From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
cc: Stephen Frost <sfrost@snowman.net>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
In-reply-to: 
 <CA+TgmoYbsVCHNkX0g5QTZS=fgf9AXYoXHT2_4Jy6gpEFD5yBXQ@mail.gmail.com>
References: <20200107181727.GB3195@tamriel.snowman.net>
 <CA+Tgmob1cEG=CHnUnryBKdpLhg+jxXH0ZRXpF2OGX1WU8hgQvQ@mail.gmail.com>
 <20200107213618.GC3195@tamriel.snowman.net>
 <CA+TgmoY0yY-mN6FUjD11pruaEoLDHmjD2kS6Y-sVEwk2XwXX2A@mail.gmail.com>
 <20200108003247.GE3195@tamriel.snowman.net>
 <CA+TgmoYB4z5R1E61qtwJHDrogsY+dg4R48TRNFSiaO3JDT=X3g@mail.gmail.com>
 <20200108230935.GN3195@tamriel.snowman.net>
 <CA+TgmoYKLetGg7wRREYUQ=M+gSjYfZBb2AV6ad5C8aurJFqPjA@mail.gmail.com>
 <20200109150911.GP3195@tamriel.snowman.net>
 <CA+Tgmob62hXe2Xkn4S7wRFpe6tPF=Gc32OBRzcS1GzGL=vj+4w@mail.gmail.com>
 <20200109163013.GR3195@tamriel.snowman.net>
 <CA+TgmoYbsVCHNkX0g5QTZS=fgf9AXYoXHT2_4Jy6gpEFD5yBXQ@mail.gmail.com>
Comments: In-reply-to Robert Haas <robertmhaas@gmail.com>
	message dated "Thu, 09 Jan 2020 12:55:04 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <6439.1578594907.1@sss.pgh.pa.us>
Date: Thu, 09 Jan 2020 13:35:07 -0500
Message-ID: <6440.1578594907@sss.pgh.pa.us>
Precedence: bulk

Robert Haas <robertmhaas@gmail.com> writes:
> Again, as I said upthread, Tom had the exact feature about which I am
> talking in the first version of the patch. That is a strong argument
> in favor of it being practical. It's also a pretty good argument that
> it is at least potentially useful, because Tom doesn't usually do
> useless things for no reason.

To try to clarify that a bit: I think there is certainly some value
in allowing superusers to control which extensions could be installed
by non-superusers, further restricting what we may think is trustworthy.

However, I felt at the time that my GUC-based implementation of that
was ugly, and then Peter raised some concrete points against it,
so I took it out.  I don't want to put it back in the same form.
I think we could leave designing a replacement for later, because it's
pretty optional, especially if we aren't aggressive about promoting
contrib modules to "trusted" status.  I don't agree that the lack of
such a feature is a reason not to commit what I've got.

In any case, AFAICT most of the heat-vs-light in this thread has not
been about which extensions are trustworthy, but about which users
should be allowed to install extensions, which seems like a totally
independent discussion.  And controlling that is also a feature that
we don't have today, so I'd rather get a minimal feature committed
for v13 and then later consider whether we need more functionality.

The idea of a DB-level INSTALL privilege addresses the second
point not the first, unless I'm totally misunderstanding it.  As
I said before, I'm not terribly comfortable with handing control
of that over to non-superuser DB owners, and I sure don't see why
doing so should be a required part of the minimal feature.

			regards, tom lane