Re: Replace current implementations in crypt() and gen_salt() to OpenSSL

From: Joe Conway <mail(at)joeconway(dot)com>
To: Daniel Gustafsson <daniel(at)yesql(dot)se>
Cc: Peter Eisentraut <peter(at)eisentraut(dot)org>, Robert Haas <robertmhaas(at)gmail(dot)com>, "Koshi Shibagaki (Fujitsu)" <shibagaki(dot)koshi(at)fujitsu(dot)com>, "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: Re: Replace current implementations in crypt() and gen_salt() to OpenSSL
Date: 2024-10-29 12:53:10
Message-ID: 451041d1-fb33-4d64-bef5-fd3920f8169c@joeconway.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On 10/29/24 05:57, Daniel Gustafsson wrote:
>> On 26 Oct 2024, at 20:10, Joe Conway <mail(at)joeconway(dot)com> wrote:
>
>> Rather than depend on figuring out if we are in FIPS_mode in a portable way, I think the GUC is simpler and sufficient. Why not do that and just use a better name, e.g. legacy_crypto_enabled or something similar (bike-shedding welcomed) as in the attached.
>
> I'm not very enthusiastic about adding a GUC to match a system property like
> that for the same reason why we avoid GUCs with transitive dependencies.
>
> Re-reading the thread and thinking about I think the best solution would be to
> split these functions off into their own extension.

Seems like that would be an issue for backward comparability and upgrades.

--
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Robert Haas 2024-10-29 12:59:21 Re: Eager aggregation, take 3
Previous Message Andy Fan 2024-10-29 12:48:09 Re: detoast datum into the given buffer as a optimization.