From: Tom Lane <tgl@sss.pgh.pa.us>
To: Bruce Momjian <bruce@momjian.us>
cc: Jacob Champion <jacob.champion@enterprisedb.com>,
        PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
        Daniel Gustafsson <daniel@yesql.se>,
        Thomas Munro <thomas.munro@gmail.com>,
        Nazir Bilal Yavuz <byavuz81@gmail.com>,
        Andres Freund <andres@anarazel.de>,
        Peter Eisentraut <peter@eisentraut.org>,
        Antonin Houska <ah@cybertec.at>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
In-reply-to: <Z9x_sUXIFz8rjvBN@momjian.us>
References: 
 <CAOYmi+n8jHAjKKk0oT+HaOdVt7fn2w==MGoFk348ih1j-L8TDg@mail.gmail.com>
 <CAN55FZ2K_aXC89mq3UfB8Z8Okj4Qq-FRxzdrH5me5J+ytY64pg@mail.gmail.com>
 <CAOYmi+kKjhOnwU1LmDksf6RSZtVe9QXnH+6HDuiR=Cv9Z+MnFw@mail.gmail.com>
 <CA+hUKG+dMm6FyQvXM2oD269u6BBnaDoPM4DEyYzZJK6SAFCEag@mail.gmail.com>
 <636879.1742357835@sss.pgh.pa.us>
 <CA+hUKGKCYRS34L+BUy!5qhMF55Zg-oCMxDhnSgqm0jWkP+6jYBA@mail.gmail.com>
 <641687.1742360249@sss.pgh.pa.us>
 <A50E37E8-05A4-4406-945D-14C757AE4AD6@yesql.se> <Z9taYF0kIuv42N8e@momjian.us>
 <CAOYmi+kn+NYA=DNMZds8sPXonAFg3dJnTgQ+vsOMXsk1Yz+3Gg@mail.gmail.com>
 <Z9x_sUXIFz8rjvBN@momjian.us>
Comments: In-reply-to Bruce Momjian <bruce@momjian.us>
	message dated "Thu, 20 Mar 2025 16:50:57 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1120966.1742504934.1@sss.pgh.pa.us>
Date: Thu, 20 Mar 2025 17:08:54 -0400
Message-ID: <1120967.1742504934@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1120967.1742504934%40sss.pgh.pa.us>
Precedence: bulk

Bruce Momjian <bruce@momjian.us> writes:
> On Thu, Mar 20, 2025 at 01:33:26PM -0700, Jacob Champion wrote:
>> So one question for the collective is -- putting Curl itself aside --
>> is having a basic-but-usable OAuth flow, out of the box, worth the
>> costs of a generic HTTP client?

> One observation is that security scanning tools are going to see the
> curl dependency and look at any CSVs related to them and ask us, whether
> they are using OAUTH or not.

Yes.  Also, none of this has addressed my complaint about the extent
of the build and install dependencies.  Yes, simply not selecting
--with-libcurl removes the problem ... but most packagers are under
very heavy pressure to enable all features of a package.