Pages on BareSQL.com

About

Mon, 01 Jan 0001 00:00:00 +0000

BareSQL.com is the home of BareSQL, one small program with two tools for SQL databases. BareSQL Audit tells you which PostgreSQL login can read which column, and how. BareSQL Portable tells you where SQL meant for SQLite, PostgreSQL, MySQL and MariaDB fails or gives different answers. Both are free and open source.

The Name

The bare in BareSQL is meant two ways, one for each tool.

BareSQL Audit lays a database’s access bare. Grants pile up over the years, roles sit inside other roles, views read tables with their owner’s rights and default privileges hand new tables to everyone. The audit cuts through all of that and lists, for every login, each column it can read and the exact route that gets it there.

BareSQL Audit

Mon, 01 Jan 0001 00:00:00 +0000

BareSQL Audit logs in to a PostgreSQL database and works out, for every login, each column it can read and the route that gets it there. It marks the columns that hold personal data and adds findings for the setups that usually end in a leak. It supports PostgreSQL 13 to 18.

baresql audit "postgres://auditor@db.example.com/shop?sslmode=verify-full"

The audit prints a summary and writes two files. report.html is a page to read and share, and audit.json holds the same facts for scripts and for comparing with the next audit. This is the summary for the sample shop database the tests build:

BareSQL Portable

Mon, 01 Jan 0001 00:00:00 +0000

BareSQL Portable checks SQL that has to run on SQLite, PostgreSQL, MySQL and MariaDB. It knows 58 differences between those engines: 35 where at least one engine refuses the statement, 15 where every engine runs it and the answers differ, and 8 where the answers differ only for some data. Each one was run on all four engines, and each comes with a form that answers the same everywhere, where one exists.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

BareSQL.com would like to hear from anyone who tries BareSQL, about what it found and what it missed.

Bug reports help most: an audit line the server disagrees with, a lint message that’s wrong for your engine, two answers that compare called equal and aren’t, or anything else that looks off. Ideas are welcome too, for a check BareSQL doesn’t do yet or a SQL difference it doesn’t know.

Write to info@baresql.com.

Download BareSQL

Mon, 01 Jan 0001 00:00:00 +0000

The baresql command is one file with nothing else to install. Each archive below holds it with its license files, the README and the changelog. The links always point to the latest release.

System	Download
Linux, x86-64	baresql_linux_amd64.tar.gz
Linux, ARM64	baresql_linux_arm64.tar.gz
macOS, Apple silicon	baresql_darwin_arm64.tar.gz
macOS, Intel	baresql_darwin_amd64.tar.gz
Windows, x86-64	baresql_windows_amd64.zip

Checksums are in SHA256SUMS. Every release is listed on GitHub.

Install

On Linux or macOS:

tar -xzf baresql_linux_amd64.tar.gz
sudo mv baresql /usr/local/bin/
baresql version

The binaries are static, so the Linux ones run on any distribution. The macOS binaries aren’t signed by Apple, so macOS may block the first run; allow it in System Settings under Privacy & Security, or run xattr -d com.apple.quarantine baresql. On Windows, unzip the archive and put baresql.exe in a folder on your PATH.

Quick Start

Mon, 01 Jan 0001 00:00:00 +0000

BareSQL is one program, baresql. BareSQL Audit is its audit and diff commands, and BareSQL Portable is lint, compare and rules. Get it from the download page and check that it runs:

baresql version

Audit a PostgreSQL Database

Give baresql audit a connection string, the same as for psql. Leave the password out of it: BareSQL reads PGPASSWORD and ~/.pgpass like every PostgreSQL tool.

export PGPASSWORD=...
baresql audit "postgres://auditor@db.example.com/shop?sslmode=verify-full"

It prints a short summary. This one is for the sample shop database BareSQL is tested on:

Reference

Mon, 01 Jan 0001 00:00:00 +0000

Every command and flag of baresql, as of version 0.1.0. baresql help lists the commands in the terminal and baresql help COMMAND shows the flags of one. A flag works with one dash or two, so -out and --out are the same. The README on GitHub is the full manual.

baresql audit [flags] [connection]      who can read what in a PostgreSQL database
baresql diff old.json new.json          compare two audits and list what changed
baresql lint [flags] file.sql ...       SQL that answers differently on SQLite, PostgreSQL, MySQL, MariaDB
baresql compare [engines] file.sql ...  run SQL on several engines and show where the answers differ
baresql rules [code]                    the differences lint knows, with each engine's recorded answer
baresql version                         print the version
baresql help [command]                  show help

audit

baresql audit [flags] [connection]

Flag	Meaning
`--out DIR`	where to write report.html and audit.json (default `baresql-report`)
`--login NAME`	audit only these logins (repeat, or separate with commas)
`--schema NAME`	audit only these schemas (repeat, or separate with commas)
`--no-sample`	read no table data: find personal data by column names only
`--sample-rows N`	rows to read per table when sampling, 1 to 10000 (default 200)
`--baseline FILE`	an earlier audit.json: exit 1 if any login can now reach more
`--timeout D`	time limit for each query, such as `30s` (default 60s)
`--format F`	what to print: `summary` (default), `lines` (one fact per line) or `json`

The connection is a postgres:// URL or a key=value string, as for psql. Whatever it leaves out comes from the usual PG* variables (PGHOST, PGUSER, PGPASSWORD and the rest) and from ~/.pgpass, so the password never has to be on the command line. TLS follows sslmode: disable, prefer (the default), require, verify-ca or verify-full, with sslrootcert for the certificate authority; sslrootcert=system uses the system’s certificates and implies verify-full. Unix sockets work as with psql (host=/var/run/postgresql). The login uses SCRAM-SHA-256 (with channel binding over TLS), MD5 or a cleartext password, whichever the server asks for.

Sample Reports

Mon, 01 Jan 0001 00:00:00 +0000

These reports are exactly what BareSQL Audit wrote for the databases its tests build. Each database is made up, with invented people in it, and planted with mistakes that turn up in real ones, plus near misses that look like mistakes and aren’t. For the four databases below, the tests check every line of the audit on PostgreSQL 13 to 18, so a change to BareSQL that alters one of them fails before it ships.