public inbox for pgsql-announce@postgresql.org
help / color / mirror / Atom feedFrom: HexaCluster via PostgreSQL Announce <announce-noreply@postgresql.org>
To: PostgreSQL Announce <pgsql-announce@lists.postgresql.org>
Subject: plpgsql_wrap v1.0 released
Date: Wed, 20 May 2026 02:30:08 +0000
Message-ID: <177924420810.800.9900559501732599882@wrigleys.postgresql.org> (raw)
Toronto, Canada - May 19th, 2026
## PostgreSQL plpgsql wrap utility
`plpgsql_wrap` is a PostgreSQL extension used to obfuscate PLPGSQL source code, making it unreadable to users while remaining fully executable by the PostgreSQL database. It is primarily used to protect intellectual property or sensitive business logic when delivering code to third parties. It is similar to the Oracle WRAP function and utility.
plpgsql_wrap v1.0 has been released, this is the first public release. It is compatible with PostgreSQL versions >= 12.
Write stored procedures with `LANGUAGE plpgsql_wrap;` source is validated, then AES-256-GCM encrypted directly into `pg_proc.prosrc`.
Users cannot look at store procedures plain text source code any more unless they know the encryption key.
pg_dump will not expose store procedures plain text source code too and the pg_dump output is directly restorable. Pre-wrapped blobs are accepted at CREATE time.
It is identical to `LANGUAGE plpgsql`, only the language name differs: `plpgsql_wrap`.
Example of use:
CREATE OR REPLACE FUNCTION public.calculate_bonus(emp_id int, yr int)
RETURNS numeric
LANGUAGE plpgsql_wrap
AS $$
DECLARE
v_salary numeric;
BEGIN
SELECT salary INTO v_salary FROM employees WHERE id = emp_id;
RETURN v_salary * 0.15; -- confidential formula
END;
$$;
-- Calling, permissions, overloading, results - all identical to plpgsql:
SELECT calculate_bonus(42, 2024);
In catalog table `pg_proc` the code is obfuscated:
SELECT substring(prosrc, 1, 50)||'...' AS wrapped_code
FROM pg_proc WHERE proname = 'calculate_bonus';
wrapped_code
-------------------------------------------------------
PLPGSQLWRAP:1:5752415001f5db365c6c185b66081ff0a23d...
(1 line)
This is also what will appears in the pg_dump output.
The `plpgsql_wrap.unwrap_procedure()` function is provided to recover the plain text source code using the encryption key. See detailed information by reading the [documentation](https://github.com/hexacluster/plpgsql_wrap/)
## Links & Credits
plpgsql_wrap is an open project. Any contribution to build a better tool is
welcome. You just have to send your ideas, features requests or patches
using the GitHub tools.
**Links :**
* Documentation: [https://github.com/hexacluster/plpgsql_wrap/](https://github.com/hexacluster/plpgsql_wrap/)
* Download: [https://github.com/hexacluster/plpgsql_wrap/releases/](https://github.com/hexacluster/plpgsql_wrap/releases/)
* Community support: use GitHub report tool at [https://github.com/hexacluster/plpgsql_wrap/issues](https://github.com/hexacluster/plpgsql_wrap/issues)
* Commercial support: [contact Hexacluster](https://hexacluster.ai/contact-us)
## About plpgsql_wrap
The objective of this extension it to provide a feature to obfuscate plpgsql source code. It is primarily used to protect intellectual property or sensitive business logic when delivering code.
This is a project created and maintained by Gilles Darold at [HexaCluster Corp](https://hexacluster.ai).
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-announce@postgresql.org
Cc: announce-noreply@postgresql.org, pgsql-announce@lists.postgresql.org
Subject: Re: plpgsql_wrap v1.0 released
In-Reply-To: <177924420810.800.9900559501732599882@wrigleys.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox