From 254299631e059c489b7b58d94db04f35d5004429 Mon Sep 17 00:00:00 2001 From: Rui Zhao Date: Mon, 10 Aug 2026 11:45:35 +0800 Subject: [PATCH] pg_dump: register the dangling-initprivs test, and let it see SET SESSION AUTHORIZATION Two test-only fixes on top of v8. src/bin/pg_dump/meson.build lists the TAP tests one by one, and 008_pg_dump_dangling_initprivs.pl was not added to it, so the test only runs under the make build (whose prove_check globs t/*.pl) and never under meson -- which is what CI uses. The --binary-upgrade check looks for a bare numeric OID in a GRANT or a REVOKE. A dangling grantor does not appear there: it appears in the SET SESSION AUTHORIZATION that dumpACL() wraps the initial-privileges block in, which is the exact command that failed in the original report. Add a separate assertion for it. Removing only the grantor half of SAFE_INITPRIVS leaves a --binary-upgrade dump whose only bare OID is in a SET SESSION AUTHORIZATION ""; line, which the existing assertion accepts and the new one rejects. --- src/bin/pg_dump/meson.build | 1 + src/bin/pg_dump/t/008_pg_dump_dangling_initprivs.pl | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/src/bin/pg_dump/meson.build b/src/bin/pg_dump/meson.build index 79bd503684..5c338d5c98 100644 --- a/src/bin/pg_dump/meson.build +++ b/src/bin/pg_dump/meson.build @@ -103,6 +103,7 @@ tests += { 't/004_pg_dump_parallel.pl', 't/005_pg_dump_filterfile.pl', 't/006_pg_dump_compress.pl', + 't/008_pg_dump_dangling_initprivs.pl', 't/010_dump_connstr.pl', ], }, diff --git a/src/bin/pg_dump/t/008_pg_dump_dangling_initprivs.pl b/src/bin/pg_dump/t/008_pg_dump_dangling_initprivs.pl index 5fcfc29a31..46067d0dab 100644 --- a/src/bin/pg_dump/t/008_pg_dump_dangling_initprivs.pl +++ b/src/bin/pg_dump/t/008_pg_dump_dangling_initprivs.pl @@ -224,4 +224,11 @@ unlike( qr/^(?:GRANT|REVOKE)\b.*\b(?:TO|FROM)\s+"(?!007")[0-9]+"/m, 'case 9: no GRANT/REVOKE with bare numeric OID under --binary-upgrade'); +# A dangling *grantor* never appears as a numeric role name in GRANT or +# REVOKE: it appears in the SET SESSION AUTHORIZATION that dumpACL() wraps +# the initial-privileges block in, which is the command that failed in the +# original report. The check above cannot see that, so check it separately. +unlike($dump_bu, qr/^SET SESSION AUTHORIZATION "(?!007")[0-9]+"/m, + 'case 9: no SET SESSION AUTHORIZATION naming a bare numeric OID'); + done_testing(); -- 2.43.7