This is an automated email from the ASF dual-hosted git repository. leborchuk pushed a commit to branch PG14_ARCHIVE_REBASED in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit a7895af766272ac4e074a89c351c7004a03be21a Author: copilot-swe-agent[bot] <[email protected]> AuthorDate: Fri Jun 19 12:27:59 2026 +0000 Address review comments: fix includes, configure options, pipefail, license headers, expected output --- .github/workflows/yezzey-ci.yaml | 4 +- configure.ac | 14 +++ .../isolation2/expected/resgroup_mdb_admin.out | 103 ++++++++++++++++++++- .../pg_aux_catalog/isolation2/isolation2_schedule | 17 ++++ contrib/pg_aux_catalog/pg_aux_catalog.c | 17 ++++ gpcontrib/Makefile | 4 - pom.xml | 3 - src/backend/catalog/oid_dispatch.c | 1 + 8 files changed, 150 insertions(+), 13 deletions(-) diff --git a/.github/workflows/yezzey-ci.yaml b/.github/workflows/yezzey-ci.yaml index 1d4402b0ad1..9913a6196c7 100644 --- a/.github/workflows/yezzey-ci.yaml +++ b/.github/workflows/yezzey-ci.yaml @@ -128,7 +128,7 @@ jobs: - name: Install MinIO Client (mc) run: | - set -ex pipefail + set -exo pipefail # Download mc for Linux (amd64) curl -fsSL -o mc https://dl.min.io/client/mc/release/linux-amd64/mc chmod +x mc @@ -136,7 +136,7 @@ jobs: - name: Configure MinIO service run: | - set -ex pipefail + set -exo pipefail # Add the MinIO service as an "alias" in mc (name it "minio-ci") mc alias set minio-ci http://minio:9000 some_key some_key diff --git a/configure.ac b/configure.ac index 89876e69d4f..308e0872f07 100644 --- a/configure.ac +++ b/configure.ac @@ -1380,6 +1380,20 @@ PGAC_ARG_BOOL(with, yezzey, no, [build with Yezzey extension]) AC_SUBST(with_yezzey) +# +# diskquota +# +PGAC_ARG_BOOL(with, diskquota, yes, + [build with diskquota extension]) +AC_SUBST(with_diskquota) + +# +# gp_stats_collector +# +PGAC_ARG_BOOL(with, gp_stats_collector, yes, + [build with gp_stats_collector extension]) +AC_SUBST(with_gp_stats_collector) + # # Realtime library # diff --git a/contrib/pg_aux_catalog/isolation2/expected/resgroup_mdb_admin.out b/contrib/pg_aux_catalog/isolation2/expected/resgroup_mdb_admin.out index c8fd232faea..7d8ed663485 100644 --- a/contrib/pg_aux_catalog/isolation2/expected/resgroup_mdb_admin.out +++ b/contrib/pg_aux_catalog/isolation2/expected/resgroup_mdb_admin.out @@ -21,13 +21,20 @@ DROP RESOURCE GROUP rg_perm_test; -- end_ignore -- --------------------------------------------------------------------- --- Setup. The mdb_admin role is not predefined in the catalog; it is --- created here the same way the control plane provisions it at runtime. +-- Setup. mdb_admin is identified by its fixed OID, so it must be created +-- through contrib/pg_aux_catalog (a plain CREATE ROLE would assign a +-- different OID and the permission checks would not recognise its members). -- --------------------------------------------------------------------- CREATE RESOURCE GROUP rg_perm_test WITH (concurrency=2, cpu_max_percent=10); CREATE -CREATE ROLE mdb_admin; -CREATE +CREATE EXTENSION IF NOT EXISTS pg_aux_catalog; +CREATE EXTENSION +SELECT pg_create_mdb_admin_role(); + pg_create_mdb_admin_role +-------------------------- + 8067 +(1 row) + CREATE ROLE role_rg_admin RESOURCE GROUP rg_perm_test; CREATE CREATE ROLE role_rg_noadmin RESOURCE GROUP rg_perm_test; @@ -121,3 +128,91 @@ DROP RESOURCE GROUP rg_perm_revoke1; DROP DROP RESOURCE GROUP rg_perm_test; DROP + + +-- --------------------------------------------------------------------- +-- 1. Member of mdb_admin can CREATE/ALTER/DROP resource groups +-- (statements are dispatched to segments). +-- --------------------------------------------------------------------- +1: SET ROLE role_rg_admin; +SET +1: CREATE RESOURCE GROUP rg_perm_admin1 WITH (concurrency=1, cpu_max_percent=5); +CREATE +1: ALTER RESOURCE GROUP rg_perm_admin1 SET cpu_max_percent 6; +ALTER +1: DROP RESOURCE GROUP rg_perm_admin1; +DROP + +-- 2. Even a member cannot ALTER or DROP the system admin_group. +1: ALTER RESOURCE GROUP admin_group SET cpu_max_percent 99; +ERROR: must be superuser to alter resource group "admin_group" +1: DROP RESOURCE GROUP admin_group; +ERROR: must be superuser to drop resource group "admin_group" +1q: ... <quitting> + +-- --------------------------------------------------------------------- +-- 3. A non-member is rejected on every entry point. +-- --------------------------------------------------------------------- +2: SET ROLE role_rg_noadmin; +SET +2: CREATE RESOURCE GROUP rg_perm_admin2 WITH (concurrency=1, cpu_max_percent=5); +ERROR: must be mdb_admin to create resource groups +2: ALTER RESOURCE GROUP rg_perm_test SET cpu_max_percent 7; +ERROR: must be mdb_admin to alter resource groups +2: DROP RESOURCE GROUP rg_perm_test; +ERROR: must be mdb_admin to drop resource groups +2q: ... <quitting> + +-- --------------------------------------------------------------------- +-- 4. pg_resgroup_move_query() honours the same permission check. +-- The first call (non-member) must fail with "must be mdb_admin". +-- The second call (member) gets past the permission gate and +-- fails on the pid lookup (masked by start_matchsubs above). +-- --------------------------------------------------------------------- +3: SET ROLE role_rg_noadmin; +SET +3: SELECT pg_resgroup_move_query(999999999, 'admin_group'); +ERROR: must be mdb_admin to move query +3: RESET ROLE; +RESET +3: SET ROLE role_rg_admin; +SET +3: SELECT pg_resgroup_move_query(999999999, 'admin_group'); +ERROR: cannot find process: XXX +3q: ... <quitting> + +-- --------------------------------------------------------------------- +-- 5. Cross-session REVOKE takes effect on the granted session's +-- next statement (the privilege is re-checked per command, not +-- cached at SET ROLE time). +-- --------------------------------------------------------------------- +4: SET ROLE role_rg_admin; +SET +4: CREATE RESOURCE GROUP rg_perm_revoke1 WITH (concurrency=1, cpu_max_percent=5); +CREATE +5: REVOKE mdb_admin FROM role_rg_admin; +REVOKE +4: CREATE RESOURCE GROUP rg_perm_revoke2 WITH (concurrency=1, cpu_max_percent=5); +ERROR: must be mdb_admin to create resource groups +4: DROP RESOURCE GROUP rg_perm_revoke1; +ERROR: must be mdb_admin to drop resource groups +4q: ... <quitting> +5q: ... <quitting> + +-- --------------------------------------------------------------------- +-- Cleanup. Roles must be dropped before the resource group they +-- reference, otherwise DROP RESOURCE GROUP fails with +-- "resource group is used by at least one role". +-- --------------------------------------------------------------------- +RESET ROLE; +RESET +DROP ROLE role_rg_admin; +DROP +DROP ROLE role_rg_noadmin; +DROP +DROP ROLE mdb_admin; +DROP +DROP RESOURCE GROUP rg_perm_revoke1; +DROP +DROP RESOURCE GROUP rg_perm_test; +DROP diff --git a/contrib/pg_aux_catalog/isolation2/isolation2_schedule b/contrib/pg_aux_catalog/isolation2/isolation2_schedule index 73b2a8a95a5..cb32fe3e768 100644 --- a/contrib/pg_aux_catalog/isolation2/isolation2_schedule +++ b/contrib/pg_aux_catalog/isolation2/isolation2_schedule @@ -1 +1,18 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + test: resgroup_mdb_admin diff --git a/contrib/pg_aux_catalog/pg_aux_catalog.c b/contrib/pg_aux_catalog/pg_aux_catalog.c index 91685561cca..958bd2f55be 100644 --- a/contrib/pg_aux_catalog/pg_aux_catalog.c +++ b/contrib/pg_aux_catalog/pg_aux_catalog.c @@ -5,6 +5,23 @@ * * contrib/pg_aux_catalog/pg_aux_catalog.c * + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + * *------------------------------------------------------------------------- */ #include "postgres.h" diff --git a/gpcontrib/Makefile b/gpcontrib/Makefile index af9862530d6..c62855d3089 100644 --- a/gpcontrib/Makefile +++ b/gpcontrib/Makefile @@ -35,10 +35,6 @@ else diskquota endif -ifeq "$(with_diskquota)" "yes" - recurse_targets += diskquota -endif - ifeq "$(with_gp_stats_collector)" "yes" recurse_targets += gp_stats_collector endif diff --git a/pom.xml b/pom.xml index 6eaa095fa37..0e000093399 100644 --- a/pom.xml +++ b/pom.xml @@ -352,9 +352,6 @@ code or new licensing patterns. <exclude>contrib/indexscan/indexscan.c</exclude> <exclude>contrib/indexscan/indexscan.sql.in</exclude> - <exclude>contrib/pg_aux_catalog/pg_aux_catalog.c</exclude> - <exclude>contrib/pg_aux_catalog/isolation2/isolation2_schedule</exclude> - <exclude>contrib/file_fdw/init_file</exclude> <exclude>contrib/file_fdw/data/**</exclude> diff --git a/src/backend/catalog/oid_dispatch.c b/src/backend/catalog/oid_dispatch.c index eaa2e099876..95afd25d0b0 100644 --- a/src/backend/catalog/oid_dispatch.c +++ b/src/backend/catalog/oid_dispatch.c @@ -129,6 +129,7 @@ #include "catalog/pg_type.h" #include "catalog/pg_user_mapping.h" #include "catalog/oid_dispatch.h" +#include "access/transam.h" #include "cdb/cdbvars.h" #include "executor/execdesc.h" #include "lib/rbtree.h" --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
