diff --git a/install-deps.sh b/install-deps.sh index ab27bbd4..424afd9f 100644 --- a/install-deps.sh +++ b/install-deps.sh @@ -20,10 +20,13 @@ rpm_deps() { if [[ "$COMPONENT" == "postgis" ]]; then INSTALL_LIST+="gdal38-devel proj95-devel geos311-devel pcre-devel " fi + if [[ "$COMPONENT" == "pg_oidc" ]]; then + INSTALL_LIST+="gcc-toolset-14 " + fi fi if [[ "${RHEL}" -eq 9 ]]; then - if [[ "$COMPONENT" == "postgresql" || "$COMPONENT" == "pg_repack" ]]; then + if [[ "$COMPONENT" == "postgresql" || "$COMPONENT" == "pg_repack" || "$COMPONENT" == "pg_oidc" ]]; then INSTALL_LIST+="gcc-toolset-14 " fi if [[ "$COMPONENT" == "pgpool2" ]]; then @@ -38,6 +41,9 @@ rpm_deps() { if [[ "$COMPONENT" == "postgis" ]]; then INSTALL_LIST+="gdal311-devel proj96-devel geos313-devel pcre2-devel " fi + if [[ "$COMPONENT" == "pg_oidc" ]]; then + INSTALL_LIST+="libstdc++-static " + fi fi dnf -y module disable postgresql || true @@ -124,7 +130,7 @@ deb_deps() { fi fi - if [[ "x${DEBIAN}" == "xbullseye" ]]; then + if [[ "x${DEBIAN}" == "xbullseye" && "$COMPONENT" != "pg_oidc" ]]; then DEBIAN_FRONTEND=noninteractive apt-get -y install software-properties-common wget https://apt.llvm.org/llvm.sh chmod +x llvm.sh @@ -133,6 +139,14 @@ deb_deps() { DEBIAN_FRONTEND=noninteractive apt-get -y --allow-unauthenticated install dh_systemd fi fi + + if [[ "$COMPONENT" == "pg_oidc" ]]; then + DEBIAN_FRONTEND=noninteractive apt-get -y install software-properties-common + wget https://apt.llvm.org/llvm.sh + chmod +x llvm.sh + ./llvm.sh 21 all + apt-get install libc++-21-dev libc++abi-21-dev clang-21 clang++-21 + fi return; } @@ -225,6 +239,22 @@ EOF ;; + pg_oidc) + if [ "x$OS" = "xrpm" ]; then + rpm_deps + INSTALL_LIST+="sudo wget git vim rpm-build libcurl-devel krb5-devel openssl-devel percona-postgresql${PG_MAJOR}-devel percona-postgresql${PG_MAJOR}-server rpmdevtools binutils make gcc gcc-c++" + dnf -y install ${INSTALL_LIST} + else + deb_deps + DEBIAN_FRONTEND=noninteractive apt-get -y install tzdata + ln -fs /usr/share/zoneinfo/America/New_York /etc/localtime + dpkg-reconfigure --frontend noninteractive tzdata + INSTALL_LIST+="sudo build-essential debhelper clang git libjwt-dev libcurl4-openssl-dev libssl-dev libreadline-dev libkrb5-dev zlib1g-dev libxml2-dev libxslt1-dev uuid-dev flex bison pkg-config percona-postgresql-${PG_MAJOR} percona-postgresql-server-dev-all" + DEBIAN_FRONTEND=noninteractive apt-get -y --allow-unauthenticated install ${INSTALL_LIST} + fi + ;; + + ydiff) if [ "x$OS" = "xrpm" ]; then rpm_deps diff --git a/pg_oidc/debian/control b/pg_oidc/debian/control new file mode 100644 index 00000000..cf3a096b --- /dev/null +++ b/pg_oidc/debian/control @@ -0,0 +1,28 @@ +Source: percona-pg-oidc-validator@@PGMAJOR@@ +Section: database +Priority: optional +Maintainer: Percona Development Team info@percona.com +Build-Depends: + debhelper (>= 9), + percona-postgresql-server-dev-all (>= 153~), + libcurl4-openssl-dev, + libssl-dev (>= 1.1.1), + libjwt-dev, + zlib1g-dev, + libkrb5-dev, + libxml2-dev, + libxslt1-dev, + libreadline-dev, +Standards-Version: 4.6.2 +Rules-Requires-Root: no +Homepage: https://github.com/Percona-Lab/pg_oidc_validator.git + +Package: percona-pg-oidc-validator@@PGMAJOR@@ +Architecture: any +Depends: + ${misc:Depends}, + ${postgresql:Depends}, + ${shlibs:Depends}, +Description: pg-oidc-validator is a PostgreSQL extension. + It is an OAuth validator library for PostgreSQL @@PGMAJOR@@. + diff --git a/pg_oidc/debian/control.in b/pg_oidc/debian/control.in new file mode 100644 index 00000000..cf3a096b --- /dev/null +++ b/pg_oidc/debian/control.in @@ -0,0 +1,28 @@ +Source: percona-pg-oidc-validator@@PGMAJOR@@ +Section: database +Priority: optional +Maintainer: Percona Development Team info@percona.com +Build-Depends: + debhelper (>= 9), + percona-postgresql-server-dev-all (>= 153~), + libcurl4-openssl-dev, + libssl-dev (>= 1.1.1), + libjwt-dev, + zlib1g-dev, + libkrb5-dev, + libxml2-dev, + libxslt1-dev, + libreadline-dev, +Standards-Version: 4.6.2 +Rules-Requires-Root: no +Homepage: https://github.com/Percona-Lab/pg_oidc_validator.git + +Package: percona-pg-oidc-validator@@PGMAJOR@@ +Architecture: any +Depends: + ${misc:Depends}, + ${postgresql:Depends}, + ${shlibs:Depends}, +Description: pg-oidc-validator is a PostgreSQL extension. + It is an OAuth validator library for PostgreSQL @@PGMAJOR@@. + diff --git a/pg_oidc/debian/percona-pg-oidc-validator18.install b/pg_oidc/debian/percona-pg-oidc-validator18.install new file mode 100644 index 00000000..1820b34b --- /dev/null +++ b/pg_oidc/debian/percona-pg-oidc-validator18.install @@ -0,0 +1 @@ +pg_oidc_validator.so usr/lib/postgresql/@@PGMAJOR@@/lib/pg_oidc_validator.so diff --git a/pg_oidc/debian/rules b/pg_oidc/debian/rules new file mode 100755 index 00000000..44effdf5 --- /dev/null +++ b/pg_oidc/debian/rules @@ -0,0 +1,31 @@ +#!/usr/bin/make -f + +include /usr/share/postgresql-common/pgxs_debian_control.mk + +%: + dh $@ + +override_dh_builddeb: + dh_builddeb -- -Zgzip + +override_dh_auto_clean: + rm -rf build + +override_dh_auto_build: + make USE_PGXS=1 \ + CXX="clang++-21" \ + CXXFLAGS="-stdlib=libc++" \ + LDFLAGS="-L/usr/lib/llvm-21/lib" \ + PG_CONFIG=/usr/lib/postgresql/@@PGMAJOR@@/bin/pg_config \ + USE_LIBCXX=1 \ + with_llvm=no + +override_dh_auto_install: + make USE_PGXS=1 install DESTDIR=$(CURDIR)/debian/tmp \ + PG_CONFIG=/usr/lib/postgresql/@@PGMAJOR@@/bin/pg_config \ + with_llvm=no + +override_dh_auto_test: + +override_dh_installdocs: + dh_installdocs --all README.* diff --git a/pg_oidc/pg_oidc.spec b/pg_oidc/pg_oidc.spec new file mode 100644 index 00000000..a6a01f4f --- /dev/null +++ b/pg_oidc/pg_oidc.spec @@ -0,0 +1,61 @@ + +%define pgmajorversion %{pgmajor} +%define pginstdir /usr/pgsql-%{pgmajorversion}/ +%global pname pg_oidc_validator +%global sname percona-pg_oidc_validator%{pgmajorversion} + +Name: %{sname} +Version: %{version} +Release: %{release}%{?dist} +Summary: PostgreSQL OAuth/OIDC token validator extension + +%global debug_package %{nil} + +License: Apache-2.0 +URL: https://github.com/Percona-Lab/pg_oidc_validator +Source0: %{name}-%{version}.tar.gz + +%if 0%{?rhel} && 0%{?rhel} <= 9 +BuildRequires: gcc-toolset-14 +%endif + +BuildRequires: postgresql%{pgmajorversion}-devel +BuildRequires: libcurl-devel +BuildRequires: openssl-devel + +Requires: postgresql%{pgmajorversion} +Requires: libcurl +Requires: openssl-libs + +%description +pg_oidc_validator is a PostgreSQL extension that implements OIDC (OpenID Connect) +token validation. It validates JWT tokens from OIDC providers, enabling OAuth-based +authentication for PostgreSQL connections. + +%prep +%setup -q + +%build +%if 0%{?rhel} && 0%{?rhel} <= 9 +source /opt/rh/gcc-toolset-14/enable +%endif +export PG_CONFIG=%{pginstdir}/bin/pg_config +make USE_PGXS=1 %{?_smp_mflags} with_llvm=no COMPILER='g++ $(CXXFLAGS)' + +%install +%if 0%{?rhel} && 0%{?rhel} <= 9 +source /opt/rh/gcc-toolset-14/enable +#%else +#source /opt/rh/gcc-toolset-15/enable +%endif +export PG_CONFIG=%{pginstdir}/bin/pg_config +make USE_PGXS=1 install DESTDIR=%{buildroot} with_llvm=no COMPILER='g++ $(CXXFLAGS)' + +%files +%license LICENSE.txt +%doc README.md +%{pginstdir}/lib/%{pname}.so + +%changelog +* Wed Jan 21 2026 Manika Singhal - 0.2-1 +- Initial build 0.2 diff --git a/pg_oidc/pg_oidc_builder.sh b/pg_oidc/pg_oidc_builder.sh new file mode 100755 index 00000000..4a439b4a --- /dev/null +++ b/pg_oidc/pg_oidc_builder.sh @@ -0,0 +1,321 @@ +#!/usr/bin/env bash +set -x +# Versions and other variables +source versions.sh "pg_oidc" +# Common functions +source common-functions.sh + +get_sources(){ + cd "${WORKDIR}" + if [ "${SOURCE}" = 0 ] + then + echo "Sources will not be downloaded" + return 0 + fi + + echo "PRODUCT=${PG_OIDC_PRODUCT}" > pg_oidc.properties + echo "PRODUCT_FULL=${PG_OIDC_PRODUCT_FULL}" >> pg_oidc.properties + echo "VERSION=${PG_OIDC_VERSION}" >> pg_oidc.properties + echo "BUILD_NUMBER=${BUILD_NUMBER}" >> pg_oidc.properties + echo "BUILD_ID=${BUILD_ID}" >> pg_oidc.properties + git clone --recursive "$PG_OIDC_SRC_REPO" ${PG_OIDC_PRODUCT_FULL} + retval=$? + if [ $retval != 0 ] + then + echo "There were some issues during repo cloning from github. Please retry one more time" + exit 1 + fi + cd ${PG_OIDC_PRODUCT_FULL} + if [ ! -z "$PG_OIDC_SRC_BRANCH" ] + then + git reset --hard + git clean -xdf + git checkout "$PG_OIDC_SRC_BRANCH" + fi + REVISION=$(git rev-parse --short HEAD) + echo "REVISION=${REVISION}" >> ${WORKDIR}/pg_oidc.properties + rm -fr debian rpm + + mkdir debian + cd debian + #git checkout debian/${VERSION}-${RELEASE} + wget ${PKG_RAW_URL}/pg_oidc/debian/control + wget ${PKG_RAW_URL}/pg_oidc/debian/control.in + wget ${PKG_RAW_URL}/pg_oidc/debian/rules + wget ${PKG_RAW_URL}/pg_oidc/debian/percona-pg-oidc-validator${PG_MAJOR}.install + sed -i "s/@@PGMAJOR@@/${PG_MAJOR}/g" control control.in rules percona-pg-oidc-validator${PG_MAJOR}.install + sudo chmod +x rules + cd ../ + + echo ${PG_MAJOR} > debian/pgversions + echo 10 > debian/compat + rm -rf deb_packaging + mkdir rpm + cd rpm + wget ${PKG_RAW_URL}/pg_oidc/pg_oidc.spec + + cd ${WORKDIR} + # + source pg_oidc.properties + # + + tar --owner=0 --group=0 --exclude=.* -czf ${PG_OIDC_PRODUCT_FULL}.tar.gz ${PG_OIDC_PRODUCT_FULL} + DATE_TIMESTAMP=$(date +%F_%H-%M-%S) + echo "UPLOAD=UPLOAD/experimental/BUILDS/${PG_OIDC_PRODUCT}/${PG_OIDC_PRODUCT_FULL}/${PG_OIDC_SRC_BRANCH}/${REVISION}/${DATE_TIMESTAMP}/${BUILD_ID}" >> pg_oidc.properties + mkdir $WORKDIR/source_tarball + mkdir $CURDIR/source_tarball + cp ${PG_OIDC_PRODUCT_FULL}.tar.gz $WORKDIR/source_tarball + cp ${PG_OIDC_PRODUCT_FULL}.tar.gz $CURDIR/source_tarball + cd $CURDIR + return +} + +get_deb_sources(){ + param=$1 + + FILE=$(basename $(find $WORKDIR/source_deb -name "percona-pg*oidc*.$param" | sort | tail -n1)) + if [ -z $FILE ] + then + FILE=$(basename $(find $CURDIR/source_deb -name "percona-pg*oidc*.$param" | sort | tail -n1)) + if [ -z $FILE ] + then + echo "There is no sources for build" + exit 1 + else + cp $CURDIR/source_deb/$FILE $WORKDIR/ + fi + else + cp $WORKDIR/source_deb/$FILE $WORKDIR/ + fi + return +} + +build_srpm(){ + if [ $SRPM = 0 ] + then + echo "SRC RPM will not be created" + return; + fi + if [ "x$OS" = "xdeb" ] + then + echo "It is not possible to build src rpm here" + exit 1 + fi + cd $WORKDIR + get_tar "source_tarball" "percona-pg*oidc*validator" + rm -fr rpmbuild + ls | grep -v tar.gz | xargs rm -rf + TARFILE=$(find . -name 'percona-pg_oidc*.tar.gz' | sort | tail -n1) + SRC_DIR=${TARFILE%.tar.gz} + # + mkdir -vp rpmbuild/{SOURCES,SPECS,BUILD,SRPMS,RPMS} + tar vxzf ${WORKDIR}/${TARFILE} --wildcards '*/rpm' --strip=1 + # + cp -av rpm/* rpmbuild/SOURCES + cp -av rpm/pg_oidc.spec rpmbuild/SPECS + # + mv -fv ${TARFILE} ${WORKDIR}/rpmbuild/SOURCES + rpmbuild -bs \ + --define "_topdir ${WORKDIR}/rpmbuild" \ + --define "dist .generic" \ + --define "pgmajor ${PG_MAJOR}" \ + --define "version ${PG_OIDC_VERSION}" \ + --define "release ${PG_OIDC_RELEASE}" \ + rpmbuild/SPECS/pg_oidc.spec + mkdir -p ${WORKDIR}/srpm + mkdir -p ${CURDIR}/srpm + cp rpmbuild/SRPMS/*.src.rpm ${CURDIR}/srpm + cp rpmbuild/SRPMS/*.src.rpm ${WORKDIR}/srpm + return +} + +build_rpm(){ + if [ $RPM = 0 ] + then + echo "RPM will not be created" + return; + fi + if [ "x$OS" = "xdeb" ] + then + echo "It is not possible to build rpm here" + exit 1 + fi + SRC_RPM=$(basename $(find $WORKDIR/srpm -name 'percona-pg_oidc*.src.rpm' | sort | tail -n1)) + if [ -z $SRC_RPM ] + then + SRC_RPM=$(basename $(find $CURDIR/srpm -name 'percona-pg_oidc*.src.rpm' | sort | tail -n1)) + if [ -z $SRC_RPM ] + then + echo "There is no src rpm for build" + echo "You can create it using key --build_src_rpm=1" + exit 1 + else + cp $CURDIR/srpm/$SRC_RPM $WORKDIR + fi + else + cp $WORKDIR/srpm/$SRC_RPM $WORKDIR + fi + cd $WORKDIR + rm -fr rpmbuild + mkdir -vp rpmbuild/{SOURCES,SPECS,BUILD,SRPMS,RPMS} + cp $SRC_RPM rpmbuild/SRPMS/ + + cd rpmbuild/SRPMS/ + # + cd $WORKDIR + RHEL=$(rpm --eval %rhel) + ARCH=$(echo $(uname -m) | sed -e 's:i686:i386:g') + if [ -f /opt/rh/devtoolset-7/enable ]; then + source /opt/rh/devtoolset-7/enable + source /opt/rh/llvm-toolset-7/enable + fi + + if [[ "${RHEL}" -eq 10 ]]; then + export QA_RPATHS=0x0002 + fi + rpmbuild \ + --define "_topdir ${WORKDIR}/rpmbuild" \ + --define "dist .$OS_NAME" \ + --define "pgmajor ${PG_MAJOR}" \ + --define "version ${PG_OIDC_VERSION}" \ + --define "release ${PG_OIDC_RELEASE}" \ + --rebuild rpmbuild/SRPMS/$SRC_RPM + + return_code=$? + if [ $return_code != 0 ]; then + exit $return_code + fi + mkdir -p ${WORKDIR}/rpm + mkdir -p ${CURDIR}/rpm + cp rpmbuild/RPMS/*/*.rpm ${WORKDIR}/rpm + cp rpmbuild/RPMS/*/*.rpm ${CURDIR}/rpm +} + +build_source_deb(){ + if [ $SDEB = 0 ] + then + echo "source deb package will not be created" + return; + fi + if [ "x$OS" = "xrpm" ] + then + echo "It is not possible to build source deb here" + exit 1 + fi + rm -rf percona-pg_oidc* + get_tar "source_tarball" "percona-pg*oidc*validator" + rm -f *.dsc *.orig.tar.gz *.debian.tar.gz *.changes + # + TARFILE=$(basename $(find . -name 'percona-pg*oidc*.tar.gz' | sort | tail -n1)) + DEBIAN=$(lsb_release -sc) + ARCH=$(echo $(uname -m) | sed -e 's:i686:i386:g') + tar zxf ${TARFILE} + BUILDDIR=${TARFILE%.tar.gz} + + mv ${TARFILE} ${PG_OIDC_PRODUCT_DEB}_${PG_OIDC_VERSION}.orig.tar.gz + cd ${BUILDDIR} + rm -f .github/workflows/*.yml + rm -f .github/workflows/*.yaml + rm -f .github/*.yml + rm -rf .github + find . | grep yml | xargs rm -f + rm -f documentation/_resource/.icons/percona/logo.svg + cd debian + rm -rf changelog + mkdir -p source + echo "3.0 (quilt)" > source/format + echo ${PG_MAJOR} > pgversions + echo 10 > compat + echo "${PG_OIDC_PRODUCT_DEB} (${PG_OIDC_VERSION}-${PG_OIDC_RELEASE}) unstable; urgency=low" > changelog + echo " * Initial Release." >> changelog + echo " -- Manika Singhal $(date -R)" >> changelog + + cd ../ + + dch -D unstable --force-distribution -v "${PG_OIDC_VERSION}-${PG_OIDC_RELEASE}" "Update to new pg-oidc-validator version ${PG_OIDC_VERSION}" + pg_buildext updatecontrol + dpkg-buildpackage -S + cd ../ + mkdir -p $WORKDIR/source_deb + mkdir -p $CURDIR/source_deb + cp *.debian.tar.* $WORKDIR/source_deb + cp *_source.changes $WORKDIR/source_deb + cp *.dsc $WORKDIR/source_deb + cp *.orig.tar.gz $WORKDIR/source_deb + cp *.debian.tar.* $CURDIR/source_deb + cp *_source.changes $CURDIR/source_deb + cp *.dsc $CURDIR/source_deb + cp *.orig.tar.gz $CURDIR/source_deb +} + +build_deb(){ + if [ $DEB = 0 ] + then + echo "source deb package will not be created" + return; + fi + if [ "x$OS" = "xrmp" ] + then + echo "It is not possible to build source deb here" + exit 1 + fi + for file in 'dsc' 'orig.tar.gz' 'changes' 'debian.tar*' + do + get_deb_sources $file + done + cd $WORKDIR + rm -fv *.deb + # + export DEBIAN=$(lsb_release -sc) + export ARCH=$(echo $(uname -m) | sed -e 's:i686:i386:g') + # + echo "DEBIAN=${DEBIAN}" >> pg_oidc.properties + echo "ARCH=${ARCH}" >> pg_oidc.properties + + # + DSC=$(basename $(find . -name '*.dsc' | sort | tail -n1)) + # + dpkg-source -x ${DSC} + + cd ${PG_OIDC_PRODUCT_DEB}-${PG_OIDC_VERSION} + dch -m -D "${DEBIAN}" --force-distribution -v "1:${PG_OIDC_VERSION}-${PG_OIDC_RELEASE}.${DEBIAN}" 'Update distribution' + unset $(locale|cut -d= -f1) + dpkg-buildpackage -rfakeroot -us -uc -b + mkdir -p $CURDIR/deb + mkdir -p $WORKDIR/deb + cd $WORKDIR/ + for file in $(ls | grep ddeb); do + mv "$file" "${file%.ddeb}.deb"; + done + cp $WORKDIR/*.*deb $WORKDIR/deb + cp $WORKDIR/*.*deb $CURDIR/deb +} +#main + +CURDIR=$(pwd) +VERSION_FILE=$CURDIR/pg_oidc.properties +args= +WORKDIR= +SRPM=0 +SDEB=0 +RPM=0 +DEB=0 +SOURCE=0 +INSTALL=0 +REVISION=0 +DEBUG=0 + +parse_arguments PICK-ARGS-FROM-ARGV "$@" +check_workdir +get_system +#install_deps +if [ $INSTALL = 0 ]; then + echo "Dependencies will not be installed" +else + source install-deps.sh "pg_oidc" +fi +get_sources +build_srpm +build_source_deb +build_rpm +build_deb diff --git a/versions.sh b/versions.sh index 544d7394..b2eed8b2 100644 --- a/versions.sh +++ b/versions.sh @@ -26,6 +26,7 @@ POSTGIS35_MINOR=4 PYSYNCOBJ_VERSION=0.3.10 WAL2JSON_VERSION=2.6 YDIFF_VERSION=1.2 +PG_OIDC_VERSION=0.2 #-------------------------------------- COMMON URLs -------------------------------------- @@ -86,6 +87,19 @@ case "$1" in PG_TDE_SRC_REPO="https://github.com/percona/pg_tde.git" ;; + pg_oidc) + # versions + PG_OIDC_PRODUCT=percona-pg_oidc_validator${PG_MAJOR} + PG_OIDC_PRODUCT_DEB=percona-pg-oidc-validator${PG_MAJOR} + PG_OIDC_PRODUCT_FULL=${PG_OIDC_PRODUCT}-${PG_OIDC_VERSION} + PG_OIDC_RELEASE='1' + PG_OIDC_SRC_BRANCH="${PG_OIDC_VERSION}" + PG_OIDC_RPM_RELEASE='1' + PG_OIDC_DEB_RELEASE='1' + # urls + PG_OIDC_SRC_REPO="https://github.com/Percona-Lab/pg_oidc_validator.git" + ;; + etcd) # versions