From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: Robert Haas <robertmhaas@gmail.com>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
In-reply-to: <20200128202918.GJ3195@tamriel.snowman.net>
References: <12039.1578602021@sss.pgh.pa.us>
 <20200110192646.GZ3195@tamriel.snowman.net> <16979.1578685198@sss.pgh.pa.us>
 <CA+TgmoYry3gSXN98s8hVyf8GVzTuqV8WuhCvpxNzMFEOdvx84w@mail.gmail.com>
 <20200110205003.GD3195@tamriel.snowman.net> <27618.1578696790@sss.pgh.pa.us>
 <20200113184019.GF3195@tamriel.snowman.net> <28604.1578947939@sss.pgh.pa.us>
 <20200113205756.GL3195@tamriel.snowman.net> <25342.1579628412@sss.pgh.pa.us>
 <20200128202918.GJ3195@tamriel.snowman.net>
Comments: In-reply-to Stephen Frost <sfrost@snowman.net>
	message dated "Tue, 28 Jan 2020 15:29:18 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <5543.1580244756.1@sss.pgh.pa.us>
Date: Tue, 28 Jan 2020 15:52:36 -0500
Message-ID: <5544.1580244756@sss.pgh.pa.us>
Precedence: bulk

Stephen Frost <sfrost@snowman.net> writes:
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> The minimum committable patch seems like it would just grant the
>> "can install trusted extensions" ability to DB owners, full stop.

> If you're alright with making it something a DB owner can do, what is
> the issue with making it part of the CREATE right on the database?

Um, well, people were complaining that it should be a distinct privilege,
which I for one wasn't sold on.

I continue to think that allowing DB owners to decide this is, if not
fundamentally the wrong thing, at least not a feature that anybody has
asked for in the past.  The feature *I* want in this area is for the
superuser to be able to decide who's got install privilege.  Making
it a DB-level privilege doesn't serve that goal, more the opposite.

Still, if we can compromise by making this part of DB "CREATE" privilege
for the time being, I'm willing to take that compromise.  It's certainly
better than failing to get rid of pg_pltemplate.

			regards, tom lane