We need your feedback

[ImTheKai]

We're thrilled to have developed pg_tde, but our journey doesn't end here. To continue improving and evolving, we need your valuable feedback.

Please share your thoughts and insights about the extension. What features would you like to see next? How can we enhance pg_tde to better meet your needs? Your feedback is instrumental in guiding our development efforts, so please don't hesitate to reach out and share your thoughts with us.

[Qqrel]

Hi Kai,
I compiled pg_tde some time (month) ago and since than I've been getting random errors in using libcrypto library, as folllows

Dec 22 03:18:26 czdc-p kernel: traps: postgres[3554489] general protection fault ip:7fdf81d9c834 sp:7ffe2448e378 error:0 in libcrypto.so.3.2.2[7fdf81cb4000+32e000]
Dec 23 03:20:07 czdc-p kernel: traps: postgres[3693939] general protection fault ip:7fdf81d9c834 sp:7ffe2448e378 error:0 in libcrypto.so.3.2.2[7fdf81cb4000+32e000]
Dec 23 22:15:15 czdc-p kernel: postgres[3831636]: segfault at 800000010 ip 00007fdf81d9c834 sp 00007ffe2448e038 error 4 in libcrypto.so.3.2.2[7fdf81cb4000+32e000] likely on CPU 0 (core 0, socket 0)
Dec 24 03:21:55 czdc-p kernel: postgres[3870706]: segfault at 100747e ip 00007fdf81d9c834 sp 00007ffe2448e378 error 4 in libcrypto.so.3.2.2[7fdf81cb4000+32e000] likely on CPU 0 (core 0, socket 0)
Dec 24 11:15:18 czdc-p kernel: postgres[3928763]: segfault at 15 ip 00007fdf81d9c834 sp 00007ffe2448e038 error 4 in libcrypto.so.3.2.2[7fdf81cb4000+32e000] likely on CPU 1 (core 1, socket 0)

So I decided to update from source but recent versions of pg_tde is probably missing some libs
src/keyring/keyring_kmip.c:15:10: fatal error: kmip.h: No such file or directory

as src/keyring/ is empty directory. Could you please verify deployment process with me that it is complete?

$ git clone https://github.com/percona/pg_tde
$ cd pg_tde/
$ $ make USE_PGXS=1
...
src/keyring/keyring_kmip.c:15:10: fatal error: kmip.h: No such file or directory
15 | #include <kmip.h>
| ^~~~~~~~
compilation terminated.
make: *** [: src/keyring/keyring_kmip.o] Error 1

thanks,
Karel.

[dutow]

Hello!

We do not support updates between early development versions - this will change in the near future, but until our first production ready release, pg_tde is only intended for testing.

As the error message suggest, for the new version, you will have to create a new key with pg_tde_set_principal_key - for details, please check the documentation, it is up to date.

If you have existing encrypted tables, the upgrade prodecure is:

• ALTER TABLE ... SET ACCESS METHOD heap; to un-encrypt the table
• DROP EXTENSION pg_tde;
• Upgrade the shared library
• Install the extension again
• Create new encrypted tables or use the same ALTER with tde_heap_basic method to make the tables encrypted again. (or tde_heap, in case of our Postgres distribution)

[Qqrel]

Hello,
I tested tde_heap_basic with community and percona PG, both versions from time to time reports error and due the error restart postgres instance. I can find kernel error in system log :

kernel: postgres[3936393]: segfault at 7cc820f ip 00007f44cb70261f sp 00007ffd5bda6af0 error 4 in pg_tde.so[7f44cb6fd000+46000] likely on CPU 1 (core 1, socket 0)

and failing query logged in postres log file.

percona-postgresql17-contrib-17.0-20250106001754.1.el9.x86_64 used.

since I used tde_heap AM instead of tde_heap_basic I got rid of errors. If you give me instructions on how to do this, I can debug or trace the bug and report it to you.

[ImTheKai]

Hey @Qqrel, can you try again against the latest release from us and tde_heap only, as basic will be deprecated moving forward.

Not sure which OS you're using -

https://percona.github.io/pg_tde/main/apt.html#install-percona-release

https://percona.github.io/pg_tde/main/yum.html

[Qqrel]

HI @ImTheKai,
I'm using RockyLInux9.
I followed steps above un-encrypt , DROP EXTENSION from all databases, update using rpm/dnf
Even so I'm getting
" []FATAL: failed to retrieve principal key. Create one using pg_tde_set_principal_key before using encrypted table"
and postgres won't start.

so I downgraded back to previous version:
dnf downgrade percona-postgresql17-contrib-17.0-20250106001754.1.el9.x86_64

how can I validate all prerequisites, can I use find against PGDATA directory to get some clue what is causing the error?

[ImTheKai]

@Qqrel We do not support upgrade during the beta phase. With the 17.2.1 release pg_tde is part of the server package, that you can install from our repository, so this upgrade won't work.

[ana-m-v]

Just what we were missing! Would you please let us know if pg_tde could be used on Windows? Is the Make Build section for that? Cheers!

[ImTheKai]

Hi @ana-m-v,

currently we don't test or build pg_tde on Windows. Is that something that would be needed in your environment?