Skip to content

Commit 447f449

Browse files
soedirgosoedirgo
committed
Revert "feat: vault sans pgsodium"
This reverts commit 7207d7a.
1 parent 4a7790c commit 447f449

File tree

15 files changed

+127
-208
lines changed

15 files changed

+127
-208
lines changed

‎.github/workflows/test.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ jobs:
7676
echo "EOF" >> $GITHUB_OUTPUT
7777
- name: verify schema.sql is committed
7878
run: |
79-
nix run github:supabase/postgres/${{ github.sha }}#dbmate-tool -- --version ${{ env.PGMAJOR }} --flake-url github:supabase/postgres/${{ github.sha }}
79+
nix run github:supabase/postgres/${{ github.sha }}#dbmate-tool -- --version ${{ env.PGMAJOR }}
8080
if ! git diff --exit-code --quiet migrations/schema-${{ env.PGMAJOR }}.sql; then
8181
echo "Detected changes in schema.sql:"
8282
git diff migrations/schema-${{ env.PGMAJOR }}.sql

‎ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh

-37
Original file line numberDiff line numberDiff line change
@@ -150,43 +150,6 @@ EOF
150150

151151
run_sql -c "$PATCH_PGMQ_QUERY"
152152
run_sql -c "update pg_extension set extowner = 'postgres'::regrole where extname = 'pgmq';"
153-
154-
# Patch to handle upgrading to pgsodium-less Vault
155-
REENCRYPT_VAULT_SECRETS_QUERY=$(cat <<EOF
156-
DO \$\$
157-
BEGIN
158-
IF EXISTS (SELECT FROM pg_available_extension_versions WHERE name = 'supabase_vault' AND version = '0.3.0')
159-
AND EXISTS (SELECT FROM pg_extension WHERE extname = 'supabase_vault')
160-
THEN
161-
IF (SELECT extversion FROM pg_extension WHERE extname = 'supabase_vault') != '0.2.8' THEN
162-
GRANT USAGE ON SCHEMA vault TO postgres WITH GRANT OPTION;
163-
GRANT SELECT, DELETE ON vault.secrets, vault.decrypted_secrets TO postgres WITH GRANT OPTION;
164-
GRANT EXECUTE ON FUNCTION vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt TO postgres WITH GRANT OPTION;
165-
END IF;
166-
-- Do an explicit IF EXISTS check to avoid referencing pgsodium objects if the project already migrated away from using pgsodium.
167-
IF EXISTS (SELECT FROM vault.secrets WHERE key_id IS NOT NULL) THEN
168-
UPDATE vault.secrets s
169-
SET
170-
secret = encode(
171-
vault._crypto_aead_det_encrypt(
172-
message := pgsodium.crypto_aead_det_decrypt(decode(s.secret, 'base64'), convert_to(s.id || s.description || s.created_at || s.updated_at, 'utf8'), s.key_id, s.nonce),
173-
additional := convert_to(s.id::text, 'utf8'),
174-
key_id := 0,
175-
context := 'pgsodium'::bytea,
176-
nonce := s.nonce
177-
),
178-
'base64'
179-
),
180-
key_id = NULL
181-
WHERE
182-
key_id IS NOT NULL;
183-
END IF;
184-
END IF;
185-
END
186-
\$\$;
187-
EOF
188-
)
189-
run_sql -c "$REENCRYPT_VAULT_SECRETS_QUERY"
190153
fi
191154

192155
run_sql -c "grant pg_read_all_data, pg_signal_backend to postgres"

‎ansible/files/postgresql_config/postgresql.conf.j2

+1-1
Original file line numberDiff line numberDiff line change
@@ -688,7 +688,7 @@ default_text_search_config = 'pg_catalog.english'
688688
#local_preload_libraries = ''
689689
#session_preload_libraries = ''
690690

691-
shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter, supabase_vault' # (change requires restart)
691+
shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter' # (change requires restart)
692692
jit_provider = 'llvmjit' # JIT library to use
693693

694694
# - Other Defaults -

‎ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql

-3
This file was deleted.

‎ansible/files/sodium_extension.sql

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
create schema if not exists pgsodium;
2+
create extension if not exists pgsodium with schema pgsodium cascade;
3+
4+
grant pgsodium_keyiduser to postgres with admin option;
5+
grant pgsodium_keyholder to postgres with admin option;
6+
grant pgsodium_keymaker to postgres with admin option;

‎ansible/tasks/test-image.yml

+3-20
Original file line numberDiff line numberDiff line change
@@ -11,34 +11,17 @@
1111
# cmd: sed -i.bak -e "s/pg_net,\ pgsodium,\ timescaledb/pg_net,\ timescaledb/g" -e "s/pgsodium.getkey_script=/#pgsodium.getkey_script=/g" /etc/postgresql/postgresql.conf
1212
# when: debpkg_mode or stage2_nix
1313

14-
- name: Temporarily disable PG Sodium and Supabase Vault references in config
14+
- name: Temporarily disable PG Sodium references in config
1515
become: yes
1616
become_user: postgres
1717
shell:
1818
cmd: >
19-
sed -i.bak
20-
-e 's/\(shared_preload_libraries = '\''.*\)pgsodium,\(.*'\''\)/\1\2/'
21-
-e 's/\(shared_preload_libraries = '\''.*\)supabase_vault,\(.*'\''\)/\1\2/'
22-
-e 's/\(shared_preload_libraries = '\''.*\), *supabase_vault'\''/\1'\''/'
19+
sed -i.bak
20+
-e 's/\(shared_preload_libraries = '\''.*\)pgsodium,\(.*'\''\)/\1\2/'
2321
-e 's/pgsodium.getkey_script=/#pgsodium.getkey_script=/'
2422
/etc/postgresql/postgresql.conf
2523
when: debpkg_mode or stage2_nix
2624

27-
- name: Verify pgsodium and vault removal from config
28-
become: yes
29-
become_user: postgres
30-
shell:
31-
cmd: |
32-
FOUND=$(grep -E "shared_preload_libraries.*pgsodium|shared_preload_libraries.*supabase_vault|^pgsodium\.getkey_script" /etc/postgresql/postgresql.conf)
33-
if [ ! -z "$FOUND" ]; then
34-
echo "Found unremoved references:"
35-
echo "$FOUND"
36-
exit 1
37-
fi
38-
register: verify_result
39-
failed_when: verify_result.rc != 0
40-
when: debpkg_mode or stage2_nix
41-
4225
- name: Start Postgres Database to load all extensions.
4326
become: yes
4427
become_user: postgres

‎ansible/vars.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ postgres_major:
88

99
# Full version strings for each major version
1010
postgres_release:
11-
postgresorioledb-17: "17.0.1.035-orioledb"
12-
postgres15: "15.8.1.039"
11+
postgresorioledb-17: "17.0.1.34-orioledb"
12+
postgres15: "15.8.1.038"
1313

1414
# Non Postgres Extensions
1515
pgbouncer_release: "1.19.0"

‎ebssurrogate/files/unit-tests/unit-test-01.sql

+8-2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ BEGIN
1717
extension_array := ARRAY[
1818
'plpgsql',
1919
'pg_stat_statements',
20+
'pgsodium',
2021
'pgtap',
2122
'pg_graphql',
2223
'pgcrypto',
@@ -29,6 +30,7 @@ BEGIN
2930
extension_array := ARRAY[
3031
'plpgsql',
3132
'pg_stat_statements',
33+
'pgsodium',
3234
'pgtap',
3335
'pg_graphql',
3436
'pgcrypto',
@@ -42,7 +44,7 @@ BEGIN
4244
PERFORM set_config('myapp.extensions', array_to_string(extension_array, ','), false);
4345
END $$;
4446

45-
SELECT no_plan();
47+
SELECT plan(8);
4648

4749
SELECT extensions_are(
4850
string_to_array(current_setting('myapp.extensions'), ',')::text[]
@@ -54,5 +56,9 @@ SELECT has_schema('pg_catalog');
5456
SELECT has_schema('information_schema');
5557
SELECT has_schema('public');
5658

59+
SELECT function_privs_are('pgsodium', 'crypto_aead_det_decrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
60+
SELECT function_privs_are('pgsodium', 'crypto_aead_det_encrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
61+
SELECT function_privs_are('pgsodium', 'crypto_aead_det_keygen', array[]::text[], 'service_role', array['EXECUTE']);
62+
5763
SELECT * FROM finish();
58-
ROLLBACK;
64+
ROLLBACK;

‎flake.nix

+34-43
Original file line numberDiff line numberDiff line change
@@ -571,49 +571,42 @@
571571
sqlTests = ./nix/tests/smoke;
572572
pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
573573
pg_regress = basePackages.pg_regress;
574-
getkey-script = pkgs.stdenv.mkDerivation {
575-
name = "pgsodium-getkey";
576-
buildCommand = ''
577-
mkdir -p $out/bin
578-
cat > $out/bin/pgsodium-getkey << 'EOF'
579-
#!${pkgs.bash}/bin/bash
580-
set -euo pipefail
581-
582-
TMPDIR_BASE=$(mktemp -d)
583-
584-
if [[ "$(uname)" == "Darwin" ]]; then
585-
KEY_DIR="/private/tmp/pgsodium"
586-
else
587-
KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
588-
fi
589-
KEY_FILE="$KEY_DIR/pgsodium.key"
590-
591-
if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
592-
echo "Error: Could not create key directory $KEY_DIR" >&2
593-
exit 1
594-
fi
595-
chmod 1777 "$KEY_DIR"
596-
597-
if [[ ! -f "$KEY_FILE" ]]; then
598-
if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
599-
if ! (openssl rand -hex 32 > "$KEY_FILE"); then
600-
echo "00000000000000000000000000000000" > "$KEY_FILE"
601-
echo "Warning: Using fallback key" >&2
602-
fi
574+
getkey-script = pkgs.writeScriptBin "pgsodium-getkey" ''
575+
#!${pkgs.bash}/bin/bash
576+
set -euo pipefail
577+
578+
TMPDIR_BASE=$(mktemp -d)
579+
580+
if [[ "$(uname)" == "Darwin" ]]; then
581+
KEY_DIR="/private/tmp/pgsodium"
582+
else
583+
KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
584+
fi
585+
KEY_FILE="$KEY_DIR/pgsodium.key"
586+
587+
if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
588+
echo "Error: Could not create key directory $KEY_DIR" >&2
589+
exit 1
590+
fi
591+
chmod 1777 "$KEY_DIR"
592+
593+
if [[ ! -f "$KEY_FILE" ]]; then
594+
if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
595+
if ! (openssl rand -hex 32 > "$KEY_FILE"); then
596+
echo "00000000000000000000000000000000" > "$KEY_FILE"
597+
echo "Warning: Using fallback key" >&2
603598
fi
604-
chmod 644 "$KEY_FILE"
605-
fi
606-
607-
if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
608-
cat "$KEY_FILE"
609-
else
610-
echo "Error: Cannot read key file $KEY_FILE" >&2
611-
exit 1
612599
fi
613-
EOF
614-
chmod +x $out/bin/pgsodium-getkey
615-
'';
616-
};
600+
chmod 644 "$KEY_FILE"
601+
fi
602+
603+
if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
604+
cat "$KEY_FILE"
605+
else
606+
echo "Error: Cannot read key file $KEY_FILE" >&2
607+
exit 1
608+
fi
609+
'';
617610

618611
# Use the shared setup but with a test-specific name
619612
start-postgres-server-bin = makePostgresDevSetup {
@@ -682,8 +675,6 @@
682675
echo "listen_addresses = '*'" >> "$PGTAP_CLUSTER"/postgresql.conf
683676
echo "port = 5435" >> "$PGTAP_CLUSTER"/postgresql.conf
684677
echo "host all all 127.0.0.1/32 trust" >> $PGTAP_CLUSTER/pg_hba.conf
685-
echo "Checking shared_preload_libraries setting:"
686-
grep -rn "shared_preload_libraries" "$PGTAP_CLUSTER"/postgresql.conf
687678
# Remove timescaledb if running orioledb-17 check
688679
echo "I AM ${pgpkg.version}===================================================="
689680
if [[ "${pgpkg.version}" == *"17"* ]]; then

‎nix/ext/vault.nix

+6-7
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,23 @@
1-
{ lib, stdenv, fetchFromGitHub, libsodium, postgresql }:
1+
{ lib, stdenv, fetchFromGitHub, postgresql }:
22

33
stdenv.mkDerivation rec {
44
pname = "vault";
5-
version = "0.3.1";
5+
version = "0.2.9";
66

7-
buildInputs = [ libsodium postgresql ];
7+
buildInputs = [ postgresql ];
88

99
src = fetchFromGitHub {
1010
owner = "supabase";
1111
repo = pname;
1212
rev = "refs/tags/v${version}";
13-
hash = "sha256-MC87bqgtynnDhmNZAu96jvfCpsGDCPB0g5TZfRQHd30=";
13+
hash = "sha256-kXTngBW4K6FkZM8HvJG2Jha6OQqbejhnk7tchxy031I=";
1414
};
1515

1616
installPhase = ''
1717
mkdir -p $out/{lib,share/postgresql/extension}
1818
19-
install -D *${postgresql.dlSuffix} $out/lib
20-
install -D -t $out/share/postgresql/extension sql/*.sql
21-
install -D -t $out/share/postgresql/extension *.control
19+
cp sql/*.sql $out/share/postgresql/extension
20+
cp *.control $out/share/postgresql/extension
2221
'';
2322

2423
meta = with lib; {

0 commit comments

Comments
 (0)