From 14a8336849807db71df29a4168d55a5be793b5a4 Mon Sep 17 00:00:00 2001 From: Petr Khartskhaev Date: Thu, 11 Sep 2025 16:23:29 +0200 Subject: [PATCH 1/6] Adding package to EPEL 9 as required by customer Issue: RHEL-96949 --- .gitignore | 1 + postgresql16-anonymizer.spec | 187 ++++++++++++++++++++++++++++------- sources | 1 + 3 files changed, 154 insertions(+), 35 deletions(-) diff --git a/.gitignore b/.gitignore index 1765a1c..d024d95 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /postgresql_anonymizer-2.3.0-vendored.tar.xz /postgresql_anonymizer-2.3.0.tar.bz2 +/postgresql-16.8.tar.bz2 diff --git a/postgresql16-anonymizer.spec b/postgresql16-anonymizer.spec index c8c4dc9..71f508e 100644 --- a/postgresql16-anonymizer.spec +++ b/postgresql16-anonymizer.spec @@ -1,10 +1,25 @@ -%{!?postgresql_default:%global postgresql_default 0} - %global shortname anonymizer %global extension postgresql_%{shortname} %global pgversion 16 +%global postgres_version %{pgversion}.8 %global pgrx_version 0.14.3 -%global pg_config %{_bindir}/pg_config +%global pg_config /tmp/pgsql%{_bindir}/pg_config + +# postgresql conditions for easy handling of %%configure +# during the build of postgresql +%{!?upgrade:%global upgrade 1} +%{!?plpython3:%global plpython3 1} +%{!?pltcl:%global pltcl 1} +%{!?plperl:%global plperl 1} +%{!?ssl:%global ssl 1} +%{!?icu:%global icu 1} +%{!?kerberos:%global kerberos 1} +%{!?ldap:%global ldap 1} +%{!?nls:%global nls 1} +%{!?uuid:%global uuid 1} +%{!?xml:%global xml 1} +%{!?pam:%global pam 1} +%{!?selinux:%global selinux 1} Name: postgresql%{pgversion}-%{shortname} Version: 2.3.0 @@ -56,6 +71,9 @@ Source0: https://gitlab.com/dalibo/%{extension}/-/archive/%{version}/%{ex Source1: %{extension}-%{version}-vendored.tar.xz # To create a tarball with all crates vendored (like https://src.fedoraproject.org/rpms/loupe/blob/rawhide/f/loupe.spec) Source2: create-vendored-tarball.sh +# Since pg16 is only available in RHEL9 as a module and non-module RPMs don't support requiring modules, we need to +# build pg16 from source and build against it +Source3: https://ftp.postgresql.org/pub/source/v%{postgres_version}/postgresql-%{postgres_version}.tar.bz2 # Change default feature to the correct pg version and remove tests from dependencies, the lack of tests is justified below Patch: anonymizer-cargo.patch Patch: remove-disallowed-licenses.patch @@ -64,14 +82,6 @@ Patch: remove-disallowed-licenses.patch # linker error because anonymizer seems to not work on ppc64 (error: linking with `cc` failed: exit status: 1) ExcludeArch: %{ix86} %{power64} -%if %?postgresql_default -%global pkgname %{extension} -%package -n %{pkgname} -Summary: Mask or replace personally identifiable information (PII) or sensitive data -%else -%global pkgname %name -%endif - BuildRequires: rustfmt BuildRequires: clang BuildRequires: bison-devel @@ -79,20 +89,71 @@ BuildRequires: readline-devel BuildRequires: zlib-devel BuildRequires: openssl-devel BuildRequires: wget -BuildRequires: postgresql%{pgversion}-server -BuildRequires: postgresql%{pgversion}-server-devel BuildRequires: cargo-rpm-macros >= 26 -Requires: postgresql%{pgversion}-server -%global precise_version %{?epoch:%epoch:}%version-%release -Provides: %{pkgname} = %precise_version -%if %?postgresql_default -Provides: %name = %precise_version -Provides: postgresql-%{extension} = %precise_version +# BuildRequires for postgresql +BuildRequires: lz4-devel +BuildRequires: perl(ExtUtils::MakeMaker) glibc-devel bison flex gawk +BuildRequires: perl(ExtUtils::Embed), perl-devel +BuildRequires: perl(Opcode) +BuildRequires: perl-generators +BuildRequires: readline-devel zlib-devel +BuildRequires: multilib-rpm-config +BuildRequires: docbook-style-xsl +#aditional BuildRequires for postgresql that can be +#turned off using the vars above +%if %plpython3 +BuildRequires: python3-devel %endif -Provides: %{pkgname}%{?_isa} = %precise_version -Provides: %{extension}-any -Conflicts: %{extension}-any + +%if %pltcl +BuildRequires: tcl-devel +%endif + +%if %ssl +BuildRequires: openssl-devel +%endif + +%if %kerberos +BuildRequires: krb5-devel +%endif + +%if %ldap +BuildRequires: openldap-devel +%endif + +%if %nls +BuildRequires: gettext >= 0.10.35 +%endif + +%if %uuid +BuildRequires: uuid-devel +%endif + +%if %xml +BuildRequires: libxml2-devel libxslt-devel +%endif + +%if %pam +BuildRequires: pam-devel +%endif + +%if %selinux +BuildRequires: libselinux-devel +%endif + +%if %icu +BuildRequires: libicu-devel +%endif + +Requires: postgresql-server > 16 postgresql-server < 17 +# There is really no postgres code included in the binary, so it probably isn't +# necessary to provide these, but a more in-depth discusison should be had as the +# guidelines aren't really clear on this. Including for now because it does no harm +# and enables easier discovery in case of CVEs, which can still happen probably. +# muPDF also provides -devel packages justifying it as "being the safer choice": +# https://src.fedoraproject.org/rpms/mupdf/blob/epel9/f/mupdf.spec +Provides: bundled(postgresql-server) = %{postgres_version} %description PostgreSQL Anonymizer is an extension to mask or replace @@ -102,19 +163,14 @@ The project has a declarative approach of anonymization. This means you can declare the masking rules using the PostgreSQL Data Definition Language (DDL) and specify your anonymization policy inside the table definition itself. -%if %?postgresql_default -%description -n %{pkgname} -PostgreSQL Anonymizer is an extension to mask or replace -personally identifiable information (PII) or commercially sensitive data from -a PostgreSQL database. -The project has a declarative approach of anonymization. This means you can -declare the masking rules using the PostgreSQL Data Definition Language (DDL) -and specify your anonymization policy inside the table definition itself. -%endif - %prep -%autosetup -a1 -p1 -n %{extension}-%{version} +%setup -q -a1 -a3 -n %{extension}-%{version} +%patch -P0 -p1 +%patch -P1 -p1 +# Enabling the unstable edition2024 feature for rust 1.84.1 on RHEL, TODO: remove in the future +echo -e "cargo-features = [\"edition2024\"]\n$(cat vendor/base64ct-1.8.0/Cargo.toml)" > vendor/base64ct-1.8.0/Cargo.toml +echo -e "cargo-features = [\"edition2024\"]\n$(cat vendor/cargo-edit-0.13.2/Cargo.toml)" > vendor/cargo-edit-0.13.2/Cargo.toml # temporary until upstream fixes it find . -name ".DS_Store" -type f -delete %{cargo_prep -v vendor} @@ -122,10 +178,66 @@ echo "[patch.crates-io] dunce = { path = 'vendor/dunce-1.0.5' } constant_time_eq = { path = 'vendor/constant_time_eq-0.3.1' } imgref = { path = 'vendor/imgref-1.11.0' } +base64ct = { path = 'vendor/base64ct-1.8.0' } +cargo-edit = { path = 'vendor/cargo-edit-0.13.2' } " >> .cargo/config.toml %build +# build postgres first +cd postgresql-%{postgres_version} +common_configure_options=' + --disable-rpath +%if %plperl + --with-perl +%endif +%if %pltcl + --with-tcl + --with-tclconfig=/usr/%_lib +%endif +%if %ldap + --with-ldap +%endif +%if %ssl + --with-openssl +%endif +%if %pam + --with-pam +%endif +%if %kerberos + --with-gssapi +%endif +%if %uuid + --with-ossp-uuid +%endif +%if %xml + --with-libxml + --with-libxslt +%endif +%if %nls + --enable-nls +%endif +%if %selinux + --with-selinux +%endif + --with-system-tzdata=/usr/share/zoneinfo + --datadir=%_datadir/pgsql + --with-lz4 +%if %icu + --with-icu +%endif +%if %plpython3 + --with-python +%endif +' +#holds the installed files from postgresql +mkdir -p /tmp/pgsql +%configure $common_configure_options +%make_build +make install DESTDIR=/tmp/pgsql +cd .. +export LD_LIBRARY_PATH=/tmp/pgsql%{_libdir} + # using normal cargo instead of the macros because `make extension` uses it too and needs to be able to find cargo pgrx # cannot build all of pgrx since pgrx-pg-sys (and anonymizer) depends on `cargo pgrx init` being called first export RUSTC_BOOTSTRAP=1 @@ -152,16 +264,21 @@ mkdir -p %{?buildroot}$COMMON_SHAREDIR/extension %{?buildroot}$COMMON_PKGLIBDIR %make_install PG_CONFIG=%{pg_config} PGVER=pg%{pgversion} \ PG_SHAREDIR=%{?buildroot}$COMMON_SHAREDIR PG_PKGLIBDIR=%{?buildroot}$COMMON_PKGLIBDIR \ TARGET_SHAREDIR=$TARGET_DIR$COMMON_SHAREDIR TARGET_PKGLIBDIR=$TARGET_DIR$COMMON_PKGLIBDIR +# move the installed files from /tmp/pgsql +mkdir -p %{?buildroot}%{_datadir} %{?buildroot}%{_libdir} +mv %{?buildroot}/tmp/pgsql%{_datadir}/* %{?buildroot}%{_datadir} +mv %{?buildroot}/tmp/pgsql%{_libdir}/postgresql %{?buildroot}%{_libdir}/pgsql # integration tests (make installcheck) and pg_tests are impossible to run here since postgres hardcodes -# where it looks for extensions, and the pgrx_tests package also requires root access to be installed and run +# where it looks for extensions, the pgrx_tests package also requires root access to be installed and run, +# and we have not built pgtests_start and do not have postgresql_pkg_tests.sh on this system # therefore, we can only run unit tests %check PGRX_HOME=%{_builddir}/.pgrx CARGO_HOME=.cargo RUSTC_BOOTSTRAP=1 RUSTFLAGS='%{build_rustflags}' cargo pgrx test -rv pg%{pgversion} ::test_ -%files -n %{pkgname} +%files %{_libdir}/pgsql/anon.so %{_datadir}/pgsql/extension/anon--%{version}.sql %{_datadir}/pgsql/extension/anon.control diff --git a/sources b/sources index 6e948c2..e924ca4 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (postgresql_anonymizer-2.3.0-vendored.tar.xz) = 4bf4d0b9014bfd2002b747e51829464d4b0506d148847b2f4c5ddf534608c33587cd163501c989df1b2ce7808c734a4f9597a83629d68d1ecd9029b42d3d9e8c SHA512 (postgresql_anonymizer-2.3.0.tar.bz2) = 3ad60825ae750ea4fb138553341a7203f7823939442d760ea275ba1244dfa469e85cb086f16e204c0e5f8ce7ddf1630b5d27df5c071566bc0c656a273ad29991 +SHA512 (postgresql-16.8.tar.bz2) = f44fdfe01fbf82f3ffe4c9fc860bd27e06dddfe43b6bd6d1c6e267d64086eb5517e23cc1b2b8895cb73e63fce76779993ea9785a97e6e348ed91b4c08bb0492d From 8e3f3f6068fc3fc5d2fddd07b24944e2a69e7e8a Mon Sep 17 00:00:00 2001 From: Petr Khartskhaev Date: Tue, 16 Sep 2025 10:36:37 +0200 Subject: [PATCH 2/6] Added a tmt test to run upstream's installcheck and specified instructions for manual testing in README --- .fmf/version | 1 + README.md | 29 +++++++++++++++++++++++++++++ plans/installcheck.fmf | 8 ++++++++ tests/installcheck/main.fmf | 2 ++ tests/installcheck/test.sh | 15 +++++++++++++++ 5 files changed, 55 insertions(+) create mode 100644 .fmf/version create mode 100644 plans/installcheck.fmf create mode 100644 tests/installcheck/main.fmf create mode 100755 tests/installcheck/test.sh diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/README.md b/README.md index 7a50b80..256b828 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,32 @@ # postgresql16-anonymizer The postgresql16-anonymizer package + +## Testing + +There are many integration tests provided by upstream that cannot be run during the build due to postgres's restrictions. +To run those tests manually, follow these steps: + +1. Install additional dependencies for building rust and built-in postgres extensions: + +`# dnf --setopt=install_weak_deps=False install rustfmt wget diffutils postgresql16-server-devel postgresql16-contrib postgresql16-anonymizer` + +2. Install and initialize pgrx: +```sh +$ cargo install cargo-pgrx --version 0.14.3 --locked +$ cargo pgrx init --pg16 /usr/bin/pg_config +``` + +3. Download and extract the source tarball and patch test files (replace `{version}` with the current version of the software): +```sh +$ wget https://gitlab.com/dalibo/postgresql_anonymizer/-/archive/{version}/postgresql_anonymizer-{version}.tar.bz2 +$ tar -xvf postgresql_anonymizer-{version}.tar.bz2 +$ cd postgresql_anonymizer-{version} +$ sed -i "s/^CONNECTION 'host=localhost/CONNECTION 'host=localhost port=28816/" tests/sql/test_replica_masking.sql +$ sed -i "s/^CONNECTION 'host=localhost/CONNECTION 'host=localhost port=28816/" tests/expected/test_replica_masking.out +``` + +4. Run the tests +```sh +$ make installcheck PG_CONFIG=/usr/bin/pg_config PGVER=pg16 +``` diff --git a/plans/installcheck.fmf b/plans/installcheck.fmf new file mode 100644 index 0000000..c5cf592 --- /dev/null +++ b/plans/installcheck.fmf @@ -0,0 +1,8 @@ +summary: Setup everything needed for building cargo-pgrx and running make installcheck +discover: + how: fmf +prepare: + how: install + package: [rustfmt, wget, diffutils, postgresql16-server-devel, postgresql16-contrib, postgresql16-anonymizer] +execute: + how: tmt diff --git a/tests/installcheck/main.fmf b/tests/installcheck/main.fmf new file mode 100644 index 0000000..e4d7822 --- /dev/null +++ b/tests/installcheck/main.fmf @@ -0,0 +1,2 @@ +summary: Run upstream's install check +test: useradd testuser && sudo -u testuser ./test.sh diff --git a/tests/installcheck/test.sh b/tests/installcheck/test.sh new file mode 100755 index 0000000..4d11b0f --- /dev/null +++ b/tests/installcheck/test.sh @@ -0,0 +1,15 @@ +#!/bin/sh -eux + +version=2.3.0 + +cd +cargo install cargo-pgrx --version 0.14.3 --locked +cargo pgrx init --pg16 /usr/bin/pg_config + +wget https://gitlab.com/dalibo/postgresql_anonymizer/-/archive/${version}/postgresql_anonymizer-${version}.tar.bz2 +tar -xvf postgresql_anonymizer-${version}.tar.bz2 +cd postgresql_anonymizer-${version} +sed -i "s/^CONNECTION 'host=localhost/CONNECTION 'host=localhost port=28816/" tests/sql/test_replica_masking.sql +sed -i "s/^CONNECTION 'host=localhost/CONNECTION 'host=localhost port=28816/" tests/expected/test_replica_masking.out + +make installcheck PG_CONFIG=/usr/bin/pg_config PGVER=pg16 || (cat regression.diffs && exit 1) From f35344f5cb6f215bbbaae916a036924c0323a47f Mon Sep 17 00:00:00 2001 From: Petr Khartskhaev Date: Tue, 16 Sep 2025 12:04:00 +0200 Subject: [PATCH 3/6] Extend test timeout --- README.md | 5 +++-- tests/installcheck/main.fmf | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 256b828..1aa6805 100644 --- a/README.md +++ b/README.md @@ -8,8 +8,9 @@ There are many integration tests provided by upstream that cannot be run during To run those tests manually, follow these steps: 1. Install additional dependencies for building rust and built-in postgres extensions: - -`# dnf --setopt=install_weak_deps=False install rustfmt wget diffutils postgresql16-server-devel postgresql16-contrib postgresql16-anonymizer` +```sh +# dnf --setopt=install_weak_deps=False install rustfmt wget diffutils postgresql16-server-devel postgresql16-contrib postgresql16-anonymizer` +``` 2. Install and initialize pgrx: ```sh diff --git a/tests/installcheck/main.fmf b/tests/installcheck/main.fmf index e4d7822..f21ad24 100644 --- a/tests/installcheck/main.fmf +++ b/tests/installcheck/main.fmf @@ -1,2 +1,3 @@ summary: Run upstream's install check +duration: 20m test: useradd testuser && sudo -u testuser ./test.sh From fe98860baf7462e33749810926c06db8897006b2 Mon Sep 17 00:00:00 2001 From: Petr Khartskhaev Date: Tue, 16 Sep 2025 13:29:41 +0200 Subject: [PATCH 4/6] Added bzip2 to packages --- plans/installcheck.fmf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plans/installcheck.fmf b/plans/installcheck.fmf index c5cf592..8613d7c 100644 --- a/plans/installcheck.fmf +++ b/plans/installcheck.fmf @@ -3,6 +3,6 @@ discover: how: fmf prepare: how: install - package: [rustfmt, wget, diffutils, postgresql16-server-devel, postgresql16-contrib, postgresql16-anonymizer] + package: [rustfmt, wget, diffutils, bzip2, postgresql16-server-devel, postgresql16-contrib, postgresql16-anonymizer] execute: how: tmt From c0c4502602122fb44fc3a6d9520b3550cda9fcd4 Mon Sep 17 00:00:00 2001 From: Petr Khartskhaev Date: Mon, 22 Sep 2025 15:34:14 +0200 Subject: [PATCH 5/6] Alter tests for epel9 --- README.md | 6 ++++++ plans/installcheck.fmf | 12 ++++++++++-- tests/installcheck/test.sh | 3 +++ 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1aa6805..9f7ac86 100644 --- a/README.md +++ b/README.md @@ -5,6 +5,12 @@ The postgresql16-anonymizer package ## Testing There are many integration tests provided by upstream that cannot be run during the build due to postgres's restrictions. + +After a PR, the installability check always fails due to the nature of the pacakge +which depends on a module. There are tmt tests that install the package and check +it, so if that passes, the package is installable and you should ignore the +installability fail. + To run those tests manually, follow these steps: 1. Install additional dependencies for building rust and built-in postgres extensions: diff --git a/plans/installcheck.fmf b/plans/installcheck.fmf index 8613d7c..7fa695f 100644 --- a/plans/installcheck.fmf +++ b/plans/installcheck.fmf @@ -2,7 +2,15 @@ summary: Setup everything needed for building cargo-pgrx and running make instal discover: how: fmf prepare: - how: install - package: [rustfmt, wget, diffutils, bzip2, postgresql16-server-devel, postgresql16-contrib, postgresql16-anonymizer] + - name: Skip Testing Farm installation of artifacts + how: install + exclude: + - .* + + - how: shell + script: dnf module enable -y postgresql:16 + + - how: install + package: [gcc, readline-devel, zlib-devel, openssl-devel, wget, diffutils, bzip2, sudo, postgresql16-anonymizer, postgresql-server-devel, postgresql-contrib] execute: how: tmt diff --git a/tests/installcheck/test.sh b/tests/installcheck/test.sh index 4d11b0f..0d91ef2 100755 --- a/tests/installcheck/test.sh +++ b/tests/installcheck/test.sh @@ -3,6 +3,9 @@ version=2.3.0 cd +wget https://sh.rustup.rs +sh ./index.html -y +. "$HOME/.cargo/env" cargo install cargo-pgrx --version 0.14.3 --locked cargo pgrx init --pg16 /usr/bin/pg_config From ecc96d19a7ba6a4053e72477ca212f6a98e46a35 Mon Sep 17 00:00:00 2001 From: Petr Khartskhaev Date: Mon, 5 Jan 2026 13:26:18 +0100 Subject: [PATCH 6/6] Update to 2.5.1 Resolves: 2415505 --- README.md | 29 ++++++++++++++++++++++++----- postgresql16-anonymizer.spec | 4 ++-- sources | 4 ++-- 3 files changed, 28 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 8d4f99a..792fb98 100644 --- a/README.md +++ b/README.md @@ -8,26 +8,45 @@ There are many integration tests provided by upstream that cannot be run during To run those tests manually, follow these steps: 1. Install additional dependencies for building rust and built-in postgres extensions: - ```sh - # dnf --setopt=install_weak_deps=False install rustfmt wget diffutils postgresql16-server-devel postgresql16-contrib postgresql16-anonymizer + + ``` + $ dnf --setopt=install_weak_deps=False install rustfmt wget diffutils postgresql16-server-devel postgresql16-contrib postgresql16-anonymizer ``` 2. Install and initialize pgrx: - ```sh + + ``` $ cargo install cargo-pgrx --version 0.14.3 --locked + ``` + + ``` $ cargo pgrx init --pg16 /usr/bin/pg_config ``` 3. Download and extract the source tarball and patch test files (replace `{version}` with the current version of the software): - ```sh + + ``` $ wget https://gitlab.com/dalibo/postgresql_anonymizer/-/archive/{version}/postgresql_anonymizer-{version}.tar.bz2 + ``` + + ``` $ tar -xvf postgresql_anonymizer-{version}.tar.bz2 + ``` + + ``` $ cd postgresql_anonymizer-{version} + ``` + + ``` $ sed -i "s/^CONNECTION 'host=localhost/CONNECTION 'host=localhost port=28816/" tests/sql/test_replica_masking.sql + ``` + + ``` $ sed -i "s/^CONNECTION 'host=localhost/CONNECTION 'host=localhost port=28816/" tests/expected/test_replica_masking.out ``` 4. Run the tests - ```sh + + ``` $ make installcheck PG_CONFIG=/usr/bin/pg_config PGVER=pg16 ``` diff --git a/postgresql16-anonymizer.spec b/postgresql16-anonymizer.spec index 6a3f387..e16608a 100644 --- a/postgresql16-anonymizer.spec +++ b/postgresql16-anonymizer.spec @@ -3,11 +3,11 @@ %global shortname anonymizer %global extension postgresql_%{shortname} %global pgversion 16 -%global pgrx_version 0.16.0 +%global pgrx_version 0.16.1 %global pg_config %{_bindir}/pg_config Name: postgresql%{pgversion}-%{shortname} -Version: 2.4.1 +Version: 2.5.1 Release: %autorelease Summary: Mask or replace personally identifiable information (PII) or sensitive data diff --git a/sources b/sources index 80ae920..2ee75d6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (postgresql_anonymizer-2.4.1.tar.bz2) = b043e9cbaa647fbed477128277dae5fe2a97f8db33cb204fa81a09e972b158b4ce9e18e0d2fdd7be85513ddba9a0cb7199bdffd541b491b5da87aff42c9cba12 -SHA512 (postgresql_anonymizer-2.4.1-vendored.tar.xz) = ca6cec1b64054cb7dfabf17a92453786323dca647f6d27912a6dd9fa6d95b4f5ce9e7eba6ce721b21be0b1d84becc8556c8d6654319648143b4555c00539dc00 +SHA512 (postgresql_anonymizer-2.5.1.tar.bz2) = f0f9c24f748f277833adad1982c00c04d0546e3aa227b9d280e68b8efa47620ee1a3f496dbad31c4d7de940f762b659953d3d49abb4eacf3378ab33f58e3d62c +SHA512 (postgresql_anonymizer-2.5.1-vendored.tar.xz) = f93002bc486141da7eec88c5414f0a8857237927e6e42df998b76702a14d6d820312d07541b984401b6f8e46ffcadf09433da8749e95396d92cc8fab256a5988