Revision history for pg_vault_tde

This file tracks default_version bumps in pg_vault_tde.control / VERSION.
Dates are taken from git history (`git log --follow -- VERSION
pg_vault_tde.control`) or, where available, from the annotated release tag;
"in-tree" means the version string changed in this branch's history but the
commit was not (yet) tagged as a release at the time of writing. See
doc/ROADMAP.md for the full feature-by-feature history, including v1.0-v1.3.

1.7.1  (in-tree since 2026-09-05; C-only bugfixes, no SQL/catalog change —
        pg_vault_tde_build_version() distinguishes these builds from 1.7.0)
    - PSQLE-148: pg_dump_tde creates its output file with mode 0600 instead of
      leaving it to the ambient umask.  The dump is ciphertext, but its header
      carries the sealed DEK, so a world-readable file handed anyone on the
      machine an offline target.  Dumps written by earlier versions keep the
      permissions they were created with: check them and chmod 0600.
    - PSQLE-148: the passphrase-file readers — the local KMS provider and
      pg_dump_tde — now validate the descriptor they opened, via
      open(O_RDONLY|O_NOFOLLOW) + fstat() + fdopen(), instead of stat()ing the
      path and opening it in a second step.  The owner-only permission check
      could previously be side-stepped by repointing the path in between, and a
      symlink is now refused outright.
    - PSQLE-135: fix AAD relid resolution and HEAP_HASEXTERNAL on decrypt.
    - PSQLE-126: KMS GUCs are now genuinely independent settings: the provider is
      initialised on first use (tde_kms_provider()) instead of from the
      pg_vault_tde.kms_provider assign hook, so the order and the scope of the
      ALTER DATABASE SET / ALTER ROLE ... IN DATABASE SET statements no longer
      matter.  Fixes the spurious "local wallet passphrase env var ... not set"
      WARNING on every connection, and the silent use of the per-database
      default wallet_path when wallet_path was set after kms_provider.
    - The local wallet path is no longer snapshotted per backend; changing a
      KMS GUC mid-session re-initialises the provider and drops any cached KEK.
    - pg_vault_tde_wallet_status() resolves the provider before reporting, so
      wallet_open still reflects the wallet and not "nothing has opened it in
      this session yet" now that init() is lazy.
    - SHOW pg_vault_tde.wallet_path now reports the computed per-database
      default instead of an empty string (show_hook was never registered).
    - The postmaster no longer attempts to open a local wallet at startup
      (it has no database context), removing the "cannot open wallet \"\""
      WARNING from every cluster-level 'local' setup.
    - New TAP file: tap/18_guc_order_independence.t.
    - PSQLE-145: postgresqlNN-devel does not pull in clang/llvm, so the rpm
      spec declares them as BuildRequires.  Without them a rebuild from the
      SRPM in a clean buildroot — which is how mock, and therefore
      yum.postgresql.org, builds — failed on the first LLVM bitcode target.
    - PSQLE-145: the source build instructions in README.md were incomplete.
      RHEL/Rocky additionally needs EPEL and CRB (for perl(IPC::Run)),
      redhat-rpm-config and clang/llvm-devel; Debian/Ubuntu needs
      build-essential; and both need the PGDG repository for any major the
      distribution does not ship itself.  Following them on a fresh host now
      works.
    - PSQLE-144: new `make check-standalone`, which creates a throwaway
      cluster, runs the regression test and tears it down — no container, no
      KMS service, no cluster to configure.  PGXS declines `make check` for
      out-of-tree extensions, and plain `make installcheck` needs a server that
      already preloads the library, so neither was usable when building from
      source.
    - PSQLE-143: the PGXN release bundle is named after VERSION (1.7.1) rather
      than the control file's default_version (1.7), and its content is
      filtered through .gitattributes: internal CI, the wiki sources and the
      container-only test suites no longer ship inside it.
    - PSQLE-146: the PostgreSQL support tables that had drifted into three
      copies are reduced to one, and doc/pg_vault_tde.md gains a generated
      Support Matrix — which (OS, PostgreSQL) combinations are packaged, and
      which of them are actually exercised in CI rather than merely compiled —
      plus a KMS Provider Coverage table.
    - PSQLE-147: CodeQL static analysis runs over the C sources for both
      supported majors and over the workflows themselves; the two PSQLE-148
      findings above came out of its first scan.

1.7.0  (in-tree since 2026-06-09; current default_version, unreleased)
    - TOAST chunk-level storage encryption, KEK hierarchy / key rotation for
      all KMS providers, PKCS#11 / HSM support, audit logging, fixed-size
      type index key encryption for tde_btree (int4, int8, uuid, date,
      timestamptz), CREATE INDEX CONCURRENTLY / REINDEX CONCURRENTLY support
      on encrypted_heap tables.
    - See doc/ROADMAP.md "v1.7" section for the complete list.

1.6.0  (tagged 2026-05-26)
    - Local PKCS#12 wallet KMS provider (production-ready offline
      encryption): passphrase via command/env/file, dev-mode passphrase
      convenience, wallet lock/unlock, Vault-to-wallet migration.

1.5.0  (in-tree since 2026-03-04)
    - Per-table DEK isolation, online key rotation (pg_vault_tde_rotate_online),
      wire format v3 with per-tuple authenticated associated data.

1.4.0  (in-tree since 2026-02-28)
    - Containerized CI/CD pipeline, tde_btree encrypted index access method
      (AES-256-SIV), wire format v2.

1.0.0 - 1.3.0
    - Initial development: AES-256-GCM encrypted_heap Table Access Method,
      HashiCorp Vault / OpenBao KMS integration, logical decoding
      compatibility, multi_insert / background worker / health_check.
    - Not individually dated in this file; see doc/ROADMAP.md.