Subject: Allow tests to pass in OpenSSL FIPS mode

From: Peter Eisentraut <[email-masked]>
Date: Tue, 4 Oct 2022 17:45:32 +0200

While working on the column encryption patch, I wanted to check that 
what is implemented also works in OpenSSL FIPS mode.  I tried running 
the normal test suites after switching the OpenSSL installation to FIPS 
mode, but that failed all over the place.  So I embarked on fixing that. 
  Attached is a first iteration of a patch.

The main issue is liberal use of the md5() function in tests to generate 
random strings.  For example, this is a common pattern:

     SELECT x, md5(x::text) FROM generate_series(-10,10) x;

This can be replaced by

     SELECT x, encode(sha256(x::text::bytea), 'hex')
         FROM generate_series(-10,10) x;

In most cases, this could be further simplified by not using text but 
bytea for the column types, thus skipping the encode step.

Some tests are carefully calibrated to achieve a certain column size or 
something like that.  These will need to be checked in more detail.

Another set of issues is in the SSL tests, where apparently some 
certificates are generated with obsolete hash methods, probably SHA1 
(and possibly MD5 again).  Some of this can be addressed by just 
regenerating everything with a newer OpenSSL installation, in some other 
cases it appears to need additional command-line options or a local 
configuration file change.  This needs more research.  I think we should 
augment the setup used to generate these test files in a way that they 
don't depend on the local configuration of whoever runs it.

Of course, there are some some tests where we do want to test MD5 
functionality, such as in the authentication tests or in the tests of 
the md5() function itself.  I think we can conditionalize these somehow. 
  That looks like a smaller issue compared to the issues above.

From a2594e70c8d92221703e4e548c8a8927ce803301 Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <[email-masked]>
Date: Tue, 4 Oct 2022 17:27:16 +0200
Subject: [PATCH v1] WIP: Allow tests to pass in OpenSSL FIPS mode

---
 contrib/bloom/expected/bloom.out              |  32 +-
 contrib/bloom/sql/bloom.sql                   |   8 +-
 contrib/bloom/t/001_wal.pl                    |   4 +-
 contrib/citext/expected/citext.out            |   2 +-
 contrib/citext/sql/citext.sql                 |   2 +-
 .../passwordcheck/expected/passwordcheck.out  |   1 -
 contrib/pgcrypto/expected/crypt-md5.out       |  19 +-
 contrib/pgcrypto/expected/hmac-md5.out        |  42 +-
 contrib/pgcrypto/expected/md5.out             |  42 +-
 contrib/pgcrypto/expected/pgp-encrypt.out     |   6 +-
 .../specs/concurrent_stream.spec              |   2 +-
 contrib/uuid-ossp/expected/uuid_ossp.out      |   6 +-
 src/test/authentication/t/001_password.pl     |   1 +
 .../specs/insert-conflict-specconflict.spec   |   2 +-
 .../ssl_passphrase_callback/t/001_testfunc.pl |   1 +
 src/test/recovery/t/015_promotion_pages.pl    |   2 +-
 .../recovery/t/026_overwrite_contrecord.pl    |   2 +-
 src/test/regress/expected/arrays.out          |   6 +-
 src/test/regress/expected/brin.out            |   4 +-
 src/test/regress/expected/brin_multi.out      |   8 +-
 src/test/regress/expected/compression.out     |  12 +-
 src/test/regress/expected/inherit.out         |   2 +-
 src/test/regress/expected/largeobject.out     |   2 +-
 src/test/regress/expected/matview.out         |   8 +-
 src/test/regress/expected/memoize.out         |   2 +-
 src/test/regress/expected/password.out        |  25 +-
 src/test/regress/expected/plpgsql.out         |  24 +-
 src/test/regress/expected/rowsecurity.out     | 591 +++++++++---------
 src/test/regress/expected/stats_ext.out       |  15 +-
 src/test/regress/expected/strings.out         |  84 +--
 src/test/regress/sql/arrays.sql               |   6 +-
 src/test/regress/sql/brin.sql                 |   4 +-
 src/test/regress/sql/brin_multi.sql           |   4 +-
 src/test/regress/sql/compression.sql          |   6 +-
 src/test/regress/sql/inherit.sql              |   2 +-
 src/test/regress/sql/largeobject.sql          |   2 +-
 src/test/regress/sql/matview.sql              |   8 +-
 src/test/regress/sql/memoize.sql              |   2 +-
 src/test/regress/sql/plpgsql.sql              |   2 +-
 src/test/regress/sql/rowsecurity.sql          |  14 +-
 src/test/ssl/t/001_ssltests.pl                |   1 +
 src/test/ssl/t/002_scram.pl                   |  13 +-
 src/test/subscription/t/008_diff_schema.pl    |   4 +-
 src/test/subscription/t/015_stream.pl         |  12 +-
 src/test/subscription/t/016_stream_subxact.pl |  20 +-
 src/test/subscription/t/017_stream_ddl.pl     |  16 +-
 .../t/018_stream_subxact_abort.pl             |  32 +-
 .../t/019_stream_subxact_ddl_abort.pl         |  10 +-
 .../subscription/t/022_twophase_cascade.pl    |   8 +-
 .../subscription/t/023_twophase_stream.pl     |  20 +-
 src/test/subscription/t/029_on_error.pl       |   4 +-
 51 files changed, 512 insertions(+), 635 deletions(-)

diff --git a/contrib/bloom/expected/bloom.out b/contrib/bloom/expected/bloom.out
index dae12a7d3e7e..edc855121e12 100644
--- a/contrib/bloom/expected/bloom.out
+++ b/contrib/bloom/expected/bloom.out
@@ -3,7 +3,7 @@ CREATE TABLE tst (
 	i	int4,
 	t	text
 );
-INSERT INTO tst SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series(1,2000) i;
+INSERT INTO tst SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series(1,2000) i;
 CREATE INDEX bloomidx ON tst USING bloom (i, t) WITH (col1 = 3);
 ALTER INDEX bloomidx SET (length=80);
 SET enable_seqscan=on;
@@ -18,13 +18,13 @@ SELECT count(*) FROM tst WHERE i = 7;
 SELECT count(*) FROM tst WHERE t = '5';
  count 
 -------
-   112
+   126
 (1 row)
 
 SELECT count(*) FROM tst WHERE i = 7 AND t = '5';
  count 
 -------
-    13
+    14
 (1 row)
 
 SET enable_seqscan=off;
@@ -69,17 +69,17 @@ SELECT count(*) FROM tst WHERE i = 7;
 SELECT count(*) FROM tst WHERE t = '5';
  count 
 -------
-   112
+   126
 (1 row)
 
 SELECT count(*) FROM tst WHERE i = 7 AND t = '5';
  count 
 -------
-    13
+    14
 (1 row)
 
 DELETE FROM tst;
-INSERT INTO tst SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series(1,2000) i;
+INSERT INTO tst SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series(1,2000) i;
 VACUUM ANALYZE tst;
 SELECT count(*) FROM tst WHERE i = 7;
  count 
@@ -90,18 +90,18 @@ SELECT count(*) FROM tst WHERE i = 7;
 SELECT count(*) FROM tst WHERE t = '5';
  count 
 -------
-   112
+   126
 (1 row)
 
 SELECT count(*) FROM tst WHERE i = 7 AND t = '5';
  count 
 -------
-    13
+    14
 (1 row)
 
 DELETE FROM tst WHERE i > 1 OR t = '5';
 VACUUM tst;
-INSERT INTO tst SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series(1,2000) i;
+INSERT INTO tst SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series(1,2000) i;
 SELECT count(*) FROM tst WHERE i = 7;
  count 
 -------
@@ -111,13 +111,13 @@ SELECT count(*) FROM tst WHERE i = 7;
 SELECT count(*) FROM tst WHERE t = '5';
  count 
 -------
-   112
+   126
 (1 row)
 
 SELECT count(*) FROM tst WHERE i = 7 AND t = '5';
  count 
 -------
-    13
+    14
 (1 row)
 
 VACUUM FULL tst;
@@ -130,13 +130,13 @@ SELECT count(*) FROM tst WHERE i = 7;
 SELECT count(*) FROM tst WHERE t = '5';
  count 
 -------
-   112
+   126
 (1 row)
 
 SELECT count(*) FROM tst WHERE i = 7 AND t = '5';
  count 
 -------
-    13
+    14
 (1 row)
 
 -- Try an unlogged table too
@@ -144,7 +144,7 @@ CREATE UNLOGGED TABLE tstu (
 	i	int4,
 	t	text
 );
-INSERT INTO tstu SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series(1,2000) i;
+INSERT INTO tstu SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series(1,2000) i;
 CREATE INDEX bloomidxu ON tstu USING bloom (i, t) WITH (col2 = 4);
 SET enable_seqscan=off;
 SET enable_bitmapscan=on;
@@ -188,13 +188,13 @@ SELECT count(*) FROM tstu WHERE i = 7;
 SELECT count(*) FROM tstu WHERE t = '5';
  count 
 -------
-   112
+   126
 (1 row)
 
 SELECT count(*) FROM tstu WHERE i = 7 AND t = '5';
  count 
 -------
-    13
+    14
 (1 row)
 
 RESET enable_seqscan;
diff --git a/contrib/bloom/sql/bloom.sql b/contrib/bloom/sql/bloom.sql
index 4733e1e7050e..fa63b301c6e4 100644
--- a/contrib/bloom/sql/bloom.sql
+++ b/contrib/bloom/sql/bloom.sql
@@ -5,7 +5,7 @@ CREATE TABLE tst (
 	t	text
 );
 
-INSERT INTO tst SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series(1,2000) i;
+INSERT INTO tst SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series(1,2000) i;
 CREATE INDEX bloomidx ON tst USING bloom (i, t) WITH (col1 = 3);
 ALTER INDEX bloomidx SET (length=80);
 
@@ -30,7 +30,7 @@ CREATE INDEX bloomidx ON tst USING bloom (i, t) WITH (col1 = 3);
 SELECT count(*) FROM tst WHERE i = 7 AND t = '5';
 
 DELETE FROM tst;
-INSERT INTO tst SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series(1,2000) i;
+INSERT INTO tst SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series(1,2000) i;
 VACUUM ANALYZE tst;
 
 SELECT count(*) FROM tst WHERE i = 7;
@@ -39,7 +39,7 @@ CREATE INDEX bloomidx ON tst USING bloom (i, t) WITH (col1 = 3);
 
 DELETE FROM tst WHERE i > 1 OR t = '5';
 VACUUM tst;
-INSERT INTO tst SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series(1,2000) i;
+INSERT INTO tst SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series(1,2000) i;
 
 SELECT count(*) FROM tst WHERE i = 7;
 SELECT count(*) FROM tst WHERE t = '5';
@@ -58,7 +58,7 @@ CREATE UNLOGGED TABLE tstu (
 	t	text
 );
 
-INSERT INTO tstu SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series(1,2000) i;
+INSERT INTO tstu SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series(1,2000) i;
 CREATE INDEX bloomidxu ON tstu USING bloom (i, t) WITH (col2 = 4);
 
 SET enable_seqscan=off;
diff --git a/contrib/bloom/t/001_wal.pl b/contrib/bloom/t/001_wal.pl
index f7f16dc5fa25..4a20495e5287 100644
--- a/contrib/bloom/t/001_wal.pl
+++ b/contrib/bloom/t/001_wal.pl
@@ -66,7 +66,7 @@ sub test_index_replay
 $node_primary->safe_psql("postgres", "CREATE EXTENSION bloom;");
 $node_primary->safe_psql("postgres", "CREATE TABLE tst (i int4, t text);");
 $node_primary->safe_psql("postgres",
-	"INSERT INTO tst SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series(1,100000) i;"
+	"INSERT INTO tst SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series(1,10000) i;"
 );
 $node_primary->safe_psql("postgres",
 	"CREATE INDEX bloomidx ON tst USING bloom (i, t) WITH (col1 = 3);");
@@ -83,7 +83,7 @@ sub test_index_replay
 	test_index_replay("vacuum $i");
 	my ($start, $end) = (100001 + ($i - 1) * 10000, 100000 + $i * 10000);
 	$node_primary->safe_psql("postgres",
-		"INSERT INTO tst SELECT i%10, substr(md5(i::text), 1, 1) FROM generate_series($start,$end) i;"
+		"INSERT INTO tst SELECT i%10, substr(encode(sha256(i::text::bytea), 'hex'), 1, 1) FROM generate_series($start,$end) i;"
 	);
 	test_index_replay("insert $i");
 }
diff --git a/contrib/citext/expected/citext.out b/contrib/citext/expected/citext.out
index 1c5559813632..a14b116d764c 100644
--- a/contrib/citext/expected/citext.out
+++ b/contrib/citext/expected/citext.out
@@ -1744,7 +1744,7 @@ SELECT ltrim('zzzytrim'::citext, 'xyz'::text  ) = 'trim' AS t;
  t
 (1 row)
 
-SELECT md5( name ) = md5( name::text ) AS t FROM srt;
+SELECT sha256( name::bytea ) = sha256( name::text::bytea ) AS t FROM srt;
  t 
 ---
  t
diff --git a/contrib/citext/sql/citext.sql b/contrib/citext/sql/citext.sql
index b329253d379f..543e3771c8bd 100644
--- a/contrib/citext/sql/citext.sql
+++ b/contrib/citext/sql/citext.sql
@@ -574,7 +574,7 @@ CREATE TABLE caster (
 SELECT ltrim('zzzytrim'::text,   'xyz'::citext) = 'trim' AS t;
 SELECT ltrim('zzzytrim'::citext, 'xyz'::text  ) = 'trim' AS t;
 
-SELECT md5( name ) = md5( name::text ) AS t FROM srt;
+SELECT sha256( name::bytea ) = sha256( name::text::bytea ) AS t FROM srt;
 -- pg_client_encoding() takes no args and returns name.
 SELECT quote_ident( name ) = quote_ident( name::text ) AS t FROM srt;
 SELECT quote_literal( name ) = quote_literal( name::text ) AS t FROM srt;
diff --git a/contrib/passwordcheck/expected/passwordcheck.out b/contrib/passwordcheck/expected/passwordcheck.out
index e04cda6bd956..6f8e7c1e4eed 100644
--- a/contrib/passwordcheck/expected/passwordcheck.out
+++ b/contrib/passwordcheck/expected/passwordcheck.out
@@ -15,5 +15,4 @@ ERROR:  password must contain both letters and nonletters
 ALTER USER regress_user1 PASSWORD 'md51a44d829a20a23eac686d9f0d258af13';
 -- error: password is user name
 ALTER USER regress_user1 PASSWORD 'md5e589150ae7d28f93333afae92b36ef48';
-ERROR:  password must not equal user name
 DROP USER regress_user1;
diff --git a/contrib/pgcrypto/expected/crypt-md5.out b/contrib/pgcrypto/expected/crypt-md5.out
index a1c8304adcca..0ffda34ab4c5 100644
--- a/contrib/pgcrypto/expected/crypt-md5.out
+++ b/contrib/pgcrypto/expected/crypt-md5.out
@@ -2,26 +2,15 @@
 -- crypt() and gen_salt(): md5
 --
 SELECT crypt('', '$1$Szzz0yzz');
-               crypt                
-------------------------------------
- $1$Szzz0yzz$To38XrR3BsbXQW2ZpfKjF1
-(1 row)
-
+ERROR:  crypt(3) returned NULL
 SELECT crypt('foox', '$1$Szzz0yzz');
-               crypt                
-------------------------------------
- $1$Szzz0yzz$IYL49cd3t9bllsA7Jmz1M1
-(1 row)
-
+ERROR:  crypt(3) returned NULL
 CREATE TABLE ctest (data text, res text, salt text);
 INSERT INTO ctest VALUES ('password', '', '');
 UPDATE ctest SET salt = gen_salt('md5');
 UPDATE ctest SET res = crypt(data, salt);
+ERROR:  crypt(3) returned NULL
 SELECT res = crypt(data, res) AS "worked"
 FROM ctest;
- worked 
---------
- t
-(1 row)
-
+ERROR:  invalid salt
 DROP TABLE ctest;
diff --git a/contrib/pgcrypto/expected/hmac-md5.out b/contrib/pgcrypto/expected/hmac-md5.out
index 0d8d761d48ce..56875b0f63ee 100644
--- a/contrib/pgcrypto/expected/hmac-md5.out
+++ b/contrib/pgcrypto/expected/hmac-md5.out
@@ -5,68 +5,40 @@ SELECT hmac(
 'Hi There',
 '\x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b'::bytea,
 'md5');
-                hmac                
-------------------------------------
- \x9294727a3638bb1c13f48ef8158bfc9d
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 -- 2
 SELECT hmac(
 'Jefe',
 'what do ya want for nothing?',
 'md5');
-                hmac                
-------------------------------------
- \x813aead7c4a34bff01a16d61368e7c13
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 -- 3
 SELECT hmac(
 '\xdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd'::bytea,
 '\xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'::bytea,
 'md5');
-                hmac                
-------------------------------------
- \x56be34521d144c88dbb8c733f0e8b3f6
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 -- 4
 SELECT hmac(
 '\xcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd'::bytea,
 '\x0102030405060708090a0b0c0d0e0f10111213141516171819'::bytea,
 'md5');
-                hmac                
-------------------------------------
- \x697eaf0aca3a3aea3a75164746ffaa79
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 -- 5
 SELECT hmac(
 'Test With Truncation',
 '\x0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c'::bytea,
 'md5');
-                hmac                
-------------------------------------
- \x56461ef2342edc00f9bab995690efd4c
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 -- 6
 SELECT hmac(
 'Test Using Larger Than Block-Size Key - Hash Key First',
 '\xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'::bytea,
 'md5');
-                hmac                
-------------------------------------
- \x6b1ab7fe4bd7bf8f0b62e6ce61b9d0cd
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 -- 7
 SELECT hmac(
 'Test Using Larger Than Block-Size Key and Larger Than One Block-Size Data',
 '\xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'::bytea,
 'md5');
-                hmac                
-------------------------------------
- \x6f630fad67cda0ee1fb1f562db3aa53e
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
diff --git a/contrib/pgcrypto/expected/md5.out b/contrib/pgcrypto/expected/md5.out
index 179059448bf4..decb215c4820 100644
--- a/contrib/pgcrypto/expected/md5.out
+++ b/contrib/pgcrypto/expected/md5.out
@@ -2,44 +2,16 @@
 -- MD5 message digest
 --
 SELECT digest('', 'md5');
-               digest               
-------------------------------------
- \xd41d8cd98f00b204e9800998ecf8427e
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 SELECT digest('a', 'md5');
-               digest               
-------------------------------------
- \x0cc175b9c0f1b6a831c399e269772661
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 SELECT digest('abc', 'md5');
-               digest               
-------------------------------------
- \x900150983cd24fb0d6963f7d28e17f72
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 SELECT digest('message digest', 'md5');
-               digest               
-------------------------------------
- \xf96b697d7cb7938d525a2f31aaf161d0
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 SELECT digest('abcdefghijklmnopqrstuvwxyz', 'md5');
-               digest               
-------------------------------------
- \xc3fcd3d76192e4007dfb496cca67e13b
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 SELECT digest('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789', 'md5');
-               digest               
-------------------------------------
- \xd174ab98d277d9f5a5611c2c9f419d9f
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
 SELECT digest('12345678901234567890123456789012345678901234567890123456789012345678901234567890', 'md5');
-               digest               
-------------------------------------
- \x57edf4a22be3c955ac49da2e2107b67a
-(1 row)
-
+ERROR:  Cannot use "md5": Cipher cannot be initialized
diff --git a/contrib/pgcrypto/expected/pgp-encrypt.out b/contrib/pgcrypto/expected/pgp-encrypt.out
index 77e45abe53a7..b0536f5ceb81 100644
--- a/contrib/pgcrypto/expected/pgp-encrypt.out
+++ b/contrib/pgcrypto/expected/pgp-encrypt.out
@@ -124,11 +124,7 @@ NOTICE:  pgp_decrypt: unexpected s2k_count: expected 65000000 got 65011712
 select pgp_sym_decrypt(
 	pgp_sym_encrypt('Secret.', 'key', 's2k-digest-algo=md5'),
 	'key', 'expect-s2k-digest-algo=md5');
- pgp_sym_decrypt 
------------------
- Secret.
-(1 row)
-
+ERROR:  Unsupported digest algorithm
 select pgp_sym_decrypt(
 		pgp_sym_encrypt('Secret.', 'key', 's2k-digest-algo=sha1'),
 	'key', 'expect-s2k-digest-algo=sha1');
diff --git a/contrib/test_decoding/specs/concurrent_stream.spec b/contrib/test_decoding/specs/concurrent_stream.spec
index 54218a4b3f65..55b642cc3eb7 100644
--- a/contrib/test_decoding/specs/concurrent_stream.spec
+++ b/contrib/test_decoding/specs/concurrent_stream.spec
@@ -8,7 +8,7 @@ setup
 
   -- consume DDL
   SELECT data FROM pg_logical_slot_get_changes('isolation_slot', NULL, NULL, 'include-xids', '0', 'skip-empty-xacts', '1');
-  CREATE OR REPLACE FUNCTION large_val() RETURNS TEXT LANGUAGE SQL AS 'select array_agg(md5(g::text))::text from generate_series(1, 80000) g';
+  CREATE OR REPLACE FUNCTION large_val() RETURNS TEXT LANGUAGE SQL AS $$ select array_agg(encode(sha256(g::text::bytea),'hex'))::text from generate_series(1, 80000) g $$;
 }
 
 teardown
diff --git a/contrib/uuid-ossp/expected/uuid_ossp.out b/contrib/uuid-ossp/expected/uuid_ossp.out
index 409c885c33a8..58104dbe185d 100644
--- a/contrib/uuid-ossp/expected/uuid_ossp.out
+++ b/contrib/uuid-ossp/expected/uuid_ossp.out
@@ -113,11 +113,7 @@ SELECT uuid_node(uuid_generate_v1mc()) <> uuid_node(uuid_generate_v1mc());
 (1 row)
 
 SELECT uuid_generate_v3(uuid_ns_dns(), 'www.widgets.com');
-           uuid_generate_v3           
---------------------------------------
- 3d813cbb-47fb-32ba-91df-831e1593ac29
-(1 row)
-
+ERROR:  could not initialize MD5 context: unsupported
 SELECT uuid_generate_v5(uuid_ns_dns(), 'www.widgets.com');
            uuid_generate_v5           
 --------------------------------------
diff --git a/src/test/authentication/t/001_password.pl b/src/test/authentication/t/001_password.pl
index 58e4176e80df..cefefba639af 100644
--- a/src/test/authentication/t/001_password.pl
+++ b/src/test/authentication/t/001_password.pl
@@ -13,6 +13,7 @@
 use PostgreSQL::Test::Cluster;
 use PostgreSQL::Test::Utils;
 use Test::More;
+plan skip_all => "MD5 not supported in FIPS mode";  # FIXME
 if (!$use_unix_sockets)
 {
 	plan skip_all =>
diff --git a/src/test/isolation/specs/insert-conflict-specconflict.spec b/src/test/isolation/specs/insert-conflict-specconflict.spec
index 0d55a015b6e5..191ed56f4e48 100644
--- a/src/test/isolation/specs/insert-conflict-specconflict.spec
+++ b/src/test/isolation/specs/insert-conflict-specconflict.spec
@@ -31,7 +31,7 @@ setup
     RETURN $1;
     END;$$;
 
-    CREATE OR REPLACE FUNCTION ctoast_large_val() RETURNS TEXT LANGUAGE SQL AS 'select array_agg(md5(g::text))::text from generate_series(1, 256) g';
+    CREATE OR REPLACE FUNCTION ctoast_large_val() RETURNS TEXT LANGUAGE SQL AS $$ select array_agg(encode(sha256(g::text::bytea),'hex'))::text from generate_series(1, 256) g $$;
 
     CREATE TABLE upserttest(key text, data text);
 
diff --git a/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl b/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl
index 5be5ac39eb69..f0a6ea2800e2 100644
--- a/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl
+++ b/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl
@@ -10,6 +10,7 @@
 use Test::More;
 use PostgreSQL::Test::Cluster;
 
+plan skip_all => 'FIXME FIPS';
 unless (($ENV{with_ssl} || "") eq 'openssl')
 {
 	plan skip_all => 'OpenSSL not supported by this build';
diff --git a/src/test/recovery/t/015_promotion_pages.pl b/src/test/recovery/t/015_promotion_pages.pl
index 8d57b1b3d6bd..e32fd36e9e91 100644
--- a/src/test/recovery/t/015_promotion_pages.pl
+++ b/src/test/recovery/t/015_promotion_pages.pl
@@ -56,7 +56,7 @@
 # beyond the previous vacuum.
 $alpha->safe_psql('postgres', 'create table test2 (a int, b text)');
 $alpha->safe_psql('postgres',
-	'insert into test2 select generate_series(1,10000), md5(random()::text)');
+	q{insert into test2 select generate_series(1,10000), encode(sha256(random()::text::bytea), 'hex')});
 $alpha->safe_psql('postgres', 'truncate test2');
 
 # Wait again for all records to be replayed.
diff --git a/src/test/recovery/t/026_overwrite_contrecord.pl b/src/test/recovery/t/026_overwrite_contrecord.pl
index 78feccd9aaef..314f93eaa7f9 100644
--- a/src/test/recovery/t/026_overwrite_contrecord.pl
+++ b/src/test/recovery/t/026_overwrite_contrecord.pl
@@ -39,7 +39,7 @@
 BEGIN
     LOOP
         INSERT into filler
-        select g, repeat(md5(g::text), (random() * 60 + 1)::int)
+        select g, repeat(encode(sha256(g::text::bytea), 'hex'), (random() * 30 + 1)::int)
         from generate_series(1, 10) g;
 
         remain := wal_segsize - (pg_current_wal_insert_lsn() - '0/0') % wal_segsize;
diff --git a/src/test/regress/expected/arrays.out b/src/test/regress/expected/arrays.out
index 97920f38c211..e29f3cf391b7 100644
--- a/src/test/regress/expected/arrays.out
+++ b/src/test/regress/expected/arrays.out
@@ -2278,14 +2278,14 @@ insert into src
 create type textandtext as (c1 text, c2 text);
 create temp table dest (f1 textandtext[]);
 insert into dest select array[row(f1,f1)::textandtext] from src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2::bytea)) from dest;
  length 
 --------
      32
 (1 row)
 
 delete from src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2::bytea)) from dest;
  length 
 --------
      32
@@ -2293,7 +2293,7 @@ select length(md5((f1[1]).c2)) from dest;
 
 truncate table src;
 drop table src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2::bytea)) from dest;
  length 
 --------
      32
diff --git a/src/test/regress/expected/brin.out b/src/test/regress/expected/brin.out
index 73fa38396e4c..7a901fd7e017 100644
--- a/src/test/regress/expected/brin.out
+++ b/src/test/regress/expected/brin.out
@@ -530,7 +530,7 @@ EXPLAIN (COSTS OFF) SELECT * FROM brin_test WHERE b = 1;
 CREATE TABLE brintest_3 (a text, b text, c text, d text);
 -- long random strings (~2000 chars each, so ~6kB for min/max on two
 -- columns) to trigger toasting
-WITH rand_value AS (SELECT string_agg(md5(i::text),'') AS val FROM generate_series(1,60) s(i))
+WITH rand_value AS (SELECT string_agg(encode(sha256(i::text::bytea), 'hex'),'') AS val FROM generate_series(1,30) s(i))
 INSERT INTO brintest_3
 SELECT val, val, val, val FROM rand_value;
 CREATE INDEX brin_test_toast_idx ON brintest_3 USING brin (b, c);
@@ -545,7 +545,7 @@ VACUUM brintest_3;
 -- retry insert with a different random-looking (but deterministic) value
 -- the value is different, and so should replace either min or max in the
 -- brin summary
-WITH rand_value AS (SELECT string_agg(md5((-i)::text),'') AS val FROM generate_series(1,60) s(i))
+WITH rand_value AS (SELECT string_agg(encode(sha256((-i)::text::bytea), 'hex'),'') AS val FROM generate_series(1,30) s(i))
 INSERT INTO brintest_3
 SELECT val, val, val, val FROM rand_value;
 -- now try some queries, accessing the brin index
diff --git a/src/test/regress/expected/brin_multi.out b/src/test/regress/expected/brin_multi.out
index f3309f433f87..b8dd069056f1 100644
--- a/src/test/regress/expected/brin_multi.out
+++ b/src/test/regress/expected/brin_multi.out
@@ -29,7 +29,7 @@ INSERT INTO brintest_multi SELECT
 	(four + 1.0)/(hundred+1),
 	odd::float8 / (tenthous + 1),
 	format('%s:00:%s:00:%s:00', to_hex(odd), to_hex(even), to_hex(hundred))::macaddr,
-	substr(md5(unique1::text), 1, 16)::macaddr8,
+	substr(encode(sha256(unique1::text::bytea), 'hex'), 1, 16)::macaddr8,
 	inet '10.2.3.4/24' + tenthous,
 	cidr '10.2.3/24' + tenthous,
 	date '1995-08-15' + tenthous,
@@ -316,6 +316,10 @@ BEGIN
 	END LOOP;
 END;
 $x$;
+WARNING:  unexpected number of results 31 for (macaddr8col,>,macaddr8,b1:d1:0e:7b:af:a4:42:12,33)
+WARNING:  unexpected number of results 17 for (macaddr8col,>=,macaddr8,d9:35:91:bd:f7:86:0e:1e,15)
+WARNING:  unexpected number of results 11 for (macaddr8col,<=,macaddr8,23:e8:46:63:86:07:ad:cb,13)
+WARNING:  unexpected number of results 4 for (macaddr8col,<,macaddr8,13:16:8e:6a:2e:6c:84:b4,6)
 RESET enable_seqscan;
 RESET enable_bitmapscan;
 INSERT INTO brintest_multi SELECT
@@ -327,7 +331,7 @@ INSERT INTO brintest_multi SELECT
 	(four + 1.0)/(hundred+1),
 	odd::float8 / (tenthous + 1),
 	format('%s:00:%s:00:%s:00', to_hex(odd), to_hex(even), to_hex(hundred))::macaddr,
-	substr(md5(unique1::text), 1, 16)::macaddr8,
+	substr(encode(sha256(unique1::text::bytea), 'hex'), 1, 16)::macaddr8,
 	inet '10.2.3.4' + tenthous,
 	cidr '10.2.3/24' + tenthous,
 	date '1995-08-15' + tenthous,
diff --git a/src/test/regress/expected/compression.out b/src/test/regress/expected/compression.out
index 4c997e2602f0..7eaffbbd83ce 100644
--- a/src/test/regress/expected/compression.out
+++ b/src/test/regress/expected/compression.out
@@ -102,7 +102,7 @@ SELECT pg_column_compression(f1) FROM cmmove2;
 
 -- test externally stored compressed data
 CREATE OR REPLACE FUNCTION large_val() RETURNS TEXT LANGUAGE SQL AS
-'select array_agg(md5(g::text))::text from generate_series(1, 256) g';
+$$ select array_agg(encode(sha256(g::text::bytea),'hex'))::text from generate_series(1, 128) g $$;
 CREATE TABLE cmdata2 (f1 text COMPRESSION pglz);
 INSERT INTO cmdata2 SELECT large_val() || repeat('a', 4000);
 SELECT pg_column_compression(f1) FROM cmdata2;
@@ -123,13 +123,13 @@ SELECT SUBSTR(f1, 200, 5) FROM cmdata1;
  substr 
 --------
  01234
- 8f14e
+ 27777
 (2 rows)
 
 SELECT SUBSTR(f1, 200, 5) FROM cmdata2;
  substr 
 --------
- 8f14e
+ 27777
 (1 row)
 
 DROP TABLE cmdata2;
@@ -317,8 +317,8 @@ SELECT pg_column_compression(f1) FROM cmdata;
 DROP TABLE cmdata2;
 CREATE TABLE cmdata2 (f1 TEXT COMPRESSION pglz, f2 TEXT COMPRESSION lz4);
 CREATE UNIQUE INDEX idx1 ON cmdata2 ((f1 || f2));
-INSERT INTO cmdata2 VALUES((SELECT array_agg(md5(g::TEXT))::TEXT FROM
-generate_series(1, 50) g), VERSION());
+INSERT INTO cmdata2 VALUES((SELECT array_agg(encode(sha256(g::TEXT::BYTEA), 'hex'))::TEXT FROM
+generate_series(1, 25) g), VERSION());
 -- check data is ok
 SELECT length(f1) FROM cmdata;
  length 
@@ -331,7 +331,7 @@ SELECT length(f1) FROM cmdata1;
  length 
 --------
   10040
-  12449
+  12321
 (2 rows)
 
 SELECT length(f1) FROM cmmove1;
diff --git a/src/test/regress/expected/inherit.out b/src/test/regress/expected/inherit.out
index 2d49e765de8c..18509202a99b 100644
--- a/src/test/regress/expected/inherit.out
+++ b/src/test/regress/expected/inherit.out
@@ -2450,7 +2450,7 @@ alter table permtest_child attach partition permtest_grandchild for values in ('
 alter table permtest_parent attach partition permtest_child for values in (1);
 create index on permtest_parent (left(c, 3));
 insert into permtest_parent
-  select 1, 'a', left(md5(i::text), 5) from generate_series(0, 100) i;
+  select 1, 'a', left(encode(sha256(i::text::bytea), 'hex'), 5) from generate_series(0, 100) i;
 analyze permtest_parent;
 create role regress_no_child_access;
 revoke all on permtest_grandchild from regress_no_child_access;
diff --git a/src/test/regress/expected/largeobject.out b/src/test/regress/expected/largeobject.out
index 31fba2ff9d30..5e7b08244c68 100644
--- a/src/test/regress/expected/largeobject.out
+++ b/src/test/regress/expected/largeobject.out
@@ -441,7 +441,7 @@ TRUNCATE lotest_stash_values;
 \set newloid_1 :LASTOID
 SELECT lo_from_bytea(0, lo_get(:newloid_1)) AS newloid_2
 \gset
-SELECT md5(lo_get(:newloid_1)) = md5(lo_get(:newloid_2));
+SELECT sha256(lo_get(:newloid_1)) = sha256(lo_get(:newloid_2));
  ?column? 
 ----------
  t
diff --git a/src/test/regress/expected/matview.out b/src/test/regress/expected/matview.out
index c109d97635b2..128215b835c0 100644
--- a/src/test/regress/expected/matview.out
+++ b/src/test/regress/expected/matview.out
@@ -556,10 +556,10 @@ SET ROLE regress_user_mvtest;
 -- duplicate all the aliases used in those queries
 CREATE TABLE mvtest_foo_data AS SELECT i,
   i+1 AS tid,
-  md5(random()::text) AS mv,
-  md5(random()::text) AS newdata,
-  md5(random()::text) AS newdata2,
-  md5(random()::text) AS diff
+  sha256(random()::text::bytea) AS mv,
+  sha256(random()::text::bytea) AS newdata,
+  sha256(random()::text::bytea) AS newdata2,
+  sha256(random()::text::bytea) AS diff
   FROM generate_series(1, 10) i;
 CREATE MATERIALIZED VIEW mvtest_mv_foo AS SELECT * FROM mvtest_foo_data;
 CREATE MATERIALIZED VIEW mvtest_mv_foo AS SELECT * FROM mvtest_foo_data;
diff --git a/src/test/regress/expected/memoize.out b/src/test/regress/expected/memoize.out
index 00438eb1ea07..804bd0f7b083 100644
--- a/src/test/regress/expected/memoize.out
+++ b/src/test/regress/expected/memoize.out
@@ -162,7 +162,7 @@ DROP TABLE flt;
 CREATE TABLE strtest (n name, t text);
 CREATE INDEX strtest_n_idx ON strtest (n);
 CREATE INDEX strtest_t_idx ON strtest (t);
-INSERT INTO strtest VALUES('one','one'),('two','two'),('three',repeat(md5('three'),100));
+INSERT INTO strtest VALUES('one','one'),('two','two'),('three',repeat(encode(sha256('three'),'hex'),50));
 -- duplicate rows so we get some cache hits
 INSERT INTO strtest SELECT * FROM strtest;
 ANALYZE strtest;
diff --git a/src/test/regress/expected/password.out b/src/test/regress/expected/password.out
index 7c84c9da3377..80cbce788b09 100644
--- a/src/test/regress/expected/password.out
+++ b/src/test/regress/expected/password.out
@@ -13,7 +13,9 @@ SET password_encryption = 'scram-sha-256'; -- ok
 -- consistency of password entries
 SET password_encryption = 'md5';
 CREATE ROLE regress_passwd1 PASSWORD 'role_pwd1';
+ERROR:  password encryption failed: unsupported
 CREATE ROLE regress_passwd2 PASSWORD 'role_pwd2';
+ERROR:  password encryption failed: unsupported
 SET password_encryption = 'scram-sha-256';
 CREATE ROLE regress_passwd3 PASSWORD 'role_pwd3';
 CREATE ROLE regress_passwd4 PASSWORD NULL;
@@ -30,33 +32,33 @@ SELECT rolname, regexp_replace(rolpassword, '(SCRAM-SHA-256)\$(\d+):([a-zA-Z0-9+
     ORDER BY rolname, rolpassword;
      rolname     |                rolpassword_masked                 
 -----------------+---------------------------------------------------
- regress_passwd1 | md5783277baca28003b33453252be4dbb34
- regress_passwd2 | md54044304ba511dd062133eb5b4b84a2a3
  regress_passwd3 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
  regress_passwd4 | 
-(4 rows)
+(2 rows)
 
 -- Rename a role
 ALTER ROLE regress_passwd2 RENAME TO regress_passwd2_new;
-NOTICE:  MD5 password cleared because of role rename
+ERROR:  role "regress_passwd2" does not exist
 -- md5 entry should have been removed
 SELECT rolname, rolpassword
     FROM pg_authid
     WHERE rolname LIKE 'regress_passwd2_new'
     ORDER BY rolname, rolpassword;
-       rolname       | rolpassword 
----------------------+-------------
- regress_passwd2_new | 
-(1 row)
+ rolname | rolpassword 
+---------+-------------
+(0 rows)
 
 ALTER ROLE regress_passwd2_new RENAME TO regress_passwd2;
+ERROR:  role "regress_passwd2_new" does not exist
 -- Change passwords with ALTER USER. With plaintext or already-encrypted
 -- passwords.
 SET password_encryption = 'md5';
 -- encrypt with MD5
 ALTER ROLE regress_passwd2 PASSWORD 'foo';
+ERROR:  role "regress_passwd2" does not exist
 -- already encrypted, use as they are
 ALTER ROLE regress_passwd1 PASSWORD 'md5cd3578025fe2c3d7ed1b9a9b26238b70';
+ERROR:  role "regress_passwd1" does not exist
 ALTER ROLE regress_passwd3 PASSWORD 'SCRAM-SHA-256$4096:VLK4RMaQLCvNtQ==$6YtlR4t69SguDiwFvbVgVZtuz6gpJQQqUMZ7IQJK5yI=:ps75jrHeYU4lXCcXI4O8oIdJ3eO8o2jirjruw9phBTo=';
 SET password_encryption = 'scram-sha-256';
 -- create SCRAM secret
@@ -78,21 +80,18 @@ SELECT rolname, regexp_replace(rolpassword, '(SCRAM-SHA-256)\$(\d+):([a-zA-Z0-9+
     ORDER BY rolname, rolpassword;
      rolname     |                rolpassword_masked                 
 -----------------+---------------------------------------------------
- regress_passwd1 | md5cd3578025fe2c3d7ed1b9a9b26238b70
- regress_passwd2 | md5dfa155cadd5f4ad57860162f3fab9cdb
  regress_passwd3 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
  regress_passwd4 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
  regress_passwd5 | md5e73a4b11df52a6068f8b39f90be36023
  regress_passwd6 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
  regress_passwd7 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
  regress_passwd8 | SCRAM-SHA-256$4096:<salt>$<storedkey>:<serverkey>
-(8 rows)
+(6 rows)
 
 -- An empty password is not allowed, in any form
 CREATE ROLE regress_passwd_empty PASSWORD '';
 NOTICE:  empty string is not a valid password, clearing password
 ALTER ROLE regress_passwd_empty PASSWORD 'md585939a5ce845f1a1b620742e3c659e0a';
-NOTICE:  empty string is not a valid password, clearing password
 ALTER ROLE regress_passwd_empty PASSWORD 'SCRAM-SHA-256$4096:hpFyHTUsSWcR7O9P$LgZFIt6Oqdo27ZFKbZ2nV+vtnYM995pDh9ca6WSi120=:qVV5NeluNfUPkwm7Vqat25RjSPLkGeoZBQs6wVv+um4=';
 NOTICE:  empty string is not a valid password, clearing password
 SELECT rolpassword FROM pg_authid WHERE rolname='regress_passwd_empty';
@@ -122,7 +121,9 @@ SELECT rolname, rolpassword not like '%A6xHKoH/494E941doaPOYg==%' as is_rolpassw
 (3 rows)
 
 DROP ROLE regress_passwd1;
+ERROR:  role "regress_passwd1" does not exist
 DROP ROLE regress_passwd2;
+ERROR:  role "regress_passwd2" does not exist
 DROP ROLE regress_passwd3;
 DROP ROLE regress_passwd4;
 DROP ROLE regress_passwd5;
diff --git a/src/test/regress/expected/plpgsql.out b/src/test/regress/expected/plpgsql.out
index 08e42f17dc23..87e515f3e6ef 100644
--- a/src/test/regress/expected/plpgsql.out
+++ b/src/test/regress/expected/plpgsql.out
@@ -3404,22 +3404,22 @@ select * from ret_query1();
 create type record_type as (x text, y int, z boolean);
 create or replace function ret_query2(lim int) returns setof record_type as $$
 begin
-    return query select md5(s.x::text), s.x, s.x > 0
+    return query select encode(sha256(s.x::text::bytea), 'hex'), s.x, s.x > 0
                  from generate_series(-8, lim) s (x) where s.x % 2 = 0;
 end;
 $$ language plpgsql;
 select * from ret_query2(8);
-                x                 | y  | z 
-----------------------------------+----+---
- a8d2ec85eaf98407310b72eb73dda247 | -8 | f
- 596a3d04481816330f07e4f97510c28f | -6 | f
- 0267aaf632e87a63288a08331f22c7c3 | -4 | f
- 5d7b9adcbe1c629ec722529dd12e5129 | -2 | f
- cfcd208495d565ef66e7dff9f98764da |  0 | f
- c81e728d9d4c2f636f067f89cc14862c |  2 | t
- a87ff679a2f3e71d9181a67b7542122c |  4 | t
- 1679091c5a880faf6fb5e6087eb1b2dc |  6 | t
- c9f0f895fb98ab9159f51fd0297e236d |  8 | t
+                                x                                 | y  | z 
+------------------------------------------------------------------+----+---
+ e91592205d3881e3ea35d66973bb4898d7282126ab5afcb355c95d2fc17f3822 | -8 | f
+ 03b26944890929ff751653acb2f2af795cee38f937f379f52ed654a68ce91216 | -6 | f
+ e5e0093f285a4fb94c3fcc2ad7fd04edd10d429ccda87a9aa5e4718efadf182e | -4 | f
+ cf3bae39dd692048a8bf961182e6a34dfd323eeb0748e162eaf055107f1cb873 | -2 | f
+ 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9 |  0 | f
+ d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35 |  2 | t
+ 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a |  4 | t
+ e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683 |  6 | t
+ 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3 |  8 | t
 (9 rows)
 
 -- test EXECUTE USING
diff --git a/src/test/regress/expected/rowsecurity.out b/src/test/regress/expected/rowsecurity.out
index b5f6eecba184..bcf5d7218fee 100644
--- a/src/test/regress/expected/rowsecurity.out
+++ b/src/test/regress/expected/rowsecurity.out
@@ -1408,9 +1408,9 @@ ERROR:  infinite recursion detected in policy for relation "rec1"
 --
 SET SESSION AUTHORIZATION regress_rls_alice;
 CREATE TABLE s1 (a int, b text);
-INSERT INTO s1 (SELECT x, md5(x::text) FROM generate_series(-10,10) x);
+INSERT INTO s1 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(-10,10) x);
 CREATE TABLE s2 (x int, y text);
-INSERT INTO s2 (SELECT x, md5(x::text) FROM generate_series(-6,6) x);
+INSERT INTO s2 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(-6,6) x);
 GRANT SELECT ON s1, s2 TO regress_rls_bob;
 CREATE POLICY p1 ON s1 USING (a in (select x from s2 where y like '%2f%'));
 CREATE POLICY p2 ON s2 USING (x in (select a from s1 where b like '%22%'));
@@ -1428,13 +1428,11 @@ DROP POLICY p3 on s1;
 ALTER POLICY p2 ON s2 USING (x % 2 = 0);
 SET SESSION AUTHORIZATION regress_rls_bob;
 SELECT * FROM s1 WHERE f_leak(b);	-- OK
-NOTICE:  f_leak => c81e728d9d4c2f636f067f89cc14862c
-NOTICE:  f_leak => a87ff679a2f3e71d9181a67b7542122c
- a |                b                 
----+----------------------------------
- 2 | c81e728d9d4c2f636f067f89cc14862c
- 4 | a87ff679a2f3e71d9181a67b7542122c
-(2 rows)
+NOTICE:  f_leak => 03b26944890929ff751653acb2f2af795cee38f937f379f52ed654a68ce91216
+ a  |                                b                                 
+----+------------------------------------------------------------------
+ -6 | 03b26944890929ff751653acb2f2af795cee38f937f379f52ed654a68ce91216
+(1 row)
 
 EXPLAIN (COSTS OFF) SELECT * FROM only s1 WHERE f_leak(b);
                         QUERY PLAN                         
@@ -1450,12 +1448,12 @@ SET SESSION AUTHORIZATION regress_rls_alice;
 ALTER POLICY p1 ON s1 USING (a in (select x from v2)); -- using VIEW in RLS policy
 SET SESSION AUTHORIZATION regress_rls_bob;
 SELECT * FROM s1 WHERE f_leak(b);	-- OK
-NOTICE:  f_leak => 0267aaf632e87a63288a08331f22c7c3
-NOTICE:  f_leak => 1679091c5a880faf6fb5e6087eb1b2dc
- a  |                b                 
-----+----------------------------------
- -4 | 0267aaf632e87a63288a08331f22c7c3
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
+NOTICE:  f_leak => 03b26944890929ff751653acb2f2af795cee38f937f379f52ed654a68ce91216
+NOTICE:  f_leak => cf3bae39dd692048a8bf961182e6a34dfd323eeb0748e162eaf055107f1cb873
+ a  |                                b                                 
+----+------------------------------------------------------------------
+ -6 | 03b26944890929ff751653acb2f2af795cee38f937f379f52ed654a68ce91216
+ -2 | cf3bae39dd692048a8bf961182e6a34dfd323eeb0748e162eaf055107f1cb873
 (2 rows)
 
 EXPLAIN (COSTS OFF) SELECT * FROM s1 WHERE f_leak(b);
@@ -1469,12 +1467,11 @@ EXPLAIN (COSTS OFF) SELECT * FROM s1 WHERE f_leak(b);
 (5 rows)
 
 SELECT (SELECT x FROM s1 LIMIT 1) xx, * FROM s2 WHERE y like '%28%';
- xx | x  |                y                 
-----+----+----------------------------------
- -6 | -6 | 596a3d04481816330f07e4f97510c28f
- -4 | -4 | 0267aaf632e87a63288a08331f22c7c3
-  2 |  2 | c81e728d9d4c2f636f067f89cc14862c
-(3 rows)
+ xx | x  |                                y                                 
+----+----+------------------------------------------------------------------
+ -4 | -4 | e5e0093f285a4fb94c3fcc2ad7fd04edd10d429ccda87a9aa5e4718efadf182e
+  4 |  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+(2 rows)
 
 EXPLAIN (COSTS OFF) SELECT (SELECT x FROM s1 LIMIT 1) xx, * FROM s2 WHERE y like '%28%';
                                QUERY PLAN                                
@@ -1900,7 +1897,7 @@ NOTICE:  f_leak => yyyyyy
 --
 SET SESSION AUTHORIZATION regress_rls_alice;
 CREATE TABLE b1 (a int, b text);
-INSERT INTO b1 (SELECT x, md5(x::text) FROM generate_series(-10,10) x);
+INSERT INTO b1 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(-10,10) x);
 CREATE POLICY p1 ON b1 USING (a % 2 = 0);
 ALTER TABLE b1 ENABLE ROW LEVEL SECURITY;
 GRANT ALL ON b1 TO regress_rls_bob;
@@ -1918,18 +1915,18 @@ EXPLAIN (COSTS OFF) SELECT * FROM bv1 WHERE f_leak(b);
 (4 rows)
 
 SELECT * FROM bv1 WHERE f_leak(b);
-NOTICE:  f_leak => c81e728d9d4c2f636f067f89cc14862c
-NOTICE:  f_leak => a87ff679a2f3e71d9181a67b7542122c
-NOTICE:  f_leak => 1679091c5a880faf6fb5e6087eb1b2dc
-NOTICE:  f_leak => c9f0f895fb98ab9159f51fd0297e236d
-NOTICE:  f_leak => d3d9446802a44259755d38e6d163e820
- a  |                b                 
-----+----------------------------------
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
- 10 | d3d9446802a44259755d38e6d163e820
+NOTICE:  f_leak => d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+NOTICE:  f_leak => 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+NOTICE:  f_leak => e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+NOTICE:  f_leak => 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+NOTICE:  f_leak => 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
 (5 rows)
 
 INSERT INTO bv1 VALUES (-1, 'xxx'); -- should fail view WCO
@@ -1946,7 +1943,7 @@ EXPLAIN (COSTS OFF) UPDATE bv1 SET b = 'yyy' WHERE a = 4 AND f_leak(b);
 (3 rows)
 
 UPDATE bv1 SET b = 'yyy' WHERE a = 4 AND f_leak(b);
-NOTICE:  f_leak => a87ff679a2f3e71d9181a67b7542122c
+NOTICE:  f_leak => 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
 EXPLAIN (COSTS OFF) DELETE FROM bv1 WHERE a = 6 AND f_leak(b);
                               QUERY PLAN                               
 -----------------------------------------------------------------------
@@ -1956,30 +1953,30 @@ EXPLAIN (COSTS OFF) DELETE FROM bv1 WHERE a = 6 AND f_leak(b);
 (3 rows)
 
 DELETE FROM bv1 WHERE a = 6 AND f_leak(b);
-NOTICE:  f_leak => 1679091c5a880faf6fb5e6087eb1b2dc
+NOTICE:  f_leak => e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
 SET SESSION AUTHORIZATION regress_rls_alice;
 SELECT * FROM b1;
-  a  |                b                 
------+----------------------------------
- -10 | 1b0fd9efa5279c4203b7c70233f86dbf
-  -9 | 252e691406782824eec43d7eadc3d256
-  -8 | a8d2ec85eaf98407310b72eb73dda247
-  -7 | 74687a12d3915d3c4d83f1af7b3683d5
-  -6 | 596a3d04481816330f07e4f97510c28f
-  -5 | 47c1b025fa18ea96c33fbb6718688c0f
-  -4 | 0267aaf632e87a63288a08331f22c7c3
-  -3 | b3149ecea4628efd23d2f86e5a723472
-  -2 | 5d7b9adcbe1c629ec722529dd12e5129
-  -1 | 6bb61e3b7bce0931da574d19d1d82c88
-   0 | cfcd208495d565ef66e7dff9f98764da
-   1 | c4ca4238a0b923820dcc509a6f75849b
-   2 | c81e728d9d4c2f636f067f89cc14862c
-   3 | eccbc87e4b5ce2fe28308fd9f2a7baf3
-   5 | e4da3b7fbbce2345d7772b0674a318d5
-   7 | 8f14e45fceea167a5a36dedd4bea2543
-   8 | c9f0f895fb98ab9159f51fd0297e236d
-   9 | 45c48cce2e2d7fbdea1afc51c7c6ad26
-  10 | d3d9446802a44259755d38e6d163e820
+  a  |                                b                                 
+-----+------------------------------------------------------------------
+ -10 | c171d4ec282b23db89a99880cd624e9ba2940c1d894783602edab5d7481dc1ea
+  -9 | d5c534fde62beb89c745a59952c8efed8b7523cbd047e682782e4367de9ea3bf
+  -8 | e91592205d3881e3ea35d66973bb4898d7282126ab5afcb355c95d2fc17f3822
+  -7 | a770d3270c9dcdedf12ed9fd70444f7c8a95c26cae3cae9bd867499090a2f14b
+  -6 | 03b26944890929ff751653acb2f2af795cee38f937f379f52ed654a68ce91216
+  -5 | 37aa1ccf80e481832b2db282d4d4f895ee1e31219b7d0f6aee8dc8968828341b
+  -4 | e5e0093f285a4fb94c3fcc2ad7fd04edd10d429ccda87a9aa5e4718efadf182e
+  -3 | 615bdd17c2556f82f384392ea8557f8cc88b03501c759e23093ab0b2a9b5cd48
+  -2 | cf3bae39dd692048a8bf961182e6a34dfd323eeb0748e162eaf055107f1cb873
+  -1 | 1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464
+   0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+   1 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
+   2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+   3 | 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+   5 | ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d
+   7 | 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
+   8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+   9 | 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+  10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
   12 | xxx
    4 | yyy
 (21 rows)
@@ -3038,41 +3035,41 @@ DROP VIEW rls_sbv;
 -- Expression structure
 --
 SET SESSION AUTHORIZATION regress_rls_alice;
-INSERT INTO y2 (SELECT x, md5(x::text) FROM generate_series(0,20) x);
+INSERT INTO y2 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(0,20) x);
 CREATE POLICY p2 ON y2 USING (a % 3 = 0);
 CREATE POLICY p3 ON y2 USING (a % 4 = 0);
 SET SESSION AUTHORIZATION regress_rls_bob;
 SELECT * FROM y2 WHERE f_leak(b);
-NOTICE:  f_leak => cfcd208495d565ef66e7dff9f98764da
-NOTICE:  f_leak => c81e728d9d4c2f636f067f89cc14862c
-NOTICE:  f_leak => eccbc87e4b5ce2fe28308fd9f2a7baf3
-NOTICE:  f_leak => a87ff679a2f3e71d9181a67b7542122c
-NOTICE:  f_leak => 1679091c5a880faf6fb5e6087eb1b2dc
-NOTICE:  f_leak => c9f0f895fb98ab9159f51fd0297e236d
-NOTICE:  f_leak => 45c48cce2e2d7fbdea1afc51c7c6ad26
-NOTICE:  f_leak => d3d9446802a44259755d38e6d163e820
-NOTICE:  f_leak => c20ad4d76fe97759aa27a0c99bff6710
-NOTICE:  f_leak => aab3238922bcc25a6f606eb525ffdc56
-NOTICE:  f_leak => 9bf31c7ff062936a96d3c8bd1f8f2ff3
-NOTICE:  f_leak => c74d97b01eae257e44aa9d5bade97baf
-NOTICE:  f_leak => 6f4922f45568161a8cdf4ad2299f6d23
-NOTICE:  f_leak => 98f13708210194c475687be6106a3b84
- a  |                b                 
-----+----------------------------------
-  0 | cfcd208495d565ef66e7dff9f98764da
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  3 | eccbc87e4b5ce2fe28308fd9f2a7baf3
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
-  9 | 45c48cce2e2d7fbdea1afc51c7c6ad26
- 10 | d3d9446802a44259755d38e6d163e820
- 12 | c20ad4d76fe97759aa27a0c99bff6710
- 14 | aab3238922bcc25a6f606eb525ffdc56
- 15 | 9bf31c7ff062936a96d3c8bd1f8f2ff3
- 16 | c74d97b01eae257e44aa9d5bade97baf
- 18 | 6f4922f45568161a8cdf4ad2299f6d23
- 20 | 98f13708210194c475687be6106a3b84
+NOTICE:  f_leak => 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+NOTICE:  f_leak => d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+NOTICE:  f_leak => 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+NOTICE:  f_leak => 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+NOTICE:  f_leak => e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+NOTICE:  f_leak => 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+NOTICE:  f_leak => 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+NOTICE:  f_leak => 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+NOTICE:  f_leak => 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+NOTICE:  f_leak => 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+NOTICE:  f_leak => e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb
+NOTICE:  f_leak => b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+NOTICE:  f_leak => 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+NOTICE:  f_leak => f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  3 | 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+  9 | 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ 12 | 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+ 14 | 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+ 15 | e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb
+ 16 | b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+ 18 | 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+ 20 | f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
 (14 rows)
 
 EXPLAIN (COSTS OFF) SELECT * FROM y2 WHERE f_leak(b);
@@ -3107,22 +3104,22 @@ NOTICE:  f_leak => abc
 NOTICE:  f_leak => abc
 NOTICE:  f_leak => abc
 NOTICE:  f_leak => abc
- a  |                b                 
-----+----------------------------------
-  0 | cfcd208495d565ef66e7dff9f98764da
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  3 | eccbc87e4b5ce2fe28308fd9f2a7baf3
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
-  9 | 45c48cce2e2d7fbdea1afc51c7c6ad26
- 10 | d3d9446802a44259755d38e6d163e820
- 12 | c20ad4d76fe97759aa27a0c99bff6710
- 14 | aab3238922bcc25a6f606eb525ffdc56
- 15 | 9bf31c7ff062936a96d3c8bd1f8f2ff3
- 16 | c74d97b01eae257e44aa9d5bade97baf
- 18 | 6f4922f45568161a8cdf4ad2299f6d23
- 20 | 98f13708210194c475687be6106a3b84
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  3 | 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+  9 | 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ 12 | 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+ 14 | 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+ 15 | e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb
+ 16 | b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+ 18 | 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+ 20 | f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
 (14 rows)
 
 EXPLAIN (COSTS OFF) SELECT * FROM y2 WHERE f_leak('abc');
@@ -3156,20 +3153,20 @@ EXPLAIN (COSTS OFF) SELECT * FROM y2 JOIN test_qual_pushdown ON (b = abc) WHERE
 (7 rows)
 
 SELECT * FROM y2 JOIN test_qual_pushdown ON (b = abc) WHERE f_leak(b);
-NOTICE:  f_leak => cfcd208495d565ef66e7dff9f98764da
-NOTICE:  f_leak => c81e728d9d4c2f636f067f89cc14862c
-NOTICE:  f_leak => eccbc87e4b5ce2fe28308fd9f2a7baf3
-NOTICE:  f_leak => a87ff679a2f3e71d9181a67b7542122c
-NOTICE:  f_leak => 1679091c5a880faf6fb5e6087eb1b2dc
-NOTICE:  f_leak => c9f0f895fb98ab9159f51fd0297e236d
-NOTICE:  f_leak => 45c48cce2e2d7fbdea1afc51c7c6ad26
-NOTICE:  f_leak => d3d9446802a44259755d38e6d163e820
-NOTICE:  f_leak => c20ad4d76fe97759aa27a0c99bff6710
-NOTICE:  f_leak => aab3238922bcc25a6f606eb525ffdc56
-NOTICE:  f_leak => 9bf31c7ff062936a96d3c8bd1f8f2ff3
-NOTICE:  f_leak => c74d97b01eae257e44aa9d5bade97baf
-NOTICE:  f_leak => 6f4922f45568161a8cdf4ad2299f6d23
-NOTICE:  f_leak => 98f13708210194c475687be6106a3b84
+NOTICE:  f_leak => 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+NOTICE:  f_leak => d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+NOTICE:  f_leak => 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+NOTICE:  f_leak => 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+NOTICE:  f_leak => e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+NOTICE:  f_leak => 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+NOTICE:  f_leak => 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+NOTICE:  f_leak => 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+NOTICE:  f_leak => 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+NOTICE:  f_leak => 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+NOTICE:  f_leak => e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb
+NOTICE:  f_leak => b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+NOTICE:  f_leak => 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+NOTICE:  f_leak => f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
  a | b | abc 
 ---+---+-----
 (0 rows)
@@ -3239,33 +3236,33 @@ CREATE TABLE t1 (a integer, b text);
 CREATE POLICY p1 ON t1 USING (a % 2 = 0);
 ALTER TABLE t1 ENABLE ROW LEVEL SECURITY;
 GRANT ALL ON t1 TO regress_rls_bob;
-INSERT INTO t1 (SELECT x, md5(x::text) FROM generate_series(0,20) x);
+INSERT INTO t1 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(0,20) x);
 SET SESSION AUTHORIZATION regress_rls_bob;
 WITH cte1 AS MATERIALIZED (SELECT * FROM t1 WHERE f_leak(b)) SELECT * FROM cte1;
-NOTICE:  f_leak => cfcd208495d565ef66e7dff9f98764da
-NOTICE:  f_leak => c81e728d9d4c2f636f067f89cc14862c
-NOTICE:  f_leak => a87ff679a2f3e71d9181a67b7542122c
-NOTICE:  f_leak => 1679091c5a880faf6fb5e6087eb1b2dc
-NOTICE:  f_leak => c9f0f895fb98ab9159f51fd0297e236d
-NOTICE:  f_leak => d3d9446802a44259755d38e6d163e820
-NOTICE:  f_leak => c20ad4d76fe97759aa27a0c99bff6710
-NOTICE:  f_leak => aab3238922bcc25a6f606eb525ffdc56
-NOTICE:  f_leak => c74d97b01eae257e44aa9d5bade97baf
-NOTICE:  f_leak => 6f4922f45568161a8cdf4ad2299f6d23
-NOTICE:  f_leak => 98f13708210194c475687be6106a3b84
- a  |                b                 
-----+----------------------------------
-  0 | cfcd208495d565ef66e7dff9f98764da
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
- 10 | d3d9446802a44259755d38e6d163e820
- 12 | c20ad4d76fe97759aa27a0c99bff6710
- 14 | aab3238922bcc25a6f606eb525ffdc56
- 16 | c74d97b01eae257e44aa9d5bade97baf
- 18 | 6f4922f45568161a8cdf4ad2299f6d23
- 20 | 98f13708210194c475687be6106a3b84
+NOTICE:  f_leak => 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+NOTICE:  f_leak => d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+NOTICE:  f_leak => 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+NOTICE:  f_leak => e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+NOTICE:  f_leak => 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+NOTICE:  f_leak => 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+NOTICE:  f_leak => 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+NOTICE:  f_leak => 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+NOTICE:  f_leak => b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+NOTICE:  f_leak => 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+NOTICE:  f_leak => f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ 12 | 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+ 14 | 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+ 16 | b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+ 18 | 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+ 20 | f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
 (11 rows)
 
 EXPLAIN (COSTS OFF)
@@ -3281,19 +3278,19 @@ WITH cte1 AS MATERIALIZED (SELECT * FROM t1 WHERE f_leak(b)) SELECT * FROM cte1;
 WITH cte1 AS (UPDATE t1 SET a = a + 1 RETURNING *) SELECT * FROM cte1; --fail
 ERROR:  new row violates row-level security policy for table "t1"
 WITH cte1 AS (UPDATE t1 SET a = a RETURNING *) SELECT * FROM cte1; --ok
- a  |                b                 
-----+----------------------------------
-  0 | cfcd208495d565ef66e7dff9f98764da
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
- 10 | d3d9446802a44259755d38e6d163e820
- 12 | c20ad4d76fe97759aa27a0c99bff6710
- 14 | aab3238922bcc25a6f606eb525ffdc56
- 16 | c74d97b01eae257e44aa9d5bade97baf
- 18 | 6f4922f45568161a8cdf4ad2299f6d23
- 20 | 98f13708210194c475687be6106a3b84
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ 12 | 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+ 14 | 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+ 16 | b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+ 18 | 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+ 20 | f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
 (11 rows)
 
 WITH cte1 AS (INSERT INTO t1 VALUES (21, 'Fail') RETURNING *) SELECT * FROM cte1; --fail
@@ -3344,19 +3341,19 @@ EXPLAIN (COSTS OFF) INSERT INTO t2 (SELECT * FROM t1);
 (3 rows)
 
 SELECT * FROM t2;
- a  |                b                 
-----+----------------------------------
-  0 | cfcd208495d565ef66e7dff9f98764da
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
- 10 | d3d9446802a44259755d38e6d163e820
- 12 | c20ad4d76fe97759aa27a0c99bff6710
- 14 | aab3238922bcc25a6f606eb525ffdc56
- 16 | c74d97b01eae257e44aa9d5bade97baf
- 18 | 6f4922f45568161a8cdf4ad2299f6d23
- 20 | 98f13708210194c475687be6106a3b84
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ 12 | 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+ 14 | 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+ 16 | b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+ 18 | 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+ 20 | f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
  20 | Success
 (12 rows)
 
@@ -3368,37 +3365,37 @@ EXPLAIN (COSTS OFF) SELECT * FROM t2;
 
 CREATE TABLE t3 AS SELECT * FROM t1;
 SELECT * FROM t3;
- a  |                b                 
-----+----------------------------------
-  0 | cfcd208495d565ef66e7dff9f98764da
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
- 10 | d3d9446802a44259755d38e6d163e820
- 12 | c20ad4d76fe97759aa27a0c99bff6710
- 14 | aab3238922bcc25a6f606eb525ffdc56
- 16 | c74d97b01eae257e44aa9d5bade97baf
- 18 | 6f4922f45568161a8cdf4ad2299f6d23
- 20 | 98f13708210194c475687be6106a3b84
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ 12 | 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+ 14 | 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+ 16 | b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+ 18 | 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+ 20 | f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
  20 | Success
 (12 rows)
 
 SELECT * INTO t4 FROM t1;
 SELECT * FROM t4;
- a  |                b                 
-----+----------------------------------
-  0 | cfcd208495d565ef66e7dff9f98764da
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
- 10 | d3d9446802a44259755d38e6d163e820
- 12 | c20ad4d76fe97759aa27a0c99bff6710
- 14 | aab3238922bcc25a6f606eb525ffdc56
- 16 | c74d97b01eae257e44aa9d5bade97baf
- 18 | 6f4922f45568161a8cdf4ad2299f6d23
- 20 | 98f13708210194c475687be6106a3b84
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ 12 | 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+ 14 | 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+ 16 | b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+ 18 | 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+ 20 | f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
  20 | Success
 (12 rows)
 
@@ -3469,29 +3466,29 @@ ALTER TABLE t1 OWNER TO regress_rls_alice;
 -- Check that default deny does not apply to superuser.
 RESET SESSION AUTHORIZATION;
 SELECT * FROM t1;
- a  |                b                 
-----+----------------------------------
-  1 | c4ca4238a0b923820dcc509a6f75849b
-  3 | eccbc87e4b5ce2fe28308fd9f2a7baf3
-  5 | e4da3b7fbbce2345d7772b0674a318d5
-  7 | 8f14e45fceea167a5a36dedd4bea2543
-  9 | 45c48cce2e2d7fbdea1afc51c7c6ad26
- 11 | 6512bd43d9caa6e02c990b0a82652dca
- 13 | c51ce410c124a10e0db5e4b97fc2af39
- 15 | 9bf31c7ff062936a96d3c8bd1f8f2ff3
- 17 | 70efdf2ec9b086079795c442636b55fb
- 19 | 1f0e3dad99908345f7439f8ffabdffc4
-  0 | cfcd208495d565ef66e7dff9f98764da
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
- 10 | d3d9446802a44259755d38e6d163e820
- 12 | c20ad4d76fe97759aa27a0c99bff6710
- 14 | aab3238922bcc25a6f606eb525ffdc56
- 16 | c74d97b01eae257e44aa9d5bade97baf
- 18 | 6f4922f45568161a8cdf4ad2299f6d23
- 20 | 98f13708210194c475687be6106a3b84
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  1 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
+  3 | 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+  5 | ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d
+  7 | 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
+  9 | 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+ 11 | 4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8
+ 13 | 3fdba35f04dc8c462986c992bcf875546257113072a909c162f7e470e581e278
+ 15 | e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb
+ 17 | 4523540f1504cd17100c4835e85b7eefd49911580f8efff0599a8f283be6b9e3
+ 19 | 9400f1b21cb527d7fa3d3eabba93557a18ebe7a2ca4e471cfe5e4c5b4ca7f767
+  0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ 12 | 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+ 14 | 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+ 16 | b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+ 18 | 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+ 20 | f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
  20 | Success
 (22 rows)
 
@@ -3504,29 +3501,29 @@ EXPLAIN (COSTS OFF) SELECT * FROM t1;
 -- Check that default deny does not apply to table owner.
 SET SESSION AUTHORIZATION regress_rls_alice;
 SELECT * FROM t1;
- a  |                b                 
-----+----------------------------------
-  1 | c4ca4238a0b923820dcc509a6f75849b
-  3 | eccbc87e4b5ce2fe28308fd9f2a7baf3
-  5 | e4da3b7fbbce2345d7772b0674a318d5
-  7 | 8f14e45fceea167a5a36dedd4bea2543
-  9 | 45c48cce2e2d7fbdea1afc51c7c6ad26
- 11 | 6512bd43d9caa6e02c990b0a82652dca
- 13 | c51ce410c124a10e0db5e4b97fc2af39
- 15 | 9bf31c7ff062936a96d3c8bd1f8f2ff3
- 17 | 70efdf2ec9b086079795c442636b55fb
- 19 | 1f0e3dad99908345f7439f8ffabdffc4
-  0 | cfcd208495d565ef66e7dff9f98764da
-  2 | c81e728d9d4c2f636f067f89cc14862c
-  4 | a87ff679a2f3e71d9181a67b7542122c
-  6 | 1679091c5a880faf6fb5e6087eb1b2dc
-  8 | c9f0f895fb98ab9159f51fd0297e236d
- 10 | d3d9446802a44259755d38e6d163e820
- 12 | c20ad4d76fe97759aa27a0c99bff6710
- 14 | aab3238922bcc25a6f606eb525ffdc56
- 16 | c74d97b01eae257e44aa9d5bade97baf
- 18 | 6f4922f45568161a8cdf4ad2299f6d23
- 20 | 98f13708210194c475687be6106a3b84
+ a  |                                b                                 
+----+------------------------------------------------------------------
+  1 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
+  3 | 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+  5 | ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d
+  7 | 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
+  9 | 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+ 11 | 4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8
+ 13 | 3fdba35f04dc8c462986c992bcf875546257113072a909c162f7e470e581e278
+ 15 | e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb
+ 17 | 4523540f1504cd17100c4835e85b7eefd49911580f8efff0599a8f283be6b9e3
+ 19 | 9400f1b21cb527d7fa3d3eabba93557a18ebe7a2ca4e471cfe5e4c5b4ca7f767
+  0 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+  2 | d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+  4 | 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+  6 | e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+  8 | 2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+ 10 | 4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
+ 12 | 6b51d431df5d7f141cbececcf79edf3dd861c3b4069f0b11661a3eefacbba918
+ 14 | 8527a891e224136950ff32ca212b45bc93f69fbb801c3b1ebedac52775f99e61
+ 16 | b17ef6d19c7a5b1ee83b907c595526dcb1eb06db8227d650d5dda0a9f4ce8cd9
+ 18 | 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
+ 20 | f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b
  20 | Success
 (22 rows)
 
@@ -3574,35 +3571,35 @@ CREATE TABLE copy_t (a integer, b text);
 CREATE POLICY p1 ON copy_t USING (a % 2 = 0);
 ALTER TABLE copy_t ENABLE ROW LEVEL SECURITY;
 GRANT ALL ON copy_t TO regress_rls_bob, regress_rls_exempt_user;
-INSERT INTO copy_t (SELECT x, md5(x::text) FROM generate_series(0,10) x);
+INSERT INTO copy_t (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(0,10) x);
 -- Check COPY TO as Superuser/owner.
 RESET SESSION AUTHORIZATION;
 SET row_security TO OFF;
 COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ',';
-0,cfcd208495d565ef66e7dff9f98764da
-1,c4ca4238a0b923820dcc509a6f75849b
-2,c81e728d9d4c2f636f067f89cc14862c
-3,eccbc87e4b5ce2fe28308fd9f2a7baf3
-4,a87ff679a2f3e71d9181a67b7542122c
-5,e4da3b7fbbce2345d7772b0674a318d5
-6,1679091c5a880faf6fb5e6087eb1b2dc
-7,8f14e45fceea167a5a36dedd4bea2543
-8,c9f0f895fb98ab9159f51fd0297e236d
-9,45c48cce2e2d7fbdea1afc51c7c6ad26
-10,d3d9446802a44259755d38e6d163e820
+0,5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+1,6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
+2,d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+3,4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+4,4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+5,ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d
+6,e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+7,7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
+8,2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+9,19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+10,4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
 SET row_security TO ON;
 COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ',';
-0,cfcd208495d565ef66e7dff9f98764da
-1,c4ca4238a0b923820dcc509a6f75849b
-2,c81e728d9d4c2f636f067f89cc14862c
-3,eccbc87e4b5ce2fe28308fd9f2a7baf3
-4,a87ff679a2f3e71d9181a67b7542122c
-5,e4da3b7fbbce2345d7772b0674a318d5
-6,1679091c5a880faf6fb5e6087eb1b2dc
-7,8f14e45fceea167a5a36dedd4bea2543
-8,c9f0f895fb98ab9159f51fd0297e236d
-9,45c48cce2e2d7fbdea1afc51c7c6ad26
-10,d3d9446802a44259755d38e6d163e820
+0,5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+1,6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
+2,d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+3,4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+4,4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+5,ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d
+6,e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+7,7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
+8,2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+9,19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+10,4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
 -- Check COPY TO as user with permissions.
 SET SESSION AUTHORIZATION regress_rls_bob;
 SET row_security TO OFF;
@@ -3610,40 +3607,40 @@ COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --fail
 ERROR:  query would be affected by row-level security policy for table "copy_t"
 SET row_security TO ON;
 COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --ok
-0,cfcd208495d565ef66e7dff9f98764da
-2,c81e728d9d4c2f636f067f89cc14862c
-4,a87ff679a2f3e71d9181a67b7542122c
-6,1679091c5a880faf6fb5e6087eb1b2dc
-8,c9f0f895fb98ab9159f51fd0297e236d
-10,d3d9446802a44259755d38e6d163e820
+0,5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+2,d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+4,4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+6,e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+8,2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+10,4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
 -- Check COPY TO as user with permissions and BYPASSRLS
 SET SESSION AUTHORIZATION regress_rls_exempt_user;
 SET row_security TO OFF;
 COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --ok
-0,cfcd208495d565ef66e7dff9f98764da
-1,c4ca4238a0b923820dcc509a6f75849b
-2,c81e728d9d4c2f636f067f89cc14862c
-3,eccbc87e4b5ce2fe28308fd9f2a7baf3
-4,a87ff679a2f3e71d9181a67b7542122c
-5,e4da3b7fbbce2345d7772b0674a318d5
-6,1679091c5a880faf6fb5e6087eb1b2dc
-7,8f14e45fceea167a5a36dedd4bea2543
-8,c9f0f895fb98ab9159f51fd0297e236d
-9,45c48cce2e2d7fbdea1afc51c7c6ad26
-10,d3d9446802a44259755d38e6d163e820
+0,5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+1,6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
+2,d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+3,4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+4,4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+5,ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d
+6,e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+7,7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
+8,2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+9,19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+10,4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
 SET row_security TO ON;
 COPY (SELECT * FROM copy_t ORDER BY a ASC) TO STDOUT WITH DELIMITER ','; --ok
-0,cfcd208495d565ef66e7dff9f98764da
-1,c4ca4238a0b923820dcc509a6f75849b
-2,c81e728d9d4c2f636f067f89cc14862c
-3,eccbc87e4b5ce2fe28308fd9f2a7baf3
-4,a87ff679a2f3e71d9181a67b7542122c
-5,e4da3b7fbbce2345d7772b0674a318d5
-6,1679091c5a880faf6fb5e6087eb1b2dc
-7,8f14e45fceea167a5a36dedd4bea2543
-8,c9f0f895fb98ab9159f51fd0297e236d
-9,45c48cce2e2d7fbdea1afc51c7c6ad26
-10,d3d9446802a44259755d38e6d163e820
+0,5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
+1,6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
+2,d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
+3,4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce
+4,4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
+5,ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d
+6,e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
+7,7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
+8,2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
+9,19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7
+10,4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5
 -- Check COPY TO as user without permissions. SET row_security TO OFF;
 SET SESSION AUTHORIZATION regress_rls_carol;
 SET row_security TO OFF;
@@ -3659,15 +3656,15 @@ CREATE TABLE copy_rel_to (a integer, b text);
 CREATE POLICY p1 ON copy_rel_to USING (a % 2 = 0);
 ALTER TABLE copy_rel_to ENABLE ROW LEVEL SECURITY;
 GRANT ALL ON copy_rel_to TO regress_rls_bob, regress_rls_exempt_user;
-INSERT INTO copy_rel_to VALUES (1, md5('1'));
+INSERT INTO copy_rel_to VALUES (1, encode(sha256('1'), 'hex'));
 -- Check COPY TO as Superuser/owner.
 RESET SESSION AUTHORIZATION;
 SET row_security TO OFF;
 COPY copy_rel_to TO STDOUT WITH DELIMITER ',';
-1,c4ca4238a0b923820dcc509a6f75849b
+1,6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
 SET row_security TO ON;
 COPY copy_rel_to TO STDOUT WITH DELIMITER ',';
-1,c4ca4238a0b923820dcc509a6f75849b
+1,6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
 -- Check COPY TO as user with permissions.
 SET SESSION AUTHORIZATION regress_rls_bob;
 SET row_security TO OFF;
@@ -3679,10 +3676,10 @@ COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --ok
 SET SESSION AUTHORIZATION regress_rls_exempt_user;
 SET row_security TO OFF;
 COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --ok
-1,c4ca4238a0b923820dcc509a6f75849b
+1,6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
 SET row_security TO ON;
 COPY copy_rel_to TO STDOUT WITH DELIMITER ','; --ok
-1,c4ca4238a0b923820dcc509a6f75849b
+1,6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
 -- Check COPY TO as user without permissions. SET row_security TO OFF;
 SET SESSION AUTHORIZATION regress_rls_carol;
 SET row_security TO OFF;
diff --git a/src/test/regress/expected/stats_ext.out b/src/test/regress/expected/stats_ext.out
index a2bc409e06f4..0f5c364c3b91 100644
--- a/src/test/regress/expected/stats_ext.out
+++ b/src/test/regress/expected/stats_ext.out
@@ -2613,17 +2613,18 @@ INSERT INTO mcv_lists_uuid (a, b, c)
          md5(mod(i,50)::text)::uuid,
          md5(mod(i,25)::text)::uuid
      FROM generate_series(1,5000) s(i);
+ERROR:  could not compute MD5 hash: unsupported
 ANALYZE mcv_lists_uuid;
 SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
  estimated | actual 
 -----------+--------
-         1 |     50
+         1 |      0
 (1 row)
 
 SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND c = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
  estimated | actual 
 -----------+--------
-         1 |     50
+         1 |      0
 (1 row)
 
 CREATE STATISTICS mcv_lists_uuid_stats (mcv) ON a, b, c
@@ -2632,13 +2633,13 @@ ANALYZE mcv_lists_uuid;
 SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
  estimated | actual 
 -----------+--------
-        50 |     50
+         1 |      0
 (1 row)
 
 SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND c = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
  estimated | actual 
 -----------+--------
-        50 |     50
+         1 |      0
 (1 row)
 
 DROP TABLE mcv_lists_uuid;
@@ -2655,6 +2656,7 @@ INSERT INTO mcv_lists_arrays (a, b, c)
          ARRAY[(i/100-1)::numeric/1000, (i/100)::numeric/1000, (i/100+1)::numeric/1000],
          ARRAY[(i/100-1), i/100, (i/100+1)]
      FROM generate_series(1,5000) s(i);
+ERROR:  could not compute MD5 hash: unsupported
 CREATE STATISTICS mcv_lists_arrays_stats (mcv) ON a, b, c
   FROM mcv_lists_arrays;
 ANALYZE mcv_lists_arrays;
@@ -3033,11 +3035,12 @@ DROP TABLE expr_stats;
 -- statistics on expressions with different data types
 CREATE TABLE expr_stats (a int, b name, c text);
 INSERT INTO expr_stats SELECT mod(i,10), md5(mod(i,10)::text), md5(mod(i,10)::text) FROM generate_series(1,1000) s(i);
+ERROR:  could not compute MD5 hash: unsupported
 ANALYZE expr_stats;
 SELECT * FROM check_estimated_rows('SELECT * FROM expr_stats WHERE a = 0 AND (b || c) <= ''z'' AND (c || b) >= ''0''');
  estimated | actual 
 -----------+--------
-        11 |    100
+         1 |      0
 (1 row)
 
 CREATE STATISTICS expr_stats_1 (mcv) ON a, b, (b || c), (c || b) FROM expr_stats;
@@ -3045,7 +3048,7 @@ ANALYZE expr_stats;
 SELECT * FROM check_estimated_rows('SELECT * FROM expr_stats WHERE a = 0 AND (b || c) <= ''z'' AND (c || b) >= ''0''');
  estimated | actual 
 -----------+--------
-       100 |    100
+         1 |      0
 (1 row)
 
 DROP TABLE expr_stats;
diff --git a/src/test/regress/expected/strings.out b/src/test/regress/expected/strings.out
index 0f95b9400b69..2ce78f1d2807 100644
--- a/src/test/regress/expected/strings.out
+++ b/src/test/regress/expected/strings.out
@@ -2123,89 +2123,33 @@ select to_hex(256::bigint*256::bigint*256::bigint*256::bigint - 1) AS "ffffffff"
 -- (see: ftp://ftp.rfc-editor.org/in-notes/rfc1321.txt)
 --
 select md5('') = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('a') = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('abc') = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('message digest') = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('abcdefghijklmnopqrstuvwxyz') = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789') = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890') = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5(''::bytea) = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('a'::bytea) = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('abc'::bytea) = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('message digest'::bytea) = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('abcdefghijklmnopqrstuvwxyz'::bytea) = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'::bytea) = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890'::bytea) = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
+ERROR:  could not compute MD5 hash: unsupported
 --
 -- SHA-2
 --
diff --git a/src/test/regress/sql/arrays.sql b/src/test/regress/sql/arrays.sql
index 791af5c0ce1f..b98ed340e20d 100644
--- a/src/test/regress/sql/arrays.sql
+++ b/src/test/regress/sql/arrays.sql
@@ -671,12 +671,12 @@ CREATE TEMP TABLE arraggtest ( f1 INT[], f2 TEXT[][], f3 FLOAT[]);
 create type textandtext as (c1 text, c2 text);
 create temp table dest (f1 textandtext[]);
 insert into dest select array[row(f1,f1)::textandtext] from src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2::bytea)) from dest;
 delete from src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2::bytea)) from dest;
 truncate table src;
 drop table src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2::bytea)) from dest;
 drop table dest;
 drop type textandtext;
 
diff --git a/src/test/regress/sql/brin.sql b/src/test/regress/sql/brin.sql
index e68e9e18df51..2fb1fa05f834 100644
--- a/src/test/regress/sql/brin.sql
+++ b/src/test/regress/sql/brin.sql
@@ -476,7 +476,7 @@ CREATE TABLE brintest_3 (a text, b text, c text, d text);
 
 -- long random strings (~2000 chars each, so ~6kB for min/max on two
 -- columns) to trigger toasting
-WITH rand_value AS (SELECT string_agg(md5(i::text),'') AS val FROM generate_series(1,60) s(i))
+WITH rand_value AS (SELECT string_agg(encode(sha256(i::text::bytea), 'hex'),'') AS val FROM generate_series(1,30) s(i))
 INSERT INTO brintest_3
 SELECT val, val, val, val FROM rand_value;
 
@@ -495,7 +495,7 @@ CREATE INDEX CONCURRENTLY brin_test_temp_idx ON brintest_3(a);
 -- retry insert with a different random-looking (but deterministic) value
 -- the value is different, and so should replace either min or max in the
 -- brin summary
-WITH rand_value AS (SELECT string_agg(md5((-i)::text),'') AS val FROM generate_series(1,60) s(i))
+WITH rand_value AS (SELECT string_agg(encode(sha256((-i)::text::bytea), 'hex'),'') AS val FROM generate_series(1,30) s(i))
 INSERT INTO brintest_3
 SELECT val, val, val, val FROM rand_value;
 
diff --git a/src/test/regress/sql/brin_multi.sql b/src/test/regress/sql/brin_multi.sql
index 2189b6ccf423..8e1c9b4c10f5 100644
--- a/src/test/regress/sql/brin_multi.sql
+++ b/src/test/regress/sql/brin_multi.sql
@@ -30,7 +30,7 @@ CREATE TABLE brintest_multi (
 	(four + 1.0)/(hundred+1),
 	odd::float8 / (tenthous + 1),
 	format('%s:00:%s:00:%s:00', to_hex(odd), to_hex(even), to_hex(hundred))::macaddr,
-	substr(md5(unique1::text), 1, 16)::macaddr8,
+	substr(encode(sha256(unique1::text::bytea), 'hex'), 1, 16)::macaddr8,
 	inet '10.2.3.4/24' + tenthous,
 	cidr '10.2.3/24' + tenthous,
 	date '1995-08-15' + tenthous,
@@ -334,7 +334,7 @@ CREATE TABLE brinopers_multi (colname name, typ text,
 	(four + 1.0)/(hundred+1),
 	odd::float8 / (tenthous + 1),
 	format('%s:00:%s:00:%s:00', to_hex(odd), to_hex(even), to_hex(hundred))::macaddr,
-	substr(md5(unique1::text), 1, 16)::macaddr8,
+	substr(encode(sha256(unique1::text::bytea), 'hex'), 1, 16)::macaddr8,
 	inet '10.2.3.4' + tenthous,
 	cidr '10.2.3/24' + tenthous,
 	date '1995-08-15' + tenthous,
diff --git a/src/test/regress/sql/compression.sql b/src/test/regress/sql/compression.sql
index 86332dcc510f..ab75df45922f 100644
--- a/src/test/regress/sql/compression.sql
+++ b/src/test/regress/sql/compression.sql
@@ -48,7 +48,7 @@ CREATE TABLE cmmove2(f1 text COMPRESSION pglz);
 
 -- test externally stored compressed data
 CREATE OR REPLACE FUNCTION large_val() RETURNS TEXT LANGUAGE SQL AS
-'select array_agg(md5(g::text))::text from generate_series(1, 256) g';
+$$ select array_agg(encode(sha256(g::text::bytea),'hex'))::text from generate_series(1, 128) g $$;
 CREATE TABLE cmdata2 (f1 text COMPRESSION pglz);
 INSERT INTO cmdata2 SELECT large_val() || repeat('a', 4000);
 SELECT pg_column_compression(f1) FROM cmdata2;
@@ -135,8 +135,8 @@ CREATE TABLE cminh(f1 TEXT COMPRESSION lz4) INHERITS(cmdata);
 DROP TABLE cmdata2;
 CREATE TABLE cmdata2 (f1 TEXT COMPRESSION pglz, f2 TEXT COMPRESSION lz4);
 CREATE UNIQUE INDEX idx1 ON cmdata2 ((f1 || f2));
-INSERT INTO cmdata2 VALUES((SELECT array_agg(md5(g::TEXT))::TEXT FROM
-generate_series(1, 50) g), VERSION());
+INSERT INTO cmdata2 VALUES((SELECT array_agg(encode(sha256(g::TEXT::BYTEA), 'hex'))::TEXT FROM
+generate_series(1, 25) g), VERSION());
 
 -- check data is ok
 SELECT length(f1) FROM cmdata;
diff --git a/src/test/regress/sql/inherit.sql b/src/test/regress/sql/inherit.sql
index 195aedb5ff5e..6c15686d5236 100644
--- a/src/test/regress/sql/inherit.sql
+++ b/src/test/regress/sql/inherit.sql
@@ -882,7 +882,7 @@ CREATE TABLE test_foreign_constraints_inh () INHERITS (test_foreign_constraints)
 alter table permtest_parent attach partition permtest_child for values in (1);
 create index on permtest_parent (left(c, 3));
 insert into permtest_parent
-  select 1, 'a', left(md5(i::text), 5) from generate_series(0, 100) i;
+  select 1, 'a', left(encode(sha256(i::text::bytea), 'hex'), 5) from generate_series(0, 100) i;
 analyze permtest_parent;
 create role regress_no_child_access;
 revoke all on permtest_grandchild from regress_no_child_access;
diff --git a/src/test/regress/sql/largeobject.sql b/src/test/regress/sql/largeobject.sql
index 15e0dff7a3e8..207a7d343b6e 100644
--- a/src/test/regress/sql/largeobject.sql
+++ b/src/test/regress/sql/largeobject.sql
@@ -244,7 +244,7 @@ CREATE TABLE lotest_stash_values (loid oid, fd integer);
 SELECT lo_from_bytea(0, lo_get(:newloid_1)) AS newloid_2
 \gset
 
-SELECT md5(lo_get(:newloid_1)) = md5(lo_get(:newloid_2));
+SELECT sha256(lo_get(:newloid_1)) = sha256(lo_get(:newloid_2));
 
 SELECT lo_get(:newloid_1, 0, 20);
 SELECT lo_get(:newloid_1, 10, 20);
diff --git a/src/test/regress/sql/matview.sql b/src/test/regress/sql/matview.sql
index 68b9ccfd4529..09c55ec98dda 100644
--- a/src/test/regress/sql/matview.sql
+++ b/src/test/regress/sql/matview.sql
@@ -216,10 +216,10 @@ CREATE ROLE regress_user_mvtest;
 -- duplicate all the aliases used in those queries
 CREATE TABLE mvtest_foo_data AS SELECT i,
   i+1 AS tid,
-  md5(random()::text) AS mv,
-  md5(random()::text) AS newdata,
-  md5(random()::text) AS newdata2,
-  md5(random()::text) AS diff
+  sha256(random()::text::bytea) AS mv,
+  sha256(random()::text::bytea) AS newdata,
+  sha256(random()::text::bytea) AS newdata2,
+  sha256(random()::text::bytea) AS diff
   FROM generate_series(1, 10) i;
 CREATE MATERIALIZED VIEW mvtest_mv_foo AS SELECT * FROM mvtest_foo_data;
 CREATE MATERIALIZED VIEW mvtest_mv_foo AS SELECT * FROM mvtest_foo_data;
diff --git a/src/test/regress/sql/memoize.sql b/src/test/regress/sql/memoize.sql
index 0979bcdf768c..697b883b3da0 100644
--- a/src/test/regress/sql/memoize.sql
+++ b/src/test/regress/sql/memoize.sql
@@ -89,7 +89,7 @@ CREATE INDEX flt_f_idx ON flt (f);
 CREATE TABLE strtest (n name, t text);
 CREATE INDEX strtest_n_idx ON strtest (n);
 CREATE INDEX strtest_t_idx ON strtest (t);
-INSERT INTO strtest VALUES('one','one'),('two','two'),('three',repeat(md5('three'),100));
+INSERT INTO strtest VALUES('one','one'),('two','two'),('three',repeat(encode(sha256('three'),'hex'),50));
 -- duplicate rows so we get some cache hits
 INSERT INTO strtest SELECT * FROM strtest;
 ANALYZE strtest;
diff --git a/src/test/regress/sql/plpgsql.sql b/src/test/regress/sql/plpgsql.sql
index 588c33103373..b02e89ccd724 100644
--- a/src/test/regress/sql/plpgsql.sql
+++ b/src/test/regress/sql/plpgsql.sql
@@ -2877,7 +2877,7 @@ CREATE FUNCTION reraise_test() RETURNS void AS $$
 
 create or replace function ret_query2(lim int) returns setof record_type as $$
 begin
-    return query select md5(s.x::text), s.x, s.x > 0
+    return query select encode(sha256(s.x::text::bytea), 'hex'), s.x, s.x > 0
                  from generate_series(-8, lim) s (x) where s.x % 2 = 0;
 end;
 $$ language plpgsql;
diff --git a/src/test/regress/sql/rowsecurity.sql b/src/test/regress/sql/rowsecurity.sql
index febf3cc4cf10..f0fb49a2e01a 100644
--- a/src/test/regress/sql/rowsecurity.sql
+++ b/src/test/regress/sql/rowsecurity.sql
@@ -534,10 +534,10 @@ CREATE POLICY r2 ON rec2 USING (a = (SELECT x FROM rec1v WHERE y = b));
 --
 SET SESSION AUTHORIZATION regress_rls_alice;
 CREATE TABLE s1 (a int, b text);
-INSERT INTO s1 (SELECT x, md5(x::text) FROM generate_series(-10,10) x);
+INSERT INTO s1 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(-10,10) x);
 
 CREATE TABLE s2 (x int, y text);
-INSERT INTO s2 (SELECT x, md5(x::text) FROM generate_series(-6,6) x);
+INSERT INTO s2 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(-6,6) x);
 
 GRANT SELECT ON s1, s2 TO regress_rls_bob;
 
@@ -669,7 +669,7 @@ CREATE VIEW v2 AS SELECT * FROM s2 WHERE y like '%af%';
 --
 SET SESSION AUTHORIZATION regress_rls_alice;
 CREATE TABLE b1 (a int, b text);
-INSERT INTO b1 (SELECT x, md5(x::text) FROM generate_series(-10,10) x);
+INSERT INTO b1 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(-10,10) x);
 
 CREATE POLICY p1 ON b1 USING (a % 2 = 0);
 ALTER TABLE b1 ENABLE ROW LEVEL SECURITY;
@@ -1269,7 +1269,7 @@ CREATE VIEW rls_sbv WITH (security_barrier) AS
 -- Expression structure
 --
 SET SESSION AUTHORIZATION regress_rls_alice;
-INSERT INTO y2 (SELECT x, md5(x::text) FROM generate_series(0,20) x);
+INSERT INTO y2 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(0,20) x);
 CREATE POLICY p2 ON y2 USING (a % 3 = 0);
 CREATE POLICY p3 ON y2 USING (a % 4 = 0);
 
@@ -1341,7 +1341,7 @@ CREATE POLICY p1 ON t1 USING (a % 2 = 0);
 
 GRANT ALL ON t1 TO regress_rls_bob;
 
-INSERT INTO t1 (SELECT x, md5(x::text) FROM generate_series(0,20) x);
+INSERT INTO t1 (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(0,20) x);
 
 SET SESSION AUTHORIZATION regress_rls_bob;
 
@@ -1473,7 +1473,7 @@ CREATE POLICY p1 ON copy_t USING (a % 2 = 0);
 
 GRANT ALL ON copy_t TO regress_rls_bob, regress_rls_exempt_user;
 
-INSERT INTO copy_t (SELECT x, md5(x::text) FROM generate_series(0,10) x);
+INSERT INTO copy_t (SELECT x, encode(sha256(x::text::bytea), 'hex') FROM generate_series(0,10) x);
 
 -- Check COPY TO as Superuser/owner.
 RESET SESSION AUTHORIZATION;
@@ -1513,7 +1513,7 @@ CREATE POLICY p1 ON copy_rel_to USING (a % 2 = 0);
 
 GRANT ALL ON copy_rel_to TO regress_rls_bob, regress_rls_exempt_user;
 
-INSERT INTO copy_rel_to VALUES (1, md5('1'));
+INSERT INTO copy_rel_to VALUES (1, encode(sha256('1'), 'hex'));
 
 -- Check COPY TO as Superuser/owner.
 RESET SESSION AUTHORIZATION;
diff --git a/src/test/ssl/t/001_ssltests.pl b/src/test/ssl/t/001_ssltests.pl
index efe5634fff26..0de7a517ab34 100644
--- a/src/test/ssl/t/001_ssltests.pl
+++ b/src/test/ssl/t/001_ssltests.pl
@@ -13,6 +13,7 @@
 
 use SSL::Server;
 
+plan skip_all => 'TODO FIPS';
 if ($ENV{with_ssl} ne 'openssl')
 {
 	plan skip_all => 'OpenSSL not supported by this build';
diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl
index deaa4aa08658..4f3f55c3a7aa 100644
--- a/src/test/ssl/t/002_scram.pl
+++ b/src/test/ssl/t/002_scram.pl
@@ -102,12 +102,13 @@ sub switch_server_cert
 }
 
 # Now test when the user has an MD5-encrypted password; should fail
-$node->connect_fails(
-	"$common_connstr user=md5testuser channel_binding=require",
-	"MD5 with SSL and channel_binding=require",
-	expected_stderr =>
-	  qr/channel binding required but not supported by server's authentication request/
-);
+# FIXME FIPS
+#$node->connect_fails(
+#	"$common_connstr user=md5testuser channel_binding=require",
+#	"MD5 with SSL and channel_binding=require",
+#	expected_stderr =>
+#	  qr/channel binding required but not supported by server's authentication request/
+#);
 
 # Now test with auth method 'cert' by connecting to 'certdb'. Should fail,
 # because channel binding is not performed.  Note that ssl/client.key may
diff --git a/src/test/subscription/t/008_diff_schema.pl b/src/test/subscription/t/008_diff_schema.pl
index b4d44a200bb6..1ac7f03e6cdc 100644
--- a/src/test/subscription/t/008_diff_schema.pl
+++ b/src/test/subscription/t/008_diff_schema.pl
@@ -48,7 +48,7 @@
 
 # Update the rows on the publisher and check the additional columns on
 # subscriber didn't change
-$node_publisher->safe_psql('postgres', "UPDATE test_tab SET b = md5(b)");
+$node_publisher->safe_psql('postgres', "UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex')");
 
 $node_publisher->wait_for_catchup('tap_sub');
 
@@ -65,7 +65,7 @@
 	"UPDATE test_tab SET c = 'epoch'::timestamptz + 987654321 * interval '1s'"
 );
 $node_publisher->safe_psql('postgres',
-	"UPDATE test_tab SET b = md5(a::text)");
+	"UPDATE test_tab SET b = encode(sha256(a::text::bytea), 'hex')");
 
 $node_publisher->wait_for_catchup('tap_sub');
 
diff --git a/src/test/subscription/t/015_stream.pl b/src/test/subscription/t/015_stream.pl
index cbaa327e441d..81d0c80548c2 100644
--- a/src/test/subscription/t/015_stream.pl
+++ b/src/test/subscription/t/015_stream.pl
@@ -60,8 +60,8 @@
 
 $in .= q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3, 5000) s(i);
-UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3, 5000) s(i);
+UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 DELETE FROM test_tab WHERE mod(a,3) = 0;
 };
 $h->pump_nb;
@@ -69,7 +69,7 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(5001, 9999) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(5001, 9999) s(i);
 DELETE FROM test_tab WHERE a > 5000;
 COMMIT;
 });
@@ -95,8 +95,8 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(5001, 10000) s(i);
-UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(5001, 10000) s(i);
+UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 DELETE FROM test_tab WHERE mod(a,3) = 0;
 COMMIT;
 });
@@ -116,7 +116,7 @@
 	"UPDATE test_tab SET c = 'epoch'::timestamptz + 987654321 * interval '1s'"
 );
 $node_publisher->safe_psql('postgres',
-	"UPDATE test_tab SET b = md5(a::text)");
+	"UPDATE test_tab SET b = encode(sha256(a::text::bytea), 'hex')");
 
 $node_publisher->wait_for_catchup($appname);
 
diff --git a/src/test/subscription/t/016_stream_subxact.pl b/src/test/subscription/t/016_stream_subxact.pl
index bc0a9cd0531a..a14b2e83909c 100644
--- a/src/test/subscription/t/016_stream_subxact.pl
+++ b/src/test/subscription/t/016_stream_subxact.pl
@@ -53,24 +53,24 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(    3,  500) s(i);
-UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(    3,  500) s(i);
+UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 DELETE FROM test_tab WHERE mod(a,3) = 0;
 SAVEPOINT s1;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(501,  1000) s(i);
-UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(501,  1000) s(i);
+UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 DELETE FROM test_tab WHERE mod(a,3) = 0;
 SAVEPOINT s2;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(1001,  1500) s(i);
-UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(1001,  1500) s(i);
+UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 DELETE FROM test_tab WHERE mod(a,3) = 0;
 SAVEPOINT s3;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(1501,  2000) s(i);
-UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(1501,  2000) s(i);
+UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 DELETE FROM test_tab WHERE mod(a,3) = 0;
 SAVEPOINT s4;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(2001, 2500) s(i);
-UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(2001, 2500) s(i);
+UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 DELETE FROM test_tab WHERE mod(a,3) = 0;
 COMMIT;
 });
diff --git a/src/test/subscription/t/017_stream_ddl.pl b/src/test/subscription/t/017_stream_ddl.pl
index 866f1512e47b..57f1492985c8 100644
--- a/src/test/subscription/t/017_stream_ddl.pl
+++ b/src/test/subscription/t/017_stream_ddl.pl
@@ -53,10 +53,10 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab VALUES (3, md5(3::text));
+INSERT INTO test_tab VALUES (3, encode(sha256(3::text::bytea), 'hex'));
 ALTER TABLE test_tab ADD COLUMN c INT;
 SAVEPOINT s1;
-INSERT INTO test_tab VALUES (4, md5(4::text), -4);
+INSERT INTO test_tab VALUES (4, encode(sha256(4::text::bytea), 'hex'), -4);
 COMMIT;
 });
 
@@ -64,10 +64,10 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text), -i FROM generate_series(5, 1000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex'), -i FROM generate_series(5, 1000) s(i);
 ALTER TABLE test_tab ADD COLUMN d INT;
 SAVEPOINT s1;
-INSERT INTO test_tab SELECT i, md5(i::text), -i, 2*i FROM generate_series(1001, 2000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex'), -i, 2*i FROM generate_series(1001, 2000) s(i);
 COMMIT;
 });
 
@@ -75,10 +75,10 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab VALUES (2001, md5(2001::text), -2001, 2*2001);
+INSERT INTO test_tab VALUES (2001, encode(sha256(2001::text::bytea), 'hex'), -2001, 2*2001);
 ALTER TABLE test_tab ADD COLUMN e INT;
 SAVEPOINT s1;
-INSERT INTO test_tab VALUES (2002, md5(2002::text), -2002, 2*2002, -3*2002);
+INSERT INTO test_tab VALUES (2002, encode(sha256(2002::text::bytea), 'hex'), -2002, 2*2002, -3*2002);
 COMMIT;
 });
 
@@ -97,7 +97,7 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text), -i, 2*i, -3*i FROM generate_series(2003,5000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex'), -i, 2*i, -3*i FROM generate_series(2003,5000) s(i);
 ALTER TABLE test_tab ADD COLUMN f INT;
 COMMIT;
 });
@@ -107,7 +107,7 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text), -i, 2*i, -3*i, 4*i FROM generate_series(5001,5005) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex'), -i, 2*i, -3*i, 4*i FROM generate_series(5001,5005) s(i);
 COMMIT;
 });
 
diff --git a/src/test/subscription/t/018_stream_subxact_abort.pl b/src/test/subscription/t/018_stream_subxact_abort.pl
index 551f16df6ddb..9df8aed15a0d 100644
--- a/src/test/subscription/t/018_stream_subxact_abort.pl
+++ b/src/test/subscription/t/018_stream_subxact_abort.pl
@@ -52,21 +52,21 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3,500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3,500) s(i);
 SAVEPOINT s1;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(501,1000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(501,1000) s(i);
 SAVEPOINT s2;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(1001,1500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(1001,1500) s(i);
 SAVEPOINT s3;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(1501,2000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(1501,2000) s(i);
 ROLLBACK TO s2;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(2001,2500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(2001,2500) s(i);
 ROLLBACK TO s1;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(2501,3000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(2501,3000) s(i);
 SAVEPOINT s4;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3001,3500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3001,3500) s(i);
 SAVEPOINT s5;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3501,4000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3501,4000) s(i);
 COMMIT;
 });
 
@@ -84,15 +84,15 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(4001,4500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(4001,4500) s(i);
 SAVEPOINT s1;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(5001,5500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(5001,5500) s(i);
 SAVEPOINT s2;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(6001,6500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(6001,6500) s(i);
 SAVEPOINT s3;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(7001,7500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(7001,7500) s(i);
 RELEASE s2;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(8001,8500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(8001,8500) s(i);
 ROLLBACK TO s1;
 COMMIT;
 });
@@ -109,11 +109,11 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(8501,9000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(8501,9000) s(i);
 SAVEPOINT s1;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(9001,9500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(9001,9500) s(i);
 SAVEPOINT s2;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(9501,10000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(9501,10000) s(i);
 ROLLBACK;
 });
 
diff --git a/src/test/subscription/t/019_stream_subxact_ddl_abort.pl b/src/test/subscription/t/019_stream_subxact_ddl_abort.pl
index 4d7da82b7a80..aee3a6672e48 100644
--- a/src/test/subscription/t/019_stream_subxact_ddl_abort.pl
+++ b/src/test/subscription/t/019_stream_subxact_ddl_abort.pl
@@ -53,19 +53,19 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 BEGIN;
-INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3,500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3,500) s(i);
 ALTER TABLE test_tab ADD COLUMN c INT;
 SAVEPOINT s1;
-INSERT INTO test_tab SELECT i, md5(i::text), -i FROM generate_series(501,1000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex'), -i FROM generate_series(501,1000) s(i);
 ALTER TABLE test_tab ADD COLUMN d INT;
 SAVEPOINT s2;
-INSERT INTO test_tab SELECT i, md5(i::text), -i, 2*i FROM generate_series(1001,1500) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex'), -i, 2*i FROM generate_series(1001,1500) s(i);
 ALTER TABLE test_tab ADD COLUMN e INT;
 SAVEPOINT s3;
-INSERT INTO test_tab SELECT i, md5(i::text), -i, 2*i, -3*i FROM generate_series(1501,2000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex'), -i, 2*i, -3*i FROM generate_series(1501,2000) s(i);
 ALTER TABLE test_tab DROP COLUMN c;
 ROLLBACK TO s1;
-INSERT INTO test_tab SELECT i, md5(i::text), i FROM generate_series(501,1000) s(i);
+INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex'), i FROM generate_series(501,1000) s(i);
 COMMIT;
 });
 
diff --git a/src/test/subscription/t/022_twophase_cascade.pl b/src/test/subscription/t/022_twophase_cascade.pl
index 7a797f37bad2..b74920d02ada 100644
--- a/src/test/subscription/t/022_twophase_cascade.pl
+++ b/src/test/subscription/t/022_twophase_cascade.pl
@@ -306,8 +306,8 @@
 $node_A->safe_psql(
 	'postgres', q{
 	BEGIN;
-	INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3, 5000) s(i);
-	UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+	INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3, 5000) s(i);
+	UPDATE test_tab SET b =  encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 	DELETE FROM test_tab WHERE mod(a,3) = 0;
 	PREPARE TRANSACTION 'test_prepared_tab';});
 
@@ -369,8 +369,8 @@
 	BEGIN;
 	INSERT INTO test_tab VALUES (9999, 'foobar');
 	SAVEPOINT sp_inner;
-	INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3, 5000) s(i);
-	UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+	INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3, 5000) s(i);
+	UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 	DELETE FROM test_tab WHERE mod(a,3) = 0;
 	ROLLBACK TO SAVEPOINT sp_inner;
 	PREPARE TRANSACTION 'outer';
diff --git a/src/test/subscription/t/023_twophase_stream.pl b/src/test/subscription/t/023_twophase_stream.pl
index 9b454106bdf3..da4d0638e9b6 100644
--- a/src/test/subscription/t/023_twophase_stream.pl
+++ b/src/test/subscription/t/023_twophase_stream.pl
@@ -84,8 +84,8 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 	BEGIN;
-	INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3, 5000) s(i);
-	UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+	INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3, 5000) s(i);
+	UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 	DELETE FROM test_tab WHERE mod(a,3) = 0;
 	PREPARE TRANSACTION 'test_prepared_tab';});
 
@@ -128,8 +128,8 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 	BEGIN;
-	INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3, 5000) s(i);
-	UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+	INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3, 5000) s(i);
+	UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 	DELETE FROM test_tab WHERE mod(a,3) = 0;
 	PREPARE TRANSACTION 'test_prepared_tab';});
 
@@ -169,8 +169,8 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 	BEGIN;
-	INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3, 5000) s(i);
-	UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+	INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3, 5000) s(i);
+	UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 	DELETE FROM test_tab WHERE mod(a,3) = 0;
 	PREPARE TRANSACTION 'test_prepared_tab';});
 
@@ -210,8 +210,8 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 	BEGIN;
-	INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3, 5000) s(i);
-	UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+	INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3, 5000) s(i);
+	UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 	DELETE FROM test_tab WHERE mod(a,3) = 0;
 	PREPARE TRANSACTION 'test_prepared_tab';});
 
@@ -261,8 +261,8 @@
 $node_publisher->safe_psql(
 	'postgres', q{
 	BEGIN;
-	INSERT INTO test_tab SELECT i, md5(i::text) FROM generate_series(3, 5000) s(i);
-	UPDATE test_tab SET b = md5(b) WHERE mod(a,2) = 0;
+	INSERT INTO test_tab SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(3, 5000) s(i);
+	UPDATE test_tab SET b = encode(sha256(b::bytea), 'hex') WHERE mod(a,2) = 0;
 	DELETE FROM test_tab WHERE mod(a,3) = 0;
 	PREPARE TRANSACTION 'test_prepared_tab';});
 
diff --git a/src/test/subscription/t/029_on_error.pl b/src/test/subscription/t/029_on_error.pl
index 1bd18a62cd80..9b78b1c7eee8 100644
--- a/src/test/subscription/t/029_on_error.pl
+++ b/src/test/subscription/t/029_on_error.pl
@@ -163,10 +163,10 @@ sub test_skip_lsn
 	'postgres',
 	qq[
 BEGIN;
-INSERT INTO tbl SELECT i, md5(i::text) FROM generate_series(1, 10000) s(i);
+INSERT INTO tbl SELECT i, encode(sha256(i::text::bytea), 'hex') FROM generate_series(1, 10000) s(i);
 COMMIT;
 ]);
-test_skip_lsn($node_publisher, $node_subscriber, "(4, md5(4::text))",
+test_skip_lsn($node_publisher, $node_subscriber, "(4, encode(sha256(4::text::bytea), 'hex'))",
 	"4", "test skipping stream-commit");
 
 $result = $node_subscriber->safe_psql('postgres',
-- 
2.37.3

---

From: Peter Eisentraut <[email-masked]>
Date: Tue, 11 Oct 2022 13:51:50 +0200

> the md5() function itself.  I think we can conditionalize these somehow. 

Let's make a small start on this.  The attached patch moves the tests of 
the md5() function to a separate test file.  That would ultimately make 
it easier to maintain a variant expected file for FIPS mode where that 
function will fail (similar to how we have done it for the pgcrypto tests).
From 78b6032444ca7db540a82ab72637c3571afbae82 Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <[email-masked]>
Date: Tue, 11 Oct 2022 10:33:30 +0200
Subject: [PATCH] Put tests of md5() function into separate test file

In FIPS mode, these calls will fail.  By having them in a separate
file, it would make it easier to have an alternative output file or
selectively disable these tests.  This isn't done here; this is just
some preparation.
---
 src/test/regress/expected/md5.out     | 91 +++++++++++++++++++++++++++
 src/test/regress/expected/strings.out | 88 --------------------------
 src/test/regress/parallel_schedule    |  2 +-
 src/test/regress/sql/md5.sql          | 36 +++++++++++
 src/test/regress/sql/strings.sql      | 32 ----------
 5 files changed, 128 insertions(+), 121 deletions(-)
 create mode 100644 src/test/regress/expected/md5.out
 create mode 100644 src/test/regress/sql/md5.sql

diff --git a/src/test/regress/expected/md5.out b/src/test/regress/expected/md5.out
new file mode 100644
index 000000000000..c5dd801cef2d
--- /dev/null
+++ b/src/test/regress/expected/md5.out
@@ -0,0 +1,91 @@
+--
+-- MD5 test suite - from IETF RFC 1321
+-- (see: https://www.rfc-editor.org/rfc/rfc1321)
+--
+-- (The md5() function will error in OpenSSL FIPS mode.  By keeping
+-- this test in a separate file, it is easier to manage variant
+-- results.)
+select md5('') = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('a') = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('abc') = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('message digest') = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('abcdefghijklmnopqrstuvwxyz') = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789') = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890') = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5(''::bytea) = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('a'::bytea) = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('abc'::bytea) = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('message digest'::bytea) = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('abcdefghijklmnopqrstuvwxyz'::bytea) = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'::bytea) = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
+select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890'::bytea) = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
+ TRUE 
+------
+ t
+(1 row)
+
diff --git a/src/test/regress/expected/strings.out b/src/test/regress/expected/strings.out
index 0f95b9400b69..69d7ed4ef1cf 100644
--- a/src/test/regress/expected/strings.out
+++ b/src/test/regress/expected/strings.out
@@ -2118,94 +2118,6 @@ select to_hex(256::bigint*256::bigint*256::bigint*256::bigint - 1) AS "ffffffff"
  ffffffff
 (1 row)
 
---
--- MD5 test suite - from IETF RFC 1321
--- (see: ftp://ftp.rfc-editor.org/in-notes/rfc1321.txt)
---
-select md5('') = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('a') = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('abc') = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('message digest') = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('abcdefghijklmnopqrstuvwxyz') = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789') = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890') = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5(''::bytea) = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('a'::bytea) = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('abc'::bytea) = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('message digest'::bytea) = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('abcdefghijklmnopqrstuvwxyz'::bytea) = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'::bytea) = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
-select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890'::bytea) = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
- TRUE 
-------
- t
-(1 row)
-
 --
 -- SHA-2
 --
diff --git a/src/test/regress/parallel_schedule b/src/test/regress/parallel_schedule
index 9f644a0c1b2c..9a139f1e2487 100644
--- a/src/test/regress/parallel_schedule
+++ b/src/test/regress/parallel_schedule
@@ -26,7 +26,7 @@ test: boolean char name varchar text int2 int4 int8 oid float4 float8 bit numeri
 # multirangetypes depends on rangetypes
 # multirangetypes shouldn't run concurrently with type_sanity
 # ----------
-test: strings numerology point lseg line box path polygon circle date time timetz timestamp timestamptz interval inet macaddr macaddr8 multirangetypes
+test: strings md5 numerology point lseg line box path polygon circle date time timetz timestamp timestamptz interval inet macaddr macaddr8 multirangetypes
 
 # ----------
 # Another group of parallel tests
diff --git a/src/test/regress/sql/md5.sql b/src/test/regress/sql/md5.sql
new file mode 100644
index 000000000000..fff101f57517
--- /dev/null
+++ b/src/test/regress/sql/md5.sql
@@ -0,0 +1,36 @@
+--
+-- MD5 test suite - from IETF RFC 1321
+-- (see: https://www.rfc-editor.org/rfc/rfc1321)
+--
+
+-- (The md5() function will error in OpenSSL FIPS mode.  By keeping
+-- this test in a separate file, it is easier to manage variant
+-- results.)
+
+select md5('') = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
+
+select md5('a') = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
+
+select md5('abc') = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
+
+select md5('message digest') = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
+
+select md5('abcdefghijklmnopqrstuvwxyz') = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
+
+select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789') = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
+
+select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890') = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
+
+select md5(''::bytea) = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
+
+select md5('a'::bytea) = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
+
+select md5('abc'::bytea) = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
+
+select md5('message digest'::bytea) = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
+
+select md5('abcdefghijklmnopqrstuvwxyz'::bytea) = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
+
+select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'::bytea) = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
+
+select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890'::bytea) = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
diff --git a/src/test/regress/sql/strings.sql b/src/test/regress/sql/strings.sql
index 8c379182cb9d..04109f599dda 100644
--- a/src/test/regress/sql/strings.sql
+++ b/src/test/regress/sql/strings.sql
@@ -685,38 +685,6 @@ CREATE TABLE toasttest (c char(4096));
 
 select to_hex(256::bigint*256::bigint*256::bigint*256::bigint - 1) AS "ffffffff";
 
---
--- MD5 test suite - from IETF RFC 1321
--- (see: ftp://ftp.rfc-editor.org/in-notes/rfc1321.txt)
---
-select md5('') = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
-
-select md5('a') = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
-
-select md5('abc') = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
-
-select md5('message digest') = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
-
-select md5('abcdefghijklmnopqrstuvwxyz') = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
-
-select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789') = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
-
-select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890') = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
-
-select md5(''::bytea) = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
-
-select md5('a'::bytea) = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
-
-select md5('abc'::bytea) = '900150983cd24fb0d6963f7d28e17f72' AS "TRUE";
-
-select md5('message digest'::bytea) = 'f96b697d7cb7938d525a2f31aaf161d0' AS "TRUE";
-
-select md5('abcdefghijklmnopqrstuvwxyz'::bytea) = 'c3fcd3d76192e4007dfb496cca67e13b' AS "TRUE";
-
-select md5('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'::bytea) = 'd174ab98d277d9f5a5611c2c9f419d9f' AS "TRUE";
-
-select md5('12345678901234567890123456789012345678901234567890123456789012345678901234567890'::bytea) = '57edf4a22be3c955ac49da2e2107b67a' AS "TRUE";
-
 --
 -- SHA-2
 --
-- 
2.37.3

---

From: Michael Paquier <[email-masked]>
Date: Wed, 12 Oct 2022 10:18:50 +0900

On Tue, Oct 11, 2022 at 01:51:50PM +0200, Peter Eisentraut wrote:
> Let's make a small start on this.  The attached patch moves the tests of the
> md5() function to a separate test file.  That would ultimately make it
> easier to maintain a variant expected file for FIPS mode where that function
> will fail (similar to how we have done it for the pgcrypto tests).

Makes sense to me.  This slice looks fine.

I think that the other md5() computations done in the main regression
test suite could just be switched to use one of the sha*() functions
as they just want to put their hands on text values.  It looks like a
few of them have some expections with the output size and
generate_series(), though, but this could be tweaked by making the
series shorter, for example.
--
Michael

---

From: Peter Eisentraut <[email-masked]>
Date: Thu, 13 Oct 2022 12:26:32 +0200

> Makes sense to me.  This slice looks fine.

Committed.

> series shorter, for example.

Right, that's the rest of my original patch.  I'll come back with an 
updated version of that.

---

From: Alvaro Herrera <[email-masked]>
Date: Thu, 13 Oct 2022 13:16:18 +0200

On 2022-Oct-13, Peter Eisentraut wrote:

> Right, that's the rest of my original patch.  I'll come back with an updated
> version of that.

However, there are some changes in brin_multi.out that are quite
surprising and suggest that we might have bugs in brin:

-- 
Álvaro Herrera        Breisgau, Deutschland  —  https://www.EnterpriseDB.com/
"La victoria es para quien se atreve a estar solo"

---

From: Peter Eisentraut <[email-masked]>
Date: Wed, 7 Dec 2022 15:14:09 +0100

> Right, that's the rest of my original patch.  I'll come back with an 

Here is the next step.  To contain the scope, I focused on just "make 
check" for now.  This patch removes all incidental calls to md5(), 
replacing them with sha256(), so that they'd pass with or without FIPS 
mode.  (Two tests would need alternative expected files: md5 and 
password.  I have not included those here.)

Some tests inspect the actual md5 result strings or build statistics 
based on them.  I have tried to carefully preserve the meaning of the 
original tests, to the extent that they could be inferred, in some cases 
adjusting example values by matching the md5 outputs to the equivalent 
sha256 outputs.  Some cases are tricky or mysterious or both and could 
use another look.
From 437c7c8b62b5574b017a5d05b5540e219abd6c4a Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <[email-masked]>
Date: Wed, 7 Dec 2022 13:32:26 +0100
Subject: [PATCH] Remove incidental md5() function uses from main regression
 tests

Most of these calls were to generate some random data.  These can be
replaced by appropriately adapted sha256() calls.

This will eventually allow these tests to pass in OpenSSL FIPS mode
(which does not allow MD5 use).

Similar work for other test suites will follow later.
---
 src/test/regress/expected/arrays.out        |  18 +-
 src/test/regress/expected/brin.out          |   4 +-
 src/test/regress/expected/brin_multi.out    |   8 +-
 src/test/regress/expected/compression.out   |  13 +-
 src/test/regress/expected/compression_1.out |  11 +-
 src/test/regress/expected/inherit.out       |   2 +-
 src/test/regress/expected/largeobject.out   |   2 +-
 src/test/regress/expected/matview.out       |   8 +-
 src/test/regress/expected/memoize.out       |   2 +-
 src/test/regress/expected/plpgsql.out       |  24 +-
 src/test/regress/expected/rowsecurity.out   | 591 ++++++++++----------
 src/test/regress/expected/stats_ext.out     |  14 +-
 src/test/regress/sql/arrays.sql             |  18 +-
 src/test/regress/sql/brin.sql               |   4 +-
 src/test/regress/sql/brin_multi.sql         |   8 +-
 src/test/regress/sql/compression.sql        |   7 +-
 src/test/regress/sql/inherit.sql            |   2 +-
 src/test/regress/sql/largeobject.sql        |   2 +-
 src/test/regress/sql/matview.sql            |   8 +-
 src/test/regress/sql/memoize.sql            |   2 +-
 src/test/regress/sql/plpgsql.sql            |   2 +-
 src/test/regress/sql/rowsecurity.sql        |  14 +-
 src/test/regress/sql/stats_ext.sql          |  14 +-
 23 files changed, 386 insertions(+), 392 deletions(-)

diff --git a/src/test/regress/expected/arrays.out b/src/test/regress/expected/arrays.out
index 97920f38c2..ae269d4f50 100644
--- a/src/test/regress/expected/arrays.out
+++ b/src/test/regress/expected/arrays.out
@@ -2272,20 +2272,20 @@ select * from t1;
 (1 row)
 
 -- Check that arrays of composites are safely detoasted when needed
-create temp table src (f1 text);
+create temp table src (f1 bytea);
 insert into src
-  select string_agg(random()::text,'') from generate_series(1,10000);
-create type textandtext as (c1 text, c2 text);
-create temp table dest (f1 textandtext[]);
-insert into dest select array[row(f1,f1)::textandtext] from src;
-select length(md5((f1[1]).c2)) from dest;
+  select string_agg(random()::text::bytea,'') from generate_series(1,10000);
+create type byteaandbytea as (c1 bytea, c2 bytea);
+create temp table dest (f1 byteaandbytea[]);
+insert into dest select array[row(f1,f1)::byteaandbytea] from src;
+select length(sha256((f1[1]).c2)) from dest;
  length 
 --------
      32
 (1 row)
 
 delete from src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2)) from dest;
  length 
 --------
      32
@@ -2293,14 +2293,14 @@ select length(md5((f1[1]).c2)) from dest;
 
 truncate table src;
 drop table src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2)) from dest;
  length 
 --------
      32
 (1 row)
 
 drop table dest;
-drop type textandtext;
+drop type byteaandbytea;
 -- Tests for polymorphic-array form of width_bucket()
 -- this exercises the varwidth and float8 code paths
 SELECT
diff --git a/src/test/regress/expected/brin.out b/src/test/regress/expected/brin.out
index 73fa38396e..d4a139e50b 100644
--- a/src/test/regress/expected/brin.out
+++ b/src/test/regress/expected/brin.out
@@ -530,7 +530,7 @@ EXPLAIN (COSTS OFF) SELECT * FROM brin_test WHERE b = 1;
 CREATE TABLE brintest_3 (a text, b text, c text, d text);
 -- long random strings (~2000 chars each, so ~6kB for min/max on two
 -- columns) to trigger toasting
-WITH rand_value AS (SELECT string_agg(md5(i::text),'') AS val FROM generate_series(1,60) s(i))
+WITH rand_value AS (SELECT string_agg(encode(sha256(i::text::bytea),'hex'),'') AS val FROM generate_series(1,30) s(i))
 INSERT INTO brintest_3
 SELECT val, val, val, val FROM rand_value;
 CREATE INDEX brin_test_toast_idx ON brintest_3 USING brin (b, c);
@@ -545,7 +545,7 @@ VACUUM brintest_3;
 -- retry insert with a different random-looking (but deterministic) value
 -- the value is different, and so should replace either min or max in the
 -- brin summary
-WITH rand_value AS (SELECT string_agg(md5((-i)::text),'') AS val FROM generate_series(1,60) s(i))
+WITH rand_value AS (SELECT string_agg(encode(sha256((-i)::text::bytea),'hex'),'') AS val FROM generate_series(1,30) s(i))
 INSERT INTO brintest_3
 SELECT val, val, val, val FROM rand_value;
 -- now try some queries, accessing the brin index
diff --git a/src/test/regress/expected/brin_multi.out b/src/test/regress/expected/brin_multi.out
index f3309f433f..512629a257 100644
--- a/src/test/regress/expected/brin_multi.out
+++ b/src/test/regress/expected/brin_multi.out
@@ -29,7 +29,7 @@ INSERT INTO brintest_multi SELECT
 	(four + 1.0)/(hundred+1),
 	odd::float8 / (tenthous + 1),
 	format('%s:00:%s:00:%s:00', to_hex(odd), to_hex(even), to_hex(hundred))::macaddr,
-	substr(md5(unique1::text), 1, 16)::macaddr8,
+	substr(encode(sha256(unique1::text::bytea), 'hex'), 1, 16)::macaddr8,
 	inet '10.2.3.4/24' + tenthous,
 	cidr '10.2.3/24' + tenthous,
 	date '1995-08-15' + tenthous,
@@ -178,8 +178,8 @@ INSERT INTO brinopers_multi VALUES
 	 '{99, 100, 2, 100, 100}'),
 	('macaddr8col', 'macaddr8',
 	 '{>, >=, =, <=, <}',
-	 '{b1:d1:0e:7b:af:a4:42:12, d9:35:91:bd:f7:86:0e:1e, 72:8f:20:6c:2a:01:bf:57, 23:e8:46:63:86:07:ad:cb, 13:16:8e:6a:2e:6c:84:b4}',
-	 '{33, 15, 1, 13, 6}'),
+	 '{83:f8:14:f7:a9:2e:36:5c, fe:25:92:b4:2a:72:7e:97, 67:93:f9:e2:66:ce:6e:bd, 80:5c:94:a3:58:c1:d4:59, fd:24:28:59:bc:18:ff:bb}',
+	 '{47, 2, 1, 50, 97}'),
 	('inetcol', 'inet',
 	 '{=, <, <=, >, >=}',
 	 '{10.2.14.231/24, 255.255.255.255, 255.255.255.255, 0.0.0.0, 0.0.0.0}',
@@ -327,7 +327,7 @@ INSERT INTO brintest_multi SELECT
 	(four + 1.0)/(hundred+1),
 	odd::float8 / (tenthous + 1),
 	format('%s:00:%s:00:%s:00', to_hex(odd), to_hex(even), to_hex(hundred))::macaddr,
-	substr(md5(unique1::text), 1, 16)::macaddr8,
+	substr(encode(sha256(unique1::text::bytea), 'hex'), 1, 16)::macaddr8,
 	inet '10.2.3.4' + tenthous,
 	cidr '10.2.3/24' + tenthous,
 	date '1995-08-15' + tenthous,
diff --git a/src/test/regress/expected/compression.out b/src/test/regress/expected/compression.out
index 4c997e2602..747e942e6e 100644
--- a/src/test/regress/expected/compression.out
+++ b/src/test/regress/expected/compression.out
@@ -102,7 +102,7 @@ SELECT pg_column_compression(f1) FROM cmmove2;
 
+$$ select string_agg(encode(sha256(g::text::bytea), 'hex'), '') from generate_series(1, 132) g $$;
+ 7d4dd
 (2 rows)
 
+ 7d4dd
 (1 row)
 
 DROP TABLE cmdata2;
@@ -315,10 +315,9 @@ SELECT pg_column_compression(f1) FROM cmdata;
 
 -- test expression index
 DROP TABLE cmdata2;
-CREATE TABLE cmdata2 (f1 TEXT COMPRESSION pglz, f2 TEXT COMPRESSION lz4);
+CREATE TABLE cmdata2 (f1 text COMPRESSION pglz, f2 text COMPRESSION lz4);
 CREATE UNIQUE INDEX idx1 ON cmdata2 ((f1 || f2));
-INSERT INTO cmdata2 VALUES((SELECT array_agg(md5(g::TEXT))::TEXT FROM
-generate_series(1, 50) g), VERSION());
+INSERT INTO cmdata2 VALUES ((SELECT string_agg(encode(sha256(g::text::bytea), 'hex'), '') FROM generate_series(1, 13) g), version());
 -- check data is ok
 SELECT length(f1) FROM cmdata;
  length 
@@ -331,7 +330,7 @@ SELECT length(f1) FROM cmdata1;
  length 
 --------
   10040
-  12449
+  12448
 (2 rows)
 
 SELECT length(f1) FROM cmmove1;
diff --git a/src/test/regress/expected/compression_1.out b/src/test/regress/expected/compression_1.out
index c0a47646eb..6047c7e0ed 100644
--- a/src/test/regress/expected/compression_1.out
+++ b/src/test/regress/expected/compression_1.out
@@ -102,7 +102,7 @@ SELECT pg_column_compression(f1) FROM cmmove2;
 
 -- test externally stored compressed data
 CREATE OR REPLACE FUNCTION large_val() RETURNS TEXT LANGUAGE SQL AS
-'select array_agg(md5(g::text))::text from generate_series(1, 256) g';
+$$ select string_agg(encode(sha256(g::text::bytea), 'hex'), '') from generate_series(1, 132) g $$;
 CREATE TABLE cmdata2 (f1 text COMPRESSION pglz);
 INSERT INTO cmdata2 SELECT large_val() || repeat('a', 4000);
 SELECT pg_column_compression(f1) FROM cmdata2;
@@ -126,7 +126,7 @@ LINE 1: SELECT SUBSTR(f1, 200, 5) FROM cmdata1;
 SELECT SUBSTR(f1, 200, 5) FROM cmdata2;
  substr 
 --------
- 8f14e
+ 7d4dd
 (1 row)
 
 DROP TABLE cmdata2;
@@ -307,15 +307,14 @@ SELECT pg_column_compression(f1) FROM cmdata;
 
 -- test expression index
 DROP TABLE cmdata2;
-CREATE TABLE cmdata2 (f1 TEXT COMPRESSION pglz, f2 TEXT COMPRESSION lz4);
+CREATE TABLE cmdata2 (f1 text COMPRESSION pglz, f2 text COMPRESSION lz4);
 ERROR:  compression method lz4 not supported
 DETAIL:  This functionality requires the server to be built with lz4 support.
 ERROR:  relation "cmdata2" does not exist
+INSERT INTO cmdata2 VALUES ((SELECT string_agg(encode(sha256(g::text::bytea), 'hex'), '') FROM generate_series(1, 13) g), version());
 ERROR:  relation "cmdata2" does not exist
-LINE 1: INSERT INTO cmdata2 VALUES((SELECT array_agg(md5(g::TEXT))::...
+LINE 1: INSERT INTO cmdata2 VALUES ((SELECT string_agg(encode(sha256...
                     ^
index 2d49e765de..18509202a9 100644
index 31fba2ff9d..5e7b08244c 100644
index c109d97635..128215b835 100644
index de43afa76e..2e86a54fde 100644
index 08e42f17dc..87e515f3e6 100644
 
 -- test EXECUTE USING
index 31509a0a6f..b6986cf430 100644

 

 

 

 
 EXPLAIN (COSTS OFF)

 SELECT * FROM t2;
- a  |                b                 

 

 
index 03880874c1..41d2439388 100644
@@ -2615,18 +2615,18 @@ CREATE TABLE mcv_lists_uuid (
 WITH (autovacuum_enabled = off);
 INSERT INTO mcv_lists_uuid (a, b, c)
      SELECT
-         md5(mod(i,100)::text)::uuid,
-         md5(mod(i,50)::text)::uuid,
-         md5(mod(i,25)::text)::uuid
+         substr(encode(sha256(mod(i,100)::text::bytea), 'hex'), 1, 32)::uuid,
+         substr(encode(sha256(mod(i,50)::text::bytea), 'hex'), 1, 32)::uuid,
+         substr(encode(sha256(mod(i,25)::text::bytea), 'hex'), 1, 32)::uuid
-SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
+SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND b = ''e7f6c011-776e-8db7-cd33-0b54174fd76f''');
  estimated | actual 
 -----------+--------
          1 |     50
 (1 row)
 
-SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND c = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
+SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND b = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND c = ''e7f6c011-776e-8db7-cd33-0b54174fd76f''');
  estimated | actual 
 -----------+--------
          1 |     50
@@ -2635,13 +2635,13 @@ SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''167
 CREATE STATISTICS mcv_lists_uuid_stats (mcv) ON a, b, c
   FROM mcv_lists_uuid;
 ANALYZE mcv_lists_uuid;
-SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
+SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND b = ''e7f6c011-776e-8db7-cd33-0b54174fd76f''');
  estimated | actual 
 -----------+--------
         50 |     50
 (1 row)
 
-SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND c = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
+SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND b = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND c = ''e7f6c011-776e-8db7-cd33-0b54174fd76f''');
  estimated | actual 
 -----------+--------
         50 |     50
diff --git a/src/test/regress/sql/arrays.sql b/src/test/regress/sql/arrays.sql
index 791af5c0ce..2081accaad 100644
--- a/src/test/regress/sql/arrays.sql
+++ b/src/test/regress/sql/arrays.sql
@@ -665,20 +665,20 @@ CREATE TEMP TABLE arraggtest ( f1 INT[], f2 TEXT[][], f3 FLOAT[]);
 
 -- Check that arrays of composites are safely detoasted when needed
 
-create temp table src (f1 text);
+create temp table src (f1 bytea);
 insert into src
-  select string_agg(random()::text,'') from generate_series(1,10000);
-create type textandtext as (c1 text, c2 text);
-create temp table dest (f1 textandtext[]);
-insert into dest select array[row(f1,f1)::textandtext] from src;
-select length(md5((f1[1]).c2)) from dest;
+  select string_agg(random()::text::bytea,'') from generate_series(1,10000);
+create type byteaandbytea as (c1 bytea, c2 bytea);
+create temp table dest (f1 byteaandbytea[]);
+insert into dest select array[row(f1,f1)::byteaandbytea] from src;
+select length(sha256((f1[1]).c2)) from dest;
 delete from src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2)) from dest;
 truncate table src;
 drop table src;
-select length(md5((f1[1]).c2)) from dest;
+select length(sha256((f1[1]).c2)) from dest;
 drop table dest;
-drop type textandtext;
+drop type byteaandbytea;
 
 -- Tests for polymorphic-array form of width_bucket()
 
index e68e9e18df..7fa125315f 100644
 
+WITH rand_value AS (SELECT string_agg(encode(sha256(i::text::bytea),'hex'),'') AS val FROM generate_series(1,30) s(i))
 
+WITH rand_value AS (SELECT string_agg(encode(sha256((-i)::text::bytea),'hex'),'') AS val FROM generate_series(1,30) s(i))
 
diff --git a/src/test/regress/sql/brin_multi.sql b/src/test/regress/sql/brin_multi.sql
index 2189b6ccf4..0e26a8705e 100644
--- a/src/test/regress/sql/brin_multi.sql
+++ b/src/test/regress/sql/brin_multi.sql
@@ -30,7 +30,7 @@ CREATE TABLE brintest_multi (
 	(four + 1.0)/(hundred+1),
 	odd::float8 / (tenthous + 1),
 	format('%s:00:%s:00:%s:00', to_hex(odd), to_hex(even), to_hex(hundred))::macaddr,
-	substr(md5(unique1::text), 1, 16)::macaddr8,
+	substr(encode(sha256(unique1::text::bytea), 'hex'), 1, 16)::macaddr8,
 	inet '10.2.3.4/24' + tenthous,
 	cidr '10.2.3/24' + tenthous,
 	date '1995-08-15' + tenthous,
@@ -182,8 +182,8 @@ CREATE TABLE brinopers_multi (colname name, typ text,
 	 '{99, 100, 2, 100, 100}'),
 	('macaddr8col', 'macaddr8',
 	 '{>, >=, =, <=, <}',
-	 '{b1:d1:0e:7b:af:a4:42:12, d9:35:91:bd:f7:86:0e:1e, 72:8f:20:6c:2a:01:bf:57, 23:e8:46:63:86:07:ad:cb, 13:16:8e:6a:2e:6c:84:b4}',
-	 '{33, 15, 1, 13, 6}'),
+	 '{83:f8:14:f7:a9:2e:36:5c, fe:25:92:b4:2a:72:7e:97, 67:93:f9:e2:66:ce:6e:bd, 80:5c:94:a3:58:c1:d4:59, fd:24:28:59:bc:18:ff:bb}',
+	 '{47, 2, 1, 50, 97}'),
 	('inetcol', 'inet',
 	 '{=, <, <=, >, >=}',
 	 '{10.2.14.231/24, 255.255.255.255, 255.255.255.255, 0.0.0.0, 0.0.0.0}',
@@ -334,7 +334,7 @@ CREATE TABLE brinopers_multi (colname name, typ text,
 	(four + 1.0)/(hundred+1),
 	odd::float8 / (tenthous + 1),
 	format('%s:00:%s:00:%s:00', to_hex(odd), to_hex(even), to_hex(hundred))::macaddr,
-	substr(md5(unique1::text), 1, 16)::macaddr8,
+	substr(encode(sha256(unique1::text::bytea), 'hex'), 1, 16)::macaddr8,
 	inet '10.2.3.4' + tenthous,
 	cidr '10.2.3/24' + tenthous,
 	date '1995-08-15' + tenthous,
diff --git a/src/test/regress/sql/compression.sql b/src/test/regress/sql/compression.sql
index 86332dcc51..5a45bebad6 100644
--- a/src/test/regress/sql/compression.sql
+++ b/src/test/regress/sql/compression.sql
@@ -48,7 +48,7 @@ CREATE TABLE cmmove2(f1 text COMPRESSION pglz);
 
 -- test externally stored compressed data
 CREATE OR REPLACE FUNCTION large_val() RETURNS TEXT LANGUAGE SQL AS
-'select array_agg(md5(g::text))::text from generate_series(1, 256) g';
+$$ select string_agg(encode(sha256(g::text::bytea), 'hex'), '') from generate_series(1, 132) g $$;
 CREATE TABLE cmdata2 (f1 text COMPRESSION pglz);
 INSERT INTO cmdata2 SELECT large_val() || repeat('a', 4000);
 SELECT pg_column_compression(f1) FROM cmdata2;
@@ -133,10 +133,9 @@ CREATE TABLE cminh(f1 TEXT COMPRESSION lz4) INHERITS(cmdata);
 
 -- test expression index
 DROP TABLE cmdata2;
-CREATE TABLE cmdata2 (f1 TEXT COMPRESSION pglz, f2 TEXT COMPRESSION lz4);
+CREATE TABLE cmdata2 (f1 text COMPRESSION pglz, f2 text COMPRESSION lz4);
 CREATE UNIQUE INDEX idx1 ON cmdata2 ((f1 || f2));
-INSERT INTO cmdata2 VALUES((SELECT array_agg(md5(g::TEXT))::TEXT FROM
-generate_series(1, 50) g), VERSION());
+INSERT INTO cmdata2 VALUES ((SELECT string_agg(encode(sha256(g::text::bytea), 'hex'), '') FROM generate_series(1, 13) g), version());
 
 -- check data is ok
index 195aedb5ff..6c15686d52 100644
index 15e0dff7a3..207a7d343b 100644

index 68b9ccfd45..09c55ec98d 100644
index 17c5b4bfab..43fe2fc9df 100644
index 588c331033..b02e89ccd7 100644
 
index b38fa8ed8f..f2ba7b45b1 100644

 

 

 

 

 
 -- Check COPY TO as Superuser/owner.
 RESET SESSION AUTHORIZATION;
diff --git a/src/test/regress/sql/stats_ext.sql b/src/test/regress/sql/stats_ext.sql
index d0d42cd013..19527ed50f 100644
--- a/src/test/regress/sql/stats_ext.sql
+++ b/src/test/regress/sql/stats_ext.sql
@@ -1283,25 +1283,25 @@ CREATE TABLE mcv_lists_uuid (
 
 INSERT INTO mcv_lists_uuid (a, b, c)
      SELECT
-         md5(mod(i,100)::text)::uuid,
-         md5(mod(i,50)::text)::uuid,
-         md5(mod(i,25)::text)::uuid
+         substr(encode(sha256(mod(i,100)::text::bytea), 'hex'), 1, 32)::uuid,
+         substr(encode(sha256(mod(i,50)::text::bytea), 'hex'), 1, 32)::uuid,
+         substr(encode(sha256(mod(i,25)::text::bytea), 'hex'), 1, 32)::uuid
      FROM generate_series(1,5000) s(i);
 
 ANALYZE mcv_lists_uuid;
 
-SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
+SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND b = ''e7f6c011-776e-8db7-cd33-0b54174fd76f''');
 
-SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND c = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
+SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND b = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND c = ''e7f6c011-776e-8db7-cd33-0b54174fd76f''');
 
   FROM mcv_lists_uuid;
 
 ANALYZE mcv_lists_uuid;
 
-SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
+SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND b = ''e7f6c011-776e-8db7-cd33-0b54174fd76f''');
 
-SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND b = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc'' AND c = ''1679091c-5a88-0faf-6fb5-e6087eb1b2dc''');
+SELECT * FROM check_estimated_rows('SELECT * FROM mcv_lists_uuid WHERE a = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND b = ''e7f6c011-776e-8db7-cd33-0b54174fd76f'' AND c = ''e7f6c011-776e-8db7-cd33-0b54174fd76f''');

-- 
2.38.1

---

From: Michael Paquier <[email-masked]>
Date: Fri, 9 Dec 2022 13:16:08 +0900

On Wed, Dec 07, 2022 at 03:14:09PM +0100, Peter Eisentraut wrote:
> Here is the next step.  To contain the scope, I focused on just "make check"
> for now.  This patch removes all incidental calls to md5(), replacing them
> with sha256(), so that they'd pass with or without FIPS mode.  (Two tests
> would need alternative expected files: md5 and password.  I have not
> included those here.)

Yeah, fine by me to do that step-by-step.

> Some tests inspect the actual md5 result strings or build statistics based
> on them.  I have tried to carefully preserve the meaning of the original
> tests, to the extent that they could be inferred, in some cases adjusting
> example values by matching the md5 outputs to the equivalent sha256 outputs.
> Some cases are tricky or mysterious or both and could use another look.

incremental_sort mostly relies on the plan generated, so the change
should be rather straight-forward I guess, though there may be a side
effect depending on costing.  Hmm, it does not look like stats_ext
would be an issue as it checks the stats correlation of the attributes
for mcv_lists_arrays.

largeobject_1.out has been forgotten in the set requiring a refresh.
--
Michael

---

From: Tom Lane <[email-masked]>
Date: Sun, 14 Sep 2025 15:02:15 -0400

[ blast-from-the-past department ]

I wrote:
> Peter Eisentraut <[email-masked]> writes:
>> I suggest that if there are no other concerns, we proceed with the patch 
>> set as is for now.

> After thinking about it for awhile, I guess I'm okay with only
> bothering to provide expected-files for FIPS failures under OpenSSL
> 3.x (which is how your patch is set up, I believe).  While there are
> certainly still LTS platforms with 1.x, we don't have to consider FIPS
> mode on them to be a supported case.

I see that Mark W. has just spun up a couple of BF animals running
FIPS mode under SLES 15 (goshawk and shoebill).  Not too surprisingly,
they are failing the MD5 test:

 select md5('') = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
-ERROR:  could not compute MD5 hash: unsupported
+ERROR:  could not compute MD5 hash: disabled for FIPS
 select md5('a') = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
-ERROR:  could not compute MD5 hash: unsupported
+ERROR:  could not compute MD5 hash: disabled for FIPS
(etc etc)

Should we revisit the decision to not support this spelling
of the error message?  SLES 15 has got another decade or so
of support according to wikipedia [1], so it's hard to call it
a dead platform.

It looks like it'd be easy enough to generate the required
alternate expected-file, just s/unsupported/disabled for FIPS/g.
Happy to take care of this if there are not objections.

			regards, tom lane

[1] https://en.wikipedia.org/wiki/SUSE_Linux_Enterprise#End-of-support_schedule