Date: Mon, 31 Aug 2020 14:16:48 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Nicholas Chammas <nicholas.chammas@gmail.com>,
	pgsql-admin@lists.postgresql.org
Subject: Re: Amazon RDS auth tokens in .pgpass
Message-ID: <20200831181648.GT29590@tamriel.snowman.net>
References: 
 <CAOhmDze1nqG2vfegpSsTFCgaiFRsqgjO6yLsbmhroz2zGmJHog@mail.gmail.com>
 <4119486.1598897040@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="CgtXan5liHMhJzJr"
Content-Disposition: inline
In-Reply-To: <4119486.1598897040@sss.pgh.pa.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--CgtXan5liHMhJzJr
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Nicholas Chammas <nicholas.chammas@gmail.com> writes:
> > It's only the combination of a) .pgpass and b) RDS auth token that does=
n't
> > work. This leads me to believe something is going wrong on a code path
> > specific to .pgpass, or that there are some undocumented restrictions on
> > what can go in .pgpass.
>=20
> Looking at the source code, there's a hard-wired restriction that lines of
> .pgpass can't be more than 320 characters long (well, NAMEDATALEN*5, but
> very few builds don't have NAMEDATALEN=3D64).  I see that somebody very
> recently added code to make libpq print a warning for overlength lines,
> but I wonder why they didn't just, um, remove the restriction.  We had
> not previously heard of a use-case for passwords with hundreds of
> characters in them, but I guess we need to cope.

My memory might be faulty, but I've got some specific recollection of
people complaining about this before and the community response being
"who would ever need such very long things?!"

In particular, this seems relevant...

https://www.postgresql.org/message-id/29496.1539388920%40sss.pgh.pa.us

but I'm also inclined to add support for these longer values.

Thanks,

Stephen

--CgtXan5liHMhJzJr
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJfTT6PAAoJEO1sijiDR2RVbmkP/2LJ7BWqParGaa6oGRNDUCIk
0cycIdnOjzXZE5soDH0vTDw6lPmGKDAbsQ5pr3/chMswsbhXoctx+CE5KsM82hs6
G5nAfDt/s9I0xeptkpwQsTwQyPs55WPIaBdFIdkYU8sKNWM2HY2wXRPMy7KZu4jK
VMYC27Ed/MiaOQyp4heqYpUBEN9tlDPo6hDzixgjmI2S3kI5OxyUVYtKw47f8ctl
gT/NdAfT3fuvQFT3gYxncV4/R4Ug032Wkf8SeZ9Uk7rYkFwU1qTzpZmjFfB12ypp
QUeuWJPiSUZMjDIg4MXGw/5+m1S7OBNy3qhW/5CIM3apX9UqJT24X14Bz6yNFkKD
v5I8iDB4eXguZTzBSAd+RYEMvHbEytpoJxgWCD1Qt6gJlQ5QIYhPV0toYAISDpqJ
oNYR0053dV1D6OPToAtdN03Ma8Ru3Ux1v0fZpmsOqluI/HgDbHBXpXGT3/V+FBD3
M1kHZSj/RPBKxacRJr3KUQVWaxaMG8aMm5eBw68MO25luA3K+65UoV6fac7CSDoP
sRzMKR1RVGz3p0Mks+8n8C0nNdUiDMCWsdhYkVNyeIB3DiREpqc0+IW//YEL0Y2h
zTbablpEmoLD+Dpg6R0TpWlm6dQOEUvZ7VGU7+zNpmpRLzCYQDLMf+G1FTk3lz/U
aUAe6Rooh55r9IaDe9a8
=5DqJ
-----END PGP SIGNATURE-----

--CgtXan5liHMhJzJr--