# Postgres extension image payload for pg_search.
#
# Unlike Dockerfile.paradedb-N / Dockerfile.official-N, this image is not a
# runnable Postgres. It is a `FROM scratch` artifact holding pg_search's shared
# library, control file, SQL scripts, licenses, and the system libraries
# pg_search links that the Postgres base image lacks. The CloudNativePG Postgres
# base image is used in the builder stage so the .deb's ABI matches the common
# extension-image runtime used by Postgres operators.
#
ARG BASE=ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie
FROM $BASE AS builder

ARG PG_VERSION_MAJOR=18
ARG PG_SEARCH_VERSION
ARG PG_SEARCH_DEB_AMD64_SHA256
ARG PG_SEARCH_DEB_ARM64_SHA256

USER 0

SHELL ["/bin/bash", "-o", "pipefail", "-c", "-e"]

# Install pg_search from GitHub Releases (same .deb as the runnable images).
RUN apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates curl && \
    : "${PG_SEARCH_VERSION:?PG_SEARCH_VERSION is required}" && \
    arch="$(dpkg --print-architecture)" && \
    case "$arch" in \
        amd64) checksum="$PG_SEARCH_DEB_AMD64_SHA256" ;; \
        arm64) checksum="$PG_SEARCH_DEB_ARM64_SHA256" ;; \
        *) echo "unsupported architecture: $arch" >&2; exit 1 ;; \
    esac && \
    if [ -z "$checksum" ]; then echo "checksum is required for $arch" >&2; exit 1; fi && \
    curl -fsSL -o /tmp/pg_search.deb "https://github.com/paradedb/paradedb/releases/download/v${PG_SEARCH_VERSION}/postgresql-${PG_VERSION_MAJOR}-pg-search_${PG_SEARCH_VERSION}-1PARADEDB-trixie_${arch}.deb" && \
    echo "${checksum}  /tmp/pg_search.deb" | sha256sum -c - && \
    dpkg-query -f '${Package}\n' -W | sort > /tmp/packages.before && \
    apt-get install -y --no-install-recommends /tmp/pg_search.deb && \
    dpkg-query -f '${Package}\n' -W | sort > /tmp/packages.after && \
    comm -13 /tmp/packages.before /tmp/packages.after > /tmp/packages.new && \
    rm /tmp/pg_search.deb && \
    rm -rf /var/lib/apt/lists/*

# Stage the system libraries pg_search.so links (libopenblas, libgfortran). Libraries
# the base image already has (libc, libm, libgcc_s, ...) are skipped, since shadowing
# them with a second copy on the consumer's LD_LIBRARY_PATH risks mixing
# runtimes. Each library is staged under its SONAME, the name the dynamic linker
# searches for, and its copyright travels with it.
RUN mkdir -p /system /licenses && \
    ldd "/usr/lib/postgresql/${PG_VERSION_MAJOR}/lib/pg_search.so" | awk '/=> \//{ print $1, $3 }' | \
    while read -r soname path; do \
        pkg="$(dpkg -S "$(readlink -f "$path")" | awk -F: 'NR == 1 { p = $1 } END { print p }')" || continue; \
        if ! grep -qxF "$pkg" /tmp/packages.new; then continue; fi; \
        echo "staging ${soname} (${pkg})"; \
        cp -L "$path" "/system/${soname}"; \
        if [ -f "/usr/share/doc/${pkg}/copyright" ]; then \
            mkdir -p "/licenses/${pkg}"; \
            cp -L "/usr/share/doc/${pkg}/copyright" "/licenses/${pkg}/"; \
        fi; \
    done

USER 65532:65532

# Final extension payload. Postgres 18+ can load this mounted /lib and
# /share/extension content through extension_control_path.
FROM scratch

ARG PG_VERSION_MAJOR=18

# Licenses
COPY --from=builder /usr/share/doc/postgresql-${PG_VERSION_MAJOR}-pg-search/copyright /licenses/postgresql-${PG_VERSION_MAJOR}-pg-search/
COPY --from=builder /licenses/ /licenses/

# Library: pg_search.so
COPY --from=builder /usr/lib/postgresql/${PG_VERSION_MAJOR}/lib/pg_search* /lib/

# Control + SQL scripts
COPY --from=builder /usr/share/postgresql/${PG_VERSION_MAJOR}/extension/pg_search* /share/extension/

# System libraries, which consumers put on LD_LIBRARY_PATH — `ld_library_path: [system]` in CloudNativePG
COPY --from=builder /system/ /system/

USER 65532:65532