From: Andrew Dunstan <andrew.dunstan@2ndquadrant.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: initdb recommendations
Date: Mon, 22 Jul 2019 13:02:13 -0400
Message-ID: <c0ccc036-8e58-f057-304f-9feb8f6ec80c@2ndQuadrant.com> (raw)
In-Reply-To: <7886.1563812705@sss.pgh.pa.us>
References: <bec17f0a-ddb1-8b95-5e69-368d9d0a3390@postgresql.org>
<f27d3170-76cf-4afb-1e1a-b1059295ec8d@2ndquadrant.com>
<CABUevExMizVYea9zaHBte66u9KipEgfwcsaE9spfqK9iYRST_g@mail.gmail.com>
<20190406180839.GA1921989@rfd.leadboat.com>
<96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com>
<fcd8848c-618c-23d1-2b39-77b13cb2d0a1@2ndquadrant.com>
<CAOBaU_bTm5M-787dAw=E3OQ13ag_BqOboVWz9xkjQk1=__MwDQ@mail.gmail.com>
<91f8272f-117f-2a04-862b-871a7b86eeed@2ndquadrant.com>
<CAOBaU_Y9quphKH98xCgiAXgTYk5xcfTWcyKO-y3o_UJOk0s2uQ@mail.gmail.com>
<7b6c4220-e5ef-2a13-18ad-af596c52b71a@2ndquadrant.com>
<23654.1563804669@sss.pgh.pa.us>
<7886.1563812705@sss.pgh.pa.us>
On 7/22/19 12:25 PM, Tom Lane wrote:
> I wrote:
>> Peter Eisentraut <peter.eisentraut@2ndquadrant.com> writes:
>>> Pushed with that note. Thanks.
>> This has completely broken the buildfarm.
> On inspection, it seems the reason for that is that the buildfarm
> script runs initdb with '-U buildfarm', so that peer-auth connections
> will only work if the buildfarm is being run by an OS user named
> exactly "buildfarm". That happens to be true on my macOS animals,
> which is why they're not broken ... but apparently, nobody else
> does it that way.
>
> I'm afraid we're going to have to revert this, at least till
> such time as a fixed buildfarm client is in universal use.
>
> As for the nature of that fix, I don't quite understand why
> the forced -U is there --- maybe we could just remove it?
> But there are multiple places in the buildfarm client that
> have hard-wired references to "buildfarm".
This goes back quite a way:
commit 7528701abb88ab84f6775448c59b392ca7f33a07
Author: Andrew Dunstan <andrew@dunslane.net>
Date: Tue Nov 27 13:47:38 2012 -0500
Run everything as buildfarm rather than local user name.
This will help if we ever want to do things like comparing dump
diffs.
Done by setting PGUSER and using initdb's -U option.
The pg_upgrade test (not the cross-version one) doesn't use this - it
explicitly unsets PGUSER.
There are a few things we could do. We could force trust auth, or we
could add an ident map that allowed $USER to login as buildfarm. Finding
all the places we would need to fix that could be a fun project ...
We could also maybe teach initdb to honor an environment setting
INTDB_DEFAULT_AUTH or some such.
I agree this should be reverted for now until we work out what we want
to do.
cheers
andrew
--
Andrew Dunstan https://www.2ndQuadrant.com
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: andrew.dunstan@2ndquadrant.com, tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, pgsql-hackers@lists.postgresql.org
Subject: Re: initdb recommendations
In-Reply-To: <c0ccc036-8e58-f057-304f-9feb8f6ec80c@2ndQuadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox