Skip to content

File encryption modules poc #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AndersAstrand wants to merge 8 commits into
base: master
Choose a base branch
from
Open

File encryption modules poc #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
fc5d131
Add file_encryption_library infrastructure
AndersAstrand May 12, 2026
4a8581d
Add contrib/basic_file_encryption (AES-256-GCM reference module)
AndersAstrand May 12, 2026
93e4b36
Reserve trailer in PageInit and teach AMs about it
AndersAstrand May 12, 2026
a514a61
Encrypt relation pages on the way to and from disk
AndersAstrand May 12, 2026
9aca92e
Encrypt BufFile temporary files
AndersAstrand May 12, 2026
06a40d6
Encrypt logical decoding spill files
AndersAstrand May 12, 2026
98c67ec
Add contrib/sm4_file_encryption (SM4-CTR + SM3 reference module)
AndersAstrand May 12, 2026
ac55ad1
pg_checksums: support encrypted clusters
AndersAstrand May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions contrib/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,9 +56,17 @@ SUBDIRS = \
vacuumlo

ifeq ($(with_ssl),openssl)
SUBDIRS += pgcrypto sslinfo
SUBDIRS += \
basic_file_encryption \
pgcrypto \
sm4_file_encryption \
sslinfo
else
ALWAYS_SUBDIRS += pgcrypto sslinfo
ALWAYS_SUBDIRS += \
basic_file_encryption \
pgcrypto \
sm4_file_encryption \
sslinfo
endif

ifneq ($(with_uuid),no)
Expand Down
2 changes: 1 addition & 1 deletion contrib/amcheck/verify_nbtree.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1461,7 +1461,7 @@ bt_target_page_check(BtreeCheckState *state)
*/
lowersizelimit = skey->heapkeyspace &&
(P_ISLEAF(topaque) || BTreeTupleGetHeapTID(itup) == NULL);
if (tupsize > (lowersizelimit ? BTMaxItemSize : BTMaxItemSizeNoHeapTid))
if (tupsize > (lowersizelimit ? BTMaxItemSizeForCluster() : BTMaxItemSizeNoHeapTidForCluster()))
{
ItemPointer tid = BTreeTupleGetPointsToTID(itup);
char *itid,
Expand Down
4 changes: 4 additions & 0 deletions contrib/basic_file_encryption/.gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# Generated subdirectories
/log/
/results/
/tmp_check/
24 changes: 24 additions & 0 deletions contrib/basic_file_encryption/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# contrib/basic_file_encryption/Makefile

MODULE_big = basic_file_encryption
OBJS = \
$(WIN32RES) \
basic_file_encryption.o
PGFILEDESC = "basic_file_encryption - reference file encryption module"

NO_INSTALLCHECK = 1
TAP_TESTS = 1

# Link against libcrypto for AES-GCM support.
SHLIB_LINK += $(filter -lcrypto, $(LIBS))

ifdef USE_PGXS
PG_CONFIG = pg_config
PGXS := $(shell $(PG_CONFIG) --pgxs)
include $(PGXS)
else
subdir = contrib/basic_file_encryption
top_builddir = ../..
include $(top_builddir)/src/Makefile.global
include $(top_srcdir)/contrib/contrib-global.mk
endif
Loading