Trusted Language Extensions for Postgres

Summary

Cloud Postgres providers often restrict extension installation until extensions are vetted, leaving some useful functionality unavailable on hosted databases. A Trusted Language Extension (TLE) is a Postgres extension written in a trusted language, allowing installation through pg_tle without placing code on the server filesystem. The source explains that conventional extensions may include SQL and functions implemented in languages such as C, while trusted languages follow PostgreSQL's security rules and cannot access raw process memory or system functions. AWS developed pg_tle, and collaboration with Supabase makes it available on Supabase and Amazon RDS for PostgreSQL 14.5 and higher; the dbdev registry can install packages such as langchain-embedding_search through SQL migrations. TLEs are presented as a way to distribute and iterate on trusted extensions without waiting for each cloud provider to preinstall them.

Takeaways

1. 1

   TLEs must be written in trusted languages such as SQL, pl/pgsql, plv8, pl/perl, or pl/tcl; extensions written in C cannot use this model.

2. 2

   pg_tle is available on new Supabase projects and on Amazon RDS for PostgreSQL 14.5 and higher.

3. 3

   The dbdev registry supports installing extensions such as langchain-embedding_search from SQL migrations, using the dbdev.install function.