fix: finish rstack dev for its first release and read long encrypted BReg values

.github/scripts/select-ubuntu-archive.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+has_noble_indexes() {
+	local archive="$1" suite
+	for suite in noble noble-updates noble-backports noble-security; do
+		curl --proto '=https' --fail --silent --show-error --head --max-time 10 \
+			"${archive}dists/$suite/InRelease" >/dev/null || return 1
+	done
+}
+
+for mirror in \
+	https://archive.ubuntu.com/ubuntu/ \
+	https://mirrors.edge.kernel.org/ubuntu/ \
+	https://mirror.math.princeton.edu/pub/ubuntu/; do
+	host="${mirror#https://}"
+	if timeout 5 getent ahosts "${host%%/*}" >/dev/null && has_noble_indexes "$mirror"; then
+		printf '%s\n' "$mirror"
+		exit 0
+	fi
+done
+
+printf '%s\n' 'No Ubuntu Noble archive mirror is reachable.' >&2
+exit 1

.github/workflows/ci.yml

@@ -2702,6 +2702,11 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          # Use the Ubuntu archive if the runner's Azure mirror cannot resolve.
+          if [[ -f /etc/apt/apt-mirrors.txt ]] && ! timeout 10 getent ahosts azure.archive.ubuntu.com >/dev/null; then
+            mirror="$(bash .github/scripts/select-ubuntu-archive.sh)"
+            printf '%s\n' "$mirror" | sudo tee /etc/apt/apt-mirrors.txt >/dev/null
+          fi
           sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y
           sudo env DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends postgresql-18 postgresql-18-postgis-3
           /usr/lib/postgresql/18/bin/postgres --version
@@ -3071,7 +3076,14 @@ jobs:
           cache-dependency-path: docs/site/package-lock.json
 
       - name: Install docs shell dependency
+        shell: bash
         run: |
+          set -euo pipefail
+          # Use the Ubuntu archive if the runner's Azure mirror cannot resolve.
+          if [[ -f /etc/apt/apt-mirrors.txt ]] && ! timeout 10 getent ahosts azure.archive.ubuntu.com >/dev/null; then
+            mirror="$(bash .github/scripts/select-ubuntu-archive.sh)"
+            printf '%s\n' "$mirror" | sudo tee /etc/apt/apt-mirrors.txt >/dev/null
+          fi
           sudo apt-get update
           sudo apt-get install --yes zsh
 

crates/registry-breg/src/mutation.rs

@@ -3659,8 +3659,10 @@ pub(crate) fn envelope_member_from_projection(value: Value) -> Result<Value, Mut
         return Ok(Value::Null);
     }
     let encoded = value.as_str().ok_or(MutationError::Unavailable)?;
+    // PostgreSQL's base64 encoding breaks its output every 76 characters;
+    // those line breaks carry no data.
     let envelope = base64::engine::general_purpose::STANDARD
-        .decode(encoded)
+        .decode(encoded.replace('\n', ""))
         .map_err(|_| MutationError::Unavailable)?;
     Ok(envelope_member_json(&envelope))
 }
@@ -4837,4 +4839,28 @@ mod tests {
         )
         .is_ok());
     }
+
+    /// PostgreSQL's `encode(..., 'base64')` breaks its output every 76
+    /// characters, so a projected envelope longer than 57 bytes reaches row
+    /// decode on several lines.
+    #[test]
+    fn a_projected_envelope_decodes_across_postgresql_line_breaks() {
+        use base64::Engine as _;
+        let envelope = (0..=200).collect::<Vec<u8>>();
+        let encoded = base64::engine::general_purpose::STANDARD.encode(&envelope);
+        let wrapped = encoded
+            .as_bytes()
+            .chunks(76)
+            .map(|line| std::str::from_utf8(line).expect("base64 is ASCII"))
+            .collect::<Vec<_>>()
+            .join("\n");
+        assert_eq!(
+            envelope_member_from_projection(Value::String(wrapped)),
+            Ok(envelope_member_json(&envelope))
+        );
+        assert_eq!(
+            envelope_member_from_projection(Value::String(format!(" {encoded}"))),
+            Err(MutationError::Unavailable)
+        );
+    }
 }

crates/registry-breg/src/postgres/roles.rs

@@ -144,7 +144,8 @@ pub async fn provision_postgis_prerequisites(
             migration_role.quoted(),
             runtime_role.quoted(),
         ))
-        .await?;
+        .await
+        .map_err(|error| PostgresKernelError::from_statement_error(&error))?;
     let bbox_role = provision_spatial_bbox_role(admin, migration_role, runtime_role).await?;
     Ok(bbox_role)
 }
@@ -178,7 +179,8 @@ pub async fn provision_spatial_bbox_role(
             migration_role.quoted(),
             bbox_role.quoted(),
         ))
-        .await?;
+        .await
+        .map_err(|error| PostgresKernelError::from_statement_error(&error))?;
     Ok(bbox_role)
 }