Skip to content

Conversation

dAdAbird
Copy link
Member

@dAdAbird dAdAbird commented Aug 12, 2025

To check if everyone's on board with the idea.
This requires small changes in the backend and basebackup protocol. But it is more reliable - the backup won't start at all if the source server has wal_keys but the destination doesn't.
Another, simpler approach would be to check during the file copy if we stumble upon pg_tde/wal_keys and, if there is no such file in the destination, then we abort the backup. It would require changes only in bin/pg_basebackup. But it can expose unencrypted WAL files in the backup directory (the backup might take who knows how long until we encounter pg_tde/wal_keys).

The code needs improvements - get rid off hardcoded strings etc. Plus we might want to check on the server side if the last WAL key is encrypted instead of just existence of the file.

Also needs tests

@codecov-commenter
Copy link

codecov-commenter commented Aug 12, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.20%. Comparing base (b2bb77c) to head (d986221).
⚠️ Report is 2 commits behind head on TDE_REL_17_STABLE.

❌ Your project status has failed because the head coverage (82.20%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files
@@                Coverage Diff                 @@
##           TDE_REL_17_STABLE     #527   +/-   ##
==================================================
  Coverage              82.19%   82.20%           
==================================================
  Files                     25       25           
  Lines                   3174     3175    +1     
  Branches                 515      516    +1     
==================================================
+ Hits                    2609     2610    +1     
  Misses                   456      456           
  Partials                 109      109           
Components Coverage Δ
access 83.47% <ø> (ø)
catalog 87.60% <ø> (ø)
common 77.77% <ø> (ø)
encryption 72.97% <ø> (ø)
keyring 73.21% <ø> (ø)
src 94.15% <ø> (ø)
smgr 95.32% <ø> (+0.02%) ⬆️
transam ∅ <ø> (∅)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@dAdAbird dAdAbird force-pushed the backup_stop_no_keys branch from 25cce39 to a29c3c6 Compare August 12, 2025 16:51
@dAdAbird dAdAbird force-pushed the backup_stop_no_keys branch from a29c3c6 to d986221 Compare August 12, 2025 17:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants