Date: Tue, 18 Feb 2020 10:13:50 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Andres Freund <andres@anarazel.de>, pgsql-hackers@lists.postgresql.org
Subject: Re: Marking some contrib modules as trusted extensions
Message-ID: <20200218151349.GY3195@tamriel.snowman.net>
References: <32315.1580326876@sss.pgh.pa.us>
 <20200213233015.r6rnubcvl4egdh5r@alap3.anarazel.de>
 <13921.1581638230@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="L4vIaEdWhlTBXHAW"
Content-Disposition: inline
In-Reply-To: <13921.1581638230@sss.pgh.pa.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--L4vIaEdWhlTBXHAW
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Andres Freund <andres@anarazel.de> writes:
> > On 2020-01-29 14:41:16 -0500, Tom Lane wrote:
> >> pgcrypto
>=20
> > FWIW, given the code quality, I'm doubtful about putting itq into the t=
rusted
> > section.
>=20
> I don't particularly have an opinion about that --- is it really that
> awful?  If there is anything broken in it, wouldn't we consider that
> a security problem anyhow?

I would certainly hope so- and I would expect that to go for any of the
other extensions which are included in core.  If we aren't going to
maintain them and deal with security issues in them, then we should drop
them.

Which goes back to my earlier complaint that having extensions in core
which aren't or can't be marked as trusted is not a position we should
put our users in.  Either they're maintained and have been vetted
through our commit process, or they aren't and should be removed.

> > Especially with FROM UNPACKAGED it seems like it'd be fairly easy to get
> > an extension script to do dangerous things (as superuser). One could
> > just create pre-existing objects that have *not* been created by a
> > previous version, and some upgrade scripts would do pretty weird
> > stuff. There's several that do things like updating catalogs directly
> > etc.  It seems to me that FROM UNPACKAGED shouldn't support trusted.
>=20
> Hmm, seems like a reasonable idea, but I'm not quite sure how to mechanize
> it given that "unpackaged" isn't magic in any way so far as extension.c
> is concerned.  Maybe we could decide that the time for supporting easy
> updates from pre-9.1 is past, and just remove all the unpackaged-to-XXX
> scripts?  Maybe even remove the "FROM version" option altogether.

I agree in general with dropping the unpackaged-to-XXX bits.

Thanks,

Stephen

--L4vIaEdWhlTBXHAW
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJeS/8tAAoJEO1sijiDR2RV7koP/0scnXTY5loODBqsM3DDBi7i
Kh5Xq6zPFm4zAr2JYGyzDBLue5cFrPACdNIA2dq+UyupGLZnJDd1mkHdJQi/uTUh
QiqM6ta7AaP4bdQ29crjxb9FRoM9iAw5wCb8tHbZGQgOIeqK+drsLkHVdR7SFE17
qCicNHRwdk4aQ5b2E/rmkiaqOhwQNProwPPsDsm/BRlELF5dDBcYKnnnuSSUpGZV
vqFRWCl80He6r9nXyJCuZKIWPUI8zyb82EgnD018UWqcZKuGPQqtFMwV9T0QATSG
PPXzNB5eCWZYv3u7XpAPyKAkzqWiSL5McgGM5yLlWHEoVzrpEvIf8pOAlRmQwQQz
ZAIxXQW6JRzEud9crKkyQBblLNgjKBzHGM3XoVI/22FU/3ZAaSOaN4j2ryyECFTi
rAadYEo0BzISLLHfeyfgqZRm3ycIPa6yfy223NK5dwgjGdBrMtWBYic23aOZv7y/
vFq7W1HGN3Da6jGrjAUBE5XD8cEZbPTTslOCOaF5JwNX+JQcZgksUEjbgFnizCa/
I3J4qVl7KAdvJAWahqjwxFfkor0CcFp7RdudzJx5TwgWK7gNM87CnnQH4e8O/g9i
45UujChh7IolZtsJXALUULEHf7ROxBIsy4lBD3B6QOim7DvWtpD+XnCK+lz5iy0f
m3oZtHLFWZViYM9cx6g4
=J+O9
-----END PGP SIGNATURE-----

--L4vIaEdWhlTBXHAW--