From 70a7732007bc4689f4c7a44e738eb2d892dac1e3 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Wed, 19 Feb 2020 16:59:14 -0500 Subject: Remove support for upgrading extensions from "unpackaged" state. Andres Freund pointed out that allowing non-superusers to run "CREATE EXTENSION ... FROM unpackaged" has security risks, since the unpackaged-to-1.0 scripts don't try to verify that the existing objects they're modifying are what they expect. Just attaching such objects to an extension doesn't seem too dangerous, but some of them do more than that. We could have resolved this, perhaps, by still requiring superuser privilege to use the FROM option. However, it's fair to ask just what we're accomplishing by continuing to lug the unpackaged-to-1.0 scripts forward. None of them have received any real testing since 9.1 days, so they may not even work anymore (even assuming that one could still load the previous "loose" object definitions into a v13 database). And an installation that's trying to go from pre-9.1 to v13 or later in one jump is going to have worse compatibility problems than whether there's a trivial way to convert their contrib modules into extension style. Hence, let's just drop both those scripts and the core-code support for "CREATE EXTENSION ... FROM". Discussion: https://postgr.es/m/20200213233015.r6rnubcvl4egdh5r@alap3.anarazel.de --- contrib/pgcrypto/Makefile | 2 +- contrib/pgcrypto/pgcrypto--unpackaged--1.0.sql | 38 -------------------------- 2 files changed, 1 insertion(+), 39 deletions(-) delete mode 100644 contrib/pgcrypto/pgcrypto--unpackaged--1.0.sql (limited to 'contrib/pgcrypto') diff --git a/contrib/pgcrypto/Makefile b/contrib/pgcrypto/Makefile index 671502f577f..61eabd2fc0c 100644 --- a/contrib/pgcrypto/Makefile +++ b/contrib/pgcrypto/Makefile @@ -46,7 +46,7 @@ OBJS = \ EXTENSION = pgcrypto DATA = pgcrypto--1.3.sql pgcrypto--1.2--1.3.sql pgcrypto--1.1--1.2.sql \ - pgcrypto--1.0--1.1.sql pgcrypto--unpackaged--1.0.sql + pgcrypto--1.0--1.1.sql PGFILEDESC = "pgcrypto - cryptographic functions" REGRESS = init md5 sha1 hmac-md5 hmac-sha1 blowfish rijndael \ diff --git a/contrib/pgcrypto/pgcrypto--unpackaged--1.0.sql b/contrib/pgcrypto/pgcrypto--unpackaged--1.0.sql deleted file mode 100644 index 8154e85f44d..00000000000 --- a/contrib/pgcrypto/pgcrypto--unpackaged--1.0.sql +++ /dev/null @@ -1,38 +0,0 @@ -/* contrib/pgcrypto/pgcrypto--unpackaged--1.0.sql */ - --- complain if script is sourced in psql, rather than via CREATE EXTENSION -\echo Use "CREATE EXTENSION pgcrypto FROM unpackaged" to load this file. \quit - -ALTER EXTENSION pgcrypto ADD function digest(text,text); -ALTER EXTENSION pgcrypto ADD function digest(bytea,text); -ALTER EXTENSION pgcrypto ADD function hmac(text,text,text); -ALTER EXTENSION pgcrypto ADD function hmac(bytea,bytea,text); -ALTER EXTENSION pgcrypto ADD function crypt(text,text); -ALTER EXTENSION pgcrypto ADD function gen_salt(text); -ALTER EXTENSION pgcrypto ADD function gen_salt(text,integer); -ALTER EXTENSION pgcrypto ADD function encrypt(bytea,bytea,text); -ALTER EXTENSION pgcrypto ADD function decrypt(bytea,bytea,text); -ALTER EXTENSION pgcrypto ADD function encrypt_iv(bytea,bytea,bytea,text); -ALTER EXTENSION pgcrypto ADD function decrypt_iv(bytea,bytea,bytea,text); -ALTER EXTENSION pgcrypto ADD function gen_random_bytes(integer); -ALTER EXTENSION pgcrypto ADD function pgp_sym_encrypt(text,text); -ALTER EXTENSION pgcrypto ADD function pgp_sym_encrypt_bytea(bytea,text); -ALTER EXTENSION pgcrypto ADD function pgp_sym_encrypt(text,text,text); -ALTER EXTENSION pgcrypto ADD function pgp_sym_encrypt_bytea(bytea,text,text); -ALTER EXTENSION pgcrypto ADD function pgp_sym_decrypt(bytea,text); -ALTER EXTENSION pgcrypto ADD function pgp_sym_decrypt_bytea(bytea,text); -ALTER EXTENSION pgcrypto ADD function pgp_sym_decrypt(bytea,text,text); -ALTER EXTENSION pgcrypto ADD function pgp_sym_decrypt_bytea(bytea,text,text); -ALTER EXTENSION pgcrypto ADD function pgp_pub_encrypt(text,bytea); -ALTER EXTENSION pgcrypto ADD function pgp_pub_encrypt_bytea(bytea,bytea); -ALTER EXTENSION pgcrypto ADD function pgp_pub_encrypt(text,bytea,text); -ALTER EXTENSION pgcrypto ADD function pgp_pub_encrypt_bytea(bytea,bytea,text); -ALTER EXTENSION pgcrypto ADD function pgp_pub_decrypt(bytea,bytea); -ALTER EXTENSION pgcrypto ADD function pgp_pub_decrypt_bytea(bytea,bytea); -ALTER EXTENSION pgcrypto ADD function pgp_pub_decrypt(bytea,bytea,text); -ALTER EXTENSION pgcrypto ADD function pgp_pub_decrypt_bytea(bytea,bytea,text); -ALTER EXTENSION pgcrypto ADD function pgp_pub_decrypt(bytea,bytea,text,text); -ALTER EXTENSION pgcrypto ADD function pgp_pub_decrypt_bytea(bytea,bytea,text,text); -ALTER EXTENSION pgcrypto ADD function pgp_key_id(bytea); -ALTER EXTENSION pgcrypto ADD function armor(bytea); -ALTER EXTENSION pgcrypto ADD function dearmor(text); -- cgit v1.2.3