Revert "feat: vault sans pgsodium"

This reverts commit 7207d7a.

Author: soedirgo

.github/workflows/test.yml

@@ -76,7 +76,7 @@ jobs:
           echo "EOF" >> $GITHUB_OUTPUT
       - name: verify schema.sql is committed
         run: |
-          nix run github:supabase/postgres/${{ github.sha }}#dbmate-tool -- --version ${{ env.PGMAJOR }} --flake-url github:supabase/postgres/${{ github.sha }}
+          nix run github:supabase/postgres/${{ github.sha }}#dbmate-tool -- --version ${{ env.PGMAJOR }}
           if ! git diff --exit-code --quiet migrations/schema-${{ env.PGMAJOR }}.sql; then
             echo "Detected changes in schema.sql:"
             git diff migrations/schema-${{ env.PGMAJOR }}.sql

ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh

@@ -150,43 +150,6 @@ EOF
 
         run_sql -c "$PATCH_PGMQ_QUERY"
         run_sql -c "update pg_extension set extowner = 'postgres'::regrole where extname = 'pgmq';"
-
-        # Patch to handle upgrading to pgsodium-less Vault
-        REENCRYPT_VAULT_SECRETS_QUERY=$(cat <<EOF
-        DO \$\$
-        BEGIN
-          IF EXISTS (SELECT FROM pg_available_extension_versions WHERE name = 'supabase_vault' AND version = '0.3.0')
-            AND EXISTS (SELECT FROM pg_extension WHERE extname = 'supabase_vault')
-          THEN
-            IF (SELECT extversion FROM pg_extension WHERE extname = 'supabase_vault') != '0.2.8' THEN
-              GRANT USAGE ON SCHEMA vault TO postgres WITH GRANT OPTION;
-              GRANT SELECT, DELETE ON vault.secrets, vault.decrypted_secrets TO postgres WITH GRANT OPTION;
-              GRANT EXECUTE ON FUNCTION vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt TO postgres WITH GRANT OPTION;
-            END IF;
-            -- Do an explicit IF EXISTS check to avoid referencing pgsodium objects if the project already migrated away from using pgsodium.
-            IF EXISTS (SELECT FROM vault.secrets WHERE key_id IS NOT NULL) THEN
-              UPDATE vault.secrets s
-              SET
-                secret = encode(
-                  vault._crypto_aead_det_encrypt(
-                    message := pgsodium.crypto_aead_det_decrypt(decode(s.secret, 'base64'), convert_to(s.id || s.description || s.created_at || s.updated_at, 'utf8'), s.key_id, s.nonce),
-                    additional := convert_to(s.id::text, 'utf8'),
-                    key_id := 0,
-                    context := 'pgsodium'::bytea,
-                    nonce := s.nonce
-                  ),
-                  'base64'
-                ),
-                key_id = NULL
-              WHERE
-                key_id IS NOT NULL;
-            END IF;
-          END IF;
-        END
-        \$\$;
-EOF
-        )
-        run_sql -c "$REENCRYPT_VAULT_SECRETS_QUERY"
     fi
 
     run_sql -c "grant pg_read_all_data, pg_signal_backend to postgres"

ansible/files/postgresql_config/postgresql.conf.j2

@@ -688,7 +688,7 @@ default_text_search_config = 'pg_catalog.english'
 #local_preload_libraries = ''
 #session_preload_libraries = ''
 
-shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter, supabase_vault'	# (change requires restart)
+shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter'	# (change requires restart)
 jit_provider = 'llvmjit'		# JIT library to use
 
 # - Other Defaults -

ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql

@@ -0,0 +1,6 @@
+create schema if not exists pgsodium;
+create extension if not exists pgsodium with schema pgsodium cascade;
+
+grant pgsodium_keyiduser to postgres with admin option;
+grant pgsodium_keyholder to postgres with admin option;
+grant pgsodium_keymaker  to postgres with admin option;

ansible/files/sodium_extension.sql

@@ -11,34 +11,17 @@
 #     cmd: sed -i.bak -e "s/pg_net,\ pgsodium,\ timescaledb/pg_net,\ timescaledb/g" -e "s/pgsodium.getkey_script=/#pgsodium.getkey_script=/g" /etc/postgresql/postgresql.conf
 #   when: debpkg_mode or stage2_nix
 
-- name: Temporarily disable PG Sodium and Supabase Vault references in config
+- name: Temporarily disable PG Sodium references in config
   become: yes
   become_user: postgres
   shell:
     cmd: >
-      sed -i.bak 
-      -e 's/\(shared_preload_libraries = '\''.*\)pgsodium,\(.*'\''\)/\1\2/' 
-      -e 's/\(shared_preload_libraries = '\''.*\)supabase_vault,\(.*'\''\)/\1\2/' 
-      -e 's/\(shared_preload_libraries = '\''.*\), *supabase_vault'\''/\1'\''/'
+      sed -i.bak
+      -e 's/\(shared_preload_libraries = '\''.*\)pgsodium,\(.*'\''\)/\1\2/'
       -e 's/pgsodium.getkey_script=/#pgsodium.getkey_script=/'
       /etc/postgresql/postgresql.conf
   when: debpkg_mode or stage2_nix
 
-- name: Verify pgsodium and vault removal from config
-  become: yes
-  become_user: postgres
-  shell:
-    cmd: |
-      FOUND=$(grep -E "shared_preload_libraries.*pgsodium|shared_preload_libraries.*supabase_vault|^pgsodium\.getkey_script" /etc/postgresql/postgresql.conf)
-      if [ ! -z "$FOUND" ]; then
-        echo "Found unremoved references:"
-        echo "$FOUND"
-        exit 1
-      fi
-  register: verify_result
-  failed_when: verify_result.rc != 0
-  when: debpkg_mode or stage2_nix
-
 - name: Start Postgres Database to load all extensions.
   become: yes
   become_user: postgres

ansible/tasks/test-image.yml

@@ -8,8 +8,8 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.035-orioledb"
-  postgres15: "15.8.1.039"
+  postgresorioledb-17: "17.0.1.34-orioledb"
+  postgres15: "15.8.1.038"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

ansible/vars.yml

@@ -17,6 +17,7 @@ BEGIN
         extension_array := ARRAY[
             'plpgsql',
             'pg_stat_statements',
+            'pgsodium',
             'pgtap',
             'pg_graphql',
             'pgcrypto',
@@ -29,6 +30,7 @@ BEGIN
         extension_array := ARRAY[
             'plpgsql',
             'pg_stat_statements',
+            'pgsodium',
             'pgtap',
             'pg_graphql',
             'pgcrypto',
@@ -42,7 +44,7 @@ BEGIN
     PERFORM set_config('myapp.extensions', array_to_string(extension_array, ','), false);
 END $$;
 
-SELECT no_plan();
+SELECT plan(8);
 
 SELECT extensions_are(
     string_to_array(current_setting('myapp.extensions'), ',')::text[]
@@ -54,5 +56,9 @@ SELECT has_schema('pg_catalog');
 SELECT has_schema('information_schema');
 SELECT has_schema('public');
 
+SELECT function_privs_are('pgsodium', 'crypto_aead_det_decrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
+SELECT function_privs_are('pgsodium', 'crypto_aead_det_encrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
+SELECT function_privs_are('pgsodium', 'crypto_aead_det_keygen', array[]::text[], 'service_role', array['EXECUTE']);
+
 SELECT * FROM finish();
-ROLLBACK;
+ROLLBACK;

ebssurrogate/files/unit-tests/unit-test-01.sql

@@ -571,49 +571,42 @@
             sqlTests = ./nix/tests/smoke;
             pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
             pg_regress = basePackages.pg_regress;
-            getkey-script = pkgs.stdenv.mkDerivation {
-              name = "pgsodium-getkey";
-              buildCommand = ''
-                mkdir -p $out/bin
-                cat > $out/bin/pgsodium-getkey << 'EOF'
-                #!${pkgs.bash}/bin/bash
-                set -euo pipefail
-                
-                TMPDIR_BASE=$(mktemp -d)
-                
-                if [[ "$(uname)" == "Darwin" ]]; then
-                  KEY_DIR="/private/tmp/pgsodium"
-                else
-                  KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
-                fi
-                KEY_FILE="$KEY_DIR/pgsodium.key"
-                
-                if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
-                  echo "Error: Could not create key directory $KEY_DIR" >&2
-                  exit 1
-                fi
-                chmod 1777 "$KEY_DIR"
-                
-                if [[ ! -f "$KEY_FILE" ]]; then
-                  if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
-                    if ! (openssl rand -hex 32 > "$KEY_FILE"); then
-                      echo "00000000000000000000000000000000" > "$KEY_FILE"
-                      echo "Warning: Using fallback key" >&2
-                    fi
+            getkey-script = pkgs.writeScriptBin "pgsodium-getkey" ''
+              #!${pkgs.bash}/bin/bash
+              set -euo pipefail
+              
+              TMPDIR_BASE=$(mktemp -d)
+              
+              if [[ "$(uname)" == "Darwin" ]]; then
+                KEY_DIR="/private/tmp/pgsodium"
+              else
+                KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
+              fi
+              KEY_FILE="$KEY_DIR/pgsodium.key"
+              
+              if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
+                echo "Error: Could not create key directory $KEY_DIR" >&2
+                exit 1
+              fi
+              chmod 1777 "$KEY_DIR"
+              
+              if [[ ! -f "$KEY_FILE" ]]; then
+                if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
+                  if ! (openssl rand -hex 32 > "$KEY_FILE"); then
+                    echo "00000000000000000000000000000000" > "$KEY_FILE"
+                    echo "Warning: Using fallback key" >&2
                   fi
-                  chmod 644 "$KEY_FILE"
-                fi
-                
-                if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
-                  cat "$KEY_FILE"
-                else
-                  echo "Error: Cannot read key file $KEY_FILE" >&2
-                  exit 1
                 fi
-                EOF
-                chmod +x $out/bin/pgsodium-getkey
-              '';
-            };
+                chmod 644 "$KEY_FILE"
+              fi
+              
+              if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
+                cat "$KEY_FILE"
+              else
+                echo "Error: Cannot read key file $KEY_FILE" >&2
+                exit 1
+              fi
+            '';
 
             # Use the shared setup but with a test-specific name
             start-postgres-server-bin = makePostgresDevSetup {
@@ -682,8 +675,6 @@
               echo "listen_addresses = '*'" >> "$PGTAP_CLUSTER"/postgresql.conf
               echo "port = 5435" >> "$PGTAP_CLUSTER"/postgresql.conf
               echo "host all all 127.0.0.1/32 trust" >> $PGTAP_CLUSTER/pg_hba.conf
-              echo "Checking shared_preload_libraries setting:"
-              grep -rn "shared_preload_libraries" "$PGTAP_CLUSTER"/postgresql.conf
               # Remove timescaledb if running orioledb-17 check
               echo "I AM ${pgpkg.version}===================================================="
               if [[ "${pgpkg.version}" == *"17"* ]]; then

flake.nix

@@ -1,24 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, libsodium, postgresql }:
+{ lib, stdenv, fetchFromGitHub, postgresql }:
 
 stdenv.mkDerivation rec {
   pname = "vault";
-  version = "0.3.1";
+  version = "0.2.9";
 
-  buildInputs = [ libsodium postgresql ];
+  buildInputs = [ postgresql ];
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-MC87bqgtynnDhmNZAu96jvfCpsGDCPB0g5TZfRQHd30=";
+    hash = "sha256-kXTngBW4K6FkZM8HvJG2Jha6OQqbejhnk7tchxy031I=";
   };
 
   installPhase = ''
     mkdir -p $out/{lib,share/postgresql/extension}
 
-    install -D *${postgresql.dlSuffix} $out/lib
-    install -D -t $out/share/postgresql/extension sql/*.sql
-    install -D -t $out/share/postgresql/extension *.control
+    cp sql/*.sql $out/share/postgresql/extension
+    cp *.control $out/share/postgresql/extension
   '';
 
   meta = with lib; {