MIME-Version: 1.0
References: <202502131716.7mgkcnrem2hn@alvherre.pgsql> <2939991.1740089974@sss.pgh.pa.us>
 <CA+TgmoauoiW4ydDhdrseg+DD4Kwha=+TSZp18BrJeHKx3o1Fdw@mail.gmail.com>
 <179448.1772033773@sss.pgh.pa.us> <CA+TgmoYFc1x11Y7AHxn6Jb0mvJ9-aPttmjqezj=YKnHmqVb-Wg@mail.gmail.com>
 <265501.1772038216@sss.pgh.pa.us> <CA+TgmobNKFc34nj+w6iX0zWJ1=mfYWqQS91PqsJrm4VD4o1yOw@mail.gmail.com>
 <296083.1772041154@sss.pgh.pa.us>
In-Reply-To: <296083.1772041154@sss.pgh.pa.us>
From: Robert Haas <robertmhaas@gmail.com>
Date: Wed, 25 Feb 2026 13:02:46 -0500
Message-ID: <CA+TgmoYJ8Y1G1r9U7pRwnyw=8dmM0xygLguE+bdihkN8GwPuCQ@mail.gmail.com>
Subject: Re: Major Version Upgrade failure due to orphan roles entries in catalog
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: =?UTF-8?Q?=C3=81lvaro_Herrera?= <alvherre@alvh.no-ip.org>, 
	Virender Singla <virender.cse@gmail.com>, pgsql-bugs@lists.postgresql.org, 
	Aniket Jha <aniketkumarj@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CA%2BTgmoYJ8Y1G1r9U7pRwnyw%3D8dmM0xygLguE%2BbdihkN8GwPuCQ%40mail.gmail.com>
Precedence: bulk

On Wed, Feb 25, 2026 at 12:39=E2=80=AFPM Tom Lane <tgl@sss.pgh.pa.us> wrote=
:
> Because the result of the restore will not match how things were
> in the source database?  True, we do not have any way to make them
> match, but that doesn't mean that pg_dumpall has fulfilled all
> expectations.

That's a fair point. On the flip side, the grantor in v15- is
basically a comment. From v16, it behaves in the way we'd normally
expect: a role grant depends on the grantor in the same way that a
table grant depends on the grantor in the table ACL, just with a
different catalog representation. In v15-, it has no functional
impact.

> > Moreover, we'll emit essentially the same warning for the member case,
> > where the warning does point to a problem that someone might want to
> > think about correcting, and exactly the same warning against a v16+
> > database where it indicates that something has actually gone wrong.
>
> That's a fair point, but maybe it could be addressed by phrasing the
> message differently for the different cases.

I like that idea. I think the biggest danger here for users is
actually that we have to convert the pre-v16 "it's a comment" catalog
state into a v16+ "it's a real thing that works like the rest of the
authorization system" catalog state, and there's no way to do that
perfectly because we're starting from a busted catalog representation.
It seems reasonable to somehow let people know that whatever we're
doing is an approximation. If we can make the "invalid grantor from
pre-v16" sound like "don't panic but we have to patch some stuff up so
you can upgrade" and the "invalid grantor for v16+" and "invalid
member" cases sound like "uh oh, it seems like something got
corrupted" then I'm entirely happy with that state of affairs
(assuming we also resume dumping the GRANT, of course).

Thanks,

--=20
Robert Haas
EDB: http://www.enterprisedb.com