Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vqrZM-0022D3-01 for pgsql-hackers@arkaria.postgresql.org; Fri, 13 Feb 2026 11:42:45 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1vqrZL-00E1Jx-0f for pgsql-hackers@arkaria.postgresql.org; Fri, 13 Feb 2026 11:42:44 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vqrZK-00E1Jp-2y for pgsql-hackers@lists.postgresql.org; Fri, 13 Feb 2026 11:42:43 +0000 Received: from smtp.outgoing.loopia.se ([93.188.3.37]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1vqrZJ-00000000Tyw-3W8L for pgsql-hackers@postgresql.org; Fri, 13 Feb 2026 11:42:43 +0000 Received: from s807.loopia.se (localhost [127.0.0.1]) by s807.loopia.se (Postfix) with ESMTP id 9489B50ED61 for ; Fri, 13 Feb 2026 12:42:40 +0100 (CET) Received: from s979.loopia.se (unknown [172.22.191.5]) by s807.loopia.se (Postfix) with ESMTP id 80F6B50FF92; Fri, 13 Feb 2026 12:42:40 +0100 (CET) Received: from s474.loopia.se (unknown [172.22.191.6]) by s979.loopia.se (Postfix) with ESMTP id 7FB6710BC4C3; Fri, 13 Feb 2026 12:42:40 +0100 (CET) X-Virus-Scanned: amavisd-new at amavis.loopia.se X-Spam-Flag: NO X-Spam-Score: -1.2 X-Spam-Level: X-Spam-Status: No, score=-1.2 tagged_above=-999 required=6.2 tests=[ALL_TRUSTED=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1] autolearn=disabled Authentication-Results: s474.loopia.se (amavisd-new); dkim=pass (2048-bit key) header.d=yesql.se Received: from s979.loopia.se ([172.22.191.6]) by s474.loopia.se (s474.loopia.se [172.22.190.14]) (amavisd-new, port 10024) with LMTP id EowRqxou-rF4; Fri, 13 Feb 2026 12:42:40 +0100 (CET) X-Loopia-Auth: user X-Loopia-User: daniel@yesql.se X-Loopia-Originating-IP: 89.255.232.236 Received: from smtpclient.apple (customer-89-255-232-236.stosn.net [89.255.232.236]) (Authenticated sender: daniel@yesql.se) by s979.loopia.se (Postfix) with ESMTPSA id EDB2510BC4B3; Fri, 13 Feb 2026 12:42:39 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yesql.se; s=loopiadkim1707475645; t=1770982960; bh=MiJBC/pe4FJJZp1a9+1bYtBV0bPPAGyqBUGUpGGsXzI=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=qiCFk4G8OwYCh+iLsU1JzZy2XRzQdVx8JOcooEHq8iER97hQJn3wmQLHijkmqxJm9 efqy0U8VdRe0W09hpprvL/AVS5BZDEgDBLFR9iax+kcJ0seDHdWNxkm9LbM6fVuHSc IToEyUBAwKIhCAPTgEFTe8dg4ovJ2nxDBAWzeI+47HiOdR6qXfozHtqS8KIXo5YG6t zTgF0aaQlKDK+YyGLEFH7TEwrga+tkeGzRat+NJ5bnNtIK4esDmKfy2in/T8TPouU2 MjHkN0EVQyzraJQGtdZD1BmVz51cvdFjycg69SPWtUUeQl/E5PLqZZqPcvFN41Vz/M y76uHlYHgsAKQ== Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.2\)) Subject: Re: Follow-up on OpenSSL "engines" and "providers" From: Daniel Gustafsson In-Reply-To: Date: Fri, 13 Feb 2026 12:42:29 +0100 Cc: PostgreSQL Hackers Content-Transfer-Encoding: quoted-printable Message-Id: <285A986D-C9A4-40DF-9061-B084ADA2C61E@yesql.se> References: To: Bear Giles X-Mailer: Apple Mail (2.3776.700.51.11.2) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk > On 29 Jan 2026, at 18:15, Bear Giles wrote: > Most importantly - giving them a way to avoid knowing their private = keys. They can't expose what they don't have. FWIW there has been discussion among those of us who regularly dip our = toes in the OpenSSL support code to add some form of integration with vaults = (like vault from Hashicorp, ipa/idm from Redhat, Keychain from Apple etc) for = storing secrets. AFAIK there are no concrete patches to look at (yet?), but = there is interest and it will most likely be discussed at PGConf.dev in case you = are thinking of attending. -- Daniel Gustafsson