Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.700.51.1.1\))
Subject: Re: pg_createsubscriber does not check output_plugin_libraries
From: Chao Li <li.evan.chao@gmail.com>
In-Reply-To: 
 <CAOYmi+=AoWyU=MqfsFWUP2QHxsydHG9w2VuNnzswoBZCsCOobg@mail.gmail.com>
Date: Tue, 15 Sep 2026 13:47:49 +0800
Cc: "Hayato Kuroda (Fujitsu)" <kuroda.hayato@fujitsu.com>,
 "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>,
 Fujii Masao <masao.fujii@gmail.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <EB0EDFFC-F11D-410A-9110-43AEDE63F614@gmail.com>
References: 
 <OS9PR01MB12149618ED793133C85A61A34F5B52@OS9PR01MB12149.jpnprd01.prod.outlook.com>
 <CAOYmi+=AoWyU=MqfsFWUP2QHxsydHG9w2VuNnzswoBZCsCOobg@mail.gmail.com>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Archived-At: 
 <https://www.postgresql.org/message-id/EB0EDFFC-F11D-410A-9110-43AEDE63F614%40gmail.com>
Precedence: bulk


> On Sep 9, 2026, at 00:33, Jacob Champion =
<jacob.champion@enterprisedb.com> wrote:
>=20
> On Thu, Sep 3, 2026 at 8:49=E2=80=AFPM Hayato Kuroda (Fujitsu)
> <kuroda.hayato@fujitsu.com> wrote:
>>=20
>> Hi hackers,
>> (CC: Jacob, who was an author of 226e49cb)
>=20
> Hi! Thanks for the report, and sorry for the delay over the US holiday =
weekend.
>=20
>> 226e49cb added a GUC parameter to specify trusted output plugins, and =
slot creation
>> would fail if a give plugin is not listed there.
>=20
> Right. (pgoutput is in that parameter by default, so the case in
> question requires a DBA to remove it and then be surprised at the
> results.)
>=20
>> pg_createsubscriber command creates replication slots with plugin =
'pgoutput',
>> without checking the GUC. This meant if the plugin name is not =
specified in the
>> parameter, --dry-run mode passes but actual convertion fails.
>> It's very surprising for users and should be avoided.
>=20
> Isn't this the same behavior as for all other permissions issues? We
> don't check for
> - REPLICATION privs
> - permission for FOR ALL TABLES
> - CREATE on the target databases
> - ownership on a publication to drop
> - permission to call pg_log_standby_snapshot()
>=20
> Looks like all those pass a --dry-run and then fail later.
>=20

That=E2=80=99s a fair point. The distinction I had in mind is that this =
patch explicitly adds a check for output_plugin_libraries to make =
--dry-run more useful. But when the caller cannot read that setting, =
pg_createsubscriber simply does not have enough information to perform =
the check. Would it make sense to print a warning in that case, rather =
than silently letting --dry-run succeed?

Best regards,
--
Chao Li (Evan)
HighGo Software Co., Ltd.
https://www.highgo.com/