mirror of
https://github.com/postgres/postgres.git
synced 2026-10-23 13:29:09 +03:00
227f8ea19a
pg_rewind installs the source's control file on the target, but every block it does not copy keeps the target's content. With checksums enabled on the target and disabled on the source, the rewound server claims enabled checksums while the blocks copied from the source have none, and fails checksum verification as soon as it reads them; in the worst case every connection attempt dies on an unverifiable catalog page. Comparing the control files is not enough. Replay on the rewound server resumes from the last common checkpoint and adopts the data checksum state recorded there, so an offline disable on the source after the divergence leaves both control files saying "off" while the rewound server still resumes with verification enabled. Check the state carried by the divergence checkpoint as well, which pg_rewind already reads. Refuse both cases, and an interrupted online transition on either side, same as pg_checksums does. The opposite mismatch, checksums on the source only, is allowed with a warning: recovery under the backup label adopts the divergence state, so the rewound server keeps checksums disabled (or converges through the replayed WAL if the source enabled them online), and no page can fail verification. Author: Zsolt Parragi <zsolt.parragi@percona.com> Reviewed-by: Bertrand Drouvot <bertranddrouvot.pg@gmail.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Discussion: https://postgr.es/m/anwm6UPxoVS41QA2@bdtpg Backpatch-through: 19