From eef732e2adbe8daf3a55042677e9ec343941f563 Mon Sep 17 00:00:00 2001
From: kronecker <2026692687@qq.com>
Date: Mon, 12 Oct 2026 15:47:03 +0800
Subject: [PATCH] fix(delivery): keep server-only plugins outside application
 runtime

---
 scripts/release/build.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/release/build.py b/scripts/release/build.py
index 3fcff81..bfd65c8 100644
--- a/scripts/release/build.py
+++ b/scripts/release/build.py
@@ -299,6 +299,10 @@ def build(repo: Path, inputs: Path, output: Path, work: Path) -> dict:
             curated(root, records, name, payload / name)
         elif name.startswith("services/usr/lib/"):
             relative = name.removeprefix("services/usr/lib/")
+            # Database-server OAuth/RADIUS plugins are provisioned with the
+            # database package, separate from application runtime libraries.
+            if relative.startswith(("libkrad.so", "libpq-oauth-")):
+                continue
             if "/" not in relative and (".so" in relative or relative == "ld-linux-x86-64.so.2"):
                 relative_name("lib/" + relative)
                 curated(root, records, name, payload / "lib" / relative)