6c00f6e30f
The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 14.3, 13.7, 12.11, 11.16, and 10.21. This release fixes over 50 bugs reported over the last three months. This release closes one security vulnerability and fixes over 50 bugs reported over the last three months. We encourage you to install this update at your earliest possible convenience. If you have any GiST indexes on columns using the ltree data type, you will need to reindex them after upgrading. For the full list of changes, please review the release notes. It also fixes a security issue, CVE-2022-1552: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox. Versions Affected: 10 - 14. The security team typically does not test unsupported versions, but this problem is quite old. Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck made incomplete efforts to operate safely when a privileged user is maintaining another user's objects. Those commands activated relevant protections too late or not at all. An attacker having permission to create non-temp objects in at least one schema could execute arbitrary SQL functions under a superuser identity. While promptly updating PostgreSQL is the best remediation for most users, a user unable to do that can work around the vulnerability by disabling autovacuum, not manually running the above commands, and not restoring from output of the pg_dump command. Performance may degrade quickly under this workaround. VACUUM is safe, and all commands are fine when a trusted user owns the target object. Security: 157ce083-d145-11ec-ab9b-6cc21735f730 Release notes: https://www.postgresql.org/docs/release/
365 lines
10 KiB
Makefile
365 lines
10 KiB
Makefile
# Created by: Marc G. Fournier <scrappy@FreeBSD.org>
|
|
|
|
PORTNAME?= postgresql
|
|
DISTVERSION?= 14.3
|
|
# PORTREVISION must be ?= otherwise, all slave ports get this PORTREVISION and
|
|
# not their own. Probably best to keep it at ?=0 when reset here too.
|
|
PORTREVISION?= 0
|
|
CATEGORIES?= databases
|
|
MASTER_SITES= PGSQL/source/v${DISTVERSION}
|
|
PKGNAMESUFFIX?= ${PORTVERSION:R}${COMPONENT}
|
|
|
|
MAINTAINER?= pgsql@FreeBSD.org
|
|
COMMENT?= PostgreSQL is the most advanced open-source database available anywhere
|
|
|
|
LICENSE= PostgreSQL
|
|
|
|
.if ${DISTVERSION:C/([0-9]*).*/\1/} >= 10
|
|
CONFLICTS+= ${PORTNAME}9* ${PORTNAME}1[^${PORTVERSION:R:C/.*([0-9]$)/\\1/}]*
|
|
.else
|
|
CONFLICTS+= ${PORTNAME}9[^${PORTVERSION:R:E}]* ${PORTNAME}1[0-9]*
|
|
.endif
|
|
|
|
WRKSRC= ${WRKDIR}/postgresql-${DISTVERSION}
|
|
DIST_SUBDIR= postgresql
|
|
|
|
OPTIONS_SUB= yes
|
|
|
|
PKGINSTALL?= ${PKGDIR}/pkg-install${COMPONENT}
|
|
USES+= tar:bzip2 cpe
|
|
.if !defined(NO_BUILD)
|
|
USES+= gmake
|
|
GNU_CONFIGURE= yes
|
|
.endif
|
|
|
|
PG_USER?= postgres
|
|
PG_GROUP?= postgres
|
|
PG_UID?= 770
|
|
|
|
LDFLAGS+= -L${LOCALBASE}/lib
|
|
INCLUDES+= -I${LOCALBASE}/include
|
|
CONFIGURE_ARGS+=--with-libraries=${PREFIX}/lib \
|
|
--with-includes=${PREFIX}/include \
|
|
--enable-thread-safety
|
|
CONFIGURE_ENV+= INCLUDES="${INCLUDES}" \
|
|
PTHREAD_LIBS="-lpthread" \
|
|
LDFLAGS_SL="${LDFLAGS_SL}"
|
|
LDFLAGS+= -lpthread
|
|
MAKE_ENV= MAKELEVEL=0
|
|
|
|
PLIST= ${PKGDIR}/pkg-plist${COMPONENT}
|
|
|
|
INSTALL_DIRS?= src/common src/timezone src/backend \
|
|
src/backend/utils/mb/conversion_procs \
|
|
src/backend/snowball src/backend/replication/libpqwalreceiver \
|
|
src/backend/replication/pgoutput \
|
|
src/bin/initdb src/bin/pg_ctl \
|
|
src/bin/pg_archivecleanup src/bin/pg_basebackup \
|
|
src/bin/pg_checksums \
|
|
src/bin/pg_controldata src/bin/pg_resetwal src/pl \
|
|
src/bin/pg_rewind \
|
|
src/bin/pg_test_fsync src/bin/pg_test_timing \
|
|
src/bin/pg_waldump src/bin/pg_upgrade
|
|
|
|
BUILD_DIRS?= src/port ${INSTALL_DIRS}
|
|
INSTALL_TARGET?=install-strip
|
|
|
|
.if !defined(CLIENT_ONLY) && !defined(SLAVE_ONLY)
|
|
SERVER_ONLY= yes
|
|
COMPONENT= -server
|
|
USE_RC_SUBR= postgresql
|
|
USES+= pgsql:${DISTVERSION:C/([0-9]\.?[0-9]).*/\1/g}
|
|
USERS= ${PG_USER}
|
|
GROUPS= ${PG_GROUP}
|
|
SUB_FILES+= 502.pgsql
|
|
.endif
|
|
|
|
OPTIONS_SUB= yes
|
|
|
|
.if defined(CLIENT_ONLY)
|
|
OPTIONS_DEFINE+=LIBEDIT DOCS
|
|
LIBEDIT_DESC= Use non-GPL libedit instead of readline
|
|
.else
|
|
MAKE_ENV+= PATH=${PREFIX}/bin:${PATH}
|
|
CONFIGURE_ENV+= PATH=${PREFIX}/bin:${PATH}
|
|
.endif
|
|
|
|
.if defined(SERVER_ONLY)
|
|
OPTIONS_DEFINE= DTRACE LDAP INTDATE TZDATA XML DOCS
|
|
LDAP_DESC= Build with LDAP authentication support
|
|
TZDATA_DESC= Use internal timezone database
|
|
XML_DESC= Build with XML data type
|
|
|
|
DTRACE_CONFIGURE_ENABLE=dtrace
|
|
DTRACE_LDFLAGS= -lelf
|
|
DTRACE_INSTALL_TARGET= install
|
|
|
|
.if ${DISTVERSION:C/([0-9]*).*/\1/} >= 14
|
|
OPTIONS_DEFINE+= LZ4
|
|
OPTIONS_DEFAULT+= LZ4
|
|
LZ4_DESC= Build with LZ4 compression support
|
|
LZ4_CONFIGURE_WITH= lz4
|
|
LZ4_LIB_DEPENDS+= liblz4.so:archivers/liblz4
|
|
.endif
|
|
|
|
.if ${DISTVERSION:C/([0-9]*).*/\1/} >= 11
|
|
OPTIONS_DEFINE+= LLVM
|
|
OPTIONS_DEFAULT+= LLVM
|
|
LLVM_DESC= Build with support for JIT-compiling expressions
|
|
OPTIONS_EXCLUDE+= ${OPTIONS_EXCLUDE_${ARCH}_${OSREL:R}}
|
|
OPTIONS_EXCLUDE_powerpc64_12= LLVM
|
|
.endif
|
|
|
|
.if ${DISTVERSION:C/([0-9]*).*/\1/} < 10
|
|
# See http://people.freebsd.org/~girgen/postgresql-icu/README.html for more info
|
|
OPTIONS_DEFINE+= ICU
|
|
ICU_DESC= Use ICU for unicode collation
|
|
.else
|
|
CONFIGURE_ARGS+=--with-icu
|
|
LIB_DEPENDS+= libicudata.so:devel/icu
|
|
USES+= pkgconfig
|
|
.endif
|
|
|
|
# See http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/76999 for more info
|
|
# (requires dump/restore if modified.)
|
|
OPTIONS_DEFINE+= INTDATE
|
|
INTDATE_DESC= Builds with 64-bit date/time type
|
|
OPTIONS_DEFAULT+= INTDATE
|
|
.endif
|
|
|
|
.if !defined(SLAVE_ONLY)
|
|
OPTIONS_DEFINE+= NLS PAM GSSAPI OPTIMIZED_CFLAGS DEBUG DOCS
|
|
. if ${DISTVERSION:R} == 9.2 || ${DISTVERSION:R} == 9.3
|
|
OPTIONS_RADIO= KRB5
|
|
OPTIONS_RADIO_KRB5= MIT_KRB5 HEIMDAL_KRB5
|
|
. endif
|
|
|
|
KRB5_DESC= Build with kerberos provider support
|
|
NLS_DESC= Use internationalized messages
|
|
PAM_DESC= Build with PAM Support
|
|
MIT_KRB5_DESC= Build with MIT kerberos support
|
|
HEIMDAL_KRB5_DESC= Builds with Heimdal kerberos
|
|
GSSAPI_DESC= Build with GSSAPI support
|
|
OPTIMIZED_CFLAGS_DESC= Builds with compiler optimizations (-O3)
|
|
|
|
OPTIONS_DEFINE+= SSL
|
|
SSL_DESC= Build with OpenSSL support
|
|
|
|
OPTIONS_DEFAULT+= SSL
|
|
|
|
GSSAPI_CONFIGURE_WITH= gssapi
|
|
.endif # !SLAVE_ONLY
|
|
|
|
.if defined(CLIENT_ONLY)
|
|
LIBEDIT_CONFIGURE_ON+=--with-libedit-preferred
|
|
LIBEDIT_USES= libedit
|
|
LIBEDIT_USES_OFF= readline
|
|
.endif # CLIENT_ONLY
|
|
|
|
SSL_USES= ssl
|
|
SSL_CONFIGURE_WITH= openssl
|
|
|
|
PAM_CONFIGURE_WITH= pam
|
|
|
|
XML_CONFIGURE_WITH= libxml
|
|
XML_LIB_DEPENDS= libxml2.so:textproc/libxml2
|
|
|
|
TZDATA_CONFIGURE_OFF= --with-system-tzdata=/usr/share/zoneinfo
|
|
|
|
INTDATE_CONFIGURE_OFF= --disable-integer-datetimes
|
|
|
|
NLS_CONFIGURE_ENABLE= nls
|
|
NLS_USES= gettext
|
|
|
|
LDAP_CONFIGURE_WITH= ldap
|
|
LDAP_USE= OPENLDAP=yes
|
|
|
|
OPTIMIZED_CFLAGS_CFLAGS=-O3 -funroll-loops
|
|
|
|
DEBUG_CONFIGURE_ENABLE= debug
|
|
|
|
PLIST_SUB+= PG_USER=${PG_USER} \
|
|
PG_USER_regex=[[:<:]]${PG_USER}[[:>:]] \
|
|
PG_GROUP=${PG_GROUP} \
|
|
PG_GROUP_regex=[[:<:]]${PG_GROUP}[[:>:]]
|
|
SUB_LIST+= PG_GROUP=${PG_GROUP} \
|
|
PG_USER=${PG_USER} \
|
|
PG_UID=${PG_UID}
|
|
|
|
.include <bsd.port.options.mk>
|
|
|
|
.if ${ARCH} == "i386"
|
|
USES+= compiler:gcc-c++11-lib
|
|
.else
|
|
USES+= compiler
|
|
.endif
|
|
|
|
.if ${DISTVERSION:C/([0-9]*).*/\1/} < 10
|
|
. if ( defined(SERVER_ONLY) && ${PORT_OPTIONS:MICU} ) || make(makesum)
|
|
USES+= autoreconf
|
|
CONFIGURE_ARGS+=--with-icu
|
|
PATCH_SITES+= http://people.freebsd.org/~girgen/postgresql-icu/:icu
|
|
PATCHFILES+= ${ICU_PATCHFILE}:icu
|
|
LIB_DEPENDS+= libicudata.so:devel/icu
|
|
. endif
|
|
.endif # server && version < 10
|
|
|
|
.if !defined(SLAVE_ONLY)
|
|
|
|
PATCH_DIST_STRIP=-p1
|
|
|
|
.if ${PORT_OPTIONS:MGSSAPI}
|
|
.if empty(PORT_OPTIONS:MMIT_KRB5) && empty(PORT_OPTIONS:MHEIMDAL_KRB5)
|
|
# Kerberos libraries will pull the proper GSSAPI library
|
|
# via linker dependencies, but otherwise we must specify
|
|
# it explicitely: ld --as-needed is used for compilation,
|
|
# so configure's -lgssapi_krb5 won't go.
|
|
LDFLAGS+= -lgssapi
|
|
LDFLAGS_SL+= -lgssapi
|
|
.endif
|
|
.endif
|
|
|
|
. if ${PORT_OPTIONS:MMIT_KRB5}
|
|
. if defined(IGNORE_WITH_SRC_KRB5) && (exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config))
|
|
IGNORE= requires that you remove heimdal\'s /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/src.conf to build successfully with MIT-KRB
|
|
. else
|
|
CONFIGURE_ARGS+=--with-krb5
|
|
# Allow defining a home built MIT Kerberos by setting KRB5_HOME
|
|
. if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config)
|
|
LIB_DEPENDS+= libkrb5.so.3:security/krb5
|
|
. endif
|
|
. endif
|
|
. endif
|
|
|
|
. if ${PORT_OPTIONS:MHEIMDAL_KRB5}
|
|
CONFIGURE_ARGS+=--with-krb5
|
|
. endif
|
|
|
|
.endif # !SLAVE_ONLY
|
|
|
|
# For testing files in FILESDIR
|
|
.include <bsd.port.pre.mk>
|
|
|
|
.if ${PORT_OPTIONS:MLLVM}
|
|
CONFIGURE_ARGS+= --with-llvm
|
|
BUILD_DEPENDS+= llvm${PG_LLVM_VERSION}>0:devel/llvm${PG_LLVM_VERSION}
|
|
BUILD_DEPENDS+= llvm-config${PG_LLVM_VERSION}:devel/llvm${PG_LLVM_VERSION}
|
|
RUN_DEPENDS+= llvm-config${PG_LLVM_VERSION}:devel/llvm${PG_LLVM_VERSION}
|
|
CONFIGURE_ENV+= LLVM_CONFIG=${LOCALBASE}/bin/llvm-config${PG_LLVM_VERSION}
|
|
.endif
|
|
|
|
# Convert LLVM_DEFAULT to COMPILER_VERSION format to make it
|
|
# suitable for version comparison.
|
|
.if ${LLVM_DEFAULT} >= 70 && ${LLVM_DEFAULT} <= 90
|
|
LLVM_DEFAULT_VERSION= ${LLVM_DEFAULT}
|
|
.else
|
|
LLVM_DEFAULT_VERSION= ${LLVM_DEFAULT}0
|
|
.endif
|
|
|
|
# Convert COMPILER_VERSION to LLVM_DEFAULT format to make it
|
|
# suitable for LLVM port name.
|
|
# All supported FreeBSD versions have Clang 10.0.1 or later.
|
|
LLVM_PORT_SUFFIX= ${COMPILER_VERSION:C/.$//}
|
|
|
|
# sync LLVM to the preferred compiler if possible
|
|
# or else use a lower version compiler that is compatible
|
|
.if ${COMPILER_VERSION} > ${LLVM_DEFAULT_VERSION}
|
|
# LLVM versions in ports are, in order, 70, 80 90, 10, 11, 12... where 10 > 90. [sic]
|
|
. if ${LLVM_PORT_SUFFIX} < 70
|
|
# PR 261976 postgresql fails to build with LLVM 14
|
|
. if ${LLVM_PORT_SUFFIX} > 13
|
|
PG_LLVM_VERSION=13
|
|
PG_COMPILER_VERSION=13
|
|
. else
|
|
PG_LLVM_VERSION=${LLVM_PORT_SUFFIX}
|
|
PG_COMPILER_VERSION=${LLVM_PORT_SUFFIX}
|
|
. endif
|
|
. else
|
|
PG_LLVM_VERSION=11
|
|
PG_COMPILER_VERSION=11
|
|
. endif
|
|
.else
|
|
. if ${LLVM_PORT_SUFFIX} > 13
|
|
PG_LLVM_VERSION=13
|
|
PG_COMPILER_VERSION=13
|
|
. else
|
|
PG_LLVM_VERSION=${LLVM_DEFAULT}
|
|
PG_COMPILER_VERSION=${LLVM_PORT_SUFFIX}
|
|
. endif
|
|
.endif
|
|
|
|
.if ${DISTVERSION:C/([0-9]*).*/\1/} >= 11
|
|
. if defined(SERVER_ONLY) && ${PORT_OPTIONS:MLLVM}
|
|
INSTALL_DIRS+= src/backend/jit/llvm
|
|
. if ${LLVM_PORT_SUFFIX} != ${PG_COMPILER_VERSION}
|
|
LLVM_CONFIGURE_ARGS?= CC=${LOCALBASE}/bin/clang${PG_COMPILER_VERSION}
|
|
. endif
|
|
. endif
|
|
.endif
|
|
|
|
.if defined(SERVER_ONLY)
|
|
pre-build:
|
|
@${SH} ${PKGINSTALL} ${PORTNAME} PRE-INSTALL
|
|
.endif
|
|
|
|
.if !defined(NO_BUILD) && !target(do-build)
|
|
|
|
do-build:
|
|
@ cd ${WRKSRC}/src/backend && ${SETENV} ${MAKE_ENV} ${MAKE_CMD} symlinks
|
|
@ for dir in ${BUILD_DIRS}; do \
|
|
cd ${WRKSRC}/$${dir} && ${SETENV} ${MAKE_ENV} ${MAKE_CMD} ; \
|
|
done
|
|
|
|
. if exists(${FILESDIR}/pkg-message${COMPONENT}.in)
|
|
SUB_FILES+= pkg-message${COMPONENT}
|
|
PKGMESSAGE= ${WRKSRC}/pkg-message${COMPONENT}
|
|
. endif
|
|
. if exists(${FILESDIR}/pkg-install${COMPONENT}.in)
|
|
SUB_FILES+= pkg-install${COMPONENT}
|
|
. endif
|
|
|
|
post-patch:
|
|
. if defined(SERVER_ONLY) && ${PORT_OPTIONS:MICU}
|
|
@${REINPLACE_CMD} \
|
|
-e '/m4_PACKAGE_VERSION/s/\[2\.6[0-9]\]/m4_defn([m4_PACKAGE_VERSION])/' \
|
|
-e '/icu/s/_57//' \
|
|
${WRKSRC}/configure.in
|
|
. elif defined(CLIENT_ONLY) && !defined(OPENSSL_PORT)
|
|
@${REINPLACE_CMD} \
|
|
-e '/^PKG_CONFIG_REQUIRES_PRIVATE = libssl libcrypto/d' \
|
|
${WRKSRC}/src/interfaces/libpq/Makefile
|
|
. endif
|
|
|
|
do-install:
|
|
@for dir in ${INSTALL_DIRS}; do \
|
|
cd ${WRKSRC}/$${dir} && \
|
|
${SETENV} ${MAKE_ENV} ${MAKE_CMD} ${MAKE_ARGS} ${INSTALL_TARGET}; \
|
|
done
|
|
. if defined(SERVER_ONLY)
|
|
@ ${MKDIR} ${STAGEDIR}${PREFIX}/share/postgresql ;\
|
|
${MKDIR} ${STAGEDIR}${PREFIX}/etc/periodic/daily ;\
|
|
${INSTALL_SCRIPT} ${WRKDIR}/502.pgsql \
|
|
${STAGEDIR}${PREFIX}/etc/periodic/daily
|
|
. endif # SERVER_ONLY
|
|
. if defined(CLIENT_ONLY)
|
|
@ cd ${WRKSRC}/src && ${SETENV} ${MAKE_ENV} ${MAKE_CMD} ${MAKE_ARGS} install-local
|
|
. endif
|
|
@ if [ -r ${PKGMESSAGE} ]; then \
|
|
${MKDIR} ${STAGEDIR}${DOCSDIR} ;\
|
|
${INSTALL_DATA} ${PKGMESSAGE} ${STAGEDIR}${DOCSDIR}/README${COMPONENT} ;\
|
|
fi
|
|
.endif # !NO_BUILD
|
|
|
|
.if defined(SERVER_ONLY)
|
|
check:
|
|
@if [ `id -u` != 0 ] ; then \
|
|
${ECHO} "Running postgresql regressions tests" ;\
|
|
cd ${WRKSRC}; ${MAKE_CMD} check ;\
|
|
else \
|
|
${ECHO} "You cannot run regression tests when postgresql is built as user root." ; \
|
|
${ECHO} "Clean and rebuild the port as a regular user to run the tests." ;\
|
|
fi
|
|
.endif
|
|
|
|
.include <bsd.port.post.mk>
|