PG-1661 Validate key coming from key providers #448
Conversation
Codecov ReportAttention: Patch coverage is
❌ Your project status has failed because the head coverage (84.12%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## TDE_REL_17_STABLE #448 +/- ##
=====================================================
- Coverage 84.65% 84.12% -0.54%
=====================================================
Files 21 21
Lines 2588 2639 +51
Branches 401 411 +10
=====================================================
+ Hits 2191 2220 +29
- Misses 316 336 +20
- Partials 81 83 +2
🚀 New features to boost your workflow:
|
1bd74da to
4f1e571
Compare
25c5bf8 to
55d69e4
Compare
|
There's also a typo in the pr title / commit message |
2930442 to
f192413
Compare
| @@ -252,7 +252,7 @@ WARNING: The WAL encryption feature is currently in beta and may be unstable. D | |||
| (1 row) | |||
|
|
|||
| SELECT pg_tde_change_global_key_provider_file('global-provider','/tmp/global-provider-file-2'); | |||
| ERROR: could not fetch key "server-key" used as server key from modified key provider "global-provider": 0 | |||
| ERROR: key "server-key" not found in key provider "global-provider" | |||
There was a problem hiding this comment.
This message doesn't seem correct.
There was a problem hiding this comment.
We expect that new key provider has key with the same name as current one. This error happens in some internal function that checks that new key provider has the same key as previous one.
Will proposed key provider "global-provider" doesn't have expected key "server key" be better error message for that?
There was a problem hiding this comment.
I originally went with "proposed" for the key providers settings that weren't yet in effect. Zsolt suggested "modified" and I agreed.
I'm not sure this message needs to be changed at all?
There was a problem hiding this comment.
Before there was no difference if we got an error from key provider of if the key not found. Now it's two separate error messages. I updated PR to restore original meaning, but kept "key not found" part. What do you think?
Check that key that we retreived from key provider is valid.
Key provider may return json without expected fields. Check key field for non-null value before processing.
f192413 to
903fc4d
Compare
https://perconadev.atlassian.net/browse/PG-1661
KeyInfoobject no longer needed