| From: | Daniel Gustafsson <daniel(at)yesql(dot)se> |
|---|---|
| To: | Joe Conway <mail(at)joeconway(dot)com> |
| Cc: | Peter Eisentraut <peter(at)eisentraut(dot)org>, Robert Haas <robertmhaas(at)gmail(dot)com>, "Koshi Shibagaki (Fujitsu)" <shibagaki(dot)koshi(at)fujitsu(dot)com>, "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
| Subject: | Re: Replace current implementations in crypt() and gen_salt() to OpenSSL |
| Date: | 2024-10-29 14:08:42 |
| Message-ID: | CF8C224D-9F2B-4F75-B91F-E0FB512262D7@yesql.se |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
> On 29 Oct 2024, at 13:53, Joe Conway <mail(at)joeconway(dot)com> wrote:
>
> On 10/29/24 05:57, Daniel Gustafsson wrote:
>>> On 26 Oct 2024, at 20:10, Joe Conway <mail(at)joeconway(dot)com> wrote:
>>> Rather than depend on figuring out if we are in FIPS_mode in a portable way, I think the GUC is simpler and sufficient. Why not do that and just use a better name, e.g. legacy_crypto_enabled or something similar (bike-shedding welcomed) as in the attached.
>> I'm not very enthusiastic about adding a GUC to match a system property like
>> that for the same reason why we avoid GUCs with transitive dependencies.
>> Re-reading the thread and thinking about I think the best solution would be to
>> split these functions off into their own extension.
>
> Seems like that would be an issue for backward comparability and upgrades.
That's undoubtedly a downside of this proposal which the GUC proposal doesn't have.
--
Daniel Gustafsson
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2024-10-29 14:12:51 | Re: Support regular expressions with nondeterministic collations |
| Previous Message | Bertrand Drouvot | 2024-10-29 14:06:11 | Re: Add isolation test template in injection_points for wait/wakeup/detach |