diff --git a/.gitignore b/.gitignore index 00decd5..2d203eb 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,2 @@ /postgresql_anonymizer* -/results* -/postgresql-16.8.tar.bz2 +/results* \ No newline at end of file diff --git a/README.md b/README.md index 8d4f99a..792fb98 100644 --- a/README.md +++ b/README.md @@ -8,26 +8,45 @@ There are many integration tests provided by upstream that cannot be run during To run those tests manually, follow these steps: 1. Install additional dependencies for building rust and built-in postgres extensions: - ```sh - # dnf --setopt=install_weak_deps=False install rustfmt wget diffutils postgresql16-server-devel postgresql16-contrib postgresql16-anonymizer + + ``` + $ dnf --setopt=install_weak_deps=False install rustfmt wget diffutils postgresql16-server-devel postgresql16-contrib postgresql16-anonymizer ``` 2. Install and initialize pgrx: - ```sh + + ``` $ cargo install cargo-pgrx --version 0.14.3 --locked + ``` + + ``` $ cargo pgrx init --pg16 /usr/bin/pg_config ``` 3. Download and extract the source tarball and patch test files (replace `{version}` with the current version of the software): - ```sh + + ``` $ wget https://gitlab.com/dalibo/postgresql_anonymizer/-/archive/{version}/postgresql_anonymizer-{version}.tar.bz2 + ``` + + ``` $ tar -xvf postgresql_anonymizer-{version}.tar.bz2 + ``` + + ``` $ cd postgresql_anonymizer-{version} + ``` + + ``` $ sed -i "s/^CONNECTION 'host=localhost/CONNECTION 'host=localhost port=28816/" tests/sql/test_replica_masking.sql + ``` + + ``` $ sed -i "s/^CONNECTION 'host=localhost/CONNECTION 'host=localhost port=28816/" tests/expected/test_replica_masking.out ``` 4. Run the tests - ```sh + + ``` $ make installcheck PG_CONFIG=/usr/bin/pg_config PGVER=pg16 ``` diff --git a/plans/installcheck.fmf b/plans/installcheck.fmf index 7fa695f..8613d7c 100644 --- a/plans/installcheck.fmf +++ b/plans/installcheck.fmf @@ -2,15 +2,7 @@ summary: Setup everything needed for building cargo-pgrx and running make instal discover: how: fmf prepare: - - name: Skip Testing Farm installation of artifacts - how: install - exclude: - - .* - - - how: shell - script: dnf module enable -y postgresql:16 - - - how: install - package: [gcc, readline-devel, zlib-devel, openssl-devel, wget, diffutils, bzip2, sudo, postgresql16-anonymizer, postgresql-server-devel, postgresql-contrib] + how: install + package: [rustfmt, wget, diffutils, bzip2, postgresql16-server-devel, postgresql16-contrib, postgresql16-anonymizer] execute: how: tmt diff --git a/postgresql16-anonymizer.spec b/postgresql16-anonymizer.spec index 607b67b..e16608a 100644 --- a/postgresql16-anonymizer.spec +++ b/postgresql16-anonymizer.spec @@ -1,28 +1,13 @@ +%{!?postgresql_default:%global postgresql_default 0} + %global shortname anonymizer %global extension postgresql_%{shortname} %global pgversion 16 -%global postgres_version %{pgversion}.8 -%global pgrx_version 0.16.0 -%global pg_config /tmp/pgsql%{_bindir}/pg_config - -# postgresql conditions for easy handling of %%configure -# during the build of postgresql -%{!?upgrade:%global upgrade 1} -%{!?plpython3:%global plpython3 1} -%{!?pltcl:%global pltcl 1} -%{!?plperl:%global plperl 1} -%{!?ssl:%global ssl 1} -%{!?icu:%global icu 1} -%{!?kerberos:%global kerberos 1} -%{!?ldap:%global ldap 1} -%{!?nls:%global nls 1} -%{!?uuid:%global uuid 1} -%{!?xml:%global xml 1} -%{!?pam:%global pam 1} -%{!?selinux:%global selinux 1} +%global pgrx_version 0.16.1 +%global pg_config %{_bindir}/pg_config Name: postgresql%{pgversion}-%{shortname} -Version: 2.4.1 +Version: 2.5.1 Release: %autorelease Summary: Mask or replace personally identifiable information (PII) or sensitive data @@ -71,9 +56,6 @@ Source0: https://gitlab.com/dalibo/%{extension}/-/archive/%{version}/%{ex Source1: %{extension}-%{version}-vendored.tar.xz # To create a tarball with all crates vendored (like https://src.fedoraproject.org/rpms/loupe/blob/rawhide/f/loupe.spec) Source2: create-vendored-tarball.sh -# Since pg16 is only available in RHEL9 as a module and non-module RPMs don't support requiring modules, we need to -# build pg16 from source and build against it -Source3: https://ftp.postgresql.org/pub/source/v%{postgres_version}/postgresql-%{postgres_version}.tar.bz2 # Change default feature to the correct pg version and remove tests from dependencies, the lack of tests is justified below Patch: anonymizer-cargo.patch Patch: remove-disallowed-licenses.patch @@ -81,6 +63,14 @@ Patch: remove-disallowed-licenses.patch # drop i686 support (https://fedoraproject.org/wiki/Changes/Noi686Repositories) ExcludeArch: %{ix86} +%if %?postgresql_default +%global pkgname %{extension} +%package -n %{pkgname} +Summary: Mask or replace personally identifiable information (PII) or sensitive data +%else +%global pkgname %name +%endif + BuildRequires: rustfmt BuildRequires: clang BuildRequires: bison-devel @@ -88,71 +78,20 @@ BuildRequires: readline-devel BuildRequires: zlib-devel BuildRequires: openssl-devel BuildRequires: wget +BuildRequires: postgresql%{pgversion}-server +BuildRequires: postgresql%{pgversion}-server-devel BuildRequires: cargo-rpm-macros >= 26 +Requires: postgresql%{pgversion}-server -# BuildRequires for postgresql -BuildRequires: lz4-devel -BuildRequires: perl(ExtUtils::MakeMaker) glibc-devel bison flex gawk -BuildRequires: perl(ExtUtils::Embed), perl-devel -BuildRequires: perl(Opcode) -BuildRequires: perl-generators -BuildRequires: readline-devel zlib-devel -BuildRequires: multilib-rpm-config -BuildRequires: docbook-style-xsl -#aditional BuildRequires for postgresql that can be -#turned off using the vars above -%if %plpython3 -BuildRequires: python3-devel +%global precise_version %{?epoch:%epoch:}%version-%release +Provides: %{pkgname} = %precise_version +%if %?postgresql_default +Provides: %name = %precise_version +Provides: postgresql-%{extension} = %precise_version %endif - -%if %pltcl -BuildRequires: tcl-devel -%endif - -%if %ssl -BuildRequires: openssl-devel -%endif - -%if %kerberos -BuildRequires: krb5-devel -%endif - -%if %ldap -BuildRequires: openldap-devel -%endif - -%if %nls -BuildRequires: gettext >= 0.10.35 -%endif - -%if %uuid -BuildRequires: uuid-devel -%endif - -%if %xml -BuildRequires: libxml2-devel libxslt-devel -%endif - -%if %pam -BuildRequires: pam-devel -%endif - -%if %selinux -BuildRequires: libselinux-devel -%endif - -%if %icu -BuildRequires: libicu-devel -%endif - -Requires: postgresql-server > 16 postgresql-server < 17 -# There is really no postgres code included in the binary, so it probably isn't -# necessary to provide these, but a more in-depth discusison should be had as the -# guidelines aren't really clear on this. Including for now because it does no harm -# and enables easier discovery in case of CVEs, which can still happen probably. -# muPDF also provides -devel packages justifying it as "being the safer choice": -# https://src.fedoraproject.org/rpms/mupdf/blob/epel9/f/mupdf.spec -Provides: bundled(postgresql-server) = %{postgres_version} +Provides: %{pkgname}%{?_isa} = %precise_version +Provides: %{extension}-any +Conflicts: %{extension}-any %description PostgreSQL Anonymizer is an extension to mask or replace @@ -162,79 +101,28 @@ The project has a declarative approach of anonymization. This means you can declare the masking rules using the PostgreSQL Data Definition Language (DDL) and specify your anonymization policy inside the table definition itself. +%if %?postgresql_default +%description -n %{pkgname} +PostgreSQL Anonymizer is an extension to mask or replace +personally identifiable information (PII) or commercially sensitive data from +a PostgreSQL database. +The project has a declarative approach of anonymization. This means you can +declare the masking rules using the PostgreSQL Data Definition Language (DDL) +and specify your anonymization policy inside the table definition itself. +%endif + %prep -%setup -q -a1 -a3 -n %{extension}-%{version} -%patch -P0 -p1 -%patch -P1 -p1 -# Enabling the unstable edition2024 feature for rust 1.84.1 on RHEL, TODO: remove in the future -echo -e "cargo-features = [\"edition2024\"]\n$(cat vendor/base64ct-1.8.0/Cargo.toml)" > vendor/base64ct-1.8.0/Cargo.toml -echo -e "cargo-features = [\"edition2024\"]\n$(cat vendor/cargo-edit-0.13.2/Cargo.toml)" > vendor/cargo-edit-0.13.2/Cargo.toml +%autosetup -a1 -p1 -n %{extension}-%{version} %{cargo_prep -v vendor} echo "[patch.crates-io] dunce = { path = 'vendor/dunce-1.0.5' } constant_time_eq = { path = 'vendor/constant_time_eq-0.3.1' } imgref = { path = 'vendor/imgref-1.11.0' } -base64ct = { path = 'vendor/base64ct-1.8.0' } -cargo-edit = { path = 'vendor/cargo-edit-0.13.2' } " >> .cargo/config.toml %build -# build postgres first -cd postgresql-%{postgres_version} -common_configure_options=' - --disable-rpath -%if %plperl - --with-perl -%endif -%if %pltcl - --with-tcl - --with-tclconfig=/usr/%_lib -%endif -%if %ldap - --with-ldap -%endif -%if %ssl - --with-openssl -%endif -%if %pam - --with-pam -%endif -%if %kerberos - --with-gssapi -%endif -%if %uuid - --with-ossp-uuid -%endif -%if %xml - --with-libxml - --with-libxslt -%endif -%if %nls - --enable-nls -%endif -%if %selinux - --with-selinux -%endif - --with-system-tzdata=/usr/share/zoneinfo - --datadir=%_datadir/pgsql - --with-lz4 -%if %icu - --with-icu -%endif -%if %plpython3 - --with-python -%endif -' -#holds the installed files from postgresql -mkdir -p /tmp/pgsql -%configure $common_configure_options -%make_build -make install DESTDIR=/tmp/pgsql -cd .. -export LD_LIBRARY_PATH=/tmp/pgsql%{_libdir} - # using normal cargo instead of the macros because `make extension` uses it too and needs to be able to find cargo pgrx # cannot build all of pgrx since pgrx-pg-sys (and anonymizer) depends on `cargo pgrx init` being called first export RUSTC_BOOTSTRAP=1 @@ -261,21 +149,16 @@ mkdir -p %{?buildroot}$COMMON_SHAREDIR/extension %{?buildroot}$COMMON_PKGLIBDIR %make_install PG_CONFIG=%{pg_config} PGVER=pg%{pgversion} \ PG_SHAREDIR=%{?buildroot}$COMMON_SHAREDIR PG_PKGLIBDIR=%{?buildroot}$COMMON_PKGLIBDIR \ TARGET_SHAREDIR=$TARGET_DIR$COMMON_SHAREDIR TARGET_PKGLIBDIR=$TARGET_DIR$COMMON_PKGLIBDIR -# move the installed files from /tmp/pgsql -mkdir -p %{?buildroot}%{_datadir} %{?buildroot}%{_libdir} -mv %{?buildroot}/tmp/pgsql%{_datadir}/* %{?buildroot}%{_datadir} -mv %{?buildroot}/tmp/pgsql%{_libdir}/postgresql %{?buildroot}%{_libdir}/pgsql # integration tests (make installcheck) and pg_tests are impossible to run here since postgres hardcodes -# where it looks for extensions, the pgrx_tests package also requires root access to be installed and run, -# and we have not built pgtests_start and do not have postgresql_pkg_tests.sh on this system +# where it looks for extensions, and the pgrx_tests package also requires root access to be installed and run # therefore, we can only run unit tests %check PGRX_HOME=%{_builddir}/.pgrx CARGO_HOME=.cargo RUSTC_BOOTSTRAP=1 RUSTFLAGS='%{build_rustflags}' cargo pgrx test -rv pg%{pgversion} ::test_ -%files +%files -n %{pkgname} %{_libdir}/pgsql/anon.so %{_datadir}/pgsql/extension/anon--%{version}.sql %{_datadir}/pgsql/extension/anon.control diff --git a/sources b/sources index c0ba890..2ee75d6 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (postgresql_anonymizer-2.4.1.tar.bz2) = b043e9cbaa647fbed477128277dae5fe2a97f8db33cb204fa81a09e972b158b4ce9e18e0d2fdd7be85513ddba9a0cb7199bdffd541b491b5da87aff42c9cba12 -SHA512 (postgresql_anonymizer-2.4.1-vendored.tar.xz) = ca6cec1b64054cb7dfabf17a92453786323dca647f6d27912a6dd9fa6d95b4f5ce9e7eba6ce721b21be0b1d84becc8556c8d6654319648143b4555c00539dc00 -SHA512 (postgresql-16.8.tar.bz2) = f44fdfe01fbf82f3ffe4c9fc860bd27e06dddfe43b6bd6d1c6e267d64086eb5517e23cc1b2b8895cb73e63fce76779993ea9785a97e6e348ed91b4c08bb0492d +SHA512 (postgresql_anonymizer-2.5.1.tar.bz2) = f0f9c24f748f277833adad1982c00c04d0546e3aa227b9d280e68b8efa47620ee1a3f496dbad31c4d7de940f762b659953d3d49abb4eacf3378ab33f58e3d62c +SHA512 (postgresql_anonymizer-2.5.1-vendored.tar.xz) = f93002bc486141da7eec88c5414f0a8857237927e6e42df998b76702a14d6d820312d07541b984401b6f8e46ffcadf09433da8749e95396d92cc8fab256a5988 diff --git a/tests/installcheck/test.sh b/tests/installcheck/test.sh index 5365dea..2e4eeb3 100755 --- a/tests/installcheck/test.sh +++ b/tests/installcheck/test.sh @@ -3,9 +3,6 @@ version=2.4.1 cd -wget https://sh.rustup.rs -sh ./index.html -y -. "$HOME/.cargo/env" cargo install cargo-pgrx --version 0.16.0 --locked cargo pgrx init --pg16 /usr/bin/pg_config