pg_basebackup: encrypt streamed WAL with new key #537
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (82.48%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## TDE_REL_17_STABLE #537 +/- ##
=====================================================
+ Coverage 82.40% 82.48% +0.07%
=====================================================
Files 25 25
Lines 3229 3232 +3
Branches 510 510
=====================================================
+ Hits 2661 2666 +5
+ Misses 457 455 -2
Partials 111 111
🚀 New features to boost your workflow:
|
dAdAbird
force-pushed
the
backup_new_wal_key
branch
5 times, most recently
from
0a724e9 to
70b96af
Compare
dAdAbird
force-pushed
the
backup_new_wal_key
branch
from
e7f8c94 to
b0830e3
Compare
dutow
approved these changes
Aug 18, 2025
contrib/pg_tde/t/pg_basebackup.pl
Outdated
| @@ -0,0 +1,49 @@ | |||
|
|
|||
| # Copyright (c) 2021-2024, PostgreSQL Global Development Group | |||
There was a problem hiding this comment.
This copyright seems incorrect, as this mostly tests encryption flags
dAdAbird
force-pushed
the
backup_new_wal_key
branch
2 times, most recently
from
fc48b60 to
3a333e6
Compare
artemgavrilov
approved these changes
Aug 19, 2025
|
A lot of tests seems to fail with this patch. I haven't looked into the details. I'll push an updated version of #542 EDIT: SEems like the issue is with using |
dAdAbird
force-pushed
the
backup_new_wal_key
branch
from
3a333e6 to
cc2a46f
Compare
Before, pg_basebackup would encrypt streamed WAL according to the keys in pg_tde/wal_keys in the destination dir. This commit introduces the number of changes: pg_basebackup encrypts WAL only if the "-E --encrypt-wal" flag is provided. In such a case, it would extract the principal key, truncate pg_tde/wal_keys and encrypt WAL with a newly generated WAL key. We still expect pg_tde/wal_keys and pg_tde/1664_providers in the destination dir. In case these files are not provided, but "-E" is specified, it fails with an error. We also throw a warning if pg_basebackup runs w/o -E, but there is wal_keys on the source as WAL might be compromised, and the backup is broken For PG-1603, PG-1857
dAdAbird
force-pushed
the
backup_new_wal_key
branch
from
cc2a46f to
78c0ecc
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before, pg_basebackup would encrypt streamed WAL according to the keys in pg_tde/wal_keys in the destination dir.
This commit introduces the number of changes:
pg_basebackup encrypts WAL only if the "-E --encrypt-wal" flag is provided. In such a case, it would extract the principal key, truncate pg_tde/wal_keys and encrypt WAL with a newly generated WAL key. We still expect pg_tde/wal_keys and pg_tde/1664_providers in the destination dir. In case these files are not provided, but "-E" is specified, it fails with an error.