Add tests for logical replication, pg_dump/restore, and 2PC under encryption - #1
Merged
Merged
Conversation
…ryption Fill coverage gaps for encrypted-data behavior that the existing suite did not exercise. Each test verifies both correctness and that data stays encrypted at rest, and all are perltidy-clean. - t/logical_replication.pl: two-node publisher/subscriber logical replication with WAL encryption on the publisher, so logical changes are decoded from encrypted WAL. Checks initial sync and incremental insert/update/delete of an encrypted (tde_heap) table, that the subscriber's copy is itself encrypted, and that the replicated rows are ciphertext on disk. (The existing t/replication.pl covers physical streaming replication.) - t/pg_dump_restore.pl: logical dump/restore round trip of a database with encrypted tables. Confirms the dump records the tde_heap access method, the data restores into a database with its own key, and the restored table is re-encrypted at rest. - t/prepared_xact.pl: two-phase commit on an encrypted table, including that a prepared transaction survives a crash and replays from encrypted WAL, then COMMIT PREPARED and ROLLBACK PREPARED behave correctly. Register all three in meson.build. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fills test-coverage gaps for encrypted-data behavior that the existing suite did not exercise. Each new test verifies both correctness and that data stays encrypted at rest, and all three are
perltidy-clean against PostgreSQL'sperltidyrc.Gap analysis
The suite already covered physical/streaming replication (
t/replication.pl),pg_rewind,pg_basebackup, crash recovery, WAL archiving, and single-node logical decoding (test_decodingint/wal_encrypt.pl). It did not cover:t/logical_replication.plpg_dump/ restore round trip of encrypted datat/pg_dump_restore.plt/prepared_xact.plNew tests
t/logical_replication.pl— two independent clusters, publisher and subscriber, each with its own key. The publisher has WAL encryption on, so logical changes are decoded from encrypted WAL. Verifies initial table sync and incremental insert/update/delete of an encryptedtde_heaptable, that the subscriber's copy is itself encrypted, and that replicated rows are ciphertext on disk. A guard asserts WAL encryption is actually enabled. (9 subtests.)t/pg_dump_restore.pl— logical dump/restore round trip. Confirms the dump records thetde_heapaccess method, the data restores into a database with its own key, the restored table is re-encrypted at rest, and its data is ciphertext on disk. (9 subtests.)t/prepared_xact.pl— two-phase commit on an encrypted table with WAL encryption on. A prepared transaction is left uncommitted, the server is crashed, and after recovery the prepared transaction still exists and COMMIT PREPARED applies the encrypted changes; ROLLBACK PREPARED is also exercised. (8 subtests.)Testing
All pass on native PostgreSQL 18 (built with the open_pg_tde core patch), alongside the existing t/replication.pl (7 subtests). Each new file is perltidy-clean.
Generated with Claude Code