## Summary `DSN.String` in `registry/datastore/db.go` builds the keyword/value connection string that `sqlConnector.Open` passes to `pgx.ParseConfig`. It escapes a space as `\ ` and a single quote as `\'`, and leaves backslashes as they are. pgx skips the character after a backslash while it looks for the end of a value, and then only decodes `\\` and `\'`, so the backslash in front of a space stays in the parsed value. This affects the `user`, `password`, `dbname`, `sslcert`, `sslkey` and `sslrootcert` settings of the `database` section. So the registry cannot connect when one of them contains a space or a tab, or ends with a backslash: a password with a space fails authentication, a database name with a space names a database that does not exist, a `sslrootcert` path with a space cannot be read, and a value that ends with a backslash takes the next setting into it, or makes the connection string fail to parse when it is the last one. `\\` and `\'` inside a value also lose their backslash. The space escape is what lib/pq expects, since it reads a backslash followed by any character as that character: it came with a58f04aa (Add initial database connection logic, 2020-03-26), when lib/pq was the driver. Since 4788a2ee (Move from lib/pq to jackc/pgx for the PostgreSQL driver, 2021-01-25) the string goes to pgx, which keeps the backslash. ## Steps to reproduce 1. Start PostgreSQL 17. `--auth-host=scram-sha-256` makes it check the password on every TCP connection, including one from 127.0.0.1 inside the container: ```shell docker run -d --name registry-db -p 127.0.0.1:5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 postgres:17 ``` 1. After a few seconds, create a role whose password has a space, and its database: ```shell docker exec registry-db psql -U postgres -c "CREATE ROLE registry LOGIN PASSWORD 'jw8s 0F4'" -c "CREATE DATABASE registry OWNER registry" ``` 1. From a checkout of `master`, save this configuration as `/tmp/config.yml` and ask the registry for the migration status: ```shell cat > /tmp/config.yml <<'EOF' version: 0.1 storage: inmemory: {} database: enabled: true host: 127.0.0.1 port: 5432 user: registry password: "jw8s 0F4" dbname: registry sslmode: disable EOF go run ./cmd/registry database migrate status /tmp/config.yml ``` ## What is the current bug behavior? On `master` at e4e3ea44 (Go 1.26.9, PostgreSQL 17.11) the command fails: ```plaintext failed to construct database connection: verification failed: failed to connect to `user=registry database=registry`: 127.0.0.1:5432 (127.0.0.1): failed SASL auth: FATAL: password authentication failed for user "registry" (SQLSTATE 28P01) ``` `pgx.ParseConfig(dsn.String())` shows why, without a database: the password comes back as `jw8s\ 0F4`. The same for other values: | Setting | Configured | Parsed by pgx | | --- | --- | --- | | `password` | `jw8s 0F4` | `jw8s\ 0F4` | | `password` | `jw8s`, a tab, `0F4` | `jw8s`, and `dbname` is lost | | `password` | `jw8s0F4\` | `jw8s0F4\ dbname=registry`, and `dbname` is lost | | `password` | `jw8s\\0F4` | `jw8s\0F4` | | `password` | `jw8s\'0F4` | `jw8s'0F4` | | `user` | `registry user` | `registry\ user` | | `dbname` | `registry db` | `registry\ db` | | `dbname`, as the last setting | `registry\` | `ParseConfig` fails: `failed to parse as keyword/value (invalid backslash)` | | `sslrootcert` | a CA file in a directory named `with space` | `ParseConfig` fails: `unable to read CA file: open .../with\ space/root.crt: no such file or directory` | Connecting through `datastore.NewConnector().Open` to PostgreSQL 17 with roles for these five passwords and for a user name with a space fails with `password authentication failed` (SQLSTATE 28P01), and with the database name above with `database "registry\ db" does not exist`. ## What is the expected correct behavior? pgx reads every setting back as it is configured: the command above prints the migration status, the connections succeed, and the CA file is loaded. ## Relevant code At e4e3ea44: - [`registry/datastore/db.go#L216-217`](https://gitlab.com/gitlab-org/container-registry/-/blob/e4e3ea4444c1a80e2aa01b57d5a4ed75a0b5907d/registry/datastore/db.go#L216-217): the escaping in `DSN.String`. - [`registry/datastore/db.go#L410`](https://gitlab.com/gitlab-org/container-registry/-/blob/e4e3ea4444c1a80e2aa01b57d5a4ed75a0b5907d/registry/datastore/db.go#L410): `sqlConnector.Open` passes the string to `pgx.ParseConfig`. - [`pgconn/config.go#L686-L752` in pgx v5.10.0](https://github.com/jackc/pgx/blob/v5.10.0/pgconn/config.go#L686-L752): `parseKeywordValueSettings`, how pgx reads a keyword/value string. - `TestDSN_String/with_spaces` in `registry/datastore/db_test.go` expects `password=jw8s\ 0F4`, but does not check what pgx makes of it. ## Possible fixes Escape backslashes first and single quotes next, then wrap a value that contains whitespace in single quotes, which is the [keyword/value format of libpq](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-KEYWORD-VALUE) that pgx follows. A value without whitespace or backslashes keeps the string it has today. A test can compare the result of `pgx.ParseConfig(dsn.String())` with the configured values without a database. I have a merge request ready for it.