Re: Replace current implementations in crypt() and gen_salt() to OpenSSL

On 10/29/24 10:08, Daniel Gustafsson wrote:
>> On 29 Oct 2024, at 13:53, Joe Conway <mail(at)joeconway(dot)com> wrote:
>> On 10/29/24 05:57, Daniel Gustafsson wrote:
>>>> On 26 Oct 2024, at 20:10, Joe Conway <mail(at)joeconway(dot)com> wrote:

>>>> Rather than depend on figuring out if we are in FIPS_mode in a
>>>> portable way, I think the GUC is simpler and sufficient. Why
>>>> not do that and just use a better name, e.g.
>>>> legacy_crypto_enabled or something similar (bike-shedding
>>>> welcomed) as in the attached.

>>> I'm not very enthusiastic about adding a GUC to match a system property like
>>> that for the same reason why we avoid GUCs with transitive dependencies.
>>> Re-reading the thread and thinking about I think the best solution would be to
>>> split these functions off into their own extension.

>> Seems like that would be an issue for backward comparability and upgrades.

> That's undoubtedly a downside of this proposal which the GUC proposal doesn't have.

Any other opinions out there?

--
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com