feat: add signed PostgreSQL release updates

distribution/bin/erp-run

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+INSTALL_ROOT="${ERP_INSTALL_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd -P)}"
+CONFIG_FILE="${ERP_CONFIG_FILE:-$INSTALL_ROOT/config/erp.env}"
+
+if [[ ! -r "$CONFIG_FILE" ]]; then
+  printf '[ERP] configuration not readable: %s\n' "$CONFIG_FILE" >&2
+  exit 1
+fi
+
+set -a
+# The installer creates this file with shell-escaped values and mode 0640.
+# shellcheck disable=SC1090
+source "$CONFIG_FILE"
+set +a
+
+RUN_DIR="${ERP_RUN_DIR:-$INSTALL_ROOT/run}"
+JAR_PATH="${ERP_JAR_PATH:-$INSTALL_ROOT/current/app/kaidi-erp.jar}"
+JAVA_BIN="${ERP_JAVA_BIN:-}"
+
+if [[ -z "$JAVA_BIN" ]]; then
+  if [[ -n "${JAVA_HOME:-}" && -x "$JAVA_HOME/bin/java" ]]; then
+    JAVA_BIN="$JAVA_HOME/bin/java"
+  else
+    JAVA_BIN="$(command -v java || true)"
+  fi
+fi
+
+if [[ -z "$JAVA_BIN" || ! -x "$JAVA_BIN" ]]; then
+  printf '[ERP] Java 17+ is not installed\n' >&2
+  exit 1
+fi
+JAVA_MAJOR="$("$JAVA_BIN" -version 2>&1 | awk -F'[".]' '/version/ {print $2; exit}')"
+if [[ ! "$JAVA_MAJOR" =~ ^[0-9]+$ || "$JAVA_MAJOR" -lt 17 ]]; then
+  printf '[ERP] Java 17+ is required\n' >&2
+  exit 1
+fi
+if [[ ! -r "$JAR_PATH" ]]; then
+  printf '[ERP] application jar not readable: %s\n' "$JAR_PATH" >&2
+  exit 1
+fi
+
+mkdir -p "$RUN_DIR"
+printf '%s\n' "$$" > "$RUN_DIR/app.pid"
+
+IFS=$' \t' read -r -a JAVA_OPTS <<< "${ERP_JAVA_OPTS:--Xms512m -Xmx2g}"
+exec "$JAVA_BIN" "${JAVA_OPTS[@]}" \
+  -jar "$JAR_PATH" \
+  --spring.profiles.active=postgres \
+  --server.port="${SERVER_PORT:-8091}"