Re: Adding support for SSLKEYLOGFILE in the frontend

From: Peter Eisentraut <peter(at)eisentraut(dot)org>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com>
Cc: Daniel Gustafsson <daniel(at)yesql(dot)se>, Abhishek Chanda <abhishek(dot)becs(at)gmail(dot)com>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: Adding support for SSLKEYLOGFILE in the frontend
Date: 2025-03-14 14:27:31
Message-ID: 68b66b6d-cc59-44f8-bdd2-248d50055740@eisentraut.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On 13.03.25 19:31, Tom Lane wrote:
> Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com> writes:
>> Adding the PG prefix to the envvar name addresses my collision
>> concern, but I think Tom's comment upthread [1] was saying that we
>> should not provide any envvar at all:
>
>>> I think it might be safer if we only accepted it as a connection
>>> parameter and not via an environment variable.
>
>> Is the addition of the PG prefix enough to address that concern too?
>
> Indeed, I was advocating for *no* environment variable. The PG prefix
> does not comfort me.

It seems to me that the environment variable would be the most useful
way to use this feature, for example if you want to debug an existing
program that you can't or don't want to change.

As was mentioned earlier, libcurl uses an environment variable for this.
Moreover, the format originated in the NSS library, which also uses an
environment variable.

So we are here constructing a higher level of security that others don't
seem to have found the need for.

It's also possible that we should consider the SSLKEYLOGFILE environment
variable some kind of quasi-standard like PAGER, and we should be using
exactly that environment variable name like everyone else.

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Tomas Vondra 2025-03-14 14:30:01 Re: Get rid of WALBufMappingLock
Previous Message Christoph Berg 2025-03-14 14:23:26 Re: Proposal: manipulating pg_control file from Perl