Skip to content

Commit a4e2a40

Browse files
soedirgosoedirgo
committed
Reapply "feat: vault sans pgsodium"
This reverts commit 447f449.
1 parent 9d7b75c commit a4e2a40

File tree

11 files changed

+143
-63
lines changed

11 files changed

+143
-63
lines changed

‎ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,43 @@ EOF
150150

151151
run_sql -c "$PATCH_PGMQ_QUERY"
152152
run_sql -c "update pg_extension set extowner = 'postgres'::regrole where extname = 'pgmq';"
153+
154+
# Patch to handle upgrading to pgsodium-less Vault
155+
REENCRYPT_VAULT_SECRETS_QUERY=$(cat <<EOF
156+
DO \$\$
157+
BEGIN
158+
IF EXISTS (SELECT FROM pg_available_extension_versions WHERE name = 'supabase_vault' AND version = '0.3.0')
159+
AND EXISTS (SELECT FROM pg_extension WHERE extname = 'supabase_vault')
160+
THEN
161+
IF (SELECT extversion FROM pg_extension WHERE extname = 'supabase_vault') != '0.2.8' THEN
162+
GRANT USAGE ON SCHEMA vault TO postgres WITH GRANT OPTION;
163+
GRANT SELECT, DELETE ON vault.secrets, vault.decrypted_secrets TO postgres WITH GRANT OPTION;
164+
GRANT EXECUTE ON FUNCTION vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt TO postgres WITH GRANT OPTION;
165+
END IF;
166+
-- Do an explicit IF EXISTS check to avoid referencing pgsodium objects if the project already migrated away from using pgsodium.
167+
IF EXISTS (SELECT FROM vault.secrets WHERE key_id IS NOT NULL) THEN
168+
UPDATE vault.secrets s
169+
SET
170+
secret = encode(
171+
vault._crypto_aead_det_encrypt(
172+
message := pgsodium.crypto_aead_det_decrypt(decode(s.secret, 'base64'), convert_to(s.id || s.description || s.created_at || s.updated_at, 'utf8'), s.key_id, s.nonce),
173+
additional := convert_to(s.id::text, 'utf8'),
174+
key_id := 0,
175+
context := 'pgsodium'::bytea,
176+
nonce := s.nonce
177+
),
178+
'base64'
179+
),
180+
key_id = NULL
181+
WHERE
182+
key_id IS NOT NULL;
183+
END IF;
184+
END IF;
185+
END
186+
\$\$;
187+
EOF
188+
)
189+
run_sql -c "$REENCRYPT_VAULT_SECRETS_QUERY"
153190
fi
154191

155192
run_sql -c "grant pg_read_all_data, pg_signal_backend to postgres"

‎ansible/files/postgresql_config/postgresql.conf.j2

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -688,7 +688,7 @@ default_text_search_config = 'pg_catalog.english'
688688
#local_preload_libraries = ''
689689
#session_preload_libraries = ''
690690

691-
shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter' # (change requires restart)
691+
shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter, supabase_vault' # (change requires restart)
692692
jit_provider = 'llvmjit' # JIT library to use
693693

694694
# - Other Defaults -

‎ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
grant usage on schema vault to postgres with grant option;
2+
grant select, delete on vault.secrets, vault.decrypted_secrets to postgres with grant option;
3+
grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option;

‎ansible/files/sodium_extension.sql

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎ansible/tasks/test-image.yml

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,34 @@
1111
# cmd: sed -i.bak -e "s/pg_net,\ pgsodium,\ timescaledb/pg_net,\ timescaledb/g" -e "s/pgsodium.getkey_script=/#pgsodium.getkey_script=/g" /etc/postgresql/postgresql.conf
1212
# when: debpkg_mode or stage2_nix
1313

14-
- name: Temporarily disable PG Sodium references in config
14+
- name: Temporarily disable PG Sodium and Supabase Vault references in config
1515
become: yes
1616
become_user: postgres
1717
shell:
1818
cmd: >
19-
sed -i.bak
20-
-e 's/\(shared_preload_libraries = '\''.*\)pgsodium,\(.*'\''\)/\1\2/'
19+
sed -i.bak
20+
-e 's/\(shared_preload_libraries = '\''.*\)pgsodium,\(.*'\''\)/\1\2/'
21+
-e 's/\(shared_preload_libraries = '\''.*\)supabase_vault,\(.*'\''\)/\1\2/'
22+
-e 's/\(shared_preload_libraries = '\''.*\), *supabase_vault'\''/\1'\''/'
2123
-e 's/pgsodium.getkey_script=/#pgsodium.getkey_script=/'
2224
/etc/postgresql/postgresql.conf
2325
when: debpkg_mode or stage2_nix
2426

27+
- name: Verify pgsodium and vault removal from config
28+
become: yes
29+
become_user: postgres
30+
shell:
31+
cmd: |
32+
FOUND=$(grep -E "shared_preload_libraries.*pgsodium|shared_preload_libraries.*supabase_vault|^pgsodium\.getkey_script" /etc/postgresql/postgresql.conf)
33+
if [ ! -z "$FOUND" ]; then
34+
echo "Found unremoved references:"
35+
echo "$FOUND"
36+
exit 1
37+
fi
38+
register: verify_result
39+
failed_when: verify_result.rc != 0
40+
when: debpkg_mode or stage2_nix
41+
2542
- name: Start Postgres Database to load all extensions.
2643
become: yes
2744
become_user: postgres

‎ebssurrogate/files/unit-tests/unit-test-01.sql

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ BEGIN
1717
extension_array := ARRAY[
1818
'plpgsql',
1919
'pg_stat_statements',
20-
'pgsodium',
2120
'pgtap',
2221
'pg_graphql',
2322
'pgcrypto',
@@ -30,7 +29,6 @@ BEGIN
3029
extension_array := ARRAY[
3130
'plpgsql',
3231
'pg_stat_statements',
33-
'pgsodium',
3432
'pgtap',
3533
'pg_graphql',
3634
'pgcrypto',
@@ -44,7 +42,7 @@ BEGIN
4442
PERFORM set_config('myapp.extensions', array_to_string(extension_array, ','), false);
4543
END $$;
4644

47-
SELECT plan(8);
45+
SELECT no_plan();
4846

4947
SELECT extensions_are(
5048
string_to_array(current_setting('myapp.extensions'), ',')::text[]
@@ -56,9 +54,5 @@ SELECT has_schema('pg_catalog');
5654
SELECT has_schema('information_schema');
5755
SELECT has_schema('public');
5856

59-
SELECT function_privs_are('pgsodium', 'crypto_aead_det_decrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
60-
SELECT function_privs_are('pgsodium', 'crypto_aead_det_encrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
61-
SELECT function_privs_are('pgsodium', 'crypto_aead_det_keygen', array[]::text[], 'service_role', array['EXECUTE']);
62-
6357
SELECT * FROM finish();
64-
ROLLBACK;
58+
ROLLBACK;

‎flake.nix

Lines changed: 43 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -587,42 +587,49 @@
587587
sqlTests = ./nix/tests/smoke;
588588
pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
589589
pg_regress = basePackages.pg_regress;
590-
getkey-script = pkgs.writeScriptBin "pgsodium-getkey" ''
591-
#!${pkgs.bash}/bin/bash
592-
set -euo pipefail
593-
594-
TMPDIR_BASE=$(mktemp -d)
595-
596-
if [[ "$(uname)" == "Darwin" ]]; then
597-
KEY_DIR="/private/tmp/pgsodium"
598-
else
599-
KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
600-
fi
601-
KEY_FILE="$KEY_DIR/pgsodium.key"
602-
603-
if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
604-
echo "Error: Could not create key directory $KEY_DIR" >&2
605-
exit 1
606-
fi
607-
chmod 1777 "$KEY_DIR"
608-
609-
if [[ ! -f "$KEY_FILE" ]]; then
610-
if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
611-
if ! (openssl rand -hex 32 > "$KEY_FILE"); then
612-
echo "00000000000000000000000000000000" > "$KEY_FILE"
613-
echo "Warning: Using fallback key" >&2
590+
getkey-script = pkgs.stdenv.mkDerivation {
591+
name = "pgsodium-getkey";
592+
buildCommand = ''
593+
mkdir -p $out/bin
594+
cat > $out/bin/pgsodium-getkey << 'EOF'
595+
#!${pkgs.bash}/bin/bash
596+
set -euo pipefail
597+
598+
TMPDIR_BASE=$(mktemp -d)
599+
600+
if [[ "$(uname)" == "Darwin" ]]; then
601+
KEY_DIR="/private/tmp/pgsodium"
602+
else
603+
KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
604+
fi
605+
KEY_FILE="$KEY_DIR/pgsodium.key"
606+
607+
if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
608+
echo "Error: Could not create key directory $KEY_DIR" >&2
609+
exit 1
610+
fi
611+
chmod 1777 "$KEY_DIR"
612+
613+
if [[ ! -f "$KEY_FILE" ]]; then
614+
if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
615+
if ! (openssl rand -hex 32 > "$KEY_FILE"); then
616+
echo "00000000000000000000000000000000" > "$KEY_FILE"
617+
echo "Warning: Using fallback key" >&2
618+
fi
614619
fi
620+
chmod 644 "$KEY_FILE"
615621
fi
616-
chmod 644 "$KEY_FILE"
617-
fi
618-
619-
if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
620-
cat "$KEY_FILE"
621-
else
622-
echo "Error: Cannot read key file $KEY_FILE" >&2
623-
exit 1
624-
fi
625-
'';
622+
623+
if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
624+
cat "$KEY_FILE"
625+
else
626+
echo "Error: Cannot read key file $KEY_FILE" >&2
627+
exit 1
628+
fi
629+
EOF
630+
chmod +x $out/bin/pgsodium-getkey
631+
'';
632+
};
626633

627634
# Use the shared setup but with a test-specific name
628635
start-postgres-server-bin = makePostgresDevSetup {
@@ -691,6 +698,8 @@
691698
echo "listen_addresses = '*'" >> "$PGTAP_CLUSTER"/postgresql.conf
692699
echo "port = 5435" >> "$PGTAP_CLUSTER"/postgresql.conf
693700
echo "host all all 127.0.0.1/32 trust" >> $PGTAP_CLUSTER/pg_hba.conf
701+
echo "Checking shared_preload_libraries setting:"
702+
grep -rn "shared_preload_libraries" "$PGTAP_CLUSTER"/postgresql.conf
694703
# Remove timescaledb if running orioledb-17 check
695704
echo "I AM ${pgpkg.version}===================================================="
696705
if [[ "${pgpkg.version}" == *"17"* ]]; then

‎nix/ext/vault.nix

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,24 @@
1-
{ lib, stdenv, fetchFromGitHub, postgresql }:
1+
{ lib, stdenv, fetchFromGitHub, libsodium, postgresql }:
22

33
stdenv.mkDerivation rec {
44
pname = "vault";
5-
version = "0.2.9";
5+
version = "0.3.1";
66

7-
buildInputs = [ postgresql ];
7+
buildInputs = [ libsodium postgresql ];
88

99
src = fetchFromGitHub {
1010
owner = "supabase";
1111
repo = pname;
1212
rev = "refs/tags/v${version}";
13-
hash = "sha256-kXTngBW4K6FkZM8HvJG2Jha6OQqbejhnk7tchxy031I=";
13+
hash = "sha256-MC87bqgtynnDhmNZAu96jvfCpsGDCPB0g5TZfRQHd30=";
1414
};
1515

1616
installPhase = ''
1717
mkdir -p $out/{lib,share/postgresql/extension}
1818
19-
cp sql/*.sql $out/share/postgresql/extension
20-
cp *.control $out/share/postgresql/extension
19+
install -D *${postgresql.dlSuffix} $out/lib
20+
install -D -t $out/share/postgresql/extension sql/*.sql
21+
install -D -t $out/share/postgresql/extension *.control
2122
'';
2223

2324
meta = with lib; {

0 commit comments

Comments
 (0)