From: Stephen Frost <sfrost@snowman.net>
To: Tim Cross <theophilusx@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: scram-sha-256 encrypted password in pgpass
Date: Mon, 22 Jun 2020 20:33:23 -0400
Message-ID: <20200623003323.GL3125@tamriel.snowman.net> (raw)
In-Reply-To: <87mu4ud3vj.fsf@gmail.com>
References: <CA+M0sHEJC6whG8VfNk=393uoDsedQg+tVZ9vy7GLdWBZR5BC0A@mail.gmail.com>
<CAKFQuwZHLq1o55-sSaeuF8hU=9nYXN8MNTdL50A7W7Zf_6ZjHQ@mail.gmail.com>
<CA+M0sHE=wMp3Q251AaHcz612D14qY7X3xgGvzuM8npAY_B6FxA@mail.gmail.com>
<87mu4ud3vj.fsf@gmail.com>
Greetings,
* Tim Cross (theophilusx@gmail.com) wrote:
> I suspect it is unlikely you will ever see a .pgpass solution which
> supports encryption. There are just too many 'chicken and egg' problems
> - you need a key to encrypt the .pgpass file, but now you need to store
> the key securely. Problem made more difficult because different
> platforms all do this in different ways and with different levels of
> sophistication. While it could be done, the amount of work required is
> probably more than the desire for anyone to implement it (not a big
> enough itch).
I generally agree with most of what you had here, but to this point I
disagree- it'd actually be quite useful for libpq to gain capabilities
in this regard, as it's something that developers these days are clearly
interesting in having provided by a library (up to and including vault
solution integration, which is becoming more and more a standardized
thing, in order to get the needed key), so I dislike the implication
that we won't do that or that we'd look down on a patch which moved us
towards such a solution. There's certainly some of us in this community
who would very much look positively on such a patch.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, theophilusx@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: scram-sha-256 encrypted password in pgpass
In-Reply-To: <20200623003323.GL3125@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox