pgpro_wrap
pgpro_wrap — obfuscate PL/pgSQL code
Synopsis
pgpro_wrap [ -V | --version ] [ -? | --help ]
Description
pgpro_wrap is a command-line utility designed to protect the PL/pgSQL code from unauthorized viewing and modification. It transforms stored procedures and functions into an obfuscated form that remains executable by the database server but cannot be easily viewed in the system catalogs.
Usage
A typical usage workflow consists of several steps. First, a PL/pgSQL function or procedure is written in a plain text file, which must be encoded in UTF-8. This file is then processed by pgpro_wrap, which produces an output file with the .wrap suffix. The output file is subsequently loaded into the database using the psql utility. The database server automatically processes the code and creates the corresponding stored object. The resulting function or procedure is then executed normally without any additional steps.
When an attempt is made to view or edit the source code of such objects directly using client tools such as pgAdmin or through the pg_proc system catalog, only the obfuscated representation is displayed. However, if an error occurs during the execution of an obfuscated object, the error message includes the failing line in plain text. This is necessary for debugging purposes.
Usage Example
Prepare a plain text file in UTF‑8 encoding containing the PL/pgSQL function or procedure.
Obfuscate the source file using pgpro_wrap:
pgpro_wrap
source_fileThe utility creates an output file named
source_file.wrapLoad the obfuscated file into the database using psql:
psql -d
database_name-fsource_file.wrapThe database server automatically processes the code and creates the corresponding stored object.
Verify that the stored object behaves as expected, for example by executing it.
Attempt to view the source code of the created object, for example, with \df+ in psql. Only the obfuscated representation is displayed, not the original plain text.
Options
pgpro_wrap accepts the following command-line arguments:
-V--versionPrint the pgpro_wrap version and exit.
-?--helpShow help about pgpro_wrap and exit.
Notes
Be aware that the obfuscated PL/pgSQL code is displayed in plain text in the following system components:
server log files
pg_proaudit logs
statistics collected by pg_stat_statements and pgpro_stats
data provided by auto_explain
Thus, pgpro_wrap effectively prevents casual viewing and direct editing of the PL/pgSQL source code through system catalogs and client tools. However, the source code may still appear in plain text in the diagnostic contexts listed above. This is an essential property of monitoring and debugging facilities, not a limitation of the utility.