mirror of https://github.com/postgres/postgres
Artem Gavrilov
1 week ago
committed by
GitHub
commit
d0b53f35fb
@ -1,3 +1,3 @@ |
||||
#!/bin/bash |
||||
|
||||
export PERCONA_SERVER_VERSION=17.5.2 |
||||
export PERCONA_SERVER_VERSION=17.5.3 |
||||
|
||||
@ -1,7 +1,18 @@ |
||||
# Overview of pg_tde CLI tools |
||||
|
||||
The `pg_tde` extension introduces new command-line utilities and extends some existing PostgreSQL tools to support encrypted WAL and tables. These include: |
||||
The `pg_tde` extension introduces new command-line utilities and extends some existing PostgreSQL tools to support encrypted WAL and tables. |
||||
|
||||
* [pg_tde_change_key_provider](../command-line-tools/pg-tde-change-key-provider.md): change encryption key provider for a database |
||||
* [pg_waldump](../command-line-tools/pg-waldump.md): inspect and decrypt WAL files |
||||
* [pg_checksums](../command-line-tools/pg-tde-checksums.md): verify data checksums (non-encrypted files only) |
||||
## New tools |
||||
|
||||
These tools are introduced by `pg_tde` to support key rotation and WAL encryption workflows: |
||||
|
||||
* [pg_tde_change_key_provider](./pg-tde-change-key-provider.md): change the encryption key provider for a database |
||||
* [pg_tde_archive_decrypt](./pg-tde-archive-decrypt.md): decrypts WAL before archiving |
||||
* [pg_tde_restore_encrypt](./pg-tde-restore-encrypt.md): a custom restore command for making sure the restored WAL is encrypted |
||||
|
||||
## Extended tools |
||||
|
||||
These existing PostgreSQL tools are enhanced to support `pg_tde`: |
||||
|
||||
* [pg_checksums](./pg-tde-checksums.md): verify data checksums (non-encrypted files only) |
||||
* [pg_waldump](./pg-waldump.md): inspect and decrypt WAL files |
||||
|
||||
@ -0,0 +1,57 @@ |
||||
# pg_tde_archive_decrypt |
||||
|
||||
The `pg_tde_archive_decrypt` tool wraps an archive command and decrypts WAL files before archiving. It allows external tools to access unencrypted WAL data, which is required because WAL encryption keys in the two-key hierarchy are host-specific and may not be available on the replay host. |
||||
|
||||
!!! tip |
||||
For more information on the encryption architecture and key hierarchy, see [Architecture](../architecture/architecture.md). |
||||
|
||||
This tool is often used in conjunction with [pg_tde_restore_encrypt](./pg-tde-restore-encrypt.md) to support WAL archive. |
||||
|
||||
## How it works |
||||
|
||||
1. Decrypts the WAL segment to a temporary file on a RAM disk (`/dev/shm`) |
||||
2. Replaces `%p` and `%f` in the archive command with the path and name of the decrypted file |
||||
3. Executes the archive command |
||||
|
||||
!!! note |
||||
|
||||
To ensure security, encrypt the files stored in your WAL archive using tools like `PgBackRest`. |
||||
|
||||
## Usage |
||||
|
||||
```bash |
||||
pg_tde_archive_decrypt [OPTION] |
||||
pg_tde_archive_decrypt DEST-NAME SOURCE-PATH ARCHIVE-COMMAND |
||||
``` |
||||
|
||||
## Parameter descriptions |
||||
|
||||
* `DEST-NAME`: name of the WAL file to send to the archive |
||||
* `SOURCE-PATH`: path to the original encrypted WAL file |
||||
* `ARCHIVE-COMMAND`: archive command to wrap. `%p` and `%f` are replaced with the decrypted WAL file path and WAL file name, respectively. |
||||
|
||||
## Options |
||||
|
||||
* `-V, --version`: show version information, then exit |
||||
* `-?, --help`: show help information, then exit |
||||
|
||||
!!! note |
||||
|
||||
Any `%f` or `%p` parameter in `ARCHIVE-COMMAND` has to be escaped as `%%f` or `%%p` respectively if used as `archive_command` in `postgresql.conf`. |
||||
|
||||
## Examples |
||||
|
||||
### Using `cp` |
||||
|
||||
```ini |
||||
archive_command='pg_tde_archive_decrypt %f %p "cp %%p /mnt/server/archivedir/%%f"' |
||||
``` |
||||
|
||||
### Using `PgBackRest` |
||||
|
||||
```ini |
||||
archive_command='pg_tde_archive_decrypt %f %p "pgbackrest --stanza=your_stanza archive-push %%p"' |
||||
``` |
||||
|
||||
!!! warning |
||||
When using PgBackRest with WAL encryption, disable PostgreSQL data checksums. Otherwise, PgBackRest may spam error messages, and in some package builds the log statement can cause crashes. |
||||
@ -0,0 +1,52 @@ |
||||
# pg_tde_restore_encrypt |
||||
|
||||
The `pg_tde_restore_encrypt` tool wraps a normal restore command from the WAL archive and writes them to disk in a format compatible with `pg_tde`. |
||||
|
||||
!!! note |
||||
|
||||
This command is often use together with [pg_tde_archive_decrypt](./pg-tde-archive-decrypt.md). |
||||
|
||||
## How it works |
||||
|
||||
1. Replaces `%f` and `%p` in the restore command with the WAL file name and temporary file path (in `/dev/shm`) |
||||
2. Runs the restore command to fetch the unencrypted WAL from the archive and write it to the temp file |
||||
3. Encrypts the temp file and writes it to the destination path in PostgreSQL’s data directory |
||||
|
||||
## Usage |
||||
|
||||
```bash |
||||
pg_tde_restore_encrypt [OPTION] |
||||
pg_tde_restore_encrypt SOURCE-NAME DEST-PATH RESTORE-COMMAND |
||||
``` |
||||
|
||||
## Parameter descriptions |
||||
|
||||
* `SOURCE-NAME`: name of the WAL file to retrieve from the archive |
||||
* `DEST-PATH`: path where the encrypted WAL file should be written |
||||
* `RESTORE-COMMAND`: restore command to wrap; `%p` and `%f` are replaced with the WAL file name and path to write the unencrypted WAL, respectively |
||||
|
||||
## Options |
||||
|
||||
* `-V, --version`: show version information, then exit |
||||
* `-?, --help`: show help information, then exit |
||||
|
||||
!!! note |
||||
|
||||
Any `%f` or `%p` parameter in `RESTORE-COMMAND` has to be escaped as `%%f` or `%%p` respectively if used as `restore_command` in `postgresql.conf`. |
||||
|
||||
## Examples |
||||
|
||||
### Using `cp` |
||||
|
||||
```ini |
||||
restore_command='pg_tde_restore_encrypt %f %p "cp /mnt/server/archivedir/%%f %%p"' |
||||
``` |
||||
|
||||
### Using `PgBackRest` |
||||
|
||||
```ini |
||||
restore_command='pg_tde_restore_encrypt %f %p "pgbackrest --stanza=your_stanza archive-get %%f \"%%p\""' |
||||
``` |
||||
|
||||
!!! warning |
||||
When using PgBackRest with WAL encryption, disable PostgreSQL data checksums. Otherwise, PgBackRest may spam error messages, and in some package builds the log statement can cause crashes. |
||||
@ -0,0 +1,77 @@ |
||||
# Backup with WAL encryption enabled |
||||
|
||||
To create a backup with WAL encryption enabled: |
||||
|
||||
1. Copy the `pg_tde` directory from the source server’s data directory, for example `/var/lib/postgresql/data/pg_tde/`, including the `wal_keys` and `1664_providers` files, to the backup destination directory where `pg_basebackup` will write the backup. |
||||
|
||||
Also copy any external files referenced by your providers configuration (such as certificate or key files) into the same relative paths under the backup destination, so that they are located and validated by `pg_basebackup -E`. |
||||
|
||||
2. Run: |
||||
|
||||
```bash |
||||
pg_basebackup -D /path/to/backup -E |
||||
``` |
||||
|
||||
Where: |
||||
|
||||
- `-D /path/to/backup` specifies the backup location where you have to copy `pg_tde`. |
||||
- `-E` (or `--encrypt-wal`) enables WAL encryption and validates that the copied `pg_tde` and provider files are present and that the server key is accessible (required). |
||||
|
||||
!!! note |
||||
- The `-E` flag only works with the `-X stream` option (default). It is not compatible with `-X none` or `-X fetch`. For more information, see [the other WAL methods topic](#other-wal-methods). |
||||
- The `-E` flag is only supported with the plain output format (`-F p`). It cannot be used with the tar output format (`-F t`). |
||||
|
||||
## Key rotation during backups |
||||
|
||||
!!! warning |
||||
Do not create, change, or rotate global key providers (or their keys) while `pg_basebackup` is running. Standbys or standalone clusters created from such backups may fail to start during WAL replay and may also lead to the corruption of encrypted data (tables, indexes, and other relations). |
||||
|
||||
Creating, changing, or rotating global key providers (or their keys) during a base backup can leave the standby in an inconsistent state where it cannot retrieve the correct key history. |
||||
|
||||
For example, you may see errors such as: |
||||
|
||||
```sql |
||||
FATAL: failed to retrieve principal key "database_keyXXXX" from key provider "providerYYYY" |
||||
CONTEXT: WAL redo at ... ROTATE_PRINCIPAL_KEY ... |
||||
``` |
||||
|
||||
To ensure standby recoverability, plan key rotations outside backup windows or take a new full backup after rotation completes. |
||||
|
||||
## Restore a backup created with WAL encryption |
||||
|
||||
When you want to restore a backup created with `pg_basebackup -E`: |
||||
|
||||
1. Ensure all external files referenced by your providers configuration (such as certificates or key files) are also present and accessible at the same relative paths. |
||||
2. Start PostgreSQL with the restored data directory. |
||||
|
||||
## Backup method compatibility with WAL encryption |
||||
|
||||
Tar format (`-F t`): |
||||
|
||||
* Works with `-X fetch`. |
||||
* Does not support `-X stream` when WAL encryption is enabled. Using `pg_basebackup -F t -X stream` will create a broken replica. |
||||
|
||||
Streaming mode (`-X stream`): |
||||
|
||||
* **Must** specify `-E` (`--encrypt-wal`). |
||||
* Without `-E`, backups may contain decrypted WAL while `wal_encryption=on` remains in `postgresql.conf` and `pg_tde/wal_keys` are copied. This leads to **startup failures and compromised data in the backup**. |
||||
|
||||
Fetch mode (`-X fetch`): |
||||
|
||||
* Compatible with encrypted WAL without requiring any additional flags. |
||||
|
||||
None (`-X none`): |
||||
|
||||
* Excludes WAL from the backup and is unaffected by WAL encryption. |
||||
|
||||
|
||||
!!! note |
||||
If the source server has `pg_tde/wal_keys`, running `pg_basebackup` with `-X none` or `-X fetch` produces warnings such as: |
||||
|
||||
```sql |
||||
pg_basebackup: warning: the source has WAL keys, but no WAL encryption configured for the target backups |
||||
pg_basebackup: detail: This may lead to exposed data and broken backup |
||||
pg_basebackup: hint: Run pg_basebackup with -E to encrypt streamed WAL |
||||
``` |
||||
|
||||
You can safely ignore the warnings with `-X none` or `-X fetch`, since no WAL streaming occurs. |
||||
@ -1,8 +1,109 @@ |
||||
# Limitations of pg_tde |
||||
|
||||
The following are current limitations of `pg_tde`: |
||||
Limitations of `pg_tde` {{release}}: |
||||
|
||||
* System tables, which include statistics data and database statistics, are currently **not encrypted**. |
||||
* The WAL encryption feature is currently in beta and is not effective unless explicitly enabled. It is not yet production ready. **Do not enable this feature in production environments**. |
||||
* PostgreSQL’s internal system tables, which include statistics and metadata, are not encrypted. |
||||
* Temporary files created when queries exceed `work_mem` are not encrypted. These files may persist during long-running queries or after a server crash which can expose sensitive data in plaintext on disk. |
||||
|
||||
## Currently unsupported WAL tools |
||||
|
||||
The following tools are currently unsupported with `pg_tde` WAL encryption: |
||||
|
||||
* `pg_createsubscriber` |
||||
* `pg_receivewal` |
||||
* `pg_verifybackup` by default fails with checksum or WAL key size mismatch errors. |
||||
As a workaround, use `-s` (skip checksum) and `-n` (`--no-parse-wal`) to verify backups. |
||||
|
||||
The following tools and extensions in Percona Distribution for PostgreSQL have been tested and verified to work with `pg_tde` WAL encryption: |
||||
|
||||
## Supported WAL tools |
||||
|
||||
The following tools have been tested and verified by Percona to work with `pg_tde` WAL encryption: |
||||
|
||||
* Patroni, for an example configuration see the following [Patroni configuration file](#example-patroni-configuration) |
||||
* `pg_basebackup` (with `--wal-method=stream` or `--wal-method=none`), for details on using `pg_basebackup` with WAL encryption, see [Backup with WAL encryption enabled](../how-to/backup-wal-enabled.md) |
||||
* `pg_resetwal` |
||||
* `pg_rewind` |
||||
* `pg_upgrade` |
||||
* `pg_waldump` |
||||
* pgBackRest |
||||
|
||||
## Example Patroni configuration |
||||
|
||||
The following is a Percona-tested example configuration. |
||||
|
||||
??? example "Click to expand the Percona-tested Patroni configuration" |
||||
```yaml |
||||
# Example Patroni configuration file maintained by Percona |
||||
# Source: https://github.com/jobinau/pgscripts/blob/main/patroni/patroni.yml |
||||
scope: tde |
||||
name: pg1 |
||||
restapi: |
||||
listen: 0.0.0.0:8008 |
||||
connect_address: pg1:8008 |
||||
etcd3: |
||||
host: etcd1:2379 |
||||
bootstrap: |
||||
dcs: |
||||
ttl: 30 |
||||
loop_wait: 10 |
||||
retry_timeout: 10 |
||||
maximum_lag_on_failover: 1048576 |
||||
postgresql: |
||||
use_pg_rewind: true |
||||
use_slots: true |
||||
parameters: |
||||
archive_command: "/lib/postgresql/17/bin/pg_tde_archive_decrypt %f %p \"pgbackrest --stanza=tde archive-push %%p\"" |
||||
archive_timeout: 600s |
||||
archive_mode: "on" |
||||
logging_collector: "on" |
||||
restore_command: "/lib/postgresql/17/bin/pg_tde_restore_encrypt %f %p \"pgbackrest --stanza=tde archive-get %%f \\\"%%p\\\"\"" |
||||
pg_hba: |
||||
- local all all peer |
||||
- host all all 0.0.0.0/0 scram-sha-256 |
||||
- host all all ::/0 scram-sha-256 |
||||
- local replication all peer |
||||
- host replication all 0.0.0.0/0 scram-sha-256 |
||||
- host replication all ::/0 scram-sha-256 |
||||
initdb: |
||||
- encoding: UTF8 |
||||
- data-checksums |
||||
- set: shared_preload_libraries=pg_tde |
||||
post_init: /usr/local/bin/setup_cluster.sh |
||||
postgresql: |
||||
listen: 0.0.0.0:5432 |
||||
connect_address: pg1:5432 |
||||
data_dir: /var/lib/postgresql/patroni-17 |
||||
bin_dir: /lib/postgresql/17/bin |
||||
pgpass: /var/lib/postgresql/patronipass |
||||
authentication: |
||||
replication: |
||||
username: replicator |
||||
password: rep-pass |
||||
superuser: |
||||
username: postgres |
||||
password: secretpassword |
||||
parameters: |
||||
unix_socket_directories: /tmp |
||||
# Use unix_socket_directories: /var/run/postgresql for Debian/Ubuntu distributions |
||||
watchdog: |
||||
mode: off |
||||
tags: |
||||
nofailover: false |
||||
noloadbalance: false |
||||
clonefrom: false |
||||
nosync: false |
||||
``` |
||||
|
||||
!!! warning |
||||
The above example is Percona-tested, but Patroni versions differ, especially with discovery backends such as `etcd`. Ensure you adjust the configuration to match your environment, version, and security requirements. |
||||
|
||||
## Next steps |
||||
|
||||
Check which PostgreSQL versions and deployment types are compatible with `pg_tde` before planning your installation. |
||||
|
||||
[View the versions and supported deployments :material-arrow-right:](supported-versions.md){.md-button} |
||||
|
||||
Begin the installation process when you're ready to set up encryption. |
||||
|
||||
[Start installing `pg_tde`](../install.md){.md-button} |
||||
|
||||
@ -0,0 +1,82 @@ |
||||
# pg_tde 2.0 ({{date.GA20}}) |
||||
|
||||
The `pg_tde` by Percona extension brings [Transparent Data Encryption (TDE)](../index/about-tde.md) to PostgreSQL and enables you to keep sensitive data safe and secure. |
||||
|
||||
[Get Started](../install.md){.md-button} |
||||
|
||||
## Release Highlights |
||||
|
||||
### WAL encryption is now generally available |
||||
|
||||
The WAL (Write-Ahead Logging) encryption feature is now fully supported and production-ready, it adds secure write-ahead logging to `pg_tde`, expanding Percona's PostgreSQL encryption coverage by enabling secure, transparent encryption of write-ahead logs using the same key infrastructure as data encryption. |
||||
|
||||
### WAL encryption upgrade limitation |
||||
|
||||
Clusters that used WAL encryption in the beta release (`pg_tde` 1.0 or older) cannot be upgraded to `pg_tde` 2.0. The following error indicates that WAL encryption was enabled: |
||||
|
||||
```sql |
||||
FATAL: principal key not configured |
||||
HINT: Use pg_tde_set_server_key_using_global_key_provider() to configure one. |
||||
``` |
||||
|
||||
Clusters that did not use WAL encryption in beta can be upgraded normally. |
||||
|
||||
### Documentation updates |
||||
|
||||
* Updated the [Limitations](../index/tde-limitations.md) topic, it now includes WAL encryption limitations and both supported and unsupported WAL tools |
||||
* [PG-1858 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1858) - Added a new topic for [Backup with WAL encryption enabled](../how-to/backup-wal-enabled.md) that includes restoring a backup created with WAL encryption |
||||
* [PG-1832 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1858) - Added documentation for using the `pg_tde_archive_decrypt` and `pg_tde_restore_encrypt` utilities. These tools are now covered in [CLI Tools](../command-line-tools/cli-tools.md) to guide users on how to archive and restore encrypted WAL segments securely |
||||
* [PG-1740 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1740) - Updated documentation for [uninstalling `pg_tde`](../how-to/uninstall.md) with WAL encryption enabled and improved the uninstall instructions to cover cases where TDE is disabled while WAL encryption remains active |
||||
|
||||
## Known issues |
||||
|
||||
* Creating, changing, or rotating global key providers (or their keys) while `pg_basebackup` is running may cause standbys or standalone clusters initialized from the backup to fail during WAL replay and may also lead to the corruption of encrypted data (tables, indexes, and other relations). |
||||
|
||||
Avoid making these actions during backup windows. Run a new full backup after completing a rotation or provider update. |
||||
|
||||
* Using `pg_basebackup` with `--wal-method=fetch` produces warnings. |
||||
|
||||
This behavior is expected and will be addressed in a future release. |
||||
|
||||
* The default `mlock` limit on Rocky Linux 8 for ARM64-based architectures equals the memory page size and is 64 Kb. This results in the child process with `pg_tde` failing to allocate another memory page because the max memory limit is reached by the parent process. |
||||
|
||||
To prevent this, you can change the `mlock` limit to be at least twice bigger than the memory page size: |
||||
|
||||
* temporarily for the current session using the `ulimit -l <value>` command. |
||||
* set a new hard limit in the `/etc/security/limits.conf` file. To do so, you require the superuser privileges. |
||||
|
||||
Adjust the limits with caution since it affects other processes running in your system. |
||||
|
||||
## Changelog |
||||
|
||||
### New Features |
||||
|
||||
* [PG-1497 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1497) WAL encryption is now generally available (GA) |
||||
* [PG-1037 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1037) - Added support for `pg_rewind` with encrypted WAL |
||||
* [PG-1411 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1497) - Added support for `pg_resetwal` with encrypted WAL |
||||
* [PG-1603 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1603) - Added support for `pg_basebackup` with encrypted WAL |
||||
* [PG-1710 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1710) - Added support for WAL archiving with encrypted WAL |
||||
* [PG-1711 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1711) - Added support for incremental backups with encrypted WAL, compatibility has been verified with `pg_combinebackup` and the WAL summarizer tool. |
||||
* [PG-1712 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1712) - Added support for `pg_createsubscriber` with encrypted WAL |
||||
* [PG-1833 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1833) - Added verified support for using `pg_waldump` with encrypted WAL |
||||
* [PG-1834 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1834) - Verified `pg_upgrade` with encryption |
||||
|
||||
### Improvements |
||||
|
||||
* [PG-1661 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1661) - Added validation for key material received from providers |
||||
* [PG-1667 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1667) - Validated Vault keyring engine type |
||||
|
||||
### Bugs Fixed |
||||
|
||||
* [PG-1391 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1391) - Fixed unencrypted checkpoint segment on replica with encrypted key |
||||
* [PG-1412 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1412) – Fixed an issue where `XLogFileCopy` failed with encrypted WAL during PITR and `pg_rewind` |
||||
* [PG-1452 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1452) - Fixed an issue where `pg_tde_change_key_provider` did not work without the `-D` flag even if `PGDATA` was set |
||||
* [PG-1485 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1485) - Fixed an issue where streaming replication failed with an invalid magic number in WAL when `wal_encryption` was enabled |
||||
* [PG-1604 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1604) - Fixed a crash during standby promotion caused by an invalid magic number when replaying two-phase transactions from WAL |
||||
* [PG-1658 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1658) - Fixed an issue where the global key provider could not be deleted after server restart |
||||
* [PG-1835 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1835) - Fixed an issue where `pg_resetwal` corrupted encrypted WAL, causing PostgreSQL to fail at startup with an invalid checkpoint |
||||
* [PG-1842 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1842) - Fixed a delay in replica startup with encrypted tables in streaming replication setups |
||||
* [PG-1843 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1843) - Fixed performance issues when creating encrypted tables |
||||
* [PG-1863 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1863) - Fixed an issue where unnecessary WAL was generated when creating temporary tables |
||||
* [PG-1866 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1866) - Fixed an issue where automatic restart after crash sometimes failed with WAL encryption enabled |
||||
* [PG-1867 :octicons-link-external-16:](https://perconadev.atlassian.net/browse/PG-1867) - Fixed archive recovery with encrypted WAL |
||||
@ -1,12 +1,13 @@ |
||||
#Variables used throughout the docs |
||||
|
||||
latestreleasenotes: 'release-notes-v1.0' |
||||
tdeversion: '1.0' |
||||
release: '1.0' |
||||
latestreleasenotes: 'release-notes-v2.0' |
||||
tdeversion: '2.0' |
||||
release: '2.0' |
||||
pgversion17: '17.5' |
||||
tdebranch: release-17.5.2 |
||||
tdebranch: release-17.5.3 |
||||
|
||||
date: |
||||
GA20: '2025-09-01' |
||||
GA10: '2025-06-30' |
||||
RC2: '2025-05-29' |
||||
RC: '2025-03-27' |
||||
|
||||
@ -0,0 +1,4 @@ |
||||
-- complain if script is sourced in psql, rather than via CREATE EXTENSION |
||||
\echo Use "ALTER EXTENSION pg_tde UPDATE TO '2.0'" to load this file. \quit |
||||
|
||||
-- This file is a dummy, because no SQL changed between 1.0 and 2.0 |
||||
@ -1,4 +1,4 @@ |
||||
comment = 'pg_tde access method' |
||||
default_version = '1.0' |
||||
default_version = '2.0' |
||||
module_pathname = '$libdir/pg_tde' |
||||
relocatable = false |
||||
|
||||
Loading…
Reference in new issue