From 2af8e33edc2beaf295b90be67260324b78adf5e8 Mon Sep 17 00:00:00 2001 From: "Joshua (D) Drake" <136637981+ChronicallyJD@users.noreply.github.com> Date: Wed, 15 Jul 2026 17:20:18 -0600 Subject: [PATCH 1/3] style: pgindent open_pg_tde_tdemap.c (TDEMapEntryV4/Type) The migration-reader code added with the key-map base_iv work left four lines that pgindent rewrites once TDEMapEntryV4 and TDEMapEntryType are recognized as types: the typedef-struct closing braces and the `TDEMapEntryV4 *entry` parameter form. This is the only file the pgindent CI check flags. Whitespace only, no behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/access/open_pg_tde_tdemap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/access/open_pg_tde_tdemap.c b/src/access/open_pg_tde_tdemap.c index 97bc9fd..4995e86 100644 --- a/src/access/open_pg_tde_tdemap.c +++ b/src/access/open_pg_tde_tdemap.c @@ -47,7 +47,7 @@ typedef enum { MAP_ENTRY_TYPE_EMPTY = 0, MAP_ENTRY_TYPE_KEY = 1, -} TDEMapEntryType; +} TDEMapEntryType; typedef struct TDEFileHeader { @@ -1021,10 +1021,10 @@ typedef struct TDEMapEntryV4 unsigned char aead_tag[MAP_ENTRY_AEAD_TAG_SIZE]; uint8 key_base_iv[INTERNAL_KEY_IV_LEN]; uint8 encrypted_key_data[32]; -} TDEMapEntryV4; +} TDEMapEntryV4; static bool -read_one_map_entry_v4(int fd, TDEMapEntryV4 * entry, off_t *offset) +read_one_map_entry_v4(int fd, TDEMapEntryV4 *entry, off_t *offset) { int bytes_read = pg_pread(fd, entry, sizeof(TDEMapEntryV4), *offset); @@ -1038,7 +1038,7 @@ read_one_map_entry_v4(int fd, TDEMapEntryV4 * entry, off_t *offset) } static void -ikey_from_map_entry_v4(TDEMapEntryV4 * entry, const TDEPrincipalKey *principal_key, InternalKey *out) +ikey_from_map_entry_v4(TDEMapEntryV4 *entry, const TDEPrincipalKey *principal_key, InternalKey *out) { out->key_len = open_pg_tde_cipher_key_length(entry->cipher); out->cipher = entry->cipher; From 14de0d17d2297027dcb421b516943d2580373fe1 Mon Sep 17 00:00:00 2001 From: "Joshua (D) Drake" <136637981+ChronicallyJD@users.noreply.github.com> Date: Wed, 15 Jul 2026 18:26:52 -0600 Subject: [PATCH 2/3] ci: make the pgindent typedefs deterministic The pgindent check regenerates typedefs.list with find_typedef, whose output depends on the debug info of the build it scans. It does not reliably emit this project's local typedefs (for example TDEMapEntryType and TDEMapEntryV4), so the pgindent check flapped: the same lines were wanted in "type" form on one run and "non-type" form on the next. Commit the project's typedefs and have dump-typedefs.sh always merge them into the generated list, so recognition no longer depends on find_typedef. Only the previously-missed local typedefs change anything, and only in open_pg_tde_tdemap.c, which the previous commit already formats for the recognized state. Co-Authored-By: Claude Opus 4.8 (1M context) --- ci_scripts/dump-typedefs.sh | 4 +++ ci_scripts/tde_typedefs.list | 62 ++++++++++++++++++++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 ci_scripts/tde_typedefs.list diff --git a/ci_scripts/dump-typedefs.sh b/ci_scripts/dump-typedefs.sh index a656e26..64b2585 100755 --- a/ci_scripts/dump-typedefs.sh +++ b/ci_scripts/dump-typedefs.sh @@ -19,4 +19,8 @@ fi ../postgres/src/tools/find_typedef . wget -q -O - "https://buildfarm.postgresql.org/cgi-bin/typedefs.pl?branch=REL_17_STABLE" wget -q -O - "https://buildfarm.postgresql.org/cgi-bin/typedefs.pl?branch=REL_18_STABLE" + # find_typedef does not reliably emit this project's local typedefs (its + # output depends on the debug info of the build it scans), which makes the + # pgindent check flap. Always include them so the result is deterministic. + cat "$SCRIPT_DIR/tde_typedefs.list" ) | sort -u > ../src/typedefs.list diff --git a/ci_scripts/tde_typedefs.list b/ci_scripts/tde_typedefs.list new file mode 100644 index 0000000..7358628 --- /dev/null +++ b/ci_scripts/tde_typedefs.list @@ -0,0 +1,62 @@ +AesCtxCache +CipherType +CurlString +EncryptionMix +EncryptionStateData +FileKeyring +GenericKeyring +InternalKey +JsonKeyringField +JsonKeyringSemState +JsonKeyringState +JsonOpenBaoMountInfoState +JsonOpenBaoRespField +JsonOpenBaoRespMountInfoSemState +JsonOpenBaoRespSemState +JsonOpenBaoRespState +KeyData +KeyInfo +KeyProviderSharedState +KeyringProviderRecord +KeyringProviderRecordInFile +KeyringReturnCode +keys_version_info +KmipCtx +KmipKeyring +MapFromDiskEntry +OpenBaoKeyring +ProviderScanType +ProviderType +RegisteredKeyProviderType +TdeBlockCryptFn +TdeCipher +TdeDdlEvent +TDEEncryptMode +TDEFileHeader +TDEKeyringRoutine +TdeKeystreamFn +TDEMapEntry +TDEMapEntryType +TDEMapEntryV3 +TDEMapEntryV4 +TDEMapEntryV5 +TDEMgrRelationEncryptionStatus +TDEPrincipalKey +TDEPrincipalKeyInfo +TdePrincipalKeylocalState +TdePrincipalKeySharedState +TDESignedPrincipalKeyInfo +TDESMgrRelation +TempRelKeyEntry +WalEncryptionRange +WalEncryptionRangeType +WalEntryFromDiskEntry +WALKeyCacheRec +WalKeyFileEntry +WalKeyFileEntryV1 +WalKeyFileEntryV2 +WalKeyFileHeader +WalLocation +XLogExtensionInstall +XLogPrincipalKeyRotate +XLogRelKey From 220c835e98a46033c6e26c711a430d176d21521a Mon Sep 17 00:00:00 2001 From: "Joshua (D) Drake" <136637981+ChronicallyJD@users.noreply.github.com> Date: Wed, 15 Jul 2026 18:34:22 -0600 Subject: [PATCH 3/3] ci: exclude vendored fetools/ from the pgindent check fetools/ holds copies of upstream PostgreSQL frontend code (pg_basebackup and friends) with small open_pg_tde modifications. Like src/libkmip, which is already excluded, keeping these close to their upstream source matters more than pgindent conformance, and a local comment in the copies is not pgindent-wrapped. Exclude fetools/ so the pgindent check reflects the code this project actually owns. Co-Authored-By: Claude Opus 4.8 (1M context) --- ci_scripts/run-pgindent.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ci_scripts/run-pgindent.sh b/ci_scripts/run-pgindent.sh index f66d880..4eeebf0 100755 --- a/ci_scripts/run-pgindent.sh +++ b/ci_scripts/run-pgindent.sh @@ -18,5 +18,9 @@ cd "$SCRIPT_DIR/.." export PATH=$SCRIPT_DIR/../../postgres/src/tools/pgindent/:$INSTALL_DIR/bin/:$PATH -# Check open_pg_tde with the fresh list extraxted from the object file -pgindent --typedefs=typedefs.list --excludes=<(echo "src/libkmip") "$@" . +# Check open_pg_tde with the fresh list extraxted from the object file. +# src/libkmip and fetools/ are vendored copies of third-party / upstream +# PostgreSQL code; keeping them close to their source matters more than +# pgindent conformance, so they are excluded. +pgindent --typedefs=typedefs.list \ + --excludes=<(printf 'src/libkmip\nfetools\n') "$@" .