WPB-29582: migrate mls key packages to PostGreSQL by blackheaven · Pull Request #5646 · wireapp/wire-server

blackheaven · 2026-10-23T09:40:41Z

https://wearezeta.atlassian.net/browse/WPB-29582

Checklist

Add a new entry in an appropriate subdirectory of changelog.d
Read and follow the PR guidelines

Copilot

🟡 Changes recommended

The review found an issue that should be addressed before approval.

10 open issues

OwnDomain resolves to the static env.domain1; startDynamicBackend does not change it. Consequently… · New
Passing alice1 sends its Z-Client header. Because the target is Alice herself,… · New
This self-claim sends alice1 as Z-Client, so Brig excludes the only client and consumes no package.… · New
Brig skips the requesting client when claiming the same user's packages. Passing alice1 here… · New
The delete endpoint returns HTTP 201 in both API versions (MLSKeyPackageAPI in… · New
replaceKeyPackages calls the PUT endpoint whose successful response is HTTP 201, as specified by… · New
This claim targets the requesting user's own client, which claimLocalKeyPackages excludes using the… · New
An unmarked user keeps writing exclusively to Cassandra, but Wire.Migration.migrationLoop exits… · New
This DISTINCT query is invalid for the existing Cassandra schema. V80_KeyPackageCiphersuite.hs… · New
The Cassandra partition key is (user, client, cipher_suite), not user alone (see… · New

What changed in this PR

Adds PostgreSQL storage and migration support for MLS key packages, connecting Brig’s storage routing to a background-worker backfill.

Changes:

Introduces PostgreSQL tables, serialization, and store operations.
Adds per-user migration locking, routing, worker controls, and metrics.
Updates deployment configuration, documentation, and migration tests.

File	Description
services/galley/galley.integration.yaml	Updated as part of this pull request.
services/brig/src/Brig/CanonicalInterpreter.hs	Updated as part of this pull request.
services/brig/brig.integration.yaml	Updated as part of this pull request.
services/background-worker/test/Test/Wire/Util.hs	Updated as part of this pull request.
services/background-worker/test/Test/Wire/BackendNotificationPusherSpec.hs	Updated as part of this pull request.
services/background-worker/src/Wire/PostgresMigrations.hs	Updated as part of this pull request.
services/background-worker/src/Wire/BackgroundWorker/Options.hs	Updated as part of this pull request.
services/background-worker/src/Wire/BackgroundWorker.hs	Updated as part of this pull request.
services/background-worker/background-worker.integration.yaml	Updated as part of this pull request.
postgres-schema.sql	Updated as part of this pull request.
libs/wire-subsystems/wire-subsystems.cabal	Updated as part of this pull request.
libs/wire-subsystems/src/Wire/PostgresMigrationOpts.hs	Updated as part of this pull request.
libs/wire-subsystems/src/Wire/MlsKeyPackageStore/Postgres.hs	Updated as part of this pull request.
libs/wire-subsystems/src/Wire/MlsKeyPackageStore/Migration.hs	Updated as part of this pull request.
libs/wire-subsystems/src/Wire/MlsKeyPackageStore/Migrating.hs	Updated as part of this pull request.
libs/wire-subsystems/postgres-migrations/20261023072742-mls-key-packages.sql	Updated as part of this pull request.
libs/wire-api/test/unit/Test/Wire/API/Roundtrip/PostgresMarshall.hs	Updated as part of this pull request.
libs/wire-api/src/Wire/API/MLS/KeyPackage.hs	Updated as part of this pull request.
libs/wire-api/src/Wire/API/MLS/CipherSuite.hs	Updated as part of this pull request.
integration/test/Test/Migration/MlsKeyPackages.hs	Updated as part of this pull request.
integration/integration.cabal	Updated as part of this pull request.
hack/helm_vars/wire-server/values.yaml.gotmpl	Updated as part of this pull request.
hack/helm_vars/common.yaml.gotmpl	Updated as part of this pull request.
docs/src/developer/reference/config-options.md	Updated as part of this pull request.
charts/wire-server/values.yaml	Updated as part of this pull request.
charts/wire-server/templates/background-worker/configmap.yaml	Updated as part of this pull request.
changelog.d/5-internal/WPB-29582	Updated as part of this pull request.

_{Review effort: Balanced}

- Rename mls_key_packages column "user" -> user_id (migration SQL, hasql statements, postgres-schema.sql hand-merged from pg_dump of the migration). - Drop Wire.MlsKeyPackageStore.DualWrite entirely: key packages are one-time-use security material (claiming deletes them), so an async delete-mirror failure could resurface a claimed key package in Postgres. migration-to-postgresql now serves Cassandra from brig while the background-worker copy loop backfills Postgres; cutover is the direct config flip cassandra -> postgresql, followed by an immediate reconciliation pass (documented in Migration.hs haddock). - Fix integration test imports (createMLSClient/ciphersuites from MLS.Util) so the test compiles.

…-user marker - insertKeyPackagesPg stored ref and data swapped; PG mode was functionally broken - migration: per-user exclusive lock + copy + marker (mls_key_packages_migrated_users); already-marked users are skipped so retry passes/restarts cannot resurrect claimed one-time-use key packages; no Cassandra deletes (users precedent) - brig migration mode: new Wire.MlsKeyPackageStore.Migrating routes per user by the marker under a shared migration lock (same strategy as the users store) - integration test: assert no failed migrations; pin claim path against ref/data swap

…-demand migration - The copier enumerated users with SELECT DISTINCT user FROM mls_key_packages, which is invalid CQL (user is not the only partition key); enumerate brig's clients table instead (partition key user alone) and fan out over (client, cipher suite) point queries restricted on the full (user, client, cipher_suite) partition key. - On-demand migration in the migration-mode interpreter: an unmarked user is copied + marked under the exclusive migration lock on first routed access, so users whose first key package lands after the worker's enumeration passed them cannot lose all packages at cutover (no reconciliation pass needed). - Test: Alice on the backend domain (OwnDomain is static env.domain1), client-less Bob claims (self-claim sends Z-Client and consumes nothing), delete/replace return 201 per the MLS routes, carol pins the worker's clients-table backfill; DO-UPDATE justification comment on insertStatement (marker-gated transaction).

…gs, migration tests)

…arity

blackheaven requested review from a team as code owners October 23, 2026 09:40

zebot added the ok-to-test Approved for running tests in CI, overrides not-ok-to-test if both labels exist label Oct 23, 2026

blackheaven force-pushed the gdifolco/WPB-29582-migration-postgres-mls-key-packages branch 2 times, most recently from 20c88fe to 322caef Compare October 23, 2026 12:30

akshaymankar requested changes Oct 28, 2026

View reviewed changes

Comment thread libs/wire-subsystems/postgres-migrations/20261023072742-mls-key-packages.sql Resolved

Comment thread libs/wire-subsystems/src/Wire/MlsKeyPackageStore/DualWrite.hs Resolved

blackheaven requested a review from akshaymankar October 28, 2026 15:00

blackheaven force-pushed the gdifolco/WPB-29582-migration-postgres-mls-key-packages branch from fa20ba2 to eaa5b43 Compare November 4, 2026 11:26

akshaymankar added the easy-to-review label Nov 5, 2026

blackheaven force-pushed the gdifolco/WPB-29582-migration-postgres-mls-key-packages branch from eaa5b43 to ffbd9e8 Compare November 5, 2026 12:05

VeryMilkyJoe requested a balanced review from Copilot November 6, 2026 16:35

Copilot started reviewing on behalf of VeryMilkyJoe November 6, 2026 16:35

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

blackheaven added 6 commits November 13, 2026 10:10

WPB-29582: migrate mls key packages to PostGreSQL

3952c44

WPB-29582: remove data-migration machinery (dual-write, backfill, fla…

1492fdc

…gs, migration tests)

WPB-29582: add MigrationToPostgresql fallback arm; fix cleanup tuple …

731c461

…arity

blackheaven force-pushed the gdifolco/WPB-29582-migration-postgres-mls-key-packages branch from bd76606 to 731c461 Compare November 13, 2026 19:21

Navigation Menu

Repository navigation

WPB-29582: migrate mls key packages to PostGreSQL - #5646

WPB-29582: migrate mls key packages to PostGreSQL#5646
blackheaven wants to merge 6 commits into
developfrom
gdifolco/WPB-29582-migration-postgres-mls-key-packages

blackheaven commented Oct 23, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

blackheaven commented Oct 23, 2026

Checklist

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants