Skip to content

PG-1213 Add SQL function for checking if WAL record is encrypted #514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: TDE_REL_17_STABLE
Choose a base branch
from
Open

PG-1213 Add SQL function for checking if WAL record is encrypted #514

wants to merge 2 commits into from

Conversation

artemgavrilov
Copy link
Collaborator

@artemgavrilov artemgavrilov commented Aug 8, 2025 •
edited
Loading

https://perconadev.atlassian.net/browse/PG-1213

This PR bumps major version for the extension and introduces two new functions:

  1. pg_tde_is_wal_record_encrypted - checks if record with provided LSN is encrypted. Function by default assumes that given LSN belongs to the current timeline, but allows to specify exact timeline id via optional argument.
  2. pg_tde_get_wal_encryption_ranges - returns WAL encryption ranges. Within provided ranges all records are encrypted. I decided to not expose knowledge about "internal keys" and represent this information just as "encryption ranges". TAP tests for this function doesn't use output files but instead relies on assertion because LSN numbers not stable in different envs/test runs.

dAdAbird
dAdAbird reviewed Aug 8, 2025
View reviewed changes
jeltz
jeltz reviewed Aug 9, 2025
View reviewed changes
@artemgavrilov artemgavrilov force-pushed the PG-1213-check-wal-enc-func branch 7 times, most recently from d411530 to f23f140 Compare August 13, 2025 19:49
@codecov-commenter
Copy link

codecov-commenter commented Aug 13, 2025 •
edited
Loading

Codecov Report

❌ Patch coverage is 86.95652% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.15%. Comparing base (6ddc86c) to head (9967248).

❌ Your project status has failed because the head coverage (82.15%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files 
@@                  Coverage Diff                  @@
##           TDE_REL_17_STABLE     #514      +/-   ##
=====================================================
+ Coverage              82.08%   82.15%   +0.06%     
=====================================================
  Files                     25       25              
  Lines                   3170     3216      +46     
  Branches                 505      514       +9     
=====================================================
+ Hits                    2602     2642      +40     
- Misses                   460      464       +4     
- Partials                 108      110       +2
Components Coverage Δ
access 83.42% <ø> (ø)
catalog 87.60% <ø> (ø)
common 77.77% <ø> (ø)
encryption 72.97% <ø> (ø)
keyring 73.21% <ø> (ø)
src 93.26% <86.95%> (-0.90%) ⬇️
smgr 95.90% <ø> (ø)
transam ∅ <ø> (∅)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@artemgavrilov artemgavrilov force-pushed the PG-1213-check-wal-enc-func branch 4 times, most recently from 80db6f8 to 6d0da57 Compare August 14, 2025 14:14
@artemgavrilov artemgavrilov marked this pull request as ready for review August 14, 2025 14:30
@artemgavrilov
PG-1213 Add function for checking if WAL record is encrypted
5e72329 
Add user function for checking if WAL record with given LSN is
encrypted. Function assumes that provided LSN belongs to current
timeline, however it allows to specify timeline ID as second argument.
@artemgavrilov
PG-1213 Add function that returns WAL encryption ragnes
9967248 
Add user function that shows LSN ranges for encrypted records in WAL.
@artemgavrilov artemgavrilov force-pushed the PG-1213-check-wal-enc-func branch from 6d0da57 to 9967248 Compare August 14, 2025 14:40
Andriciuc
Andriciuc approved these changes Aug 14, 2025
View reviewed changes
Copy link
Collaborator

@Andriciuc Andriciuc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved from docs, well done!

nastena1606
nastena1606 reviewed Aug 14, 2025
View reviewed changes
contrib/pg_tde/documentation/docs/functions.md
);
```

### pg_tde_get_wal_encryption_ranges
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
### pg_tde_get_wal_encryption_ranges
### pg_tde_get_wal_encryption_ranges

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nastena1606 nastena1606 nastena1606 left review comments

@Andriciuc Andriciuc Andriciuc approved these changes

@jeltz jeltz Awaiting requested review from jeltz

@dAdAbird dAdAbird Awaiting requested review from dAdAbird

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@artemgavrilov @codecov-commenter @jeltz @Andriciuc @dAdAbird @nastena1606