Remove CGO Dependency from PostgreSQL FDW (#2860)

Author: ecordell

Dockerfile

@@ -1,12 +1,10 @@
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
-# Note: Using Debian-based golang image (not alpine) to build with glibc for postgres-fdw support
-FROM golang:1.25.6@sha256:ce63a16e0f7063787ebb4eb28e72d477b00b4726f79874b3205a965ffd797ab2 AS spicedb-builder
+FROM golang:1.25.6-alpine@sha256:660f0b83cf50091e3777e4730ccc0e63e83fea2c420c872af5c60cb357dcafb2 AS spicedb-builder
 WORKDIR /go/src/app
-RUN apt-get update && apt-get install -y --no-install-recommends git gcc libc6-dev && rm -rf /var/lib/apt/lists/*
+RUN apk update && apk add --no-cache git
 COPY . .
 # https://github.com/odigos-io/go-rtml#about-ldflags-checklinkname0
-# Build with CGO enabled for postgres-fdw support
-RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod CGO_ENABLED=1 go build -tags memoryprotection -v -ldflags=-checklinkname=0 -o spicedb ./cmd/spicedb
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod CGO_ENABLED=0 go build -tags memoryprotection -v -ldflags=-checklinkname=0 -o spicedb ./cmd/spicedb
 
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
 FROM golang:1.25.6-alpine@sha256:660f0b83cf50091e3777e4730ccc0e63e83fea2c420c872af5c60cb357dcafb2 AS health-probe-builder
@@ -18,8 +16,7 @@ RUN git checkout main
 RUN CGO_ENABLED=0 go install -a -tags netgo -ldflags=-w
 
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
-# Note: Using glibc-dynamic base instead of static because the postgres-fdw command requires libc
-FROM cgr.dev/chainguard/glibc-dynamic@sha256:3f5dc064fa077619b186d21a426c07fb3868668ffe104db8ba3e46347a80a1d3
+FROM cgr.dev/chainguard/static@sha256:99a5f826e71115aef9f63368120a6aa518323e052297718e9bf084fb84def93c
 COPY --from=health-probe-builder /go/bin/grpc-health-probe /bin/grpc_health_probe
 COPY --from=spicedb-builder /go/src/app/spicedb /usr/local/bin/spicedb
 ENV PATH="$PATH:/usr/local/bin"

Dockerfile.release

@@ -1,7 +1,6 @@
 # vim: syntax=dockerfile
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
-# Note: Using glibc-dynamic base instead of static because the postgres-fdw command requires libc
-ARG BASE=cgr.dev/chainguard/glibc-dynamic@sha256:3f5dc064fa077619b186d21a426c07fb3868668ffe104db8ba3e46347a80a1d3
+ARG BASE=cgr.dev/chainguard/static@sha256:99a5f826e71115aef9f63368120a6aa518323e052297718e9bf084fb84def93c
 FROM golang:1.25.6-alpine@sha256:660f0b83cf50091e3777e4730ccc0e63e83fea2c420c872af5c60cb357dcafb2 AS health-probe-builder
 WORKDIR /go/src/app
 RUN apk update && apk add --no-cache git

go.mod

@@ -101,6 +101,7 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
+	github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07
 	go.opencensus.io v0.24.0
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0
@@ -399,6 +400,7 @@ require (
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/tetafro/godot v1.5.4 // indirect
+	github.com/tetratelabs/wazero v1.9.0 // indirect
 	github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 // indirect
 	github.com/timonwong/loggercheck v0.11.0 // indirect
 	github.com/tomarrell/wrapcheck/v2 v2.11.0 // indirect
@@ -407,6 +409,7 @@ require (
 	github.com/ultraware/whitespace v0.2.0 // indirect
 	github.com/uudashr/gocognit v1.2.0 // indirect
 	github.com/uudashr/iface v1.4.1 // indirect
+	github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect

go.sum

@@ -1689,6 +1689,8 @@ github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpR
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY=
 github.com/tetafro/godot v1.5.4 h1:u1ww+gqpRLiIA16yF2PV1CV1n/X3zhyezbNXC3E14Sg=
 github.com/tetafro/godot v1.5.4/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
+github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
+github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
 github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 h1:9LPGD+jzxMlnk5r6+hJnar67cgpDIz/iyD+rfl5r2Vk=
 github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67/go.mod h1:mkjARE7Yr8qU23YcGMSALbIxTQ9r9QBVahQOBRfU460=
 github.com/timonwong/loggercheck v0.11.0 h1:jdaMpYBl+Uq9mWPXv1r8jc5fC3gyXx4/WGwTnnNKn4M=
@@ -1707,6 +1709,10 @@ github.com/uudashr/gocognit v1.2.0 h1:3BU9aMr1xbhPlvJLSydKwdLN3tEUUrzPSSM8S4hDYR
 github.com/uudashr/gocognit v1.2.0/go.mod h1:k/DdKPI6XBZO1q7HgoV2juESI2/Ofj9AcHPZhBBdrTU=
 github.com/uudashr/iface v1.4.1 h1:J16Xl1wyNX9ofhpHmQ9h9gk5rnv2A6lX/2+APLTo0zU=
 github.com/uudashr/iface v1.4.1/go.mod h1:pbeBPlbuU2qkNDn0mmfrxP2X+wjPMIQAy+r1MBXSXtg=
+github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07 h1:mJdDDPblDfPe7z7go8Dvv1AJQDI3eQ/5xith3q2mFlo=
+github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07/go.mod h1:Ak17IJ037caFp4jpCw/iQQ7/W74Sqpb1YuKJU6HTKfM=
+github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 h1:OvLBa8SqJnZ6P+mjlzc2K7PM22rRUPE1x32G9DTPrC4=
+github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52/go.mod h1:jMeV4Vpbi8osrE/pKUxRZkVaA0EX7NZN0A9/oRzgpgY=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=

internal/fdw/pgserver.go

@@ -7,7 +7,7 @@ import (
 	"sync"
 
 	wire "github.com/jeroenrinzema/psql-wire"
-	pg_query "github.com/pganalyze/pg_query_go/v6"
+	pgquery "github.com/wasilibs/go-pgquery"
 
 	"github.com/authzed/authzed-go/v1"
 
@@ -113,7 +113,7 @@ func (p *PgBackend) Close() error {
 }
 
 func (p *PgBackend) handler(ctx context.Context, query string) (wire.PreparedStatements, error) {
-	parsed, err := pg_query.Parse(query)
+	parsed, err := pgquery.Parse(query)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse query: %w", err)
 	}

internal/fdw/tables/delete_test.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"testing"
 
-	pg_query "github.com/pganalyze/pg_query_go/v6"
 	"github.com/stretchr/testify/require"
+	pgquery "github.com/wasilibs/go-pgquery"
 )
 
 func TestParseDeleteStatement(t *testing.T) {
@@ -95,7 +95,7 @@ func TestParseDeleteStatement(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 
 			ctx := context.Background()
@@ -149,7 +149,7 @@ func TestDeleteStatementReturningColumns(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 
 			ctx := context.Background()

internal/fdw/tables/insert_test.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"testing"
 
-	pg_query "github.com/pganalyze/pg_query_go/v6"
 	"github.com/stretchr/testify/require"
+	pgquery "github.com/wasilibs/go-pgquery"
 )
 
 func TestParseInsertStatement(t *testing.T) {
@@ -103,7 +103,7 @@ func TestParseInsertStatement(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 
 			ctx := context.Background()
@@ -146,7 +146,7 @@ func TestInsertStatementReturningColumns(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 
 			ctx := context.Background()

internal/fdw/tables/matcher_test.go

@@ -3,8 +3,8 @@ package tables
 import (
 	"testing"
 
-	pg_query "github.com/pganalyze/pg_query_go/v6"
 	"github.com/stretchr/testify/require"
+	pgquery "github.com/wasilibs/go-pgquery"
 )
 
 func TestPatternMatcher(t *testing.T) {
@@ -66,7 +66,7 @@ func TestPatternMatcher(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 
 			selectStmt := parsed.Stmts[0].Stmt.GetSelectStmt()
@@ -134,7 +134,7 @@ func TestEqualityPattern(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 
 			selectStmt := parsed.Stmts[0].Stmt.GetSelectStmt()
@@ -187,7 +187,7 @@ func TestSubQueryPlaceholderPattern(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 
 			selectStmt := parsed.Stmts[0].Stmt.GetSelectStmt()
@@ -240,7 +240,7 @@ func TestColumnRefPattern(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 
 			selectStmt := parsed.Stmts[0].Stmt.GetSelectStmt()
@@ -266,7 +266,7 @@ func TestColumnRefPattern(t *testing.T) {
 // BenchmarkPatternMatcher compares the performance of pattern matching vs old approach
 func BenchmarkPatternMatcher(b *testing.B) {
 	query := "SELECT * FROM relationships WHERE resource_type = 'document' AND resource_id = 'doc1' AND relation = 'viewer'"
-	parsed, err := pg_query.Parse(query)
+	parsed, err := pgquery.Parse(query)
 	require.NoError(b, err)
 
 	selectStmt := parsed.Stmts[0].Stmt.GetSelectStmt()

internal/fdw/tables/select_test.go

@@ -3,8 +3,8 @@ package tables
 import (
 	"testing"
 
-	pg_query "github.com/pganalyze/pg_query_go/v6"
 	"github.com/stretchr/testify/require"
+	pgquery "github.com/wasilibs/go-pgquery"
 )
 
 func TestParseSelectStatement(t *testing.T) {
@@ -175,7 +175,7 @@ func TestParseSelectStatement(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 
 			slc, err := ParseSelectStatement(parsed.Stmts[0].Stmt.GetSelectStmt(), false)

internal/fdw/tables/util_test.go

@@ -4,8 +4,8 @@ import (
 	"testing"
 
 	wire "github.com/jeroenrinzema/psql-wire"
-	pg_query "github.com/pganalyze/pg_query_go/v6"
 	"github.com/stretchr/testify/require"
+	pgquery "github.com/wasilibs/go-pgquery"
 )
 
 func TestStringValue(t *testing.T) {
@@ -162,7 +162,7 @@ func TestReturningColumnsFromQuery(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			parsed, err := pg_query.Parse(tc.query)
+			parsed, err := pgquery.Parse(tc.query)
 			require.NoError(t, err)
 			require.NotEmpty(t, parsed.Stmts)