schema-evolution-manager 0.9.60 → 0.9.61

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9ac86130a475dfedad8e6d56d0bf250b717e44698205fb612e7561096f45c796
-  data.tar.gz: 79af5be19d627253552a44e73e753865e3b84baf8d91076859fcd269dda1b0e2
+  metadata.gz: 60215e02faf6492f2a4e0b263008b6038f95d3ff824417fb6ce615296342ea5f
+  data.tar.gz: e9450f3c24a2f54b3f25566c1152a6454de7e7b2eb4750dd0a8021b273b014c6
 SHA512:
-  metadata.gz: 4283a52241a30e38cefac92040ea14a4e15f2b9af51912c9ae5017e8599f0e84912b5db8d2198515875c2ffcca84c261a63cde849fa58ee1369499546c4f4504
-  data.tar.gz: 39152c48787380c306725fd15dabb0ab0574ce0ed3620d405bf0707f3d24252c1ecc91bd41127117e9a005a9bee648ee278e8cad458aea5ae998a6c1693a4fbf
+  metadata.gz: 6673d52ee37258fee586cd320799eeff9e6477d963a98c79f737f1fc8f44009dcbc076ed26dc8e900ef970e79516d1d115d125b6ec4d23da45d1b5903508ca8b
+  data.tar.gz: 3081446f6663a18bf00523332c0d9363e9b3322c9a900561205e1d90509698f4a6899824087a202ba9fdc5f6487fd9ab475574fbca246c7c0e156f691ceb700a

data/README.md

@@ -1,5 +1,3 @@
-[![Build Status](https://travis-ci.org/mbryzek/schema-evolution-manager.svg?branch=main)](https://travis-ci.org/mbryzek/schema-evolution-manager)
-
 # Schema Evolution Manager (sem)
 
 ## Intended Audience
@@ -43,6 +41,24 @@ dozens of independent postgresql databases.
 See INSTALLATION and GETTING STARTED for details.
 
 
+## Why sem
+
+sem is deliberately small. A schema change is a plain SQL file, named
+by the timestamp it was added, committed to git next to every other
+change to that database. There is no migration DSL, no down
+migrations, and no runtime dependency beyond ruby, git and psql.
+
+Applying changes is psql running each file in order inside a
+transaction, and recording the filename in one table. Because psql
+does the work, anything that runs in psql runs in sem: plpgsql,
+extensions, data fixes, large backfills.
+
+If you want a tool that generates SQL from a model, or that rolls
+schema changes back for you, sem is the wrong choice. If you want the
+SQL you wrote to be the SQL that runs, and a plain record of what ran
+where, it is a good fit.
+
+
 ## Project Goals
 
   - Absolutely minimal set of dependencies. We found that anything
@@ -133,7 +149,7 @@ There are three ways to install schema evolution manager:
 
         git clone git@github.com:mbryzek/schema-evolution-manager.git
         cd schema-evolution-manager
-        git checkout 0.9.60
+        git checkout 0.9.61
         ruby ./configure.rb
         sudo ./install.rb
 
@@ -157,6 +173,23 @@ version.
     git init /tmp/sample
     sem-init --dir /tmp/sample --url postgresql://postgres@localhost/sample
 
+### Configuring the scripts directory (.sem)
+
+By default sem keeps scripts in ./scripts. To keep them elsewhere, commit
+a file named .sem at the root of the repository:
+
+    sem.config.scripts_dir = schema/scripts
+
+Every command walks up from the current directory to the first .sem and
+resolves paths relative to the directory that holds it. Blank lines and
+lines starting with # are ignored. sem-init writes the file for you when
+given --scripts_dir:
+
+    sem-init --dir /tmp/sample --url postgresql://postgres@localhost/sample --scripts_dir schema/scripts
+
+sem-dist always packs the scripts under the name scripts/ and never packs
+.sem, so a tarball applies on a server with no .sem.
+
 ### Writing your first sql script
 
     cd /tmp/sample
@@ -236,6 +269,18 @@ There are two recommended ways in which to pass user passwords to psql:
 
         sem-apply --url postgresql://postgres@localhost/sample --password
 
+### Running inside the postgres Docker image
+
+The official postgres image runs the scripts in
+docker-entrypoint-initdb.d before the server listens on TCP. During
+that phase postgres accepts connections only on its unix socket, so a
+URL naming localhost is refused. Leave the host out of the URL and
+libpq connects over the socket:
+
+    sem-apply --url postgresql://$POSTGRES_USER@/$POSTGRES_DB
+
+No password is needed on the socket during initialization.
+
 ### Apply the changes
 
     sem-apply --url postgresql://postgres@localhost/sample

data/bin/sem-add

@@ -1,5 +1,6 @@
 #!/usr/bin/env ruby
-# == Adds a database upgrade script to this repository.
+# == Adds a database upgrade script to this repository. The script is
+#    written to the scripts directory named by .sem (default ./scripts)
 #
 # == Usage
 #  sem-add <path>
@@ -19,7 +20,7 @@ end
 SchemaEvolutionManager::Preconditions.check_state(File.exist?(file), "File[#{file}] could not be found")
 SchemaEvolutionManager::Preconditions.check_state(file.match(/\.sql/i), "File[#{file}] must end with .sql")
 
-scripts_dir = File.join(`pwd`.strip, "scripts")
+scripts_dir = SchemaEvolutionManager::Config.load.scripts_dir
 SchemaEvolutionManager::Library.ensure_dir!(scripts_dir)
 
 contents = IO.read(file)
@@ -33,7 +34,7 @@ while File.exist?(target)
 end
 
 puts "Adding #{target}"
-SchemaEvolutionManager::Library.system_or_error("mv #{file} #{target}")
-SchemaEvolutionManager::Library.system_or_error("git add #{target}")
+SchemaEvolutionManager::Library.system_or_error(["mv", "--", file, target])
+SchemaEvolutionManager::Library.system_or_error(["git", "add", "--", target])
 
 puts "File staged in git. You need to commit and push"

data/bin/sem-apply

@@ -23,6 +23,7 @@ password = if args.password
              nil
            end
 
+config = SchemaEvolutionManager::Config.load
 db = SchemaEvolutionManager::Db.from_args(args, :password => password)
 util = SchemaEvolutionManager::ApplyUtil.new(db, :dry_run => args.dry_run || false)
 
@@ -30,12 +31,12 @@ begin
   db.bootstrap!
 
   puts "Upgrading schema for #{db.sanitized_url}"
-  count = util.apply!("./scripts")
+  count = util.apply!(config.scripts_dir)
   if count == 0
     puts "  All scripts have been previously applied"
   end
 
-  version_file = "./VERSION"
+  version_file = File.join(config.base_dir, "VERSION")
   if !util.dry_run? && File.exist?(version_file)
     version = IO.read(version_file).strip
     if !version.empty?

data/bin/sem-baseline

@@ -17,6 +17,7 @@ load File.join(File.dirname(__FILE__), 'sem-config')
 
 args = SchemaEvolutionManager::Args.from_stdin(:optional => %w(url host port name user dry_run))
 
+config = SchemaEvolutionManager::Config.load
 db = SchemaEvolutionManager::Db.from_args(args)
 db.bootstrap!
 
@@ -24,10 +25,10 @@ dry_run = args.dry_run.nil? ? false : args.dry_run
 
 util = SchemaEvolutionManager::BaselineUtil.new(db, :dry_run => dry_run)
 
-puts "Baselining schema for #{db.url}"
+puts "Baselining schema for #{db.sanitized_url}"
 
 begin
-  count = util.apply!("./scripts")
+  count = util.apply!(config.scripts_dir)
   if count == 0
     puts "  All scripts have been previously applied"
   end

data/bin/sem-dist

@@ -30,13 +30,13 @@ args = SchemaEvolutionManager::Args.from_stdin(:optional => ['artifact_name', 't
 
 # On MAC OS X, use gnutar if available, otherwise use tar with --no-xattrs
 tar_cmd = `which gnutar 2> /dev/null`.strip
-tar_opts = ""
+tar_opts = []
 if tar_cmd == ""
   tar_cmd = "tar"
   # Use --no-xattrs to prevent extended attributes from being archived (works in create mode)
   # Also use --no-mac-metadata to prevent AppleDouble files
-  if system("tar --no-xattrs -cf /dev/null /dev/null 2>/dev/null")
-    tar_opts = "--no-xattrs --no-mac-metadata"
+  if system("tar", "--no-xattrs", "-cf", "/dev/null", "/dev/null", :err => File::NULL)
+    tar_opts = ["--no-xattrs", "--no-mac-metadata"]
   end
 end
 
@@ -58,7 +58,8 @@ SchemaEvolutionManager::Library.git_assert_tag_exists(tag)
 SchemaEvolutionManager::Versions.validate_version!(tag)
 
 changes = SchemaEvolutionManager::Library.git_changes(:tag => tag)
-repo_path = SchemaEvolutionManager::Library.normalize_path(`pwd`.strip)
+config = SchemaEvolutionManager::Config.load
+repo_path = config.base_dir
 
 if args.artifact_name
   artifact_name = args.artifact_name
@@ -76,16 +77,19 @@ SchemaEvolutionManager::Library.with_temp_file do |tmp|
   tmpdir = File.join(tmp, filename)
   SchemaEvolutionManager::Library.ensure_dir!(tmpdir)
 
-  SchemaEvolutionManager::Library.system_or_error("cp -R %s %s" % [File.join(repo_path, "scripts"), File.join(tmpdir, "scripts")])
+  # The tarball always holds the scripts under the fixed name scripts/
+  # and never .sem, so a server applies it without any config.
+  SchemaEvolutionManager::Library.system_or_error(["cp", "-R", "--", config.scripts_dir, File.join(tmpdir, "scripts")])
   File.open(File.join(tmpdir, "CHANGES"), "w") { |out| out << changes }
   File.open(File.join(tmpdir, "VERSION"), "w") { |out| out << tag }
 
-  # Clear extended attributes to avoid tar warnings on Linux
-  SchemaEvolutionManager::Library.system_or_error("xattr -cr #{tmpdir} 2>/dev/null || true")
+  # Clear extended attributes to avoid tar warnings on Linux. Best
+  # effort: xattr is absent on most Linux hosts.
+  system("xattr", "-cr", "--", tmpdir, [:out, :err] => File::NULL)
 
   Dir.chdir(tmp) do
     # COPYFILE_DISABLE prevents AppleDouble ._ files from being created
-    SchemaEvolutionManager::Library.system_or_error("COPYFILE_DISABLE=1 #{tar_cmd} #{tar_opts} -cf #{filename}.tar #{filename}")
+    SchemaEvolutionManager::Library.system_or_error([tar_cmd] + tar_opts + ["-cf", "#{filename}.tar", "--", filename], :env => { "COPYFILE_DISABLE" => "1" })
     FileUtils.cp("#{filename}.tar", tarball)
   end
 end
@@ -96,8 +100,7 @@ if File.exist?(gzip_file)
   FileUtils.rm(gzip_file)
 end
 
-command = "gzip #{tarball}"
-SchemaEvolutionManager::Library.system_or_error(command)
+SchemaEvolutionManager::Library.system_or_error(["gzip", "--", tarball])
 
 puts ""
 puts "Created distribution file at #{gzip_file}"

data/bin/sem-init

@@ -9,16 +9,19 @@
 #
 #   dir: The directory containing a git repository that will contain the schema evolution files
 #   url: The connection string for the psql database
+#   scripts_dir: Optional path to the scripts directory, relative to dir. When given,
+#                it is recorded in dir/.sem so every sem command finds it. Defaults to scripts
 #
 # == Example
 #  git init /tmp/example_repo
 #  bin/sem-init --dir /tmp/example_repo --url postgresql://username@localhost/sample
+#  bin/sem-init --dir /tmp/example_repo --url postgresql://username@localhost/sample --scripts_dir schema/scripts
 #
 
 load File.join(File.dirname(__FILE__), 'sem-config')
 SchemaEvolutionManager::Library.set_verbose(true)
 
-args = SchemaEvolutionManager::Args.from_stdin(:required => %w(dir), :optional => %w(url host port name user))
+args = SchemaEvolutionManager::Args.from_stdin(:required => %w(dir), :optional => %w(url host port name user scripts_dir))
 SchemaEvolutionManager::Preconditions.check_state(File.directory?(args.dir), "Dir[%s] does not exist" % args.dir)
 
 if args.url.nil? && args.name.nil?
@@ -43,8 +46,11 @@ template_dir = File.join(SchemaEvolutionManager::Library.base_dir, "template")
 SchemaEvolutionManager::Preconditions.check_state(File.directory?(template_dir),
                                                   "Could not find schema-evolution-manager/template subdir. Expected it at[%s]" % [template_dir])
 
+# The wrapper scripts are committed to the repository, so they carry the url
+# with any password removed; a password is supplied through a pgpass file.
+# dev.rb takes the url as a ruby string literal.
 subs = {
-  "url" => db.url,
+  "url_literal" => SchemaEvolutionManager::ConnectionData.strip_password(db.url).inspect,
   "add_script_path" => File.join(SchemaEvolutionManager::Library.base_dir, "bin/sem-add")
 }
 
@@ -57,40 +63,56 @@ Dir.chdir(args.dir) do
     if !File.exist?(wrapper)
       puts "Creating wrapper script #{wrapper}"
       copy_file(path, wrapper, subs)
-      SchemaEvolutionManager::Library.system_or_error("chmod +x #{wrapper}")
-      SchemaEvolutionManager::Library.system_or_error("git add #{wrapper}")
+      SchemaEvolutionManager::Library.system_or_error(["chmod", "--", "+x", wrapper])
+      SchemaEvolutionManager::Library.system_or_error(["git", "add", "--", wrapper])
       wrappers << wrapper
     end
   end
   if !wrappers.empty?
-    SchemaEvolutionManager::Library.system_or_error("git commit -m 'Add schema-evolution-manager wrapper scripts' #{wrappers.join(" ")}")
+    SchemaEvolutionManager::Library.system_or_error(["git", "commit", "-m", "Add schema-evolution-manager wrapper scripts", "--"] + wrappers)
   end
 
   readme = "README.md"
   if !File.exist?(readme)
     puts "Creating #{readme}"
     copy_file("schema-evolution-manager/template/README.md", "README.md", subs)
-    SchemaEvolutionManager::Library.system_or_error("git add #{readme}")
-    SchemaEvolutionManager::Library.system_or_error("git commit -m 'Adding README.md' README.md")
+    SchemaEvolutionManager::Library.system_or_error(["git", "add", "--", readme])
+    SchemaEvolutionManager::Library.system_or_error(["git", "commit", "-m", "Adding README.md", "--", readme])
   end
 
-  if !File.exist?("scripts")
-    SchemaEvolutionManager::Library.system_or_error("mkdir scripts")
-    SchemaEvolutionManager::Library.system_or_error("touch scripts/.exists")
-    SchemaEvolutionManager::Library.system_or_error("git add scripts/.exists")
-    SchemaEvolutionManager::Library.system_or_error("git commit -m 'Adding scripts directory' scripts/.exists")
+  if args.scripts_dir
+    config_file = SchemaEvolutionManager::Config::FILENAME
+    if File.exist?(config_file)
+      existing = SchemaEvolutionManager::Config.parse(File.expand_path(config_file))
+      SchemaEvolutionManager::Preconditions.check_state(existing.scripts_dir == File.expand_path(args.scripts_dir),
+                                                        "%s already sets scripts_dir[%s] - not overwriting with[%s]" % [config_file, existing.scripts_dir, args.scripts_dir])
+    else
+      puts "Creating #{config_file}"
+      File.open(config_file, "w") { |out| out << "sem.config.scripts_dir = #{args.scripts_dir}\n" }
+      SchemaEvolutionManager::Library.system_or_error(["git", "add", "--", config_file])
+      SchemaEvolutionManager::Library.system_or_error(["git", "commit", "-m", "Adding #{config_file}", "--", config_file])
+    end
+  end
+
+  scripts_dir = args.scripts_dir || "scripts"
+  if !File.exist?(scripts_dir)
+    exists_marker = File.join(scripts_dir, ".exists")
+    SchemaEvolutionManager::Library.ensure_dir!(scripts_dir)
+    SchemaEvolutionManager::Library.system_or_error(["touch", exists_marker])
+    SchemaEvolutionManager::Library.system_or_error(["git", "add", "--", exists_marker])
+    SchemaEvolutionManager::Library.system_or_error(["git", "commit", "-m", "Adding scripts directory", "--", exists_marker])
   end
 
   # Create the first git tag if necessary
-  tags = SchemaEvolutionManager::Library.system_or_error("git tag -l")
+  tags = SchemaEvolutionManager::Library.system_or_error(["git", "tag", "-l"])
   if tags.nil? || tags == ""
     puts "Creating initial git tag (0.0.1)"
     SchemaEvolutionManager::Library.git_create_tag("0.0.1")
   end
 
   if SchemaEvolutionManager::Library.git_has_remote?
-    branch = SchemaEvolutionManager::Library.system_or_error("git symbolic-ref --short HEAD")
-    SchemaEvolutionManager::Library.system_or_error("git push origin #{branch}")
+    branch = SchemaEvolutionManager::Library.system_or_error(["git", "symbolic-ref", "--short", "HEAD"])
+    SchemaEvolutionManager::Library.system_or_error(["git", "push", "origin", branch])
   end
 
 end

data/lib/schema-evolution-manager/args.rb

@@ -16,6 +16,7 @@ module SchemaEvolutionManager
         :name => "Specifies the name of the database to which to connect",
         :url => "The connection string for the psql database",
         :dir => "Path to a directory",
+        :scripts_dir => "Path to the scripts directory, relative to --dir. Recorded in .sem",
         :tag => "A git tag (e.g. 0.0.1)",
         :prefix => "Configure installer to use this prefix",
         :set => "Passthrough for postgresql --set argument. Returns an array of the options set"
@@ -31,13 +32,16 @@ module SchemaEvolutionManager
       }
     end
 
-    attr_reader :artifact_name, :host, :port, :name, :prefix, :url, :user, :dir, :dry_run, :non_interactive, :tag, :password, :set
+    attr_reader :artifact_name, :host, :port, :name, :prefix, :url, :user, :dir, :dry_run, :non_interactive, :tag, :password, :set, :scripts_dir
 
-    # args: Actual string arguments
+    # args: The arguments, either an argv array (each element one
+    #       argument, so a value may contain whitespace) or a string
+    #       split on whitespace
     # :required => list of parameters that are required
     # :optional => list of parameters that are optional
     def initialize(args, opts={})
-      Preconditions.assert_class_or_nil(args, String)
+      Preconditions.check_state(args.nil? || args.is_a?(String) || args.is_a?(Array),
+                                "args must be a String or an Array")
       required = (opts.delete(:required) || []).map { |flag| format_flag(flag) }
       optional = (opts.delete(:optional) || []).map { |flag| format_flag(flag) }
       Preconditions.assert_class(required, Array)
@@ -67,6 +71,7 @@ module SchemaEvolutionManager
       @url = found_arguments.delete(:url)
       @user = found_arguments.delete(:user)
       @dir = found_arguments.delete(:dir)
+      @scripts_dir = found_arguments.delete(:scripts_dir)
       @tag = found_arguments.delete(:tag)
       @set = found_arguments.delete(:set) || []
 
@@ -100,8 +105,7 @@ module SchemaEvolutionManager
 
     # Hack to minimize bleeding from STDIN. Returns an instance of Args class
     def Args.from_stdin(opts)
-      values = ARGV.join(" ")
-      Args.new(values, opts)
+      Args.new(ARGV.dup, opts)
     end
 
     private
@@ -143,10 +147,9 @@ module SchemaEvolutionManager
 
 
     def parse_string_arguments(args)
-      Preconditions.assert_class_or_nil(args, String)
       found = {}
       index = 0
-      values = args.to_s.strip.split(/\s+/)
+      values = args.is_a?(Array) ? args : args.to_s.strip.split(/\s+/)
       while index < values.length do
         flag = format_flag(values[index])
         index += 1

data/lib/schema-evolution-manager/ask.rb

@@ -54,7 +54,7 @@ module SchemaEvolutionManager
           input = STDIN.gets
           puts ""
         ensure
-          `stty #{settings}`
+          system("stty", settings)
         end
         input
       end

data/lib/schema-evolution-manager/config.rb

@@ -0,0 +1,90 @@
+module SchemaEvolutionManager
+
+  # Repository level configuration, read from a file named .sem. Every
+  # command walks up from the current directory to the first .sem; the
+  # directory holding it is the base directory. Lines follow the
+  # migration file attribute grammar:
+  #
+  #   sem.config.scripts_dir = schema/scripts
+  #
+  # Blank lines and lines starting with # are ignored. Paths are
+  # relative to the base directory. With no .sem anywhere, the base
+  # directory is the start directory and scripts_dir is ./scripts.
+  class Config
+
+    unless defined?(FILENAME)
+      FILENAME = ".sem"
+      PROPERTY_PREFIX = /^sem\.config\./
+      DEFAULT_SCRIPTS_DIR = "scripts"
+      NAMES = ["scripts_dir"]
+    end
+
+    attr_reader :path, :base_dir, :scripts_dir
+
+    # path: the .sem file this config was read from, or nil
+    # base_dir: absolute path against which relative paths resolve
+    # scripts_dir: scripts directory, relative to base_dir or absolute
+    def initialize(path, base_dir, scripts_dir)
+      @path = path
+      @base_dir = Library.normalize_path(File.expand_path(base_dir))
+      @scripts_dir = Library.normalize_path(File.expand_path(scripts_dir, @base_dir))
+    end
+
+    def Config.load(start_dir=Dir.pwd)
+      Preconditions.assert_class(start_dir, String)
+      start = File.expand_path(start_dir)
+      Preconditions.check_state(File.directory?(start), "Dir[%s] does not exist" % start)
+
+      if path = Config.find(start)
+        Config.parse(path)
+      else
+        Config.new(nil, start, DEFAULT_SCRIPTS_DIR)
+      end
+    end
+
+    # Returns the path to the first .sem file found walking up from
+    # dir to the filesystem root, or nil if there is none.
+    def Config.find(dir)
+      current = File.expand_path(dir)
+      loop do
+        candidate = File.join(current, FILENAME)
+        if File.file?(candidate)
+          return candidate
+        end
+        parent = File.dirname(current)
+        if parent == current
+          return nil
+        end
+        current = parent
+      end
+    end
+
+    def Config.parse(path)
+      Preconditions.check_state(File.file?(path), "File[%s] does not exist" % path)
+
+      values = {}
+      File.foreach(path).each_with_index do |line, index|
+        stripped = line.strip
+        if stripped.empty? || stripped.start_with?("#")
+          next
+        end
+
+        location = "File[%s] line %s" % [path, index + 1]
+        name, value = Library.parse_property(stripped, PROPERTY_PREFIX)
+        Preconditions.check_state(!name.nil? && !value.nil?,
+                                  "%s: Invalid line[%s]. Expected sem.config.<name> = <value>" % [location, stripped])
+        Preconditions.check_state(NAMES.include?(name),
+                                  "%s: Config with name[%s] not found. Must be one of: %s" % [location, name, NAMES.join(" ")])
+        Preconditions.check_state(!value.empty?,
+                                  "%s: Config[%s] - value cannot be blank" % [location, name])
+        Preconditions.check_state(!values.has_key?(name),
+                                  "%s: Config[%s] is specified more than once" % [location, name])
+        values[name] = value
+      end
+
+      Config.new(path, File.dirname(path), values["scripts_dir"] || DEFAULT_SCRIPTS_DIR)
+    end
+
+  end
+
+end

data/lib/schema-evolution-manager/connection_data.rb

@@ -3,8 +3,8 @@ module SchemaEvolutionManager
   class ConnectionData
 
     DEFAULT_PORT = 5432 unless defined?(DEFAULT_PORT)
-    
-    attr_reader :host, :name, :port, :user
+
+    attr_reader :host, :name, :port, :user, :password
 
     def initialize(host, name, opts={})
       @host = host
@@ -19,50 +19,103 @@ module SchemaEvolutionManager
       Preconditions.check_argument(@port > 0, "Port must be > 0")
 
       @user = opts.delete(:user)
+      @password = opts.delete(:password)
       Preconditions.assert_empty_opts(opts)
     end
 
     # Returns a valid pgpass line entry representing this connection.
+    # The name parsed from a url can carry query parameters
+    # (?sslmode=require), which libpq does not match on, so they are dropped.
     #
     # @param password: Optional password to include in the connection string
     def pgpass(password=nil)
-      [@host, @port, @name, @user, password.to_s].join(":")
+      database = @name.to_s.split("?", 2).first
+      [@host, @port, database, @user, password].map { |v| ConnectionData.pgpass_escape(v) }.join(":")
+    end
+
+    # libpq reads ':' as the pgpass field separator and '\' as its escape,
+    # so both must be backslash-escaped within a field.
+    def ConnectionData.pgpass_escape(value)
+      value.to_s.gsub(/[\\:]/) { |c| "\\#{c}" }
+    end
+
+    # Returns the url with any password removed from it. The username is
+    # kept so that libpq still selects the matching pgpass entry.
+    #
+    # @param url e.g. postgres://user:pass@db.com:5553/test_db
+    def ConnectionData.strip_password(url)
+      ConnectionData.rebuild_lead(url) { |user, _password| user }
+    end
+
+    # Returns the url with any password replaced by [REDACTED], for display.
+    def ConnectionData.redact(url)
+      ConnectionData.rebuild_lead(url) { |user, password| password.nil? ? user : "#{user}:[REDACTED]" }
     end
 
     # Parses a connection string into a ConnectionData instance. You
-    # will get an error if the URL could not be parsed.
+    # will get an error if the URL could not be parsed. A password in the
+    # url is percent-decoded, as libpq does, and never appears in an error.
     #
     # @param url e.g. postgres://user1@db.com:5553/test_db
     def ConnectionData.parse_url(url)
+      display = ConnectionData.redact(url)
       protocol, rest = url.split("//", 2)
       if rest.nil?
-        raise "Invalid url[%s]. Expected to start with postgres://" % url
+        raise "Invalid url[%s]. Expected to start with postgres://" % display
       end
-      
+
       lead, name = rest.split("/", 2)
       if name.nil?
-        raise "Invalid url[%s]. Missing database name" % url
+        raise "Invalid url[%s]. Missing database name" % display
       end
 
-      parts = lead.split("@", 2)
-      if parts.size == 2
-        user = parts[0]
-        db_host = parts[1]
-      else
-        user = nil
-        db_host = lead
-      end
+      userinfo, db_host = ConnectionData.split_lead(lead)
+      user, password = ConnectionData.split_userinfo(userinfo)
 
       host, port = db_host.split(":", 2)
       if port
         if port.to_i.to_s != port
-          raise "Invalid url[%s]. Expected database port[%s] to be an integer" % [url, port]
+          raise "Invalid url[%s]. Expected database port[%s] to be an integer" % [display, port]
         end
       end
 
-      ConnectionData.new(host, name, :user => user, :port => port)
+      ConnectionData.new(host, name, :user => user && ConnectionData.percent_decode(user),
+                         :password => password && ConnectionData.percent_decode(password), :port => port)
     end
-    
+
+    # Splits "userinfo@host:port" on the LAST '@', since an unencoded
+    # password may itself contain one. Returns [userinfo or nil, host:port]
+    def ConnectionData.split_lead(lead)
+      index = lead.rindex("@")
+      index.nil? ? [nil, lead] : [lead[0...index], lead[(index + 1)..-1]]
+    end
+
+    # Splits "user:password" on the FIRST ':'. Returns [user, password or nil]
+    def ConnectionData.split_userinfo(userinfo)
+      return [nil, nil] if userinfo.nil?
+      user, password = userinfo.split(":", 2)
+      [user, password]
+    end
+
+    def ConnectionData.percent_decode(value)
+      value.gsub(/%([0-9A-Fa-f]{2})/) { $1.hex.chr }
+    end
+
+    # Yields [user, password] from the url's userinfo and returns the url
+    # with the userinfo replaced by the block's result. A url with no
+    # userinfo is returned unchanged.
+    def ConnectionData.rebuild_lead(url)
+      protocol, rest = url.split("//", 2)
+      return url if rest.nil?
+      lead, name = rest.split("/", 2)
+      userinfo, db_host = ConnectionData.split_lead(lead)
+      return url if userinfo.nil?
+      user, password = ConnectionData.split_userinfo(userinfo)
+      new_userinfo = yield(user, password)
+      new_lead = new_userinfo.to_s.empty? ? db_host : "#{new_userinfo}@#{db_host}"
+      name.nil? ? "#{protocol}//#{new_lead}" : "#{protocol}//#{new_lead}/#{name}"
+    end
+
   end
 
 end

data/lib/schema-evolution-manager/db.rb

@@ -2,20 +2,34 @@ module SchemaEvolutionManager
 
   class Db
 
-    attr_reader :url, :psql_executable_with_options
-
+    # psql_args: the psql executable and its global options, as an argv
+    attr_reader :url, :psql_args
+
+    # Options every psql invocation carries. --no-psqlrc keeps the applying
+    # user's ~/.psqlrc (and the system psqlrc) out of every command and
+    # migration; --no-password makes a missing credential fail rather than
+    # prompt, so an unattended apply can never hang.
+    PSQL_ISOLATION_OPTIONS = ["--no-psqlrc", "--no-password"]
+
+    # A password embedded in the url (postgres://user:pass@host/db) is moved
+    # into a private pgpass file and @url keeps only the password-free form,
+    # so the password never reaches a psql argv, a log line or an error.
+    #
+    # @param password: Optional password; takes precedence over one in the url
     def initialize(url, opts={})
-      @url = Preconditions.check_not_blank(url, "url cannot be blank")
+      Preconditions.check_not_blank(url, "url cannot be blank")
       password = opts.delete(:password)
 
-      @psql_executable_with_options = "psql"
+      @psql_args = ["psql"]
       (opts.delete(:set) || []).each do |arg|
-        @psql_executable_with_options << " --set #{arg}"
+        @psql_args += ["--set", arg]
       end
 
       Preconditions.assert_empty_opts(opts)
-      connection_data = ConnectionData.parse_url(@url)
+      connection_data = ConnectionData.parse_url(url)
+      @url = ConnectionData.strip_password(url)
 
+      password ||= connection_data.password
       if password
         ENV['PGPASSFILE'] = Db.password_to_tempfile(connection_data.pgpass(password))
       end
@@ -34,10 +48,8 @@ module SchemaEvolutionManager
     # executes a simple sql command.
     def psql_command(sql_command)
       Preconditions.assert_class(sql_command, String)
-      template = "#{@psql_executable_with_options} --no-align --tuples-only --no-psqlrc --command \"%s\" %s"
-      command = template % [sql_command, Shellwords.escape(@url)]
-      command_to_log = template % [sql_command, sanitized_url]
-      Library.system_or_error(command, command_to_log)
+      command = @psql_args + PSQL_ISOLATION_OPTIONS + ["--no-align", "--tuples-only", "--command", sql_command]
+      Library.system_or_error(command + [@url], :log => command + [sanitized_url])
     end
 
     def Db.attribute_values(path)
@@ -66,32 +78,28 @@ module SchemaEvolutionManager
       options
     end
 
-    # executes sql commands from a file in a single transaction
+    # executes sql commands from a file in a single transaction.
+    # psql reads the original file, so the line numbers and path in
+    # any psql error match the file in git.
     def psql_file(filename, path)
       Preconditions.assert_class(path, String)
       Preconditions.check_state(File.exist?(path), "File[%s] not found" % path)
 
-      options = Db.attribute_values(path).join(" ")
-
-      Library.with_temp_file(:prefix => File.basename(path)) do |tmp|
-        File.open(tmp, "w") do |out|
-          out << "\\set ON_ERROR_STOP true\n\n"
-          out << IO.read(path)
-        end
+      command = psql_file_command(path)
 
-        command = "#{@psql_executable_with_options} --file \"%s\" #{options} %s" % [tmp, Shellwords.escape(@url)]
-
-        Library.with_temp_file do |output|
-          result = `#{command} > #{output} 2>&1`.strip
-          status = $?
-          if status.to_i > 0
-            errors = File.exist?(output) ? IO.read(output) : result
-            raise ScriptError.new(self, filename, path, errors)
-          end
-        end
+      output, status = Open3.capture2e(*command)
+      if !status.success?
+        raise ScriptError.new(self, filename, path, output)
       end
     end
 
+    # The psql argv psql_file runs. ON_ERROR_STOP is set on the
+    # command line, after any --set the caller passed, so it is in
+    # effect before the first line of the file is read.
+    def psql_file_command(path)
+      @psql_args + PSQL_ISOLATION_OPTIONS + ["--set", "ON_ERROR_STOP=1", "--file", path] + Db.attribute_values(path) + [@url]
+    end
+
     # True if the specific schema exists; false otherwise
     def schema_schema_evolution_manager_exists?
       sql = "select count(*) from pg_namespace where nspname='%s'" % Db.schema_name
@@ -122,47 +130,34 @@ module SchemaEvolutionManager
       end
     end
 
+    # Returns value as a SQL string literal, doubling any single quote.
+    def Db.quote_literal(value)
+      Preconditions.assert_class(value, String)
+      "'" + value.gsub("'", "''") + "'"
+    end
+
     # Returns the name of the schema_evolution_manager schema
     def Db.schema_name
       "schema_evolution_manager"
     end
 
+    # Writes the pgpass contents to a file in Library::TMPFILE_DIR,
+    # returning its path. The file is a plain file rather than a Tempfile so
+    # that no finalizer can unlink it while psql still needs it; the
+    # TMPFILE_DIR at_exit hook removes it. libpq ignores a pgpass file that
+    # is group or world readable, so it is created mode 0600.
     def Db.password_to_tempfile(contents)
-      file = Tempfile.new("sem-db")
-      file.write(contents)
-      file.rewind
-      file.path
+      path = File.join(Library::TMPFILE_DIR, "pgpass.%s" % SecureRandom.hex(8))
+      File.open(path, File::WRONLY | File::CREAT | File::EXCL, 0600) do |out|
+        out.write(contents)
+      end
+      path
     end
 
-    # Returns a sanitized version of the URL with the password removed
-    # to prevent passwords from being logged or displayed in error messages
+    # The url for display. @url never carries a password (see initialize),
+    # so this is @url itself; kept for callers that print the connection.
     def sanitized_url
-      # Parse the URL to extract components
-      if @url.include?("://")
-        protocol, rest = @url.split("://", 2)
-        lead, name = rest.split("/", 2)
-
-        # Check if there's a username:password@ pattern
-        if lead.include?("@")
-          # Take the last element as host_part to handle passwords with @ symbols
-          host_part = lead.split("@").last
-          # Take everything before the last @ as user_part
-          user_part = lead.split("@")[0..-2].join("@")
-
-          if user_part.include?(":")
-            # Remove password, keep only username (everything before the first colon)
-            username = user_part.split(":", 2)[0]
-            sanitized_lead = "#{username}:[REDACTED]@#{host_part}"
-          else
-            sanitized_lead = lead
-          end
-          "#{protocol}://#{sanitized_lead}/#{name}"
-        else
-          @url
-        end
-      else
-        @url
-      end
+      @url
     end
 
   end

data/lib/schema-evolution-manager/install_template.rb

@@ -12,8 +12,10 @@ module SchemaEvolutionManager
     def generate
       template = Template.new
       template.add('timestamp', Time.now.to_s)
-      template.add('lib_dir', @lib_dir)
-      template.add('bin_dir', @bin_dir)
+      # Inserted as Ruby string literals: the generated script runs under
+      # sudo, so a quote in the prefix must not end the literal
+      template.add('lib_dir', @lib_dir.inspect)
+      template.add('bin_dir', @bin_dir.inspect)
       template.parse(TEMPLATE)
     end
 
@@ -22,7 +24,7 @@ module SchemaEvolutionManager
       File.open(path, "w") do |out|
         out << generate
       end
-      Library.system_or_error("chmod +x %s" % path)
+      Library.system_or_error(["chmod", "--", "+x", path])
     end
 
     if !defined?(TEMPLATE)
@@ -35,8 +37,8 @@ module SchemaEvolutionManager
 load File.join(File.dirname(__FILE__), 'lib/schema-evolution-manager.rb')
 SchemaEvolutionManager::Library.set_verbose(true)
 
-lib_dir = '%%lib_dir%%'
-bin_dir = '%%bin_dir%%'
+lib_dir = %%lib_dir%%
+bin_dir = %%bin_dir%%
 version = SchemaEvolutionManager::Version.read
 
 version_name = "schema-evolution-manager-%s" % version.to_version_string
@@ -49,18 +51,18 @@ SchemaEvolutionManager::Library.ensure_dir!(bin_dir)
 Dir.chdir(lib_dir) do
   if File.exist?("schema-evolution-manager")
     if File.symlink?("schema-evolution-manager")
-      SchemaEvolutionManager::Library.system_or_error("rm schema-evolution-manager")
-      SchemaEvolutionManager::Library.system_or_error("ln -s %s %s" % [version_name, 'schema-evolution-manager'])
+      SchemaEvolutionManager::Library.system_or_error(["rm", "schema-evolution-manager"])
+      SchemaEvolutionManager::Library.system_or_error(["ln", "-s", version_name, "schema-evolution-manager"])
     else
       puts "*** WARNING: File[%s] already exists. Not creating symlink" % File.join(lib_dir, "schema-evolution-manager")
     end
   else
-    SchemaEvolutionManager::Library.system_or_error("ln -s %s %s" % [version_name, 'schema-evolution-manager'])
+    SchemaEvolutionManager::Library.system_or_error(["ln", "-s", version_name, "schema-evolution-manager"])
   end
 end
 
 ['CONVENTIONS.md', 'LICENSE', 'README.md', 'VERSION', 'install.sh'].each do |filename|
-  SchemaEvolutionManager::Library.system_or_error("cp %s %s" % [filename, version_dir])
+  SchemaEvolutionManager::Library.system_or_error(["cp", "--", filename, version_dir])
 end
 
 ['bin', 'lib', 'lib/schema-evolution-manager', 'template', 'scripts'].each do |dir|
@@ -69,9 +71,9 @@ end
   Dir.foreach(dir) do |filename|
     path = File.join(dir, filename)
     if File.file?(path)
-      SchemaEvolutionManager::Library.system_or_error("cp %s %s" % [path, this_dir])
+      SchemaEvolutionManager::Library.system_or_error(["cp", "--", path, this_dir])
       if dir == "bin" && filename != "sem-config"
-        SchemaEvolutionManager::Library.system_or_error("chmod +x %s/%s" % [this_dir, filename])
+        SchemaEvolutionManager::Library.system_or_error(["chmod", "--", "+x", File.join(this_dir, filename)])
       end
     end
   end
@@ -82,7 +84,8 @@ Dir.chdir(bin_dir) do
   Dir.foreach(aliased_bin_dir) do |filename|
     path = File.join(aliased_bin_dir, filename)
     if File.file?(path)
-      SchemaEvolutionManager::Library.system_or_error("rm -f %s && ln -s %s" % [filename, path])
+      SchemaEvolutionManager::Library.system_or_error(["rm", "-f", "--", filename])
+      SchemaEvolutionManager::Library.system_or_error(["ln", "-s", "--", path])
     end
   end
 end
@@ -91,7 +94,7 @@ end
 init_file = File.join(version_dir, "bin/sem-config")
 SchemaEvolutionManager::Preconditions.check_state(File.exist?(init_file), "Init file[%s] not found" % init_file)
 File.open(init_file, "w") do |out|
-  out << "load File.join('%s')\n" % File.join(version_dir, 'lib/schema-evolution-manager.rb')
+  out << "load %s\n" % File.join(version_dir, 'lib/schema-evolution-manager.rb').inspect
 end
 
 puts ""

data/lib/schema-evolution-manager/library.rb

@@ -20,7 +20,7 @@ module SchemaEvolutionManager
       Preconditions.assert_class(dir, String)
 
       if !File.directory?(dir)
-        Library.system_or_error("mkdir -p #{dir}")
+        Library.system_or_error(["mkdir", "-p", "--", dir])
       end
       Library.assert_dir_exists(dir)
     end
@@ -38,14 +38,14 @@ module SchemaEvolutionManager
     end
 
     def Library.git_assert_tag_exists(tag)
-      command = "git tag -l"
+      command = ["git", "tag", "-l"]
       results = Library.system_or_error(command)
       if results.nil?
         raise "No git tags found"
       end
 
       if !Library.tag_exists?(tag)
-        raise "Tag[#{tag}] not found. Check #{command}"
+        raise "Tag[#{tag}] not found. Check #{Shellwords.join(command)}"
       end
     end
 
@@ -61,11 +61,17 @@ module SchemaEvolutionManager
     # no tags, otherwise returns an instance of Version. Only searches for
     # tags matching x.x.x (e.g. 1.0.2)
     def Library.latest_tag
-      `git tag -l`.strip.split.select { |tag| Version.is_valid?(tag) }.map { |tag| Version.parse(tag) }.sort.last
+      Library.git_tags.select { |tag| Version.is_valid?(tag) }.map { |tag| Version.parse(tag) }.sort.last
     end
 
+    # True only when a tag with exactly this name exists - 1.0.10 does
+    # not make 1.0.1 exist.
     def Library.tag_exists?(tag)
-      `git tag -l`.strip.include?(tag)
+      Library.git_tags.include?(tag)
+    end
+
+    def Library.git_tags
+      `git tag -l`.strip.split
     end
 
     # Ex: Library.git_create_tag("0.0.1")
@@ -73,11 +79,11 @@ module SchemaEvolutionManager
       Library.assert_valid_tag(tag)
       has_remote = Library.git_has_remote?
       if has_remote
-        Library.system_or_error("git fetch --tags origin")
+        Library.system_or_error(["git", "fetch", "--tags", "origin"])
       end
-      Library.system_or_error("git tag -a -m #{tag} #{tag}")
+      Library.system_or_error(["git", "tag", "-a", "-m", tag, tag])
       if has_remote
-        Library.system_or_error("git push --tags origin")
+        Library.system_or_error(["git", "push", "--tags", "origin"])
       end
     end
 
@@ -125,24 +131,65 @@ module SchemaEvolutionManager
       @@base_dir = Library.normalize_path(value)
     end
 
-    # Runs the specified command, raising an error if there is a problem
-    # (based on status code of the process executed). Otherwise returns
-    # all the output from the script invoked.
-    def Library.system_or_error(command, cmd_to_log=nil)
+    # Parses one property line of the form "<prefix><name> = <value>",
+    # stripping whitespace from both the name and the value. Returns
+    # [name, value] when the stripped line matches prefix (a Regexp
+    # anchored at the start of the line), otherwise nil. value is nil
+    # when the line has no equals sign. Shared by migration file
+    # attributes (-- sem.attribute.) and the .sem config file
+    # (sem.config.).
+    def Library.parse_property(line, prefix)
+      Preconditions.assert_class(line, String)
+      Preconditions.assert_class(prefix, Regexp)
+
+      stripped = line.strip
+      if stripped.match(prefix)
+        stripped.sub(prefix, '').split(/\=/, 2).map(&:strip)
+      else
+        nil
+      end
+    end
+
+    # Runs the command, raising an error if it exits non-zero, and
+    # returns its standard output, stripped. Standard error passes
+    # through to ours.
+    #
+    # The command is an argv array, executed directly and never through a
+    # shell, so a path or value holding a space, a quote or a dollar sign
+    # reaches the program as exactly one argument:
+    #
+    #   Library.system_or_error(["mv", "--", file, target])
+    #
+    # @param env: Optional hash of environment variables set for the command
+    # @param log: Optional array shown in place of the command when
+    #        logging or raising, for a command carrying a secret
+    def Library.system_or_error(command, opts={})
+      env = opts.delete(:env) || {}
+      log = opts.delete(:log) || command
+      Preconditions.assert_empty_opts(opts)
+      Preconditions.assert_class(command, Array)
+      Preconditions.check_state(!command.empty?, "command cannot be empty")
+      Preconditions.check_state(command.all? { |arg| arg.is_a?(String) }, "every argument must be a String: %s" % command.inspect)
+
+      display = Library.command_to_s(log, env)
       if Library.is_verbose?
-        puts cmd_to_log || command
+        puts display
       end
 
       begin
-        result = `#{command}`.strip
-        status = $?
-        if status.to_i > 0
-          raise "Non zero exit code[%s] running command[%s]" % [status, command]
-        end
-      rescue Exception => e
-        raise "Error running command[%s]: %s" % [command, e.to_s]
+        result, status = Open3.capture2(env, *command)
+      rescue SystemCallError => e
+        raise "Error running command[%s]: %s" % [display, e.to_s]
+      end
+      if !status.success?
+        raise "Non zero exit code[%s] running command[%s]" % [status, display]
       end
-      result
+      result.strip
+    end
+
+    # A shell-quoted rendering of an argv, for logs and error messages
+    def Library.command_to_s(command, env={})
+      (env.map { |k, v| "%s=%s" % [k, Shellwords.escape(v)] } + [Shellwords.join(command)]).join(" ")
     end
 
     def Library.normalize_path(path)
@@ -164,7 +211,7 @@ module SchemaEvolutionManager
       Preconditions.check_state(number_changes > 0)
       Preconditions.assert_empty_opts(opts)
 
-      git_log_command = "git log --pretty=format:\"%h %ad | %s%d [%an]\" --date=short -#{number_changes}"
+      git_log_command = ["git", "log", "--pretty=format:%h %ad | %s%d [%an]", "--date=short", "-#{number_changes}"]
       git_log = Library.system_or_error(git_log_command)
       out = ""
       out << "Created: %s\n" % Library.format_time
@@ -172,7 +219,7 @@ module SchemaEvolutionManager
         out << "Git Tag: %s\n" % tag
       end
       out << "\n"
-      out << "%s:\n" % git_log_command
+      out << "%s:\n" % Library.command_to_s(git_log_command)
       out << "  " << git_log.split("\n").join("\n  ") << "\n"
       out
     end

data/lib/schema-evolution-manager/migration_file.rb

@@ -42,6 +42,7 @@ module SchemaEvolutionManager
 
     unless defined?(DEFAULTS)
       DEFAULTS = [AttributeValue.new("transaction", "single")]
+      PROPERTY_PREFIX = /^\-\-\s+sem\.attribute\./
     end
 
     attr_reader :path, :attribute_values
@@ -86,11 +87,8 @@ module SchemaEvolutionManager
       File.foreach(path, mode: "rb") do |raw|
         line = raw.force_encoding("UTF-8")
         line = line.scrub unless line.valid_encoding?
-        stripped = line.strip
-        if stripped.match(/^\-\-\s+sem\.attribute\./)
-          stripped.sub!(/^\-\-\s+sem\.attribute\./, '')
-          name, value = stripped.split(/\=/, 2).map(&:strip)
-          yield name, value
+        if property = Library.parse_property(line, PROPERTY_PREFIX)
+          yield property[0], property[1]
         end
       end
     end

data/lib/schema-evolution-manager/scripts.rb

@@ -6,6 +6,18 @@ module SchemaEvolutionManager
       SCRIPTS = "scripts"
       BOOTSTRAP_SCRIPTS = "bootstrap_scripts"
       VALID_TABLE_NAMES = [BOOTSTRAP_SCRIPTS, SCRIPTS]
+      # A script basename is interpolated into SQL and passed to psql, so
+      # nothing outside this pattern may reach a query or be applied.
+      VALID_FILENAME = /\A\d{6,}-\d{6}\.sql\z/
+    end
+
+    # Raises unless filename follows the naming convention
+    # (e.g. 20120503-173242.sql). Returns the filename.
+    def Scripts.assert_valid_filename!(filename)
+      Preconditions.assert_class(filename, String)
+      Preconditions.check_state(VALID_FILENAME.match?(filename),
+                                "Invalid filename[#{filename}]. Must be like: 20120503-173242.sql")
+      filename
     end
 
     # @param db Instance of Db class
@@ -41,7 +53,7 @@ module SchemaEvolutionManager
     def each_pending(dir)
       files = {}
       Scripts.all(dir).each do |path|
-        name = File.basename(path)
+        name = Scripts.assert_valid_filename!(File.basename(path))
         files[name] = path
       end
 
@@ -63,8 +75,9 @@ module SchemaEvolutionManager
     # True if this script has already been applied to the db. False
     # otherwise.
     def has_run?(filename)
+      Scripts.assert_valid_filename!(filename)
       if @db.schema_schema_evolution_manager_exists?
-        query = "select count(*) from %s.%s where filename = '%s'" % [Db.schema_name, @table_name, filename]
+        query = "select count(*) from %s.%s where filename = %s" % [Db.schema_name, @table_name, Db.quote_literal(filename)]
         @db.psql_command(query).to_i > 0
       else
         false
@@ -73,9 +86,8 @@ module SchemaEvolutionManager
 
     # Inserts a record to indiciate that we have loaded the specified file.
     def record_as_run!(filename)
-      Preconditions.check_state(filename.match(/^\d\d\d\d\d\d+\-\d\d\d\d\d\d\.sql$/),
-                                "Invalid filename[#{filename}]. Must be like: 20120503-173242.sql")
-      command = "insert into %s.%s (filename) select '%s' where not exists (select 1 from %s.%s where filename = '%s')" % [Db.schema_name, @table_name, filename, Db.schema_name, @table_name, filename]
+      literal = Db.quote_literal(Scripts.assert_valid_filename!(filename))
+      command = "insert into %s.%s (filename) select %s where not exists (select 1 from %s.%s where filename = %s)" % [Db.schema_name, @table_name, literal, Db.schema_name, @table_name, literal]
       @db.psql_command(command)
     end
 
@@ -96,7 +108,8 @@ module SchemaEvolutionManager
       if scripts.empty? || !@db.schema_schema_evolution_manager_exists?
         []
       else
-        sql = "select filename from %s.%s where filename in (%s)" % [Db.schema_name, @table_name, "'" + scripts.join("', '") + "'"]
+        literals = scripts.map { |name| Db.quote_literal(Scripts.assert_valid_filename!(name)) }
+        sql = "select filename from %s.%s where filename in (%s)" % [Db.schema_name, @table_name, literals.join(", ")]
         @db.psql_command(sql).strip.split
       end
     end

data/lib/schema-evolution-manager/sem_info.rb

@@ -19,7 +19,7 @@ module SchemaEvolutionManager
         exit(4)
       end
 
-      db_args = SchemaEvolutionManager::Args.new(args.join(" "), :optional => ['url', 'host', 'user', 'name', 'port', 'set'])
+      db_args = SchemaEvolutionManager::Args.new(args, :optional => ['url', 'host', 'user', 'name', 'port', 'set'])
 
       if db_args.url.to_s.strip.empty? && db_args.name.to_s.strip.empty?
         $stderr.puts "ERROR: Missing database connection. Provide --url <postgres url> or --host/--name."

data/lib/schema-evolution-manager/sem_version.rb

@@ -3,7 +3,7 @@ module SchemaEvolutionManager
 
 module SemVersion
 
-VERSION ||= '0.9.60'
+VERSION ||= '0.9.61'
 
 end
 

data/lib/schema-evolution-manager/template.rb

@@ -29,7 +29,9 @@ module SchemaEvolutionManager
       Preconditions.check_not_blank(contents)
       string = contents.dup
       @subs.each do |sub|
-        string = string.gsub(/%%#{sub.pattern}%%/, sub.value)
+        # Block form: the value is inserted literally, so a backslash in
+        # it is never read as a backreference
+        string = string.gsub(/%%#{sub.pattern}%%/) { sub.value }
       end
       string
     end

data/lib/schema-evolution-manager.rb

@@ -1,8 +1,9 @@
 require 'fileutils'
 require 'pathname'
-require 'tempfile'
 require 'tmpdir'
+require 'securerandom'
 require 'shellwords'
+require 'open3'
 
 dir = File.dirname(__FILE__)
 lib_dir = File.join(dir, "schema-evolution-manager")
@@ -29,3 +30,4 @@ load File.join(lib_dir, 'install_template.rb')
 load File.join(lib_dir, 'script_error.rb')
 load File.join(lib_dir, 'sem_info.rb')
 load File.join(lib_dir, 'migration_file.rb')
+load File.join(lib_dir, 'config.rb')

data/template/dev.rb

@@ -6,7 +6,7 @@
 #
 
 Dir.chdir(File.dirname($0)) {
-  command = "sem-apply --url %%url%%"
-  puts command
-  exec(command)
+  command = ["sem-apply", "--url", %%url_literal%%]
+  puts command.join(" ")
+  exec(*command)
 }

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: schema-evolution-manager
 version: !ruby/object:Gem::Version
-  version: 0.9.60
+  version: 0.9.61
 platform: ruby
 authors:
 - Michael Bryzek
 bindir: bin
 cert_chain: []
-date: 2026-09-27 00:00:00.000000000 Z
+date: 2026-10-09 00:00:00.000000000 Z
 dependencies: []
 description: '["Michael Bryzek"]'
 email: mbryzek@alum.mit.edu
@@ -35,6 +35,7 @@ files:
 - lib/schema-evolution-manager/args.rb
 - lib/schema-evolution-manager/ask.rb
 - lib/schema-evolution-manager/baseline_util.rb
+- lib/schema-evolution-manager/config.rb
 - lib/schema-evolution-manager/connection_data.rb
 - lib/schema-evolution-manager/db.rb
 - lib/schema-evolution-manager/install_template.rb