MIME-Version: 1.0
References: <E1tl8m6-000KH7-0J@gemulon.postgresql.org>
 <Z-sPFl27Y0ZC-VBl@msg.df7cb.de>
 <CAOYmi+=SEwJ+7ATgxrkvDFyGb-FQ5FN9eF_RVMic6DAU3bk5zw@mail.gmail.com>
 <Z-vkHdDPFlD8SKAf@msg.df7cb.de>
 <CB1D7ED6-0A7C-4B3E-84E4-72E9576E9AAD@yesql.se>
In-Reply-To: <CB1D7ED6-0A7C-4B3E-84E4-72E9576E9AAD@yesql.se>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Tue, 1 Apr 2025 08:48:52 -0700
Message-ID: 
 <CAOYmi+nb_LVQs+Rjg3mh_CqRz3qOFMi55xD1+MBV4riEosruQQ@mail.gmail.com>
Subject: Re: pgsql: Add support for OAUTHBEARER SASL mechanism
To: Daniel Gustafsson <daniel@yesql.se>,
 Peter Eisentraut <peter@eisentraut.org>
Cc: Christoph Berg <myon@debian.org>, Thomas Munro <thomas.munro@gmail.com>,
	pgsql-hackers@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/CAOYmi%2Bnb_LVQs%2BRjg3mh_CqRz3qOFMi55xD1%2BMBV4riEosruQQ%40mail.gmail.com>
Precedence: bulk

On Tue, Apr 1, 2025 at 6:12=E2=80=AFAM Daniel Gustafsson <daniel@yesql.se> =
wrote:
>
> > On 1 Apr 2025, at 15:03, Christoph Berg <myon@debian.org> wrote:
>
> > With the libpq-oauth split, this makes even more sense because
> > building a library that always throws an error isn't very useful.
> > (Don't build that file at all if the feature doesn't work.)
>
> After the split, configure/meson should fail if the libcurl dependency is=
n't
> satisfied or if the platform isn't supported.

Yeah, after sleeping on it I agree. If I want a "canary" buildfarm
animal to opt into compilation on unsupported platforms, I can instead
look into a manual #define or something; it doesn't have to be a
supported configure-time thing.

> > Since oauth/curl have some security implications, would it make more
> > sense to call the switch --enable-oauth (-Doauth) so users could
> > control better what features their libpq is going to have? Perhaps
> > some other feature (pg_service as URL?) is going to need libcurl as
> > well, but it should be configurable separately.
>
> Perhaps --with-oauth-client for the opt-in libpq-oauth?

It started as -Doauth way back when, but was changed as part of the
discussion at [1]. Peter, do you have any objections to switching back
to an OAuth-related name?

--Jacob

[1] https://postgr.es/m/6bde5f56-9e7a-4148-b81c-eb6532cb3651%40eisentraut.o=
rg