PG-1419 Validate key provider on creation #224
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I forgot about pg_regress variant expected files 🙄 |
AndersAstrand
force-pushed
the
tde/validate-on-new-provider
branch
from
60d7f1a to
d1d5851
Compare
Codecov ReportAttention: Patch coverage is
❌ Your project status has failed because the head coverage (75.53%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## TDE_REL_17_STABLE #224 +/- ##
=====================================================
+ Coverage 75.45% 75.53% +0.08%
=====================================================
Files 22 22
Lines 2465 2514 +49
Branches 388 394 +6
=====================================================
+ Hits 1860 1899 +39
- Misses 532 538 +6
- Partials 73 77 +4
🚀 New features to boost your workflow:
|
AndersAstrand
force-pushed
the
tde/validate-on-new-provider
branch
3 times, most recently
from
caea669 to
0341bc4
Compare
dutow
reviewed
Apr 17, 2025
jeltz
reviewed
Apr 17, 2025
jeltz
reviewed
Apr 17, 2025
AndersAstrand
force-pushed
the
tde/validate-on-new-provider
branch
from
0341bc4 to
f15d3c7
Compare
AndersAstrand
commented
Apr 22, 2025
AndersAstrand
force-pushed
the
tde/validate-on-new-provider
branch
2 times, most recently
from
08cc7d1 to
82bd1b8
Compare
AndersAstrand
force-pushed
the
tde/validate-on-new-provider
branch
from
f30bf62 to
7aa2928
Compare
No callers cared about the return value of these functions anyway.
This regression file didn't really test anything. The tests it was supposed to do was removed here percona/pg_tde@e270322 So now it doesn't test anything that key_provider.sql doesn't already do for us.
The colon was on the wrong side of the space.
The new name, KeyringProviderRecordInFile, describes what it is rather than what it's used for. But the real reason is that I want to use it for other things than the WAL in future commits.
Previously write_key_provider_info() was a bit of a "do everything" function that had very different behavior depending on what parameters was passed to it. This commit reworks it to a "dumb" function that just writes the data without asking questions and have the callers take responsibility for data validity. This is to make it easier to validate the data in different ways depending on the caller's needs without further complicating write_key_provider_info().
This adds some validation to make sure we can access the key provider when it's created to make the user experience a little nicer. The actual access validation is very rudimentary for now but can easily be expanded.
AndersAstrand
force-pushed
the
tde/validate-on-new-provider
branch
from
7aa2928 to
7057f00
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The validation done is very rudimentary for now. The main part of this PR is some refactoring of tde_keyring.c. I'm not fully happy with where it's at, but I think I like it better than what was there at least.
I did leave a TODO in there for any reviewers to comment on! The comment will ofc not be merged, I'll either remove the comment or change the behaviour.