Date: Tue, 1 Apr 2025 15:03:25 +0200
From: Christoph Berg <myon@debian.org>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Daniel Gustafsson <dgustafsson@postgresql.org>,
	Thomas Munro <thomas.munro@gmail.com>,
	pgsql-hackers@lists.postgresql.org
Subject: Re: pgsql: Add support for OAUTHBEARER SASL mechanism
Message-ID: <Z-vkHdDPFlD8SKAf@msg.df7cb.de>
References: <E1tl8m6-000KH7-0J@gemulon.postgresql.org>
 <Z-sPFl27Y0ZC-VBl@msg.df7cb.de>
 <CAOYmi+=SEwJ+7ATgxrkvDFyGb-FQ5FN9eF_RVMic6DAU3bk5zw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
 <CAOYmi+=SEwJ+7ATgxrkvDFyGb-FQ5FN9eF_RVMic6DAU3bk5zw@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/Z-vkHdDPFlD8SKAf%40msg.df7cb.de>
Precedence: bulk

Re: Jacob Champion
> (That means that Windows builds --with-libcurl are similarly broken, I
> think. Not that Windows packagers will want to use --with-libcurl --
> it doesn't do anything -- but it should build.)

Does --with-libcurl still do anything useful if this feature test
fails? From what you are saying, the answer is "no", and I can see
more "not on this platform" error messages in other callbacks.

This should be documented in doc/src/sgml/installation.sgml.

> We could change how this works a bit for the proposed libpq-oauth.so
> plugin, and only build it if we have a workable implementation. I do
> like having these other platforms compile the Curl code, though, since
> we'd prefer to keep the build clean for a future Windows
> implementation...

I would prefer to get an error from configure if the feature doesn't
do anything on my platform. The current way is confusing. If future
users of libcurl change that, the configure test can still be changed.

With the libpq-oauth split, this makes even more sense because
building a library that always throws an error isn't very useful.
(Don't build that file at all if the feature doesn't work.)

Since oauth/curl have some security implications, would it make more
sense to call the switch --enable-oauth (-Doauth) so users could
control better what features their libpq is going to have? Perhaps
some other feature (pg_service as URL?) is going to need libcurl as
well, but it should be configurable separately.

Christoph