[DO NOT MERGE] chore: upgrade orioledb to beta17

Dockerfile-orioledb-17

@@ -158,6 +158,10 @@ RUN sed -i 's/ timescaledb,//g;' "/etc/postgresql/postgresql.conf" && \
 RUN sed -i 's/\(shared_preload_libraries.*\)'\''\(.*\)$/\1, orioledb'\''\2/' "/etc/postgresql/postgresql.conf" && \
     echo "default_table_access_method = 'orioledb'" >> "/etc/postgresql/postgresql.conf"
 
+# orioledb-17 is pinned to 17.11+, which added output_plugin_libraries as an
+# allow-list for logical decoding output plugins
+RUN echo "output_plugin_libraries = 'pgoutput, test_decoding, wal2json'" >> "/etc/postgresql/postgresql.conf"
+
 # Include schema migrations
 COPY migrations/db /docker-entrypoint-initdb.d/
 COPY ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql /docker-entrypoint-initdb.d/init-scripts/00-schema.sql

ansible/files/pg_wait_sampling_extension.sql

@@ -0,0 +1,2 @@
+CREATE SCHEMA IF NOT exists extensions;
+CREATE EXTENSION IF NOT EXISTS pg_wait_sampling with schema extensions;

ansible/files/postgresql_config/postgresql.conf.j2

@@ -687,7 +687,7 @@ default_text_search_config = 'pg_catalog.english'
 #local_preload_libraries = ''
 #session_preload_libraries = ''
 
-shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter, supabase_vault'	# (change requires restart)
+shared_preload_libraries = 'pg_stat_statements, pg_wait_sampling, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, timescaledb, auto_explain, pg_tle, plan_filter, supabase_vault'	# (change requires restart)
 jit_provider = 'llvmjit'		# JIT library to use
 
 # - Other Defaults -

ansible/files/postgresql_config/supautils.conf.j2

@@ -1,13 +1,13 @@
 supautils.extensions_parameter_overrides = '{"pg_cron":{"schema":"pg_catalog"},"amcheck":{"schema":"pg_catalog"}}'
 supautils.policy_grants = '{"postgres":["auth.audit_log_entries","auth.flow_state","auth.identities","auth.instances","auth.mfa_amr_claims","auth.mfa_challenges","auth.mfa_factors","auth.oauth_clients","auth.one_time_tokens","auth.refresh_tokens","auth.saml_providers","auth.saml_relay_states","auth.sessions","auth.sso_domains","auth.sso_providers","auth.users","realtime.messages","realtime.subscription","storage.buckets","storage.buckets_analytics","storage.objects","storage.prefixes","storage.s3_multipart_uploads","storage.s3_multipart_uploads_parts"]}'
 supautils.drop_trigger_grants = '{"postgres":["auth.audit_log_entries","auth.flow_state","auth.identities","auth.instances","auth.mfa_amr_claims","auth.mfa_challenges","auth.mfa_factors","auth.oauth_clients","auth.one_time_tokens","auth.refresh_tokens","auth.saml_providers","auth.saml_relay_states","auth.sessions","auth.sso_domains","auth.sso_providers","auth.users","realtime.messages","realtime.subscription","storage.buckets","storage.buckets_analytics","storage.objects","storage.prefixes","storage.s3_multipart_uploads","storage.s3_multipart_uploads_parts"]}'
-# full list:                                 address_standardizer, address_standardizer_data_us, adminpack, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, file_fdw, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intagg, intarray, isn, lo, ltree, moddatetime, old_snapshot, orioledb, pageinspect, pg_buffercache, pg_cron, pg_freespacemap, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_surgery, pg_tle, pg_trgm, pg_visibility, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgmq, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers, xml2
+# full list:                                 address_standardizer, address_standardizer_data_us, adminpack, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, file_fdw, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intagg, intarray, isn, lo, ltree, moddatetime, old_snapshot, orioledb, pageinspect, pg_buffercache, pg_cron, pg_freespacemap, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_surgery, pg_tle, pg_trgm, pg_visibility, pg_wait_sampling, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgmq, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers, xml2
 # omitted because may be unsafe:             adminpack, file_fdw, lo, old_snapshot, pageinspect, pg_freespacemap, pg_surgery, pg_visibility
 # omitted because deprecated:                intagg, xml2
 # omitted because doesn't require superuser: pgmq
 # omitted because protected:                 plpgsql
 # NOTE: keep nix/tests/prime-superuser.sql in sync with the "may be unsafe" + "deprecated" lists above.
-supautils.privileged_extensions = 'address_standardizer, address_standardizer_data_us, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intarray, isn, ltree, moddatetime, orioledb, pg_buffercache, pg_cron, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_tle, pg_trgm, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers'
+supautils.privileged_extensions = 'address_standardizer, address_standardizer_data_us, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intarray, isn, ltree, moddatetime, orioledb, pg_buffercache, pg_cron, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_tle, pg_trgm, pg_wait_sampling, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers'
 supautils.extension_custom_scripts_path = '/etc/postgresql-custom/extension-custom-scripts'
 supautils.restrict_extension_versions = 'warn'
 supautils.privileged_extensions_superuser = 'supabase_admin'

ansible/files/postgresql_extension_custom_scripts/pg_wait_sampling/after-create.sql

@@ -0,0 +1,4 @@
+-- Upstream revokes this from PUBLIC (it's the only function of the
+-- extension not already granted to PUBLIC); grant it back to postgres so
+-- the extension is fully usable without superuser.
+grant execute on function pg_wait_sampling_reset_profile() to postgres with grant option;

ansible/playbook.yml

@@ -17,7 +17,11 @@
           dest: "00-schema.sql",
         }
       - { source: "stat_extension.sql", dest: "01-extension.sql" }
-
+      - {
+          source: "pg_wait_sampling_extension.sql",
+          dest: "02-extension.sql",
+        }
+
   environment:
     PATH: /usr/lib/postgresql/bin:{{ ansible_env.PATH }}
 

ansible/tasks/stage2-setup-postgres.yml

@@ -48,6 +48,14 @@
             path: '/etc/postgresql/postgresql.conf'
             state: 'present'
 
+        # orioledb-17 is pinned to 17.11+, which added output_plugin_libraries
+        # as an allow-list for logical decoding output plugins.
+        - name: Allow wal2json as a logical decoding output plugin
+          ansible.builtin.lineinfile:
+            line: "output_plugin_libraries = 'pgoutput, test_decoding, wal2json'"
+            path: '/etc/postgresql/postgresql.conf'
+            state: 'present'
+
         - name: Add ORIOLEDB_ENABLED environment variable
           ansible.builtin.lineinfile:
             line: 'ORIOLEDB_ENABLED=true'

ansible/vars.yml

@@ -11,9 +11,9 @@ postgres_major:
 # This is the source of truth for Postgres versions used in the Dockerfiles, and
 # is used to derive image tags and base images in the release matrix.
 postgres_release:
-  postgresorioledb-17: "17.9.0.023-orioledb"
-  postgres17: "17.6.1.170"
-  postgres15: "15.14.1.170"
+  postgresorioledb-17: "17.11.0.001-orioledb-bench-1"
+  postgres17: "17.6.1.171-bench-1"
+  postgres15: "15.14.1.171-bench-1"
 # Docker release matrix — base images built first, layered images built on top.
 # tag and base_tag are derived at build time from postgres_release via release_key.
 # tag_suffix is appended to the release version to form the final image tag.

docker/pgctld/orioledb-postgresql.conf.tmpl

@@ -296,9 +296,5 @@ wal_log_hints = 'on'
 # These settings activate OrioleDB as the default table storage engine.
 # Injected automatically by the /usr/local/bin/pgctld wrapper in variant-orioledb-17.
 #------------------------------------------------------------------------------
-shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, auto_explain, pg_tle, plan_filter, supabase_vault, orioledb'
+shared_preload_libraries = 'pg_stat_statements, pg_wait_sampling, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, auto_explain, pg_tle, plan_filter, supabase_vault, orioledb'
 default_table_access_method = 'orioledb'
-orioledb.enable_rewind = true
-orioledb.rewind_max_time = 1200
-orioledb.rewind_max_transactions = 100000
-orioledb.rewind_buffers = 1280

docker/pgctld/postgresql.conf.tmpl

@@ -231,7 +231,7 @@ default_text_search_config = 'pg_catalog.english'
 
 session_preload_libraries = 'supautils'
 
-shared_preload_libraries = 'pg_stat_statements, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, auto_explain, pg_tle, plan_filter, supabase_vault'
+shared_preload_libraries = 'pg_stat_statements, pg_wait_sampling, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, auto_explain, pg_tle, plan_filter, supabase_vault'
 session_preload_libraries = 'supautils'
 
 jit_provider = 'llvmjit'		# JIT library to use

migrations/schema-orioledb-17.sql

@@ -4,8 +4,8 @@
 
 \restrict SupabaseTestDumpKey123
 
--- Dumped from database version 17.9
--- Dumped by pg_dump version 17.9
+-- Dumped from database version 17.11
+-- Dumped by pg_dump version 17.11
 
 SET statement_timeout = 0;
 SET lock_timeout = 0;

nix/checks.nix

@@ -123,6 +123,7 @@
                 # Define which extensions should be preloaded (in order of priority)
                 WANTED_EXTS=(
                   "pg_stat_statements"
+                  "pg_wait_sampling"
                   "pgaudit"
                   "plpgsql"
                   "plpgsql_check"
@@ -256,6 +257,7 @@
                 "pg_cron_trigger_privileges" # needs pg_cron + the postgres role and cron-schema grants from the full migrations, not in the CLI prime file
                 "supautils_restrict_versions" # needs the postgres role + primed hstore from the full migrations/prime, not present in the CLI variant
                 "amcheck" # needs the postgres/anon/authenticated/service_role roles and the default privileges from the full migrations, plus amcheck primed by prime.sql
+                "pg_wait_sampling"
                 # Version-specific extension tests
                 "z_17_ext_interface"
                 "z_17_pg_stat_monitor"
@@ -411,6 +413,9 @@
                   # Add orioledb to shared_preload_libraries
                   perl -pi -e "s/(shared_preload_libraries = ')/\$1orioledb, /" "$PGTAP_CLUSTER/postgresql.conf"
                   log info "OrioleDB added to shared_preload_libraries"
+                  # orioledb-17 is pinned to 17.11+, which added output_plugin_libraries
+                  # as an allow-list for logical decoding output plugins.
+                  echo "output_plugin_libraries = 'pgoutput, test_decoding, wal2json'" >> "$PGTAP_CLUSTER/postgresql.conf"
                 fi
 
                 # Check if postgresql.conf exists

nix/config.nix

@@ -56,8 +56,8 @@ in
         };
         orioledb = {
           "17" = {
-            version = "17_20";
-            hash = "sha256-HDrHTx9yeIPJoyIBs+BdAhBQqt1IEtQrG9pFfvHJqdg=";
+            version = "17_21";
+            hash = "sha256-c/J5f0xP6tYWgZ1AxDFfhTKVbv3ExlaYaI+qZX9PeSg=";
           };
         };
       };

nix/ext/orioledb.nix

@@ -15,10 +15,10 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "orioledb";
     repo = "orioledb";
-    rev = "beta16";
-    sha256 = "sha256-HCfNzMPt80nGeVwlstUCeMpdNZYd9KhLLHYyD/Hvuhk=";
+    rev = "beta17";
+    sha256 = "sha256-gDX28/CHlbLj+jC3Qx6z/Hg6M73K4mFPw3iysc1Xv6I=";
   };
-  version = "beta16";
+  version = "beta17";
   buildInputs = [
     curl
     libkrb5
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     openssl
   ];
   buildPhase = ''
-    make USE_PGXS=1 ORIOLEDB_PATCHSET_VERSION=20
+    make USE_PGXS=1 ORIOLEDB_PATCHSET_VERSION=21
   '';
   separateDebugInfo = true;
   installPhase = ''

nix/ext/pg_wait_sampling-defaults.patch

@@ -0,0 +1,20 @@
+--- a/pg_wait_sampling.c
++++ b/pg_wait_sampling.c
+@@ -363,7 +363,7 @@
+ 							"Sets size of waits history.",
+ 							NULL,
+ 							&pgws_historySize,
+-							5000,
++							300000,
+ 							100,
+ 							/* to avoid error in collector.c:alloc_history */
+ 							MaxAllocSize / sizeof(HistoryItem),
+@@ -403,7 +403,7 @@
+ 							 "Sets whether profile should be collected per pid.",
+ 							 NULL,
+ 							 &pgws_profilePid,
+-							 true,
++							 false,
+ 							 PGC_SIGHUP,
+ 							 0,
+ 							 NULL,

nix/ext/pg_wait_sampling.nix

@@ -0,0 +1,113 @@
+{
+  pkgs,
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+  makeWrapper,
+  switch-ext-version,
+  latestOnly ? false,
+}:
+
+let
+  pname = "pg_wait_sampling";
+  build =
+    version: versionData:
+    stdenv.mkDerivation rec {
+      inherit pname version;
+
+      buildInputs = [ postgresql ];
+
+      src = fetchFromGitHub {
+        owner = "postgrespro";
+        repo = pname;
+        rev = versionData.rev or "v${version}";
+        hash = versionData.hash;
+      };
+
+      makeFlags = [ "USE_PGXS=1" ];
+
+      # Ship with different compiled-in defaults than upstream
+      patches = [ ./pg_wait_sampling-defaults.patch ];
+
+      installPhase = ''
+        mkdir -p $out/{lib,share/postgresql/extension}
+
+        # Install versioned library
+        install -Dm755 ${pname}${postgresql.dlSuffix} $out/lib/${pname}-${version}${postgresql.dlSuffix}
+
+        if [[ "${version}" == "${latestVersion}" ]]; then
+          cp ${pname}--*.sql $out/share/postgresql/extension/
+        fi
+
+        # Create versioned control file with modified module path
+        sed -e "/^default_version =/d" \
+            -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}-${version}'|" \
+          ${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
+      '';
+
+      meta = with lib; {
+        description = "Sampling based statistics of wait events";
+        homepage = "https://github.com/postgrespro/pg_wait_sampling";
+        platforms = postgresql.meta.platforms;
+        license = licenses.postgresql;
+      };
+    };
+  allVersions = (builtins.fromJSON (builtins.readFile ./versions.json)).${pname};
+  supportedVersions = lib.filterAttrs (
+    _: value: builtins.elem (lib.versions.major postgresql.version) value.postgresql
+  ) allVersions;
+  versions = lib.naturalSort (lib.attrNames supportedVersions);
+  latestVersion = lib.last versions;
+  versionsToUse =
+    if latestOnly then
+      { "${latestVersion}" = supportedVersions.${latestVersion}; }
+    else
+      supportedVersions;
+  versionsBuilt = if latestOnly then [ latestVersion ] else versions;
+  numberOfVersionsBuilt = builtins.length versionsBuilt;
+  packages = builtins.attrValues (lib.mapAttrs (name: value: build name value) versionsToUse);
+in
+pkgs.buildEnv {
+  name = pname;
+  paths = packages;
+  nativeBuildInputs = [ makeWrapper ];
+
+  pathsToLink = [
+    "/lib"
+    "/share/postgresql/extension"
+  ];
+
+  postBuild = ''
+    {
+      echo "default_version = '${latestVersion}'"
+      cat $out/share/postgresql/extension/${pname}--${latestVersion}.control
+    } > $out/share/postgresql/extension/${pname}.control
+    ln -sfn ${pname}-${latestVersion}${postgresql.dlSuffix} $out/lib/${pname}${postgresql.dlSuffix}
+
+    # checks
+    (set -x
+       test "$(ls -A $out/lib/${pname}*${postgresql.dlSuffix} | wc -l)" = "${
+         toString (numberOfVersionsBuilt + 1)
+       }"
+    )
+
+    makeWrapper ${lib.getExe switch-ext-version} $out/bin/switch_${pname}_version \
+      --prefix EXT_WRAPPER : "$out" --prefix EXT_NAME : "${pname}"
+  '';
+
+  passthru = {
+    versions = versionsBuilt;
+    numberOfVersions = numberOfVersionsBuilt;
+    inherit switch-ext-version latestOnly;
+    hasBackgroundWorker = true;
+    defaultSettings = {
+      shared_preload_libraries = [ pname ];
+    };
+    version =
+      if latestOnly then
+        latestVersion
+      else
+        "multi-" + lib.concatStringsSep "-" (map (v: lib.replaceStrings [ "." ] [ "-" ] v) versions);
+  };
+}

nix/ext/tests/default.nix

@@ -163,6 +163,9 @@ let
                   ]
                   ++ (lib.toList ((installedExtension "17").defaultSettings.shared_preload_libraries or [ ]));
                   default_table_access_method = "orioledb";
+                  # orioledb-17 is pinned to 17.11+, which added output_plugin_libraries
+                  # as an allow-list for logical decoding output plugins.
+                  output_plugin_libraries = "pgoutput, test_decoding, wal2json";
                 }
               );
               initdbArgs = [