Subject: [pgjdbc/pgjdbc] PR #3124: Add Windows and MacOS native certificate support

From: "minfrin (@minfrin)" <[email-masked]>
Date: Fri, 16 Feb 2024 10:11:35 +0000

Add three new SSLSocketFactory implementations to support native keystores on Windows and Mac.

org.postgresql.ssl.MSCAPILocalMachineSSLFactory
org.postgresql.ssl.MSCAPISSLFactory
org.postgresql.ssl.KeychainSSLFactory

Add the sslsubject parameter to limit the chosen certificate where more than one certificate might match for a given connection.

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing](https://github.com/pgjdbc/pgjdbc/blob/master/CONTRIBUTING.md) document?
* [x] Have you checked to ensure there aren't other open [Pull Requests](../../pulls) for the same update/change?

<!-- You can erase any parts of this template not applicable to your Pull Request. -->

### New Feature Submissions:

1. [x] Does your submission pass tests?
2. [x] Does `./gradlew styleCheck` pass ?
3. [x] Have you added your new test classes to an existing test suite in alphabetical order?

### Changes to Existing Features:

* [ ] Does this break existing behaviour? If so please explain.
* [x] Have you added an explanation of what your changes do and why you'd like us to include them?
* [x] Have you written new tests for your core changes, as applicable?
* [x] Have you successfully run tests with your changes locally?

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Thu, 22 Feb 2024 11:20:42 +0000

Would it be possible to approve the workflows outstanding on this PR?

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Wed, 28 Feb 2024 14:08:13 +0000

> Would it be possible to approve the workflows outstanding on this PR?

Yes, sorry. I should have realized they weren't running

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Thu, 29 Feb 2024 10:36:24 +0000

(on pgjdbc/src/main/java/org/postgresql/ssl/SSLFactory.java:89)

I'm getting a test failure, more specifically a compilation failure that I don't understand.

```
[Task :postgresql:compileJava] [argument] incompatible argument for parameter arg1 of KeyManagerFactory.init.
      keyManagerFactory.init(keyStore, keyPassphrase);
                                       ^
  found   : @initialized @nonnull char @FBCBottom @nullable []
```

keyPassphrase is a char[], the extra annotations seem sane.

Can you confirm for me if possible what specifically is wrong with this line so I can fix it?

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Thu, 29 Feb 2024 10:38:12 +0000

These warnings might be relevant:

```
> Task :postgresql:compileJava
warning: /home/runner/work/pgjdbc/pgjdbc/config/checkerframework/Assert.astub:(line 1,col 1): Package not found: org.junit
warning: /home/runner/work/pgjdbc/pgjdbc/config/checkerframework/Assert.astub:(line 6,col 1): Type not found: org.junit.Assert
```

---

From: "michael-o (@michael-o)" <[email-masked]>
Date: Fri, 08 Mar 2024 21:21:12 +0000

(on pgjdbc/src/main/java/org/postgresql/ssl/SSLFactory.java)

Java

---

From: "michael-o (@michael-o)" <[email-masked]>
Date: Fri, 08 Mar 2024 21:21:56 +0000

(on pgjdbc/src/main/java/org/postgresql/ssl/SSLFactory.java:93)

Isn't `ex.getMessage()` redudant since the target message will be recursively built?

---

From: "michael-o (@michael-o)" <[email-masked]>
Date: Fri, 08 Mar 2024 21:22:16 +0000

(on pgjdbc/src/main/java/org/postgresql/ssl/SSLFactory.java:135)

Same here

---

From: "michael-o (@michael-o)" <[email-masked]>
Date: Fri, 08 Mar 2024 21:22:21 +0000

same here

---

From: "michael-o (@michael-o)" <[email-masked]>
Date: Fri, 08 Mar 2024 21:22:29 +0000

(on pgjdbc/src/main/java/org/postgresql/ssl/SSLFactory.java:145)

Both same here

---

From: "michael-o (@michael-o)" <[email-masked]>
Date: Fri, 08 Mar 2024 21:22:42 +0000

(on pgjdbc/src/main/java/org/postgresql/ssl/SSLFactory.java:163)

Same both here

---

From: "michael-o (@michael-o)" <[email-masked]>
Date: Fri, 08 Mar 2024 21:22:50 +0000

(on pgjdbc/src/main/java/org/postgresql/ssl/SSLFactory.java:176)

Same here

---

From: "michael-o (@michael-o)" <[email-masked]>
Date: Fri, 08 Mar 2024 21:23:33 +0000

(on pgjdbc/src/test/java/org/postgresql/test/ssl/SSLFactoryTest.java:36)

You are sure that cause will not be null at some point?

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Mon, 18 Mar 2024 09:04:23 +0000

Fixed.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Mon, 18 Mar 2024 09:10:19 +0000

Java is fixed.

The ex.getMessage() is there on purpose so that the whole error message is on one single line.

The target audience for this patch are data scientists who aren't Java developers, nor are they experts in SSL. They see the message "Could not find a java cryptographic algorithm", they don't understand it (fair: "which crypto algorithm?"), and I have to pick it all apart for them, first helping them give me the whole exception (I'll get a screenshot of the top few lines, then I'll explain how to cut and paste), then finding the needle in the haystack of "caused by", then googling for them.

With the whole message on one line, they have one line to google themselves, on the top line, and lots and lots of make work is avoided.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Mon, 18 Mar 2024 09:10:33 +0000

Java is fixed.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Mon, 18 Mar 2024 09:10:43 +0000

Java is fixed.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Mon, 18 Mar 2024 09:10:53 +0000

Java is fixed.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Mon, 18 Mar 2024 09:11:06 +0000

Java is fixed.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Mon, 18 Mar 2024 09:11:23 +0000

This is intended.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Mon, 18 Mar 2024 09:13:44 +0000

Instanceof doesn't require a null check. The expression "null instancof PSQLException" returns false.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Mon, 25 Mar 2024 22:31:31 +0000

Another gentle bump - is it possible to trigger workflows?

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Wed, 27 Mar 2024 11:03:11 +0000

sorry about that

---

From: "sehrope (@sehrope)" <[email-masked]>
Date: Wed, 27 Mar 2024 12:54:10 +0000

@minfrin You can enable actions to run on your pgjdbc fork as well. This is particularly useful if you want to try running something in CI without opening a PR in this repo. The GitHub Actions should work with no issues on your fork. The Windows / AppVeyor stuff is a bit finicky but in theory should work if you set up an account there as well.

(Note that I'm not suggesting opening this PR and running the CI on pgjdbc/pgjdbc was a bad idea ... I'm just suggesting an alternative for the future if you're trying out something else)

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Wed, 24 Apr 2024 08:57:56 +0000

Quick ping on this comment - I don't understand how it compiles everywhere else but not in this specific case. Is someone familiar with CheckerFramework able to confirm?

https://github.com/pgjdbc/pgjdbc/actions/runs/8323877965/job/23147420376?pr=3124

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Wed, 24 Apr 2024 19:51:20 +0000

@minfrin I took the liberty of fixing the checker errors

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Wed, 24 Apr 2024 21:26:48 +0000

> @minfrin I took the liberty of fixing the checker errors

Much appreciated, thank you.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Tue, 16 Jul 2024 15:47:17 +0000

Quick bump on this one, is there anything further needed on this patch?

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Sun, 29 Sep 2024 11:51:22 +0000

Another quick ping on this one - keen to make certificates easier to use on Windows and Mac.

---

From: "minfrin (@minfrin)" <[email-masked]>
Date: Tue, 10 Dec 2024 17:41:22 +0000

Another bump on this one - anyone able to take a look?