Score:0

Howto build docker postgres image with pgcrypto sha3-512 support?

cn flag

I need to create a postgresql 11 docker image that has support for sha3-512 hash function. By default, the official postgres docker images do not support this. I already have some systems that use the official docker images. I need a new image that works exactly like the official, except that it has support for these hash functions. My idea was to create a copy of the official Dockerfile and modify it.

According to the configuration notes section here: https://www.postgresql.org/docs/11/pgcrypto.html#id-1.11.7.34.10 the SHA224/256/384/512 hash functions are supported only if postgresql was configured and built with --with-openssl

I have copied the Dockerfile and the entrypoint script from here:

https://github.com/docker-library/postgres/tree/master/11/stretch

and then, I'm stuck. I have no idea how or where to add "--with-openssl". I suspect that the configuration and compilation happens at this section:

# build .deb files from upstream's source packages (which are verified by apt-get)
            apt-get update; \
            apt-get build-dep -y \
                postgresql-common pgdg-keyring \
                "postgresql-$PG_MAJOR=$PG_VERSION" \
            ; \
            DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
                apt-get source --compile \
                    postgresql-common pgdg-keyring \
                    "postgresql-$PG_MAJOR=$PG_VERSION" \
            ; \

but at this point, I don't know what to do, or what to change.

The error itself is like this

select digest('test','sha3-512')
SQL Error [22023]: ERROR: Cannot use "sha3-512": No such hash algorithm

Seemingly, there are no additional hash algorithms added:

postgres=# \df digest
                       List of functions
 Schema | Name | Result data type | Argument data types | Type 
--------+------+------------------+---------------------+------
(0 rows)

postgres=# select * from pg_available_extensions where name='pgcrypto';
name    |default_version|installed_version|comment                |
--------+---------------+-----------------+-----------------------+
pgcrypto|1.3            |1.3              |cryptographic functions|
cn flag
If I start the official image and execute "pg_config" in it, then "--with-openssl" is present in CONFIGURE, but the sha3-512 algorithm is not available anyway. So maybe the problem is not the missing --with-openssl option. But then what?
Score:0
cn flag

After trying out different possible solutions (with some help), I found out that the postgres:11.14-bullseye works correctly and it contains all openssl hash functions. Interestingly, the default postgres:11 is missing them.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.