Re: "cert" + clientcert=verify-ca in pg_hba.conf?

On Thu, Sep 24, 2020 at 09:59:50PM -0400, Tom Lane wrote:
> Kyotaro Horiguchi <horikyota(dot)ntt(at)gmail(dot)com> writes:
> > Thank you Bruce, Michael. This is a rebased version.
>
> I really strongly object to all the encoded data in this patch.
> One cannot read it, one cannot even easily figure out how long
> it is until the tests break by virtue of the certificates expiring.
>
> One can, however, be entirely certain that they *will* break at
> some point. I don't like the idea of time bombs in our test suite.
> That being the case, it'd likely be better to drop all the pre-made
> certificates and have the test scripts create them on the fly.
> That'd remove both the documentation problem (i.e., having readable
> info as to how the certificates were made) and the expiration problem.

I am not planning to apply the test parts of this patch. I think
having the committer test it is sufficient.

--
Bruce Momjian <bruce(at)momjian(dot)us> https://momjian.us
EnterpriseDB https://enterprisedb.com

The usefulness of a cup is in its emptiness, Bruce Lee