Fail fast extensions by carlopi · Pull Request #20605 · duckdb/duckdb

carlopi · 2026-01-20T11:02:54Z

Changes so that INSTALL also performs signature checks (according to database configuration).
This is somewhat redundant, BUT avoids cases where one might successful install an extension that can't be then loaded.

Logic is as follows:

files ending in ".duckdb_extension" can only be created in the INSTALL path
when moving, either ending ".duckdb_extension" is present both in source and target, OR it should not be present on target
on install, we first verify signature of the buffer, then copy data to "name.tmp-UUID.duckdb_extension", then move it to "name.duckdb_extension". Note that this is legal with both 1 & 2, and makes so that all files (written by duckdb) that ends in '.duckdb_extension' are signature checked
on load, we load only from files eneding in ".duckdb_extension"

Basically there are 3 families of files:

A: those ending in '.duckdb_extension'
B. the other files

B can be created and moved into freely
A can only be created during install path (since it's the only place where we pass the flag, and we will only create B)
A can only be moved into from other A files, while A can be moved to a B
A is the only type of file we would load from

…AsDuckDBExtension

… or moved in default situations For creations, opening a file for writing is forbidden if the relevant flag is missing For moveing A into B, either B is NOT an extension, or both A AND B are extensions Note that this means temporary files are also named ending in '.duckdb_extension'

… extensions are enabled) This enforces that extensions are only loaded if ending in '.duckdb_extension' For development reasons, LOAD <path> is still possible when extension signature checks are disabled

…o load

…ding from path

samansmink

Looks great! left a few comments

Mytherin

Looks good - some comments from my side

Mytherin · 2026-01-20T11:15:32Z

+			target_file->Close();
+			target_file.reset();
+			fs.TryRemoveFile(path);
+			throw IOException("Attempting to install an extension file that hasn't a valid signature, see "


Maybe use the error manager here similar to what we do for ErrorType::UNSIGNED_EXTENSION so we can override suggestions for it

Yes, that would be cleaner, but I opted NOT to add them, given this will require changes client side for a patch release.
This can be considered for v1.5.0.

Mytherin · 2026-01-20T11:31:15Z

 		VerifyCanAccessFile(source);
 		VerifyCanAccessFile(target);
+		if (StringUtil::EndsWith(target, "duckdb_extension") && !StringUtil::EndsWith(source, "duckdb_extension")) {
+			throw PermissionException("File '%s' cannot be moved to '%s' due to the suffix 'duckdb_extension'", source,


On that note - we should only check this if allow_unsigned_extensions is enabled.

It would also be nicer if this was pushed into VerifyCanAccessFile somehow - e.g. by pushing in the action:

VerifyCanAccessFile(source, FileOperationType::MOVE_FILE)

On that note - we should only check this if allow_unsigned_extensions is enabled.

I opted here to implement this independently from allow_unsigned_extensions flag, basically duckdb will never write to files ending in allow_unsigned_extensions, and never move them (but if both are extensions), and signature checks are independent and performed on LOAD or now INSTALL (and those will have the check on allow_unsigned_extensions or whether community extensions are enabled or not.

carlopi · 2026-01-21T08:43:33Z

There are still two comments not properly handled.

…uffer (already in memory) Use those to check for signature validity BEFORE writing temporary extension file to disk

Fail fast extensions (duckdb/duckdb#20605)

Fail fast extensions (duckdb/duckdb#20605) Co-authored-by: krlmlr <krlmlr@users.noreply.github.com>

Tested on fork's CI to be working, according to changes that landed in #20605. Should make so nightly CI for `v1.4-varieagata` (and later other brances as well) should pass for "Extension updating test".

carlopi added 3 commits January 20, 2026 10:54

Add FileFlags::FILE_FLAGS_ENABLE_DUCKDB_EXTENSION and function Enable…

668edab

…AsDuckDBExtension

Loading extensions from arbitrary paths is forbidden (unless unsigned…

7329f12

… extensions are enabled) This enforces that extensions are only loaded if ending in '.duckdb_extension' For development reasons, LOAD <path> is still possible when extension signature checks are disabled

carlopi marked this pull request as draft January 20, 2026 11:17

carlopi added 2 commits January 20, 2026 12:20

Forbid install of extensions whose current DBConfig would not allow t…

887dfd2

…o load

Fix test/sql/extensions/checked_load.test, now failure more is on loa…

03ae81a

…ding from path

carlopi force-pushed the fail_fast_extensions branch from b8eb198 to 03ae81a Compare January 20, 2026 11:20

carlopi marked this pull request as ready for review January 20, 2026 11:20

samansmink reviewed Jan 20, 2026

View reviewed changes

Comment thread src/include/duckdb/common/opener_file_system.hpp Outdated

Comment thread src/include/duckdb/common/opener_file_system.hpp Outdated

Comment thread src/main/extension/extension_install.cpp Outdated

Comment thread src/main/extension/extension_load.cpp Outdated

Mytherin reviewed Jan 20, 2026

View reviewed changes

Move check on extension ending

6022f2e

carlopi marked this pull request as draft January 20, 2026 12:56

carlopi added 2 commits January 20, 2026 14:44

Open extension tempo file both for WRITE and READ

4fb64b8

D_ASSERT into InternalExceptions

483daa0

carlopi force-pushed the fail_fast_extensions branch 2 times, most recently from 5586e21 to e30ba53 Compare January 20, 2026 15:04

Fixup error messages

3791a27

carlopi force-pushed the fail_fast_extensions branch from e30ba53 to 3791a27 Compare January 20, 2026 19:36

carlopi marked this pull request as ready for review January 21, 2026 08:42

Rename variables

7ce6137

duckdb-draftbot marked this pull request as draft January 21, 2026 10:16

carlopi marked this pull request as ready for review January 21, 2026 10:16

carlopi force-pushed the fail_fast_extensions branch from b826c86 to 3abba50 Compare January 21, 2026 10:21

duckdb-draftbot marked this pull request as draft January 21, 2026 10:21

Refactor using utility functions

9ab4b88

carlopi force-pushed the fail_fast_extensions branch from 3abba50 to 9ab4b88 Compare January 21, 2026 10:22

carlopi marked this pull request as ready for review January 21, 2026 10:22

carlopi requested a review from samansmink January 21, 2026 10:25

carlopi mentioned this pull request Jan 21, 2026

Fail fast extension #20551

Closed

carlopi marked this pull request as draft January 21, 2026 14:06

carlopi force-pushed the fail_fast_extensions branch from 1347c9d to d5dcf30 Compare January 21, 2026 14:06

carlopi marked this pull request as ready for review January 21, 2026 14:06

carlopi marked this pull request as draft January 21, 2026 14:20

carlopi force-pushed the fail_fast_extensions branch from d5dcf30 to c195649 Compare January 21, 2026 14:20

carlopi marked this pull request as ready for review January 21, 2026 14:21

samansmink reviewed Jan 21, 2026

View reviewed changes

Restructure Extension Checking code, to allow versions that takes a b…

601e3d7

…uffer (already in memory) Use those to check for signature validity BEFORE writing temporary extension file to disk

carlopi force-pushed the fail_fast_extensions branch 2 times, most recently from 837b514 to f0b38e6 Compare January 21, 2026 15:34

duckdb-draftbot marked this pull request as draft January 21, 2026 16:17

carlopi marked this pull request as ready for review January 21, 2026 16:28

carlopi force-pushed the fail_fast_extensions branch from 55eaf54 to 1668d9a Compare January 21, 2026 16:48

duckdb-draftbot marked this pull request as draft January 21, 2026 16:50

carlopi marked this pull request as ready for review January 21, 2026 17:05

carlopi marked this pull request as draft January 21, 2026 17:14

carlopi added 3 commits January 21, 2026 21:13

Refactor

ee64c87

Refactor ComputeSHA256Buffer to take same arguments

fca9892

Template ComputeHashesOnSegments to reuse code

79b498b

carlopi force-pushed the fail_fast_extensions branch from 1668d9a to 79b498b Compare January 21, 2026 20:13

carlopi marked this pull request as ready for review January 21, 2026 20:13

carlopi added the Ready For Review label Jan 22, 2026

carlopi requested a review from samansmink January 22, 2026 08:29

samansmink approved these changes Jan 22, 2026

View reviewed changes

lnkuiper merged commit 6ddac80 into duckdb:v1.4-andium Jan 22, 2026
61 checks passed

github-actions Bot pushed a commit to duckdb/duckdb-r that referenced this pull request Jan 22, 2026

vendor: Update vendored sources to duckdb/duckdb@6ddac80

6eacd60

Fail fast extensions (duckdb/duckdb#20605)

github-actions Bot mentioned this pull request Jan 22, 2026

vendor: Update vendored sources to duckdb/duckdb@6ddac802ffa9bcfbcc3f5f0d71de5dff9b0bc250 duckdb/duckdb-r#2014

Merged

github-actions Bot added a commit to duckdb/duckdb-r that referenced this pull request Jan 22, 2026

vendor: Update vendored sources to duckdb/duckdb@6ddac80 (#2014)

6b8d9de

Fail fast extensions (duckdb/duckdb#20605) Co-authored-by: krlmlr <krlmlr@users.noreply.github.com>

carlopi mentioned this pull request Feb 2, 2026

Fixup test/extension/update_extensions_ci.test [v1.4-andium] #20777

Merged

Conversation

carlopi commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

samansmink left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mytherin left a comment

Choose a reason for hiding this comment

Uh oh!

Mytherin Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

carlopi Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mytherin Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Mytherin Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

carlopi Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

carlopi commented Jan 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

carlopi commented Jan 20, 2026 •

edited

Loading

carlopi Jan 21, 2026 •

edited

Loading