Follow-up to PR #5882. Every native-vs-libpq differential test (query, transactions, copy, prepared, portals) currently connects with sslmode=disable. Native backend TLS is exercised only by the Phase-1 auth differential. Untested-under-TLS surfaces called out by reviews on the branch:
- the native drives' outbound buffering through
native_ssl_outbuf (flush preamble TLS leg in native_fetch_result_cont, partial-send recovery for CopyFail/Bind/Execute frames);
- the SSL_write WANT_READ edge (currently busy-iterates, mirroring query_cont — flagged as a Minor; a TLS run would tell us if it matters in practice);
- SCRAM-SHA-256-PLUS channel binding on real query traffic (auth test covers the handshake only);
- large result streaming (threshold flushing) over TLS.
Proposed shape: parameterize the existing differential tests (env var or a second groups.json entry) to run their corpus with sslmode=require against a TLS-enabled backend + proxysql frontend TLS, rather than writing new tests. The pgsql17-repl infra or an extended docker-pgsql16 config can provide the TLS-enabled backend (pg_hba already has a hostssl cert line).
Follow-up to PR #5882. Every native-vs-libpq differential test (query, transactions, copy, prepared, portals) currently connects with sslmode=disable. Native backend TLS is exercised only by the Phase-1 auth differential. Untested-under-TLS surfaces called out by reviews on the branch:
native_ssl_outbuf(flush preamble TLS leg in native_fetch_result_cont, partial-send recovery for CopyFail/Bind/Execute frames);Proposed shape: parameterize the existing differential tests (env var or a second groups.json entry) to run their corpus with sslmode=require against a TLS-enabled backend + proxysql frontend TLS, rather than writing new tests. The pgsql17-repl infra or an extended docker-pgsql16 config can provide the TLS-enabled backend (pg_hba already has a hostssl cert line).