biscuit

Overview

Version

Build

You can build the RPM / DEB packages for pg_biscuit using pig build:

pig build pkg pg_biscuit         # build RPM / DEB packages

Install

You can install pg_biscuit directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

• Install
• pig
• dnf
• apt

pig install pg_biscuit;          # Install for current active PG version

pig ext install -y pg_biscuit -v 18  # PG 18
pig ext install -y pg_biscuit -v 17  # PG 17
pig ext install -y pg_biscuit -v 16  # PG 16

dnf install -y pg_biscuit_18       # PG 18
dnf install -y pg_biscuit_17       # PG 17
dnf install -y pg_biscuit_16       # PG 16

apt install -y postgresql-18-biscuit   # PG 18
apt install -y postgresql-17-biscuit   # PG 17
apt install -y postgresql-16-biscuit   # PG 16

Create Extension:

CREATE EXTENSION biscuit CASCADE;  -- requires: plpgsql

Usage

GitHub: CrystallineCore/pg_biscuit

biscuit (pg_biscuit) is a PostgreSQL extension that provides IAM-like pattern matching with bitmap indexing. It enables efficient matching of permission-style patterns against text values using a specialized bitmap index.

Features

• IAM-like pattern matching: Supports wildcard pattern matching similar to AWS IAM policy patterns
• Bitmap indexing: Uses bitmap indexes for fast pattern matching queries
• Permission evaluation: Evaluate whether a given action matches a set of permission patterns

Quick Start

CREATE EXTENSION biscuit CASCADE;  -- requires plpgsql

-- Create a table with permission patterns
CREATE TABLE permissions (
  id serial PRIMARY KEY,
  pattern text NOT NULL
);

-- Insert IAM-like patterns
INSERT INTO permissions (pattern) VALUES
  ('s3:GetObject'),
  ('s3:*'),
  ('ec2:Describe*'),
  ('iam:Create*');

Pattern Syntax

Biscuit supports IAM-style wildcard patterns:

• * matches any sequence of characters
• ? matches any single character
• Exact strings match literally

Notes

• Requires the plpgsql extension (installed automatically with CASCADE)
• Available for PostgreSQL 16, 17, and 18
• Licensed under MIT