Re: [PATCH] pg_hba.conf : new auth option : clientcert=verify-full - Mailing list pgsql-hackers

From Julian Markwort
Subject Re: [PATCH] pg_hba.conf : new auth option : clientcert=verify-full
Date
Msg-id permail-201807141247373cc687ad000077fb-j_mark05@message-id.uni-muenster.de
Whole thread Raw
In response to Re: [PATCH] pg_hba.conf : new auth option : clientcert=verify-full  (Thomas Munro <thomas.munro@enterprisedb.com>)
Responses Re: [PATCH] pg_hba.conf : new auth option : clientcert=verify-full  (Thomas Munro <thomas.munro@enterprisedb.com>)
List pgsql-hackers
Hi Thomas,

here's a rebased patch, with your observations corrected.

Thomas Munro wrote on 2018-07-13:
> +   In this case, the <literal>CN</literal> (nommon name) provided in
> "common name"
> +   <literal>CN</literal> (Common Name) in the certificate matches
> "common"? (why a capital letter here?)

I've resorted to "<literal>CN</literal> (Common Name)" on all occurences in this patch now.

Also, while writing this part of the docs, I tried to stay below 80 characters, but I've exceeded it in some places.
There are several other places (several in the .sgml files touched by this patch), where 80 characters are exceeded;
Howclose should one adhere to that limit nowadays? 


> This line isn't modified by your patch, but I saw it while in
> proof-reading mode:
>   *err_msg = "clientcert can not be set to 0 when using \"cert\"
> authentication";
> I think "can not" is usually written "cannot"?

I'm not sure about can not, cannot, can't... There are 56, respectively 12697, and 2024 occurrences in master right
now.
We could touch those lines now and change them to the more common cannot, or we can leave it as is...


> Yeah.  The packages to install depend on your operating system, and in
> some cases (macOS, Windows?) which bolt-on package thingamajig you
> use, though.  Perhaps the READMEs could be improved with details for
> systems we have reports about (like the recently added "Requirements"
> section of src/test/ldap/README).

That would be nice, however I could only provide the package names for Fedora right now...
Would It make sense to add those on their own?
Or should somebody (maybe myself, when I'm less busy) gather those for most supported systems and commit them as a
whole?

kind regards
Julian

Attachment

pgsql-hackers by date:

Previous
From: Michael Paquier
Date:
Subject: Re: missing toast table for pg_policy
Next
From: Tom Lane
Date:
Subject: Re: CVE-2017-7484-induced bugs, or, btree cmp functions are not leakproof?