PG-1857 Do not start basebackup w/o WAL keys #527
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To check if everyone's on board with the idea.
This requires small changes in the backend and basebackup protocol. But it is more reliable - the backup won't start at all if the source server has wal_keys but the destination doesn't.
Another, simpler approach would be to check during the file copy if we stumble upon pg_tde/wal_keys and, if there is no such file in the destination, then we abort the backup. It would require changes only in bin/pg_basebackup. But it can expose unencrypted WAL files in the backup directory (the backup might take who knows how long until we encounter pg_tde/wal_keys).
The code needs improvements - get rid off hardcoded strings etc. Plus we might want to check on the server side if the last WAL key is encrypted instead of just existence of the file.
Also needs tests