Date: Mon, 22 Jun 2020 20:33:23 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Tim Cross <theophilusx@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: scram-sha-256 encrypted password in pgpass
Message-ID: <20200623003323.GL3125@tamriel.snowman.net>
References: 
 <CA+M0sHEJC6whG8VfNk=393uoDsedQg+tVZ9vy7GLdWBZR5BC0A@mail.gmail.com>
 <CAKFQuwZHLq1o55-sSaeuF8hU=9nYXN8MNTdL50A7W7Zf_6ZjHQ@mail.gmail.com>
 <CA+M0sHE=wMp3Q251AaHcz612D14qY7X3xgGvzuM8npAY_B6FxA@mail.gmail.com>
 <87mu4ud3vj.fsf@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="wwtQuX191/I956S7"
Content-Disposition: inline
In-Reply-To: <87mu4ud3vj.fsf@gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--wwtQuX191/I956S7
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Greetings,

* Tim Cross (theophilusx@gmail.com) wrote:
> I suspect it is unlikely you will ever see a .pgpass solution which
> supports encryption. There are just too many 'chicken and egg' problems
> - you need a key to encrypt the .pgpass file, but now you need to store
> the key securely. Problem made more difficult because different
> platforms all do this in different ways and with different levels of
> sophistication. While it could be done, the amount of work required is
> probably more than the desire for anyone to implement it (not a big
> enough itch).

I generally agree with most of what you had here, but to this point I
disagree- it'd actually be quite useful for libpq to gain capabilities
in this regard, as it's something that developers these days are clearly
interesting in having provided by a library (up to and including vault
solution integration, which is becoming more and more a standardized
thing, in order to get the needed key), so I dislike the implication
that we won't do that or that we'd look down on a patch which moved us
towards such a solution.  There's certainly some of us in this community
who would very much look positively on such a patch.

Thanks,

Stephen

--wwtQuX191/I956S7
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJe8U3TAAoJEO1sijiDR2RV1GgP/0V7G1RpYPeXX8o+TEVdHZit
y28DYE+/rmKH6FsADfzaApJ0HQPKK1he0hbcJ8W2N4p640S25qccN9LAxsDaSWIW
B7GqzstubjpUpaq7ULIQ9l3hds52jr5d40MjU658d1P9vezz5IxG7erWFB+EtLcK
lRpB0l1LY/6w8DOzEt+BdMuV9agWlAHeF94kJcHF2E60scC6ZX1oQ3e/g2O158rf
LCJMPuezXpeT65RWbXH/roZqNp5K+4RUdTdZwyKtJqLJes17EKoLb79//vYmWxMt
NQ4/mYYD0rWkcWbQK2KhAYd6gdbZm2jVXPZvFdeBIiQSIW7QdXyf6ZS6+FXY3tPt
h4NccrUK1JemJV9pUSlmCNjjbv8REMFP3Wu+fUirWj086yV/xSWMvfqhUq4809+R
P/KGWQibxdAasqqEsaFSl3stGJuDkcHjB9HJ9p9NVDQ+RMWZlVlSgZmye1plFWy8
k2z7eoYST4aVd6b0dPuZVubv1xzJTVpO7jfDz8gVD0+u3QsiASBGrjzWgzcI0KQ/
hyFT9bWn4iwgFOO1V05NbIeA+SVjwN0ihV1I+Ahn7wX0TtqdggwvFWUuLnv7NRmO
n+55Ok/2jCgTKY/R2pzK41QgyUE6iy5t5qRgYWtwVMkk745d9zc+PoIQ8xSLCKz7
kMzL+h81BpJNITh1XJtB
=Hwh6
-----END PGP SIGNATURE-----

--wwtQuX191/I956S7--