mirror of https://github.com/postgres/postgres
Conflicts - contrib/pg_tde/Makefile - contrib/pg_tde/expected/change_access_method.out - contrib/pg_tde/meson.build - contrib/pg_tde/src/access/pg_tde_tdemap.c - contrib/pg_tde/src/access/pg_tde_xlog_encrypt.c - contrib/pg_tde/src/keyring/keyring_vault.c - contrib/pg_tde/src/pg_tde.c - contrib/pg_tde/src/pg_tde_alter_key_provider.c - contrib/pg_tde/src/pg_tde_event_capture.c - src/bin/Makefile - src/bin/meson.build Deleted in TDE_REL_17_STABLE - contrib/pg_tde/expected/change_access_method_basic.out - contrib/pg_tde/expected/vault_v2_test_basic.out - contrib/pg_tde/sql/change_access_method.inc - contrib/pg_tde/sql/vault_v2_test.inc - src/bin/pg_tde_change_key_provider/Makefile - src/bin/pg_tde_change_key_provider/meson.buildpull/209/head
Andreas Karlsson
6 months ago
commit
3a6422b9f9
@ -1,5 +0,0 @@ |
||||
# Switch from Percona Server for PostgreSQL to PostgreSQL Community |
||||
|
||||
Percona Server for PostgreSQL and PostgreSQL Community are binary compatible and enable you to switch from one to another. Here's how: |
||||
|
||||
1. If you used the `tde_heap` (tech preview feature) access method for encryption, either re-encrypt the data using the `tde_heap_basic` access method, or [decrypt](decrypt.md) it completely |
||||
@ -0,0 +1,74 @@ |
||||
CREATE EXTENSION IF NOT EXISTS pg_tde; |
||||
SELECT * FROM pg_tde_principal_key_info(); |
||||
ERROR: Principal key does not exists for the database |
||||
HINT: Use set_principal_key interface to set the principal key |
||||
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||
pg_tde_add_key_provider_file |
||||
------------------------------ |
||||
1 |
||||
(1 row) |
||||
|
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
id | provider_name | provider_type | options |
||||
----+---------------+---------------+------------------------------------------------------------ |
||||
1 | file-provider | file | {"type" : "file", "path" : "/tmp/pg_tde_test_keyring.per"} |
||||
(1 row) |
||||
|
||||
SELECT pg_tde_delete_key_provider('file-provider'); |
||||
pg_tde_delete_key_provider |
||||
---------------------------- |
||||
|
||||
(1 row) |
||||
|
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
id | provider_name | provider_type | options |
||||
----+---------------+---------------+--------- |
||||
(0 rows) |
||||
|
||||
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||
pg_tde_add_key_provider_file |
||||
------------------------------ |
||||
2 |
||||
(1 row) |
||||
|
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
id | provider_name | provider_type | options |
||||
----+---------------+---------------+------------------------------------------------------------ |
||||
2 | file-provider | file | {"type" : "file", "path" : "/tmp/pg_tde_test_keyring.per"} |
||||
(1 row) |
||||
|
||||
SELECT pg_tde_delete_key_provider('file-provider'); |
||||
pg_tde_delete_key_provider |
||||
---------------------------- |
||||
|
||||
(1 row) |
||||
|
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
id | provider_name | provider_type | options |
||||
----+---------------+---------------+--------- |
||||
(0 rows) |
||||
|
||||
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||
pg_tde_add_key_provider_file |
||||
------------------------------ |
||||
3 |
||||
(1 row) |
||||
|
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
id | provider_name | provider_type | options |
||||
----+---------------+---------------+------------------------------------------------------------ |
||||
3 | file-provider | file | {"type" : "file", "path" : "/tmp/pg_tde_test_keyring.per"} |
||||
(1 row) |
||||
|
||||
SELECT pg_tde_delete_key_provider('file-provider'); |
||||
pg_tde_delete_key_provider |
||||
---------------------------- |
||||
|
||||
(1 row) |
||||
|
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
id | provider_name | provider_type | options |
||||
----+---------------+---------------+--------- |
||||
(0 rows) |
||||
|
||||
DROP EXTENSION pg_tde; |
||||
@ -0,0 +1,8 @@ |
||||
CREATE EXTENSION pg_tde; |
||||
-- should fail |
||||
CREATE TABLE t1 (n INT) USING tde_heap; |
||||
ERROR: failed to retrieve principal key. Create one using pg_tde_set_principal_key before using encrypted tables. |
||||
-- should work |
||||
CREATE TABLE t2 (n INT) USING heap; |
||||
DROP TABLE t2; |
||||
DROP EXTENSION pg_tde; |
||||
@ -0,0 +1,134 @@ |
||||
CREATE EXTENSION IF NOT EXISTS pg_tde; |
||||
SELECT pg_tde_add_key_provider_file('file-vault','/tmp/pg_tde_test_keyring.per'); |
||||
pg_tde_add_key_provider_file |
||||
------------------------------ |
||||
1 |
||||
(1 row) |
||||
|
||||
SELECT pg_tde_set_principal_key('test-db-principal-key','file-vault'); |
||||
pg_tde_set_principal_key |
||||
-------------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
SET default_table_access_method = "tde_heap"; |
||||
CREATE TABLE t1(n integer); |
||||
SELECT pg_tde_is_encrypted('t1'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
VACUUM FULL t1; |
||||
SELECT pg_tde_is_encrypted('t1'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
CREATE TABLE test_tab1 AS SELECT generate_series(1,10) a; |
||||
CREATE INDEX test_idx1 ON test_tab1(a); |
||||
SELECT pg_tde_is_encrypted('test_tab1'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
SELECT pg_tde_is_encrypted('test_idx1'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
REINDEX index CONCURRENTLY test_idx1; |
||||
SELECT pg_tde_is_encrypted('test_tab1'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
SELECT pg_tde_is_encrypted('test_idx1'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
CREATE TABLE mvtest_t (id int NOT NULL PRIMARY KEY, type text NOT NULL, amt numeric NOT NULL); |
||||
INSERT INTO mvtest_t VALUES |
||||
(1, 'x', 2), |
||||
(2, 'x', 3), |
||||
(3, 'y', 5), |
||||
(4, 'y', 7), |
||||
(5, 'z', 11); |
||||
CREATE MATERIALIZED VIEW mvtest_tm AS SELECT type, sum(amt) AS totamt FROM mvtest_t GROUP BY type WITH NO DATA; |
||||
SELECT pg_tde_is_encrypted('mvtest_tm'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
REFRESH MATERIALIZED VIEW mvtest_tm; |
||||
SELECT pg_tde_is_encrypted('mvtest_tm'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
CREATE TYPE rewritetype AS (a int); |
||||
CREATE TABLE rewritemetoo1 OF rewritetype; |
||||
CREATE TABLE rewritemetoo2 OF rewritetype; |
||||
SELECT pg_tde_is_encrypted('rewritemetoo1'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
SELECT pg_tde_is_encrypted('rewritemetoo2'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
ALTER TYPE rewritetype ALTER ATTRIBUTE a TYPE text cascade; |
||||
SELECT pg_tde_is_encrypted('rewritemetoo1'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
SELECT pg_tde_is_encrypted('rewritemetoo2'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
CREATE TABLE encrypted_table ( |
||||
id SERIAL, |
||||
data TEXT, |
||||
created_at DATE NOT NULL, |
||||
PRIMARY KEY (id, created_at) |
||||
) USING tde_heap; |
||||
CREATE INDEX idx_date ON encrypted_table (created_at); |
||||
SELECT pg_tde_is_encrypted('encrypted_table'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
CLUSTER encrypted_table USING idx_date; |
||||
SELECT pg_tde_is_encrypted('encrypted_table'); |
||||
pg_tde_is_encrypted |
||||
--------------------- |
||||
t |
||||
(1 row) |
||||
|
||||
DROP EXTENSION pg_tde CASCADE; |
||||
NOTICE: drop cascades to 7 other objects |
||||
DETAIL: drop cascades to table t1 |
||||
drop cascades to table test_tab1 |
||||
drop cascades to table mvtest_t |
||||
drop cascades to materialized view mvtest_tm |
||||
drop cascades to table rewritemetoo1 |
||||
drop cascades to table rewritemetoo2 |
||||
drop cascades to table encrypted_table |
||||
RESET default_table_access_method; |
||||
@ -0,0 +1,8 @@ |
||||
CREATE EXTENSION pg_tde; |
||||
SELECT pg_tde_version(); |
||||
pg_tde_version |
||||
----------------- |
||||
pg_tde 1.0.0-rc |
||||
(1 row) |
||||
|
||||
DROP EXTENSION pg_tde; |
||||
@ -0,0 +1,20 @@ |
||||
CREATE EXTENSION IF NOT EXISTS pg_tde; |
||||
|
||||
SELECT * FROM pg_tde_principal_key_info(); |
||||
|
||||
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
SELECT pg_tde_delete_key_provider('file-provider'); |
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
|
||||
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
SELECT pg_tde_delete_key_provider('file-provider'); |
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
|
||||
SELECT pg_tde_add_key_provider_file('file-provider','/tmp/pg_tde_test_keyring.per'); |
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
SELECT pg_tde_delete_key_provider('file-provider'); |
||||
SELECT * FROM pg_tde_list_all_key_providers(); |
||||
|
||||
DROP EXTENSION pg_tde; |
||||
@ -0,0 +1,11 @@ |
||||
CREATE EXTENSION pg_tde; |
||||
|
||||
-- should fail |
||||
CREATE TABLE t1 (n INT) USING tde_heap; |
||||
|
||||
-- should work |
||||
CREATE TABLE t2 (n INT) USING heap; |
||||
|
||||
DROP TABLE t2; |
||||
|
||||
DROP EXTENSION pg_tde; |
||||
@ -0,0 +1,54 @@ |
||||
CREATE EXTENSION IF NOT EXISTS pg_tde; |
||||
|
||||
SELECT pg_tde_add_key_provider_file('file-vault','/tmp/pg_tde_test_keyring.per'); |
||||
SELECT pg_tde_set_principal_key('test-db-principal-key','file-vault'); |
||||
|
||||
SET default_table_access_method = "tde_heap"; |
||||
|
||||
CREATE TABLE t1(n integer); |
||||
SELECT pg_tde_is_encrypted('t1'); |
||||
VACUUM FULL t1; |
||||
SELECT pg_tde_is_encrypted('t1'); |
||||
|
||||
CREATE TABLE test_tab1 AS SELECT generate_series(1,10) a; |
||||
CREATE INDEX test_idx1 ON test_tab1(a); |
||||
SELECT pg_tde_is_encrypted('test_tab1'); |
||||
SELECT pg_tde_is_encrypted('test_idx1'); |
||||
REINDEX index CONCURRENTLY test_idx1; |
||||
SELECT pg_tde_is_encrypted('test_tab1'); |
||||
SELECT pg_tde_is_encrypted('test_idx1'); |
||||
|
||||
CREATE TABLE mvtest_t (id int NOT NULL PRIMARY KEY, type text NOT NULL, amt numeric NOT NULL); |
||||
INSERT INTO mvtest_t VALUES |
||||
(1, 'x', 2), |
||||
(2, 'x', 3), |
||||
(3, 'y', 5), |
||||
(4, 'y', 7), |
||||
(5, 'z', 11); |
||||
CREATE MATERIALIZED VIEW mvtest_tm AS SELECT type, sum(amt) AS totamt FROM mvtest_t GROUP BY type WITH NO DATA; |
||||
SELECT pg_tde_is_encrypted('mvtest_tm'); |
||||
REFRESH MATERIALIZED VIEW mvtest_tm; |
||||
SELECT pg_tde_is_encrypted('mvtest_tm'); |
||||
|
||||
CREATE TYPE rewritetype AS (a int); |
||||
CREATE TABLE rewritemetoo1 OF rewritetype; |
||||
CREATE TABLE rewritemetoo2 OF rewritetype; |
||||
SELECT pg_tde_is_encrypted('rewritemetoo1'); |
||||
SELECT pg_tde_is_encrypted('rewritemetoo2'); |
||||
ALTER TYPE rewritetype ALTER ATTRIBUTE a TYPE text cascade; |
||||
SELECT pg_tde_is_encrypted('rewritemetoo1'); |
||||
SELECT pg_tde_is_encrypted('rewritemetoo2'); |
||||
|
||||
CREATE TABLE encrypted_table ( |
||||
id SERIAL, |
||||
data TEXT, |
||||
created_at DATE NOT NULL, |
||||
PRIMARY KEY (id, created_at) |
||||
) USING tde_heap; |
||||
CREATE INDEX idx_date ON encrypted_table (created_at); |
||||
SELECT pg_tde_is_encrypted('encrypted_table'); |
||||
CLUSTER encrypted_table USING idx_date; |
||||
SELECT pg_tde_is_encrypted('encrypted_table'); |
||||
|
||||
DROP EXTENSION pg_tde CASCADE; |
||||
RESET default_table_access_method; |
||||
@ -0,0 +1,3 @@ |
||||
CREATE EXTENSION pg_tde; |
||||
SELECT pg_tde_version(); |
||||
DROP EXTENSION pg_tde; |
||||
@ -0,0 +1 @@ |
||||
/pg_tde_change_key_provider |
||||
Loading…
Reference in new issue