Message-ID: <18f84e6a-41cf-4313-8bea-6007868dd05a@technowledgy.de>
Date: Tue, 8 Apr 2025 18:57:18 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
Content-Language: en-US
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Bruce Momjian <bruce@momjian.us>, Daniel Gustafsson <daniel@yesql.se>,
 Christoph Berg <myon@debian.org>, Andres Freund <andres@anarazel.de>,
 Peter Eisentraut <peter@eisentraut.org>, Tom Lane <tgl@sss.pgh.pa.us>,
 PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
 Thomas Munro <thomas.munro@gmail.com>, Nazir Bilal Yavuz
 <byavuz81@gmail.com>, Antonin Houska <ah@cybertec.at>
References: <CAOYmi+moTsgohh5Tf1gn7dBynARV9EFfWaBVPcJD9O=h6RkSCw@mail.gmail.com>
 <5bec3d4f-613f-425b-88c4-59e71c70f7d6@eisentraut.org>
 <t66lxwxgaxinug7zr4pgf72anhzkqwgrudmqnczgjdu4rv3ll5@jkcxvyvkgcqc>
 <CAOYmi+kc=YXZvZ8YtSPRt57N1Tp9_gRwyXfMO5TJYtCLnEXo1A@mail.gmail.com>
 <Z_QdtqYmSggALamF@msg.df7cb.de>
 <CAOYmi+=YjmfJ+U6RTHfiXEFt9xJzaHnnbNSgSKahWr774_xGdA@mail.gmail.com>
 <Z_RKf5IPsxD6YHCn@msg.df7cb.de>
 <CAOYmi+kt5UvPOXXXT9w_nHBNgcqiTQWS2j=D9qJaewvmO4iaAg@mail.gmail.com>
 <CAOYmi+m2-2TH5AP7-8Knm_gcSiEaZVPGeUkfZeCLmYH395MYgA@mail.gmail.com>
 <B2A4AB83-C99D-4DF7-A310-50BF857739DA@yesql.se> <Z_Uzde7a1lCFaqfW@momjian.us>
 <CAOYmi+mrYnuwMEnpYWA4FWFtDCe4rMKavDrKQPpV43u=zmR8Xg@mail.gmail.com>
 <96b5b38b-2fac-409f-b922-f7fd653bf847@technowledgy.de>
 <CAOYmi+m-q8VOPsFxB3D-CWf-T057h4XLqVPvCTudXyAj7-9vpA@mail.gmail.com>
 <bf7c3396-a9a2-4df7-aabd-6fed387e027b@technowledgy.de>
 <CAOYmi+mn_xhkQEyS5KG3zoSOrvskVx8mhD8x_Z+0LL9PaZo1gQ@mail.gmail.com>
From: Wolfgang Walther <walther@technowledgy.de>
In-Reply-To: <CAOYmi+mn_xhkQEyS5KG3zoSOrvskVx8mhD8x_Z+0LL9PaZo1gQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/18f84e6a-41cf-4313-8bea-6007868dd05a%40technowledgy.de>
Precedence: bulk

Jacob Champion:
> On Tue, Apr 8, 2025 at 9:32 AM Wolfgang Walther <walther@technowledgy.de> wrote:
>> And that should also not be a problem for distributions - they could offer a libpq and a libpq_oauth package, where only one of them can be installed at the same time, I guess? *
> My outsider understanding is that maintaining this sort of thing
> becomes a major headache, because of combinatorics. You don't really
> want to ship a libpq and libpq-with-gss and libpq-with-oauth and
> libpq-with-oauth-and-gss and ...

That would only be the case, if you were to consider those other 
dependencies as "dangerous" as cURL. But we already depend on them. So 
if it's really the case that cURL is that much worse, that we consider 
loading it as a module... then the combinatorics should not be a problem 
either.

However, if the other deps are considered problematic as well, then the 
ship has already sailed, and there is not point for a special case here 
anymore.

Best,

Wolfgang