C1-clean placement layer — absolute rootfs paths, published diff_id, platform-tagged index

[styk-tv]

Ask

Publish pgrdf-bundle additionally as a C1-clean placement layer, so a downstream assembler can reference pgRDF's layer by digest instead of extracting a tarball and copying the files into a new layer.

Adopts the contract in sporaxis-com/sporaxis#32. styk-tv/pgCK#15 takes the same step for pgCK.

Measured — the current shape

pgrdf-bundle:0.6.22-pg18-<arch> is a single gzip layer whose entries are relative: pgrdf-0.6.22-pg18-glibc-<arch>/lib/pgrdf.so. A consumer must tar -xzf … --strip-components=1 and then COPY the files, which produces a new layer. The shipped image therefore contains a copy of pgRDF rather than pgRDF's own attested blob, and per-layer provenance is lost at exactly that boundary.

The index descriptors also carry platform: null and no annotations, so an assembler cannot select an architecture from the index without fetching each leaf manifest (measured and recorded in styk-tv/pgCK#15).

Requirements

1. Absolute rootfs paths in the layer — usr/lib/postgresql/18/lib/pgrdf.so, usr/share/postgresql/18/extension/… — so applying the layer places the files.
2. Media type application/vnd.oci.image.layer.v1.tar+gzip, so the blob is mountable into another repository and referenceable from an image manifest's layers[].
3. Publish each layer's diff_id (uncompressed digest) in the artifact annotations, so an assembler can build a config's rootfs.diff_ids without decompressing.
4. platform on each multi-arch index descriptor.
5. Attestation covers the layer blob, per the contract.

Cost of requirement 1 — recorded now, not discovered later

Absolute rootfs paths make the layer non-relocatable, which today's tarball is. This is probably the right trade, but it should be a recorded decision:

• The artifact matrix grows an axis. A new PostgreSQL major becomes a differently-pathed layer, not merely a differently-built one.
• The failure mode goes quiet. The layer is valid only against a base carrying Debian's postgres layout. PROVENANCE.md Rule 9 already pins that contractually to postgres:18-trixie, so this is consistent with existing policy — but it converts a contractual coupling into a mechanical one, where a base-layout change yields a layer that applies to the wrong paths instead of failing loudly.
• PG19: add pg19 feature + postgres:19 runtime (#63 follow-up, untracked until now) #74 (PG19, parked) inherits a second path set whenever it wakes.

The relocatable tarball keeps shipping alongside, which is what keeps this reversible.

Not a replacement

This is additive. The existing tarball artifact keeps shipping unchanged — downstream Dockerfile-mode consumers depend on it and must not break. This adds a second, referenceable form alongside it.

Why it matters downstream

Without it, sporaxis-com/oci-germination#18 cannot assemble a runnable image that references pgRDF by digest, and the per-component attestation goal in sporaxis-com/oci-germination#10 stays unreachable for the pgRDF layer specifically.

Relates

• sporaxis-com/sporaxis#32 (contract) · sporaxis-com/sporaxis#33 (assembler) · Layer-only bundle form — single-tarball artifact + measured MANIFEST.json + multi-arch index (pgRDF#67 req 2/4, sporaxis#8) pgCK#15 (pgCK's half)
• Per-component supply-chain attestation + linking (SPEC.OCI.BUNDLE.v0.5) sporaxis-com/oci-germination#10 · CI: push + attest the sporaxis-assembled OCI index (emit-for-push half of #10) sporaxis-com/oci-germination#18