Re: Offline data checksum changes can cause incorrect checksum state on standbys

> On 12 Aug 2026, at 09:55, Bertrand Drouvot <bertranddrouvot(dot)pg(at)gmail(dot)com> wrote:

> First one, is a case where a standby can enable checksum verification without its
> own pages having been checksummed, making the standby unreadable.

Thanks for the report. While I don't have a proposal ready at this time of
writing, I wanted to ACK having seen this and make it known (to RMT) that it is
being worked on.

> Therefore, I think a simpler fix is to preserve the pre-f19c0eccae96 behavior
> for offline checksum changes: they are not propagated through WAL. In the second
> repro, the standby therefore remains off, honoring its local offline change.

I wholeheartedly disagree, running a cluster with mismatched data_checksums
settings across the nodes is not a supported mode of operation, and is already
documented to not work (albeit it way too vague wording IMO). This doesn't
work as it is right now (in any version of postgres), pg_rewind or other file
based tools can break it, and we should not attempt to make it work.

Detecting a cluster with mismatched settings and safely erroring out as well as
improving the documentation is what I think we should do.

> If this looks like too much code changes so close to the v19 release, another
> option could be to remove pg_checksums --enable and --disable while keeping --check
> and require checksum state changes to be done online.

That's also not a good option, I think we need to make sure offline enabling of
checksums *if done correctly* works as intended, and if done incorrectly errors
out safely.

I have a patch proposal brewing, and I know Zsolt has been looking into it as
well. Hopefully there will be something to share very soon.

--
Daniel Gustafsson