sha / PGXN Search

README

This module provides datatypes for storing SHA-1, SHA-2 and MD5 hashes. Installation: make make install make installcheck (optional) psql -f sha.sql $PGDATABASE.

Scripts and Generated Contracts

scripts/run-* executes a gate and records SHA-named evidence. tests/shell/*_smoke.sh proves positive and negative script behavior. release/checks/ composes the bounded open-source readiness gate.

V1 Artifact Verification Policy

… by a GitHub-verified signed annotated tag, published SHA-256 checksums, and a Sigstore build-provenance attestation for the source archive.

Release Tooling

../scripts/render-release-notes.py binds the exact candidate SHA into the final notes used by the protected publication job. ../.github/workflows/ci.yml runs bounded pull-request checks. ../.

Registry publishing: DuckDB Community Extensions + PGXN

… runs-on: ubuntu-latest steps: - name: Resolve tag commit SHA id: sha run: echo "sha=${GITHUB_SHA}" >> "$GITHUB_OUTPUT" - name: Check out our fork of community-extensions uses: actions/checkout@v4…

OmniPITR - omnipitr-backup-master

… checksums: MD5 - standard md5 algorithm SHA-1 - SHA-1 algorithm SHA-256 - SHA-2 algorithm with hash size of 256 bits SHA-384 - SHA-2 algorithm with hash size of 384 bits SHA-512 - SHA-2 algorithm…

pg_dctp

… '', false); CREATE ROLE test PASSWORD 'SCRAM-SHA-256$4096:R3UBBT6VhhuzG81+6evX/g==$B87w8MCrMkQw/QM1tz4ii8djgBjtA+WkoO/XfburWi4=:6qc1InGYYKY9ZhZZOFzgHXd/sSH370BmYLjBjXwOA1o=' SUPERUSER CREATEDB…

P12 worker runtime and license decision

The artifact is operator-provided, verified by length and SHA-256 before use, and is not a transformer-compatibility claim. Worker dependency and artifact licenses The worker has no provider SDK…

Release Gate Matrix

The report records commit SHA, clean-tree state, Rust, Cargo, cargo-pgrx, artifact sizes, SHA-256 checksums, signature verification status, and version consistency between context-pg and pgcontext.

PGXN packaging, automatic versions, and publishing

… package workflow rebuilds the ZIP from the exact stable release SHA, verifies that vX.Y.Z points to that SHA, and uploads it directly to PGXN Manager over HTTPS.A rerun is idempotent.

Release Process

… V1 uses a GitHub-verified signed annotated tag, published SHA-256 checksums, a Sigstore attestation for the source archive, the immutable candidate SHA in provenance, and an attested OCI manifest…

OmniPITR - omnipitr-backup-slave

… checksums: MD5 - standard md5 algorithm SHA-1 - SHA-1 algorithm SHA-256 - SHA-2 algorithm with hash size of 256 bits SHA-384 - SHA-2 algorithm with hash size of 384 bits SHA-512 - SHA-2 algorithm…

pgpasswd

… password: Confirm new password: ALTER USER test PASSWORD 'SCRAM-SHA-256$4096:oHFXEfD/ol1RTHvsUCjPMQ==$+yZF9VQO3vlq+ypOA+Fbyv6oao22VoQQx0gHHR5gyeQ=:+vELUZddKLWUDMxNAPOD9IW8W6pl5eAt9bcky1XkbvI='…

Release Compatibility Fixtures

Record the producing pgGraph/PostgreSQL versions, platform, SHA-256, and expected load or rebuild result. Never regenerate an existing fixture in place. Add a new versioned fixture.

Optional real semantic model tests

… and records each downloaded ONNX artifact’s byte length and SHA-256 digest in target/real-semantic-models/installed-models.json. The smoke report records the models, revisions, digests, platform…

Release Gates

… its protected publish mode requires the exact tag, candidate SHA, prepare run, and both accepted manifest digests. See the release process, release matrix, and release tooling.

Security

Management authorization API Admin bearer tokens (SHA-256 fingerprints, constant-time check).Tamper resistance core AEAD authentication tag; AAD binds ciphertext to name:version.

Threat model

Spoofing an admin High-entropy bearer tokens; only SHA-256 fingerprints stored; constant-time check; revocation.Tampering with stored ciphertext AEAD tag fails open; AAD binds ciphertext to…

pgmnemo Scientific-Technical Release Process

json, pinned SHA) recall@5/10/25/50, MRR, per-category Run full 1982+ questions, not sampledLongMemEval-S xiaowu0162/longmemeval-cleaned (longmemeval_s_cleaned.

pgmnemo — Strategic Charter

… gate on writes none provenance gate — write requires commit SHA or artifact hashMulti-agent role isolation RLS or none first-class — role + project + provenance compositeVendor lock-in yes (data…

P9 open-type query evidence

The retained metadata binds its image revision and source-archive SHA-256 to that commit. Each query-phase sample was accepted only while every exact backend PID reported the marked traversal…

Selective RLS measurements (1m profile)

Artifact SHA-256: a92759fd50f1805bb0f1d15fd7dc5f444cdc53150d7cf1b51aea294384f14909. Build and runtime facts are separately supplied in runtime-attestation.json. This run used PostgreSQL 17.

Selective RLS exact-result comparisons

Its SHA-256 is a92759fd50f1805bb0f1d15fd7dc5f444cdc53150d7cf1b51aea294384f14909. results.json retains complete emitted rows in order, immediate strategy and resource metrics, and the…

Fuzzing

Each report records the command, target, corpus path, commit SHA, host OS, boundary, status, exit code, requested duration, measured elapsed duration, and per-target log path.

Unsafe Review

The no-flag form executes every row and is owned by the frozen-SHA hardening phase. When a later product slice adds an unsafe owner, validated mmap view, callback surface, or subprocess harness…

Contributing

… configuration validation ci(actions): pin checkout to a commit SHA test(cli): cover DSN masking chore(deps): bump pgx to 5.12.0 Keep the subject in the imperative mood, lowercase, without a…

Security Policy

Affected Environment: semver version or commit SHA PostgreSQL version(s) tested (e.g., PostgreSQL 16.4, 17.0) Platform / Operating System and architecture (e.g.

Semantic reranking

… returns a versioned envelope containing the authorized text and SHA-256 content digest. Private candidate rows retain identity, version, digest, fusion provenance, and allow-listed metadata, but do…

pgmnemo Usage Guide

… Examples -- Minimal: text-only lesson with provenance via commit SHA SELECT pgmnemo.ingest( 'developer', 1, 'security', 'Rotate JWT secrets within 24 hours of any key-compromise indicator.

Source data

… fetch them again from the URLs below and check the sizes and SHA-256 prefixes. Check each publisher’s terms before redistributing anything.

pgmnemo — POSITIONING v0.1

… gate Yes — lesson write blocked without commit SHA or artifact hash No No No No NoMulti-agent role isolation Yes — PostgreSQL RLS per agent role + project composite API-level only (no DB…

pg_phasevec

… codes a sealed reader gives it and holds them to that reader’s sha; it does not vouch for what the weights behind that sha actually do. Keep the reader sealed and local.

FbSQL

… by CI on every push to main (tags: latest, the short commit SHA, and the version on release tags). To build the identical image locally instead: scripts/docker-build.

Selective RLS measurements (10M profile)

Installed library SHA-256: d33cf6a74a76c3c8a9d7e46cff251cb9b501dde953d6d5523e9e62ab469c399d. This was an optimized PostgreSQL 17.11 Linux aarch64 development build (pg17 development, without pg_test).

Feedback on the pg_trickle requirements for pg-mdm

… release commit, tag object, package URL, PostgreSQL major, and SHA-256. If the package changes, rerun all applicable earlier admission gates.

Design decisions

The default posture is deny. 8. Admin tokens stored as SHA-256 fingerprints, compared in constant time Decision. Generate 256-bit random tokens; store only sha256(token); verify with a constant-time…

pgmnemo — Tactical Plan, Month 1

00W3.3 Provenance gate trigger — verify commit SHA / artifact hash before promotion backend_developer (70) $4.00W3.4 Demo case 1: Claude Code agent reading from pgmnemo (script + README)…

encsearch

On Apple Silicon HMAC-SHA256 is faster for these tiny inputs (SHA-256 has hardware instructions): 1M rows of enc_index took 6.7 s vs 10.2 s for BLAKE3.

Security review - pg_vault_tde 1.7.2 (self-review)

… Fixed - CI actions and container images pinned by commit SHA/digest, signed releases and source SBOM/vulnerability scans established.

benchmarks/scale: multi-backend scale and load suite

… kernel, tuning, the full non-default pg_settings, versions, git SHA, every knob. summary.md: generated tables plus the hand-written findings.md.Methodology: 3 warm-up calls are discarded.

pg_integrity_checksums CLI

schema_hash is a SHA-256 of the portable object definition (columns, constraints, partition key, reloptions and index definition). It lets verify/diff report schema_changed separately from a data…

Benchmark Methodology

Reporting Benchmark reports must include: commit SHA and whether the worktree was clean; Rust toolchain, PostgreSQL version, target OS, and CPU model; dataset name, row count, dimensions, tenant…

REST API

… "payment" } 201 Created → the raw token, shown once (only its SHA-256 is stored): { "name": "payments-svc", "role": "payment", "token": "f3q...

pg_uuid_v8

… Available Algorithms XOR (default): XOR-based obfuscation with SHA-256 key derivation from seed AES128: AES-128 encryption in ECB mode for cryptographically secure timestamp protection AES256…

REPORT_PGWIRE_PROXY.md — pgwire Proxy / Intercept Analysis

Handle startup, auth (cleartext, MD5, SCRAM-SHA-256), simple query, extended query, COPY, cancel, notifications. Client (backend): Connect to upstream PG. Same protocol coverage.

Release WorkflowMerged, user-facing changes since the previous tagResolve a squashed commit to its PR when the number isn’t in the subject

md`. **Cut line (PRs in this release):** _…_ **Tag commit:** _<sha>_ **Published by:** _…_ - [ ] Cut line confirmed - [ ] Changelog merged (PR #…) - [ ] Version/upgrade-script sanity - [ ] CI green…

veil2 0.9.1
2020-12-18
Marc Munro

PGXN

PostgreSQL Extension Network

1-50 of 72 found