From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: Thomas Munro <thomas.munro@gmail.com>,
        Andrew Dunstan <andrew@dunslane.net>,
        PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
        Jacob Champion <jacob.champion@enterprisedb.com>
Subject: Re: disabled SSL log_like tests
In-reply-to: <D9A0285C-D051-4E6F-B9F0-09CE3282EA54@yesql.se>
References: <984fca80-85a8-4c6f-a5cc-bb860950b435@dunslane.net>
 <2199758.1744901785@sss.pgh.pa.us>
 <1ce11d3f-624c-4003-a032-1b10cc138305@dunslane.net>
 <2814408.1745005558@sss.pgh.pa.us> <2859105.1745015195@sss.pgh.pa.us>
 <1120735.1745350422@sss.pgh.pa.us>
 <CA+hUKG+fLqyweHqFSBcErueUVT0vDuSNWui-ySz3+d_APmq7dw@mail.gmail.com>
 <3058990.1746485124@sss.pgh.pa.us> <3227092.1746580691@sss.pgh.pa.us>
 <CA+hUKGJkUJAwckjBr-=B9oUdDgjSEH+3njd__OnPoPuAtze3Qg@mail.gmail.com>
 <3248136.1746592452@sss.pgh.pa.us>
 <3004EFB2-8FFA-429A-AC5E-E3F40E002A94@yesql.se>
 <3320404.1746633879@sss.pgh.pa.us>
 <8E3E58BF-CC99-4C45-9FB8-3BA83AA6FDC8@yesql.se>
 <51363.1746646179@sss.pgh.pa.us>
 <8293D36E-8027-4DB8-AB41-5EA2C2A9A788@yesql.se>
 <80137.1746654871@sss.pgh.pa.us>
 <D9A0285C-D051-4E6F-B9F0-09CE3282EA54@yesql.se>
Comments: In-reply-to Daniel Gustafsson <daniel@yesql.se>
	message dated "Thu, 08 May 2025 13:20:06 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <182013.1746712177.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 08 May 2025 09:49:37 -0400
Message-ID: <182014.1746712177@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/182014.1746712177%40sss.pgh.pa.us>
Precedence: bulk

Daniel Gustafsson <daniel@yesql.se> writes:
> On 7 May 2025, at 23:54, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> +# Determine whether this build uses OpenSSL or LibreSSL. As a heuristi=
c, the
>> +# HAVE_SSL_CTX_SET_CERT_CB macro isn't defined for LibreSSL.
>> +my $libressl =3D not check_pg_config("#define HAVE_SSL_CTX_SET_CERT_CB=
 1");

> Longer term it would be nice to move this into SSL::Server and have the =
module
> export a function or symbol which returns the underlying library and ver=
sion,
> but that's not for this patch.

I was feeling itchy about having two copies of code that looks none
too set-in-stone.  Maybe we should just do that.  Any preferences
on the API?

>> +# As of 5/2025, LibreSSL doesn't actually work for RSA-PSS certificate=
s.

> Should we add a link to the relevant thread for future readers?  OpenBSD=
 refer
> to MARC for archiving which I believe is stable enough for an inclusion.

WFM, I'll make it so.

			regards, tom lane