We need your feedback

[ImTheKai]

We're thrilled to have developed pg_tde, but our journey doesn't end here. To continue improving and evolving, we need your valuable feedback.

Please share your thoughts and insights about the extension. What features would you like to see next? How can we enhance pg_tde to better meet your needs? Your feedback is instrumental in guiding our development efforts, so please don't hesitate to reach out and share your thoughts with us.

[Qqrel]

Hi Kai,
I compiled pg_tde some time (month) ago and since than I've been getting random errors in using libcrypto library, as folllows

Dec 22 03:18:26 czdc-p kernel: traps: postgres[3554489] general protection fault ip:7fdf81d9c834 sp:7ffe2448e378 error:0 in libcrypto.so.3.2.2[7fdf81cb4000+32e000]
Dec 23 03:20:07 czdc-p kernel: traps: postgres[3693939] general protection fault ip:7fdf81d9c834 sp:7ffe2448e378 error:0 in libcrypto.so.3.2.2[7fdf81cb4000+32e000]
Dec 23 22:15:15 czdc-p kernel: postgres[3831636]: segfault at 800000010 ip 00007fdf81d9c834 sp 00007ffe2448e038 error 4 in libcrypto.so.3.2.2[7fdf81cb4000+32e000] likely on CPU 0 (core 0, socket 0)
Dec 24 03:21:55 czdc-p kernel: postgres[3870706]: segfault at 100747e ip 00007fdf81d9c834 sp 00007ffe2448e378 error 4 in libcrypto.so.3.2.2[7fdf81cb4000+32e000] likely on CPU 0 (core 0, socket 0)
Dec 24 11:15:18 czdc-p kernel: postgres[3928763]: segfault at 15 ip 00007fdf81d9c834 sp 00007ffe2448e038 error 4 in libcrypto.so.3.2.2[7fdf81cb4000+32e000] likely on CPU 1 (core 1, socket 0)

So I decided to update from source but recent versions of pg_tde is probably missing some libs
src/keyring/keyring_kmip.c:15:10: fatal error: kmip.h: No such file or directory

as src/keyring/ is empty directory. Could you please verify deployment process with me that it is complete?

$ git clone https://github.com/percona/pg_tde
$ cd pg_tde/
$ $ make USE_PGXS=1
...
src/keyring/keyring_kmip.c:15:10: fatal error: kmip.h: No such file or directory
15 | #include <kmip.h>
| ^~~~~~~~
compilation terminated.
make: *** [: src/keyring/keyring_kmip.o] Error 1

thanks,
Karel.

[dutow]

Hello!

kmip is a submodule, please try executing git submodule update --init

[Qqrel]

Hello, thanks!
submodule added, compilation with a few warnings done. But when restarted with new tde it complained about

ERROR: failed to retrieve principal key. Create one using pg_tde_set_principal_key before using encrypted tables.

so I returned back old library to get it working again. It seems this recent update doesn't like key in file or Is there any procedure that has to be done when tde is updated?

[dutow]

Hello!

We do not support updates between early development versions - this will change in the near future, but until our first production ready release, pg_tde is only intended for testing.

As the error message suggest, for the new version, you will have to create a new key with pg_tde_set_principal_key - for details, please check the documentation, it is up to date.

If you have existing encrypted tables, the upgrade prodecure is:

• ALTER TABLE ... SET ACCESS METHOD heap; to un-encrypt the table
• DROP EXTENSION pg_tde;
• Upgrade the shared library
• Install the extension again
• Create new encrypted tables or use the same ALTER with tde_heap_basic method to make the tables encrypted again. (or tde_heap, in case of our Postgres distribution)