Re: Replace current implementations in crypt() and gen_salt() to OpenSSL - Mailing list pgsql-hackers

From Daniel Gustafsson
Subject Re: Replace current implementations in crypt() and gen_salt() to OpenSSL
Date
Msg-id CF8C224D-9F2B-4F75-B91F-E0FB512262D7@yesql.se
Whole thread Raw
In response to Re: Replace current implementations in crypt() and gen_salt() to OpenSSL  (Joe Conway <mail@joeconway.com>)
List pgsql-hackers
> On 29 Oct 2024, at 13:53, Joe Conway <mail@joeconway.com> wrote:
>
> On 10/29/24 05:57, Daniel Gustafsson wrote:
>>> On 26 Oct 2024, at 20:10, Joe Conway <mail@joeconway.com> wrote:
>>> Rather than depend on figuring out if we are in FIPS_mode in a portable way, I think the GUC is simpler and
sufficient.Why not do that and just use a better name, e.g. legacy_crypto_enabled or something similar (bike-shedding
welcomed)as in the attached. 
>> I'm not very enthusiastic about adding a GUC to match a system property like
>> that for the same reason why we avoid GUCs with transitive dependencies.
>> Re-reading the thread and thinking about I think the best solution would be to
>> split these functions off into their own extension.
>
> Seems like that would be an issue for backward comparability and upgrades.

That's undoubtedly a downside of this proposal which the GUC proposal doesn't have.
--
Daniel Gustafsson




pgsql-hackers by date:

Previous
From: Bertrand Drouvot
Date:
Subject: Re: Add isolation test template in injection_points for wait/wakeup/detach
Next
From: Tom Lane
Date:
Subject: Re: Support regular expressions with nondeterministic collations