BASH_REMATCH[3]}" ]] || fail "major mismatch: $name"
+		[[ "$asset_arch:$deb_arch" =~ ^(x86_64:amd64|arm64:arm64)$ ]] || fail "architecture mismatch: $name"
+	else
+		fail "unexpected asset name: $name"
+	fi
+
+	[[ -f "$path.sha256" ]] || fail "missing checksum file: $name.sha256"
+	kind=main
+	[[ -n "$dbgsym" ]] && kind=dbgsym
+	printf '%s|%s|%s|%s\n' "$major" "$debian" "$asset_arch" "$kind" >>"$actual"
+	echo "$version" >>"$versions"
+done < <(find "$ROOT" -type f -print0)
+
+sort -o "$actual" "$actual"
+if [[ -n $(uniq -d "$actual") ]]; then
+	fail "duplicate artifact tuple: $(uniq -d "$actual" | xargs)"
+fi
+
+missing=$(comm -23 "$expected" "$actual")
+unexpected=$(comm -13 "$expected" "$actual")
+if [[ -n "$missing" || -n "$unexpected" ]]; then
+	[[ -n "$missing" ]] && echo "verify-release-assets: missing artifact tuples: $(xargs <<<"$missing")" >&2
+	[[ -n "$unexpected" ]] && echo "verify-release-assets: unexpected artifact tuples: $(xargs <<<"$unexpected")" >&2
+	exit 1
+fi
+
+if [[ $(sort -u "$versions" | wc -l) -ne 1 ]]; then
+	fail "inconsistent package versions: $(sort -u "$versions" | xargs)"
+fi
+if [[ -n "$VERSION" && "$(head -n 1 "$versions")" != "$VERSION" ]]; then
+	fail "package version $(head -n 1 "$versions") does not match expected $VERSION"
+fi
+
+echo "verify-release-assets: $(wc -l <"$actual" | tr -d ' ') packages (+ .sha256) for version $(head -n 1 "$versions") passed"

From 29078814c1a9571d6c02bd2a7d6787f832e2537b Mon Sep 17 00:00:00 2001
From: pthorpe92 <p.thorpe.dev@gmail.com>
Date: Mon, 5 Oct 2026 16:36:18 -0700
Subject: [PATCH 08/12] ci: build, test and release PG 17/18/19 packages

packages.yml replaces release.yml and Dockerfile.pscale-debian12, which
built every major in one floating postgres:18.1-bookworm image (arm64
under QEMU) with a hard-coded VERSION default. It runs on pull requests,
master, v* tags, merge_group and workflow_dispatch:

- 10 package rows on native depot runners: docker build --target test,
  then scripts/test-package on the exact assets, then upload.
- "Release inventory": the verifier self-test plus the verifier on all
  40 downloaded files. It is the single aggregate check.
- release (tags only): verify again and upload the .debs and .sha256
  sidecars. The package version is still `${tag#v}-1`, so
  v1.2.0-1.pscale2 ships postgresql-<M>-roaringbitmap_1.2.0-1.pscale2-1_<arch>.deb.

build-test.yml (pgxn-tools source build + installcheck) gains PG 19.
---
 .github/workflows/build-test.yml |   9 +-
 .github/workflows/packages.yml   | 220 +++++++++++++++++++++++++++++++
 .github/workflows/release.yml    | 143 --------------------
 Dockerfile.pscale-debian12       |  42 ------
 4 files changed, 228 insertions(+), 186 deletions(-)
 create mode 100644 .github/workflows/packages.yml
 delete mode 100644 .github/workflows/release.yml
 delete mode 100644 Dockerfile.pscale-debian12

diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index e9dae38..fd2c77c 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -2,12 +2,19 @@ name: Build and test
 on:
   push: # Run on any push
   pull_request: # Run on PRs
+  merge_group:
+permissions:
+  contents: read
+# Source build + `make installcheck` (pgxn-tools resolves the newest PGDG
+# build of each major, so PG 19 tracks the current beta). The pinned,
+# authoritative builds and tests are in packages.yml.
 jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
-        pg: [17, 18]
+        pg: [17, 18, 19]
     container:
       image: pgxn/pgxn-tools
     steps:
diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
new file mode 100644
index 0000000..756413d
--- /dev/null
+++ b/.github/workflows/packages.yml
@@ -0,0 +1,220 @@
+name: Packages
+
+# Builds pg_roaringbitmap .debs against pinned PGDG packages for every
+# consumed PG major x Debian x arch, tests each exact package in a clean
+# image, and publishes them (with .sha256 sidecars) on v<version> tags.
+# "Release inventory" is the single aggregate check that gates the release.
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+  pull_request:
+  merge_group:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  version:
+    name: Package version
+    runs-on: depot-ubuntu-24.04
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Set package version
+        id: version
+        shell: bash
+        run: |
+          if [[ "$GITHUB_REF_TYPE" == tag ]]; then
+            # Same scheme as v1.2.0-1.pscale1; postgres-private downloads
+            # postgresql-<M>-roaringbitmap_<tag without v>-1_<arch>.deb.
+            if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-[0-9]+\.pscale[0-9]+$ ]]; then
+              echo "invalid release tag: $GITHUB_REF_NAME" >&2
+              exit 1
+            fi
+            version="${GITHUB_REF_NAME#v}-1"
+          else
+            version="1.2.0-1.pscale0~ci${GITHUB_RUN_NUMBER}-1"
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+  package:
+    name: PG ${{ matrix.pg }} / Debian ${{ matrix.debian }} / ${{ matrix.asset_arch }}
+    needs: version
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - pg: 17
+            pg_package_version: 17.11-1.pgdg12+2
+            debian: 12
+            codename: bookworm
+            base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
+            asset_arch: x86_64
+            runner: depot-ubuntu-24.04-4
+          - pg: 17
+            pg_package_version: 17.11-1.pgdg12+2
+            debian: 12
+            codename: bookworm
+            base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
+            asset_arch: arm64
+            runner: depot-ubuntu-24.04-arm-4
+          - pg: 18
+            pg_package_version: 18.6-1.pgdg12+2
+            debian: 12
+            codename: bookworm
+            base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
+            asset_arch: x86_64
+            runner: depot-ubuntu-24.04-4
+          - pg: 18
+            pg_package_version: 18.6-1.pgdg12+2
+            debian: 12
+            codename: bookworm
+            base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
+            asset_arch: arm64
+            runner: depot-ubuntu-24.04-arm-4
+          - pg: 18
+            pg_package_version: 18.6-1.pgdg13+2
+            debian: 13
+            codename: trixie
+            base_image: debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
+            asset_arch: x86_64
+            runner: depot-ubuntu-24.04-4
+          - pg: 18
+            pg_package_version: 18.6-1.pgdg13+2
+            debian: 13
+            codename: trixie
+            base_image: debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
+            asset_arch: arm64
+            runner: depot-ubuntu-24.04-arm-4
+          - pg: 19
+            pg_package_version: 19~beta4-1.pgdg12+1
+            debian: 12
+            codename: bookworm
+            base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
+            asset_arch: x86_64
+            runner: depot-ubuntu-24.04-4
+          - pg: 19
+            pg_package_version: 19~beta4-1.pgdg12+1
+            debian: 12
+            codename: bookworm
+            base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
+            asset_arch: arm64
+            runner: depot-ubuntu-24.04-arm-4
+          - pg: 19
+            pg_package_version: 19~beta4-1.pgdg13+1
+            debian: 13
+            codename: trixie
+            base_image: debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
+            asset_arch: x86_64
+            runner: depot-ubuntu-24.04-4
+          - pg: 19
+            pg_package_version: 19~beta4-1.pgdg13+1
+            debian: 13
+            codename: trixie
+            base_image: debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
+            asset_arch: arm64
+            runner: depot-ubuntu-24.04-arm-4
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Build packages
+        shell: bash
+        env:
+          PACKAGE_VERSION: ${{ needs.version.outputs.version }}
+        run: |
+          docker build --target test \
+            --build-arg BASE_IMAGE=${{ matrix.base_image }} \
+            --build-arg DEBIAN_CODENAME=${{ matrix.codename }} \
+            --build-arg DEBIAN_VERSION=${{ matrix.debian }} \
+            --build-arg PACKAGE_VERSION="$PACKAGE_VERSION" \
+            --build-arg PG_MAJOR=${{ matrix.pg }} \
+            --build-arg PG_PACKAGE_VERSION=${{ matrix.pg_package_version }} \
+            -t pg-roaringbitmap-test -f Dockerfile.package .
+
+      - name: Test exact packages
+        shell: bash
+        env:
+          PACKAGE_VERSION: ${{ needs.version.outputs.version }}
+        run: |
+          docker run --rm pg-roaringbitmap-test \
+            --pg ${{ matrix.pg }} \
+            --debian ${{ matrix.debian }} \
+            --asset-arch ${{ matrix.asset_arch }} \
+            --version "$PACKAGE_VERSION"
+
+      - name: Extract packages
+        shell: bash
+        run: |
+          container=$(docker create pg-roaringbitmap-test)
+          mkdir packages
+          docker cp "$container:/packages/." packages/
+          docker rm "$container"
+          ls -l packages
+
+      - name: Upload packages
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: pg_roaringbitmap-pg${{ matrix.pg }}-debian${{ matrix.debian }}-${{ matrix.asset_arch }}
+          path: packages/*
+          if-no-files-found: error
+          retention-days: 30
+
+  inventory:
+    name: Release inventory
+    needs: [version, package]
+    runs-on: depot-ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Download packages
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: pg_roaringbitmap-pg*
+          path: packages
+          merge-multiple: true
+
+      - name: Self-test the verifier
+        run: scripts/test-verify-release-assets
+
+      - name: Verify release assets
+        run: scripts/verify-release-assets --version "${{ needs.version.outputs.version }}" packages
+
+  release:
+    if: github.ref_type == 'tag'
+    needs: [version, inventory]
+    runs-on: depot-ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Download packages
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: pg_roaringbitmap-pg*
+          path: packages
+          merge-multiple: true
+
+      - name: Verify release assets
+        run: scripts/verify-release-assets --version "${{ needs.version.outputs.version }}" packages
+
+      - name: Upload .deb packages and checksums to release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          draft: false
+          prerelease: false
+          generate_release_notes: true
+          files: packages/*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 3faf001..0000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,143 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  build:
-    strategy:
-      matrix:
-        include:
-          - arch: amd64
-            runner: ubuntu-latest
-          - arch: arm64
-            runner: ubuntu-latest
-      fail-fast: false
-    runs-on: ${{ matrix.runner }}
-    outputs:
-      version: ${{ steps.version.outputs.VERSION }}
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-        if: matrix.arch == 'arm64'
-
-      - name: Get version from tag
-        id: version
-        run: |
-          echo "VERSION=${GITHUB_REF#refs/tags/v}-1" >> $GITHUB_OUTPUT
-          echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-
-      - name: Build Docker image with packages
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
-        with:
-          context: .
-          file: ./Dockerfile.pscale-debian12
-          push: false
-          load: true
-          tags: pg-roaringbitmap-builder
-          platforms: linux/${{ matrix.arch }}
-          build-args: |
-            VERSION=${{ steps.version.outputs.VERSION }}
-            GIT_SHA=${{ steps.version.outputs.GIT_SHA }}
-
-      - name: Extract .deb packages from Docker image
-        run: |
-          # Create a temporary container to copy files from
-          CONTAINER_ID=$(docker create \
-            --stop-timeout=1 \
-            --entrypoint="" \
-            pg-roaringbitmap-builder \
-              tail -f /dev/null)
-          docker start "${CONTAINER_ID}"
-
-          # Copy .deb files from container
-          docker exec ${CONTAINER_ID} sh -c 'tar -cf - /*.deb' | tar -xf -
-
-          # Clean up the container
-          docker stop ${CONTAINER_ID} || true
-          docker rm ${CONTAINER_ID} || true
-
-          # List the .deb files for verification
-          ls -la *.deb
-
-      - name: Verify package contents
-        run: |
-          # Verify that each PostgreSQL version package contains the crucial files
-          for deb in postgresql-*-roaringbitmap_*.deb; do
-            echo "Verifying $deb..."
-
-            # Extract the package and check contents
-            ar x "$deb" data.tar.xz
-
-            # Derive the PostgreSQL major version from the package name
-            PG_VERSION=$(echo "$deb" | sed -n 's/postgresql-\([0-9]*\)-roaringbitmap_.*/\1/p')
-
-            # Verify .so file exists
-            if ! tar -tf data.tar.xz | grep -q "./usr/lib/postgresql/${PG_VERSION}/lib/roaringbitmap.so"; then
-              echo "ERROR: Missing roaringbitmap.so in $deb"
-              exit 1
-            fi
-
-            # Verify control file exists
-            if ! tar -tf data.tar.xz | grep -q "./usr/share/postgresql/${PG_VERSION}/extension/roaringbitmap.control"; then
-              echo "ERROR: Missing roaringbitmap.control in $deb"
-              exit 1
-            fi
-
-            # Verify SQL file exists
-            if ! tar -tf data.tar.xz | grep -q "./usr/share/postgresql/${PG_VERSION}/extension/roaringbitmap--1.2.sql"; then
-              echo "ERROR: Missing roaringbitmap--1.2.sql in $deb"
-              exit 1
-            fi
-
-            echo "✓ $deb contains all crucial files"
-            rm -f data.tar.xz
-          done
-          echo "All packages verified successfully!"
-
-      - name: Calculate checksums
-        run: |
-          for file in *.deb; do
-            sha256sum "$file" > "$file.sha256"
-          done
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: pg-roaringbitmap-${{ matrix.arch }}
-          path: |
-            *.deb
-            *.deb.sha256
-          retention-days: 30
-
-  release:
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          path: packages/
-
-      - name: Create Release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
-        with:
-          files: |
-            packages/**/*.deb
-            packages/**/*.deb.sha256
-          generate_release_notes: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/Dockerfile.pscale-debian12 b/Dockerfile.pscale-debian12
deleted file mode 100644
index 6b4f375..0000000
--- a/Dockerfile.pscale-debian12
+++ /dev/null
@@ -1,42 +0,0 @@
-FROM postgres:18.1-bookworm AS deps
-
-# VERSION should be injected by the ci release workflow as a build-arg based on the git tag pushed to the repo
-ARG VERSION=1.2.0-1.pscale1
-ARG GIT_SHA=unknown
-ENV VERSION=${VERSION}
-ENV GIT_SHA=${GIT_SHA}
-
-RUN apt-get -qy update && \
-	apt-get install -qy --no-install-recommends \
-		architecture-is-64-bit \
-		build-essential \
-		devscripts \
-		debhelper-compat \
-		lsb-release \
-		postgresql-all \
-		postgresql-server-dev-all
-
-FROM deps AS builder
-
-COPY . /src
-WORKDIR /src
-
-# this modifies the /src/debian/control.in template to make entries for all supported PostgreSQL versions
-RUN pg_buildext updatecontrol
-
-# this modifies the /src/debian/changelog file used by dpkg-buildpackage to set the version to use on the packages
-RUN dch -v "${VERSION}" \
-	--distribution "$(lsb_release -cs)" \
-	"Custom PlanetScale build"
-
-# This builds .deb packages for all supported PostgreSQL versions
-# and places them in ../ (relative to WORKDIR)
-RUN dpkg-buildpackage -us -uc -b
-
-# final image simply holds the built .deb packages
-#
-# this is an optimization to speed up CI by avoiding the slow process of
-# copying the full builder image into the local docker daemon when all we do
-# is start it once to copy out the packages.
-FROM postgres:18.1-bookworm
-COPY --from=builder /*.deb /

From 6f36df6b4bbf7ee44f1af68a8bf4e1fa35153a6c Mon Sep 17 00:00:00 2001
From: pthorpe92 <p.thorpe.dev@gmail.com>
Date: Mon, 5 Oct 2026 16:53:41 -0700
Subject: [PATCH 09/12] test-package: expect upstream's empty-input error from
 *_recv

Upstream 1.2.0 (c9e0d60) rejects empty binary input in roaringbitmap_recv
and roaringbitmap64_recv with 'empty roaring bitmap binary data'. Expect
that, and probe the 64-bit type's empty input too.
---
 scripts/test-package | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/test-package b/scripts/test-package
index 3e0a7d9..24ac08f 100755
--- a/scripts/test-package
+++ b/scripts/test-package
@@ -335,10 +335,15 @@ probe "binary COPY round-trip" 6 \
 # Corrupt blobs are rejected by *_recv and the bytea casts, without crashing.
 psql_q -c "COPY (SELECT 1, '\\x0102'::bytea, NULL::bytea) TO '$WORK/copy/bad.bin' (FORMAT binary)" \
 	-c "COPY (SELECT 1, NULL::bytea, '\\x0102'::bytea) TO '$WORK/copy/bad64.bin' (FORMAT binary)" \
-	-c "COPY (SELECT 1, ''::bytea, NULL::bytea) TO '$WORK/copy/empty.bin' (FORMAT binary)"
-for f in bad bad64 empty; do
+	-c "COPY (SELECT 1, ''::bytea, NULL::bytea) TO '$WORK/copy/empty.bin' (FORMAT binary)" \
+	-c "COPY (SELECT 1, NULL::bytea, ''::bytea) TO '$WORK/copy/empty64.bin' (FORMAT binary)"
+for f in bad bad64; do
 	expect_error "COPY rb_bin2 FROM '$WORK/copy/$f.bin' (FORMAT binary)" 'bitmap format is error'
 done
+# Upstream 1.2.0 (c9e0d60) rejects empty binary input explicitly.
+for f in empty empty64; do
+	expect_error "COPY rb_bin2 FROM '$WORK/copy/$f.bin' (FORMAT binary)" 'empty roaring bitmap binary data'
+done
 expect_error "SELECT '\\x0102'::bytea::roaringbitmap" 'bitmap format is error'
 expect_error "SELECT '\\x0102'::bytea::roaringbitmap64" 'bitmap format is error'
 probe "rows after rejected input" 6 "SELECT count(*) FROM rb_bin2"

From 59e974ab2f71d1e16b0a6331be8d351ca1569ae6 Mon Sep 17 00:00:00 2001
From: pthorpe92 <p.thorpe.dev@gmail.com>
Date: Tue, 6 Oct 2026 14:11:22 -0700
Subject: [PATCH 10/12] test-verify-release-assets: make canonical-on-trixie
 test its label, drop repeats

canonical-on-trixie only deleted the prefixed Debian 13 asset, which
repeated the missing case. Ship that build under its canonical name in a
per-job directory instead and assert it is rejected as a duplicate of
the Debian 12 tuple.

stray-changes and unexpected-pg16 hit the same unexpected-asset-name
branch as stray-buildinfo; drop them.
---
 scripts/test-verify-release-assets | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/scripts/test-verify-release-assets b/scripts/test-verify-release-assets
index beb9b93..12b3a27 100755
--- a/scripts/test-verify-release-assets
+++ b/scripts/test-verify-release-assets
@@ -48,9 +48,18 @@ expect_fail() {
 		exit 1
 	fi
 	echo "  rejected $label: ${err#verify-release-assets: }"
+	last_err=$err
 	case_num=$((case_num + 1))
 }
 
+# expect_error <label> <substring>: the last rejection was for this reason
+expect_error() {
+	if [[ "$last_err" != *"$2"* ]]; then
+		echo "test-verify-release-assets: FAIL: '$1' rejected for the wrong reason (want: $2)" >&2
+		exit 1
+	fi
+}
+
 fixture() {
 	local dir="$workdir/$1"
 	populate "$dir"
@@ -69,10 +78,6 @@ d=$(fixture missing-dbgsym)
 rm "$d/pg19-trixie-arm64-postgresql-19-roaringbitmap-dbgsym_${V}_arm64.deb"*
 expect_fail "missing dbgsym" "$d" "$CONTRACT"
 
-d=$(fixture unexpected-pg16)
-add "$d" "postgresql-16-roaringbitmap_${V}_amd64.deb"
-expect_fail "unexpected pg16" "$d" "$CONTRACT"
-
 d=$(fixture unexpected-pg17-trixie)
 add "$d" "pg17-trixie-x86_64-postgresql-17-roaringbitmap_${V}_amd64.deb"
 expect_fail "unexpected pg17 trixie" "$d" "$CONTRACT"
@@ -81,9 +86,16 @@ d=$(fixture duplicate)
 add "$d" "postgresql-19-roaringbitmap_1.2.0-1.pscale3-1_arm64.deb"
 expect_fail "duplicate tuple" "$d" "$CONTRACT"
 
+# A Debian 13 build shipped under the canonical (Debian 12) name, e.g. from
+# an unmerged per-job artifact directory: the unprefixed file parses as the
+# PG 19 / Debian 12 / arm64 package, which is then present twice. (In one flat
+# directory it would overwrite the Debian 12 file; that is the "missing" case.)
 d=$(fixture canonical-on-trixie)
 rm "$d/pg19-trixie-arm64-postgresql-19-roaringbitmap_${V}_arm64.deb"*
+mkdir "$d/pg19-debian13-arm64"
+add "$d/pg19-debian13-arm64" "postgresql-19-roaringbitmap_${V}_arm64.deb"
 expect_fail "trixie row without prefix" "$d" "$CONTRACT"
+expect_error "trixie row without prefix" "duplicate artifact tuple: 19|12|arm64|main"
 
 d=$(fixture major-mismatch)
 rm "$d/pg19-trixie-x86_64-postgresql-19-roaringbitmap_${V}_amd64.deb"*
@@ -116,10 +128,6 @@ d=$(fixture stray-buildinfo)
 touch "$d/pg-roaringbitmap_${V}_amd64.buildinfo"
 expect_fail "stray .buildinfo" "$d" "$CONTRACT"
 
-d=$(fixture stray-changes)
-touch "$d/pg-roaringbitmap_${V}_amd64.changes"
-expect_fail "stray .changes" "$d" "$CONTRACT"
-
 d=$(fixture sha256-sha256)
 sha256_line "$d" "postgresql-18-roaringbitmap_${V}_amd64.deb.sha256" >"$d/postgresql-18-roaringbitmap_${V}_amd64.deb.sha256.sha256"
 expect_fail "sidecar of a sidecar" "$d" "$CONTRACT"

From 51662faa399112d955538121d40c39562a6a3391 Mon Sep 17 00:00:00 2001
From: pthorpe92 <p.thorpe.dev@gmail.com>
Date: Tue, 6 Oct 2026 14:12:00 -0700
Subject: [PATCH 11/12] ci: run Packages on GitHub-hosted runners

Run 37508482475 never got a runner for its depot-* jobs, apparently
because those labels aren't available to this public repository. Use
ubuntu-latest, as release.yml and build-test.yml did, and the native
GitHub-hosted ubuntu-24.04-arm for arm64 rows instead of release.yml's
QEMU emulation.
---
 .github/workflows/packages.yml | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index 756413d..1f95110 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -21,7 +21,7 @@ permissions:
 jobs:
   version:
     name: Package version
-    runs-on: depot-ubuntu-24.04
+    runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
@@ -56,70 +56,70 @@ jobs:
             codename: bookworm
             base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
             asset_arch: x86_64
-            runner: depot-ubuntu-24.04-4
+            runner: ubuntu-latest
           - pg: 17
             pg_package_version: 17.11-1.pgdg12+2
             debian: 12
             codename: bookworm
             base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
             asset_arch: arm64
-            runner: depot-ubuntu-24.04-arm-4
+            runner: ubuntu-24.04-arm
           - pg: 18
             pg_package_version: 18.6-1.pgdg12+2
             debian: 12
             codename: bookworm
             base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
             asset_arch: x86_64
-            runner: depot-ubuntu-24.04-4
+            runner: ubuntu-latest
           - pg: 18
             pg_package_version: 18.6-1.pgdg12+2
             debian: 12
             codename: bookworm
             base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
             asset_arch: arm64
-            runner: depot-ubuntu-24.04-arm-4
+            runner: ubuntu-24.04-arm
           - pg: 18
             pg_package_version: 18.6-1.pgdg13+2
             debian: 13
             codename: trixie
             base_image: debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
             asset_arch: x86_64
-            runner: depot-ubuntu-24.04-4
+            runner: ubuntu-latest
           - pg: 18
             pg_package_version: 18.6-1.pgdg13+2
             debian: 13
             codename: trixie
             base_image: debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
             asset_arch: arm64
-            runner: depot-ubuntu-24.04-arm-4
+            runner: ubuntu-24.04-arm
           - pg: 19
             pg_package_version: 19~beta4-1.pgdg12+1
             debian: 12
             codename: bookworm
             base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
             asset_arch: x86_64
-            runner: depot-ubuntu-24.04-4
+            runner: ubuntu-latest
           - pg: 19
             pg_package_version: 19~beta4-1.pgdg12+1
             debian: 12
             codename: bookworm
             base_image: debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
             asset_arch: arm64
-            runner: depot-ubuntu-24.04-arm-4
+            runner: ubuntu-24.04-arm
           - pg: 19
             pg_package_version: 19~beta4-1.pgdg13+1
             debian: 13
             codename: trixie
             base_image: debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
             asset_arch: x86_64
-            runner: depot-ubuntu-24.04-4
+            runner: ubuntu-latest
           - pg: 19
             pg_package_version: 19~beta4-1.pgdg13+1
             debian: 13
             codename: trixie
             base_image: debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
             asset_arch: arm64
-            runner: depot-ubuntu-24.04-arm-4
+            runner: ubuntu-24.04-arm
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -169,7 +169,7 @@ jobs:
   inventory:
     name: Release inventory
     needs: [version, package]
-    runs-on: depot-ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -190,7 +190,7 @@ jobs:
   release:
     if: github.ref_type == 'tag'
     needs: [version, inventory]
-    runs-on: depot-ubuntu-24.04
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:

From d53c9e44c137bcbedb7f029749b4ad050e80018c Mon Sep 17 00:00:00 2001
From: pthorpe92 <p.thorpe.dev@gmail.com>
Date: Tue, 6 Oct 2026 14:12:00 -0700
Subject: [PATCH 12/12] ci: fail Release inventory on any failed row; annotate
 PGDG pins

Release inventory now always runs and its first step fails unless every
needed job succeeded, so it fails rather than skips when a package row
fails and can serve as the required check. release still runs only after
inventory succeeds.

Add renovate comments to the pinned PGDG versions in the deb-datasource
form postgres-private uses (suite/arch/component per row).
---
 .github/workflows/packages.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index 1f95110..9c62ad7 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -49,8 +49,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # pg_package_version pins exact PGDG builds, and PGDG drops superseded
+        # ones (19~beta4 first). The renovate comments use postgres-private's
+        # deb-datasource form so Renovate can propose bumps as PRs; they are
+        # inert until Renovate is enabled here with a manager for this file.
         include:
           - pg: 17
+            # renovate: datasource=deb depName=postgresql-17 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=bookworm-pgdg&binaryArch=amd64&components=main
             pg_package_version: 17.11-1.pgdg12+2
             debian: 12
             codename: bookworm
@@ -58,6 +63,7 @@ jobs:
             asset_arch: x86_64
             runner: ubuntu-latest
           - pg: 17
+            # renovate: datasource=deb depName=postgresql-17 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=bookworm-pgdg&binaryArch=arm64&components=main
             pg_package_version: 17.11-1.pgdg12+2
             debian: 12
             codename: bookworm
@@ -65,6 +71,7 @@ jobs:
             asset_arch: arm64
             runner: ubuntu-24.04-arm
           - pg: 18
+            # renovate: datasource=deb depName=postgresql-18 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=bookworm-pgdg&binaryArch=amd64&components=main
             pg_package_version: 18.6-1.pgdg12+2
             debian: 12
             codename: bookworm
@@ -72,6 +79,7 @@ jobs:
             asset_arch: x86_64
             runner: ubuntu-latest
           - pg: 18
+            # renovate: datasource=deb depName=postgresql-18 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=bookworm-pgdg&binaryArch=arm64&components=main
             pg_package_version: 18.6-1.pgdg12+2
             debian: 12
             codename: bookworm
@@ -79,6 +87,7 @@ jobs:
             asset_arch: arm64
             runner: ubuntu-24.04-arm
           - pg: 18
+            # renovate: datasource=deb depName=postgresql-18 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=trixie-pgdg&binaryArch=amd64&components=main
             pg_package_version: 18.6-1.pgdg13+2
             debian: 13
             codename: trixie
@@ -86,6 +95,7 @@ jobs:
             asset_arch: x86_64
             runner: ubuntu-latest
           - pg: 18
+            # renovate: datasource=deb depName=postgresql-18 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=trixie-pgdg&binaryArch=arm64&components=main
             pg_package_version: 18.6-1.pgdg13+2
             debian: 13
             codename: trixie
@@ -93,6 +103,7 @@ jobs:
             asset_arch: arm64
             runner: ubuntu-24.04-arm
           - pg: 19
+            # renovate: datasource=deb depName=postgresql-19 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=bookworm-pgdg&binaryArch=amd64&components=19
             pg_package_version: 19~beta4-1.pgdg12+1
             debian: 12
             codename: bookworm
@@ -100,6 +111,7 @@ jobs:
             asset_arch: x86_64
             runner: ubuntu-latest
           - pg: 19
+            # renovate: datasource=deb depName=postgresql-19 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=bookworm-pgdg&binaryArch=arm64&components=19
             pg_package_version: 19~beta4-1.pgdg12+1
             debian: 12
             codename: bookworm
@@ -107,6 +119,7 @@ jobs:
             asset_arch: arm64
             runner: ubuntu-24.04-arm
           - pg: 19
+            # renovate: datasource=deb depName=postgresql-19 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=trixie-pgdg&binaryArch=amd64&components=19
             pg_package_version: 19~beta4-1.pgdg13+1
             debian: 13
             codename: trixie
@@ -114,6 +127,7 @@ jobs:
             asset_arch: x86_64
             runner: ubuntu-latest
           - pg: 19
+            # renovate: datasource=deb depName=postgresql-19 registryUrl=https://apt.postgresql.org/pub/repos/apt?suite=trixie-pgdg&binaryArch=arm64&components=19
             pg_package_version: 19~beta4-1.pgdg13+1
             debian: 13
             codename: trixie
@@ -168,9 +182,23 @@ jobs:
 
   inventory:
     name: Release inventory
+    # Always report, so a failed or skipped package row fails this aggregate
+    # check instead of skipping it (a skipped required check counts as passed).
+    if: always()
     needs: [version, package]
     runs-on: ubuntu-latest
     steps:
+      - name: Require every package row to succeed
+        shell: bash
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: |
+          failed=$(jq -r 'to_entries[] | select(.value.result != "success") | "\(.key)=\(.value.result)"' <<<"$NEEDS")
+          if [[ -n "$failed" ]]; then
+            echo "required jobs did not succeed: $(xargs <<<"$failed")" >&2
+            exit 1
+          fi
+
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4