Message-ID: <2373b0487573c9f780590709881ecc84e965abcc.camel@gmail.com>
Subject: Re: Make PGOAUTHCAFILE in libpq-oauth work out of debug mode
From: "Jonathan Gonzalez V." <jonathan.abdiel@gmail.com>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Zsolt Parragi <zsolt.parragi@percona.com>, Daniel Gustafsson
	 <daniel@yesql.se>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>
In-Reply-To: <CAOYmi+kNGJXy3YqPDoceb1doNfA-S6fmdKv-AH3j0PPUicyUQQ@mail.gmail.com>
References: <16a91d02795cb991963326a902afa764e4d721db.camel@gmail.com>
	 <3D82D240-1CC5-4CE6-BE30-6065B693D40C@yesql.se>
	 <CAOYmi+=fbZNJSkHVci=GpR8XPYObK=H+2ERRha0LDTS+ifsWnw@mail.gmail.com>
	 <CAN4CZFPhm2NCRWzZpX=kRLqyxu4Ps-d0xE5W75a-iDoKrLbXBw@mail.gmail.com>
	 <CAOYmi+=HcXJub1rDsQ7vpKMHuBB6NTA2Z5T=zAkaFdRThf+9zg@mail.gmail.com>
	 <b08bf613bba131eaf15ac163d84604db452d4fde.camel@gmail.com>
	 <CAOYmi+mMx1DnNpKG8RdknH0-GuPR9jv+G9r2iFND=Yve7DOF6g@mail.gmail.com>
	 <7a0464f0c05db689eb97ba963b212d477d03f5a3.camel@gmail.com>
	 <CAOYmi+nQawWHzC4mRhJnzZzzqjnUDg-yxN3f3ZqPX=+jpKU+zg@mail.gmail.com>
	 <711e10411f81a2f554fec97b340b60abf5331c9a.camel@gmail.com>
	 <CAOYmi+mTHahYXqBZH-bE1Z3Yc5SJ0gTHsM69LSVna2h7ftgVzQ@mail.gmail.com>
	 <0eb07ab7217fe6da36ab0f96fad8a644982871b2.camel@gmail.com>
	 <CAOYmi+kNGJXy3YqPDoceb1doNfA-S6fmdKv-AH3j0PPUicyUQQ@mail.gmail.com>
Autocrypt: addr=jonathan.abdiel@gmail.com; prefer-encrypt=mutual;
 keydata=mQINBF1Rbm8BEADc2lW3toboDjMLry1spo/hxUiMKlA+CDCMwXPZPvyB4TGCQAVYnU+gS
 NgBJ8H7CF8ghllm9OYeqdRoRvr1unQN5RUShUWTsLhznUu5KV0KfhFbEjQyH7lDeVCzMRNr5r27QT
 RrmycqAacistMqtjfnsG/j8+HQU9tLrOdnhsxIRUZN/guHBEwx3LVp77lf9HMWabnSgGQVOqhUzA6
 P97j8oWRwQNDZjHFVf5k4HMHJRp8OzcvXUOSa+ynH33xBsrLPDza0X6y7pZlfYbmjXdwU/XKSd7oB
 4BeChFbrmdilIeSAGKLAHURH9jKeRxDt9pzYMvsIiK9UZlThnEgAVM2IqQzhnzd4jxG13Hi8HZ82O
 2Ng4n36kVh5uz0NoIGJ6Guw9R+gqHHxbeSdt8S0P+2VO80UTX+hF7OPbLjE7w8wsTt37Ekp+jRxUs
 RooShDvnUENiw+TkyPszUZ0k9BZmfwcaC3++WDYyWvGK20wty3ZZMjl69SDdQXQaRu8E59leIpKw6
 p8HBBAGZgytVPUN61w52r9dgX9RW0ujBrEztRNWPaDauedKGCXrL678mq7KwYW6Rg+y9orvZJPLUq
 Z7/m8RJUaeuJdz2LJ2bioUJ2BaPX7YxXdqMm9LZWknzy/pyF8iZHXD5D3H+WNJROlcQ6TQNLqUB11
 KRK0koNeqiNbwARAQABtDlKb25hdGhhbiBHb256YWxleiBWLiA8am9uYXRoYW4uZ29uemFsZXpAZW
 50ZXJwcmlzZWRiLmNvbT6JAlQEEwEKAD4CGwMCHgECF4AFCwkIBwMFFQoJCAsFFgIDAQAWIQQSbD6
 5ytnQRUDy/MNDze8Kc6UcxQUCaY2PJAUJDh1UNQAKCRBDze8Kc6UcxXl0D/9GitE44UsOyJKtRR/Q
 T45vrSkg+OsHFQQTTJmAZf+jzeMMvW9PDHnG9aX+JEM8vDl6EL6X3Q2sf7/Yi4XX7FneiNNpBJGml
 Ak7DsNQRwP6wnD5AOteDztBFm5QMJTqoVOqQn3/WtFUuJfPEd9fNaUh8DUhXXScKEqSqBSr+bZE1/
 fVF/i5nCSwlOTXVIPaVGB2Q92eGfXQnwSK2pxV5+VBP6oiW3bTf1HwD+NpKEAWDJ2utc4OAXmLuGU
 ZdiaxuUwud0xTgHxBPoei2C9SsuJ7VjlqYXUN2EgFdAysH3Gx9hHVEDE/dG2kq6K72hG2ze5Zzp2u
 Xg3QZVcTN90WWTblhFyB/dGm5iBCClPHqyhSCFdYrclEY/4kPafl3WLiKkRZyb2GZ96uLu8LYt9/F
 sLsc3HR3i3rGQ0XIdiUcbaSG4OE7rJDGV+hTfu7xxPzy1Wc4bclqmdya5g4I0u5saM9NBEYpPc5E9
 Bb/w8F+QQZ6XVITGUxgdr0K3anflleAANqtNGpW5pQE5ukRKpqcl1YK8PkuxdHf/RjbB3RSx3h6qw
 NTQqlZWmzk6fotgFfgD1EK8brCIRYMJutWvAiDQ+AWrfGdEGx0ZrbjEqR/67DTNJXMEOIDPc/eVvD
 qe5F7IvxrFu06EEC6E97K6aTHfm339RlE4+DpqLrjnls/vIJ/LQwSm9uYXRoYW4gR29uemFsZXogV
 i4gPGpvbmF0aGFuLmFiZGllbEBnbWFpbC5jb20+iQJUBBMBCgA+AhsDAh4BAheABQsJCAcDBRUKCQ
 gLBRYCAwEAFiEEEmw+ucrZ0EVA8vzDQ83vCnOlHMUFAmmNjyUFCQ4dVDUACgkQQ83vCnOlHMVwJQ/
 9GAxjP7q/ZU/ZmZ1kBdeAzsL0AZLGkXnkDCdIrXS9NB1gR63bjLzIFvyAKpofRuJkKex1ZorDeXmd
 DrIXCcZTRFSxq13X81z4QANFWMe/a7MTG0f7b0t7FTfmjq4QeC8zcbuj3zS4dvBMGH2QdOSrttnnz
 ogTAnVK0tg8dF+8mWQ6fHoepch0Zlcbb1nnMGdcEdq6D9kwpYQWhD64dFmou+NrG8cFAbskmEqSbu
 FjmQIjPY9yhYhMtJzB32eCkcSXrpEQiEDhy/2YVyzQ/xPnSLgPa1n6J04DbsO38GFADhT6oJowunj
 8WGbN7e1XJr2qAo/pnmqdfn4eEXIPSgfQhIRT4Z/JwR/IljYHD5HJZUA5DTU1zDTEjuOe8YCFkIoi
 QPM07QHeMTP4oyqAEoxv/CTJNDMRt7hx8zvo5OmAg8BmUDX46kwkRlAfNVM01BFnYHiREuW/8mF9H
 fQH8sEiKOfkq0ZyHtuuQ4HXh6MyrfPP2mUzcphG87/bl/rEQIDLqseBqVEc+sfg9zoLezqM7EmfG0
 9dnDH9d1JwhM9UW5TPl7yJq1Zd7nv6DdLog/Cdgdqu6ZroTrv2Vp+jdgmimgZYaWnB2iaj6fNz/w+
 HsitfS+7V+yRUou3+hH5JNkWpGibVosOeYgK8PHMRzqNRl9m859rcrXM/iWYqUFacVXm0N0pvbmF0
 aGFuIEdvbnphbGV6IFYgPGpvbmF0aGFuLmdvbnphbGV6QDJuZHF1YWRyYW50LmNvbT6JAlQEEwEKA
 D4CGwMCHgECF4AFCwkIBwMFFQoJCAsFFgIDAQAWIQQSbD65ytnQRUDy/MNDze8Kc6UcxQUCaY2PJQ
 UJDh1UNQAKCRBDze8Kc6UcxeQaEADHYERzaodpec8m2ZNF04gj9Ra3udvurrpab4598TeKwNsODvZ
 ASMY0fjATtnduEirypa0mS3jMK51XVFz7WUxqm/zccWGCivzn4+Zl8yqhn0Exf57ORACQeB5UJ0UU
 Fl/8Z1LxEe0uS0XiUnS8tfpS/LxP0PkT+gNIS0Tqo1IMZD30ANt4wfrrnR8Bzy2E6/5J0vNtKhpNm
 bdwAT5lwaM0bc+o6IKIaSTpoEdaF1XnW8ThOs2nxhmIQmaFNM48GqeKny65shxYDmn58e093v5T2U
 1QrUUhFt6sAapbSLvekNWBCNlqE6dwDcuYSA53Shn/bX4kLoMX4yk6pfCIr9j+wLShq0mVRznBM+J
 WTF5NtUoD4NvYTXdOfdsnbfDdUFRQDqsDOpl8gsQW3N5Rc54jAAd+W6bgP05GeoiwM+SmedNlJiSQ
 NnMw0vtV8u2B2AVgCD8UvOZP3mLUiTmHymD2HmXIXhOn+O7l5fymNMrCYv5ihAMsA20RExVfZ+I37
 Qt+uJcsPSf7lvcWSJkoB0oktwnq9UUxYF0FNyFfaPGfCKxRvBeVD8qcZpOTWh9pTy0urM31MIaZPh
 MkBrl4WZ2pXqzkkqGn6daY9g5/4oPgazAmqRSfxdDmAbG08STMMvqimaIc2DHYZTRjNKBDvO7Xmef
 plnv3mXrjZZoDBMglnQ==
Content-Type: multipart/signed; micalg="pgp-sha512";
	protocol="application/pgp-signature"; boundary="=-IwbVAhu4ADXPvdPibNlQ"
Date: Thu, 19 Feb 2026 15:18:34 +0100
MIME-Version: 1.0
User-Agent: Evolution 3.56.2-4 
Archived-At: <https://www.postgresql.org/message-id/2373b0487573c9f780590709881ecc84e965abcc.camel%40gmail.com>
Precedence: bulk


--=-IwbVAhu4ADXPvdPibNlQ
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi!

> > +#define conn_oauth_ca_file(CONN) (CONN->oauth_ca_file)
>=20
> Arrrghh I hadn't even considered that this thread would conflict with
> the changes over at [1]. Well, the silver lining is that I already
> know I have to get most of that work in; this just serializes things.

Well, it will definitely conflict but I can rebase the work on that
patch, not an issue, since now I understand what you mean it's even
more fun! What do you think? I can do some testing and review on those
patches too while working on a rebase, so I think it's a win-win

> > I want to add some test for this option that I think it could be
> > really
> > useful, what do you think?
>=20
> Definitely. I could see either upgrading the oauth_validator test
> suite to use HTTPS throughout, and then setting the new envvar
> globally, or just adding a single test that switches it on (but I'm
> not sure that's actually less work, since you have to teach
> oauth_server.py to speak HTTPS either way).

Ok, so probably a new patch to teach oauth_server.py to speak HTTPS
could be good? Since it requires to create certificates and lot of
testing work a different patch could be better right? just to add HTTPS
support.


Thank you!
--=20
Jonathan Gonzalez V. <jonathan.abdiel@gmail.com>
EnterpriseDB

--=-IwbVAhu4ADXPvdPibNlQ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEEmw+ucrZ0EVA8vzDQ83vCnOlHMUFAmmXG7kACgkQQ83vCnOl
HMVBDA//aTWES+TfBQe91VO8dI/nvGcO3/MvX5Suere2hiIok24mWFE/qc88IkjF
woVuVvkDrBaGMM6jxZQTDEXM9sBOyhzAQ98UvTeATsUk8g8oPLsGvNOUp7rvirOQ
HuYsVVhZ9Ly2On99/wcKBSoz64FizqG7P08J9CjyC4UiA/xySNra7qHNTTXH2XxR
Ebhypau7iPqZ3kBzOiFw1HyQfEULQ72Ygzqlme4fhRzkFkQoUYTvhKRYSMtHnFif
eFbzhGfd3XoAheamT7EThMJFwKnfkBtaCOA1RhsRaWdGqaW2A9gyJai9E7LxYRuk
Z8kL24HNML+TNn0BPxIOWAvbKAFIUJW6BQ9RUkm+r6DIti7s1N35LetqOp1lo1rh
NbzwncIRCkmWMuaTAheMFQdLoc2/ixIQPNBl6cMxOgUj37+tdiOAwJABmwGABjfA
4N8LbO5EP68uwCtltcvY+I647+fO4lnI4sX0r/X/Df/xMml8zMCG21VmML3THrom
waUDys4jkm0fS8dyjQ9jmsuLVjPcA/MGBjlBHgSb5rpvl3lj08DQyAguMS7FVWDe
3lLzw4qsIFlOQC8AEDv67X47J0ZS1jMAAxfTtkOcpS/nFnBZ2CXhKlVmk5mYP9PA
REeDjpDWnRVXL36FcAEfNwvxEnbDbUoRaYc4YW2j6xJVaBOLwxk=
=e4h9
-----END PGP SIGNATURE-----

--=-IwbVAhu4ADXPvdPibNlQ--