From: Tom Lane <tgl@sss.pgh.pa.us>
To: immerrr again <immerrr@gmail.com>
cc: Pavel Luzanov <p.luzanov@postgrespro.ru>,
        pgsql-general@lists.postgresql.org
Subject: Re: DROP ROLE blocked by pg_init_privs
In-reply-to: <CAERznn-Hz_Y-V2gYP5UAcO+nU+e39o9WGDYTjpAqddyp8PMp4g@mail.gmail.com>
References: <CAERznn-QWVpAvqnyF=rZfiuxkeDG0tym_rY+RuEkSPWvzgi67Q@mail.gmail.com> <ca3fe7b5-2399-4537-bba4-cd000907bda7@postgrespro.ru> <CAERznn-SBBqQ3YcdZk9U4mqVQPsVgLisi=EdFzY5Fb7hOQ4g_Q@mail.gmail.com> <CAERznn-Hz_Y-V2gYP5UAcO+nU+e39o9WGDYTjpAqddyp8PMp4g@mail.gmail.com>
Comments: In-reply-to immerrr again <immerrr@gmail.com>
	message dated "Wed, 26 Nov 2025 00:06:39 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1484312.1764115685.1@sss.pgh.pa.us>
Date: Tue, 25 Nov 2025 19:08:05 -0500
Message-ID: <1484313.1764115685@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/1484313.1764115685%40sss.pgh.pa.us>
Precedence: bulk

immerrr again <immerrr@gmail.com> writes:
> Sorry, nvm, I forgot to drop the privileges in the repro. Can confirm, with
> 16.9 it works as expected:
> ...
> The same script with postgres:17 image fails with the error I have been
> describing:

The missing step here is

DROP OWNED BY test_role;

You have to use that to get rid of "initial privileges" because
neither REVOKE nor ALTER DEFAULT PRIVILEGES will touch existing
initial privileges.  Pre-v17 didn't account for this properly
and would allow you to drop the role anyway, leaving dangling
entries behind in pg_init_privs.  While those are harmless in
isolation, they cause problems for later dump/restore activity.

See discussion here:

https://www.postgresql.org/message-id/flat/1745535.1712358659%40sss.pgh.pa.us

			regards, tom lane