Blog
Updates, design notes, and deep dives from the SecantusDB project.
-
The errors are the feature
Summary: The errors are the feature (v0.6.0b17).
For three weeks the work was almost entirely about what SecantusDB says when something is wrong. Rejecting a malformed command is easy; rejecting it the way
mongoddoes — same code, same message, validated in the same order, so a driver's own … -
The Rust PostgreSQL server ships as a binary now
Summary: secantusd-pg has prebuilt archives for the first time, and the site now leads with the two Rust servers.
Until this week the only way to run SecantusDB's PostgreSQL server was to clone the repository, check out a WiredTiger submodule and wait for
cargo build --release. There are prebuilt archives … -
The drivers found the bugs this time
Summary: The drivers found the bugs this time (v0.6.0b16).
Six of the nine entries below started as a driver-conformance failure rather than a failing unit test, and two of them could only have been found that way. The C driver asserts on the exact text of the error …
-
Restores stopped writing 2 GB for a 2 MB backup
Summary: Restores stopped writing 2 GB for a 2 MB backup (v0.6.0b15).
A point-in-time restore used to write 2 GB to disk no matter how little data it was restoring. WiredTiger preallocates its log file to 2 GiB, that file is almost entirely zeros, and zeros compress to …
-
Writes got a lot faster, and we built the rig that proved it
Summary: Writes got a lot faster, and we built the rig that proved it (v0.6.0b14).
The block compressor changed from zlib to lz4, and it is the largest single performance change this engine has had. Profiling the daemon under sustained write load found 65% of server CPU inside …
-
Three privilege-escalation holes closed, and the PostgreSQL wire corpus from 10 files to 37
Summary: Three privilege-escalation holes closed, and the PostgreSQL wire corpus from 10 files to 37 (v0.6.0b12).
Three ways a caller could reach data its grants didn't cover are now shut. An aggregation pipeline could sidestep role-based access control outright, so a user with no read grant on a …
-
A silent lost update caught in the act, pipelined batches with real transaction semantics, and query cancellation
Summary: A silent lost update caught in the act, pipelined batches with real transaction semantics, and query cancellation (v0.6.0b11).
The headline of this release is a data-integrity fix that took three CI platforms, a paired A/B sampler, and a deterministic race harness to pin down. Statements a …
-
Large objects over Fastpath, a drop that can't wedge the engine, and TCP_NODELAY everywhere
Summary: Large objects over Fastpath, a drop that can't wedge the engine, and TCP_NODELAY everywhere (v0.6.0b10).
This release closes two of the oldest gaps a PostgreSQL client could hit. The PG server now implements the Large Object API the way pgjdbc's
LargeObjectManager(and therefore JDBCBlob/Clob) actually … -
A kill -9 crash window in the data-nonlogged mode could lose acknowledged writes — fixed
Summary: A kill -9 crash window in the data-nonlogged mode could lose acknowledged writes — fixed (v0.6.0b8).
The opt-in log-only-the-oplog mode (
data_nonlogged) wrote its stable marker — the seq recovery replays from — before running the checkpoint it describes. The marker lives in an always-WAL-logged table, so it became crash-durable immediately … -
Async oplog hardened: transactions can no longer leak ghost events
Summary: Async oplog hardened: transactions can no longer leak ghost events (v0.6.0b9).
The Rust server's opt-in async oplog (
RustServer(oplog_async=True)/secantusd-rs --oplog-async) closed out its prototype caveats. The important one was a correctness bug the hardening audit caught: a write inside a multi-document transaction handed its oplog …