From: Tom Lane <tgl@sss.pgh.pa.us>
To: Thomas Munro <thomas.munro@gmail.com>
cc: Daniel Gustafsson <daniel@yesql.se>,
        Jacob Champion <jacob.champion@enterprisedb.com>,
        Nazir Bilal Yavuz <byavuz81@gmail.com>,
        Andres Freund <andres@anarazel.de>,
        Peter Eisentraut <peter@eisentraut.org>,
        Antonin Houska <ah@cybertec.at>,
        PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
In-reply-to: 
 <CA+hUKG+xJF7TrO0wrDzwFWxnuZgH3E89uD0YXABQwm9O0RO5gA@mail.gmail.com>
References: <83C44AB4-24B0-437F-B139-B5CBC5821BB1@yesql.se>
 <CAOYmi+=zgJinCoqdQ70fvKmvyrLekd9-supkuj57Poa1FmX8bw@mail.gmail.com>
 <2A1511A0-C04B-47E4-B1C3-54C2A1C765B8@yesql.se>
 <CAOYmi+=1_AqPL0Y7qdqg1ER0-bBjCUKUZfrLcgob5bHjzSsvbA@mail.gmail.com>
 <CAOYmi+nP8AM9xm+xUW5kDz7XDF7MKBjuDnQ4LjMEm07tpwDgrg@mail.gmail.com>
 <AACF415F-894A-434F-9FE2-272ED8FA4981@yesql.se>
 <13F329B6-86BC-40A5-96F4-102784A0357A@yesql.se>
 <CAOYmi+nZUivtO3Ed4X3tBh3sLmMQTe+ir7utyc1Gv5L6ZDU5cA@mail.gmail.com>
 <p4bd7mn6dxr2zdak74abocyltpfdxif4pxqzixqpxpetjwt34h@qc6jgfmoddvq>
 <CAOYmi+nePFefTKmeRtajfVhunbXFq64etBr7VwbhxzDBQL-BBw@mail.gmail.com>
 <uqzksikuuprgcu4mrpqdu65s7loh52pghdaq5rkzdruhgy4wse@4ojpvnsfumpc>
 <CAOYmi+=Pyf9EuR7dRn46ymV-P9fhUft3qH8mqdS-m9ZksmooEg@mail.gmail.com>
 <CAOYmi+mhqahb65y1zXtv60T9=mDYTaepV9b-wq-GHey00zuGOg@mail.gmail.com>
 <CA+hUKGJ+WyJ26QGvO_nkgvbxgw+03U4EQ4Hxw+QBft6Np+XW7w@mail.gmail.com>
 <CAOYmi+mf+hw7x+E3XkRypEGy=yR3n6zowjjXeXaSK20WxX3UGw@mail.gmail.com>
 <CAOYmi+kOyST1DoF1WOMQvf75L56LiL!
 HZR2+3qTJ+QCg2KC8raQ@mail.gmail.com>
 <CA+hUKGL59uY=UpCHEmTL6dpzuWJBVf1Kc4bQADYDEWG9ZDCffA@mail.gmail.com>
 <CAOYmi+k6HUMK4XQAfnxsmgs1oPOKnchyj2O2a+R7H9jOTU4LPQ@mail.gmail.com>
 <CA+hUKG+mUfH81RuYm5fJrOxdm85hvxLEm=KxXm+n-12FJJH9jA@mail.gmail.com>
 <CAOYmi+nk-KHGGBHz6BGik4+xHPmyPrwOj3ezSM3F4d=-kH_n2Q@mail.gmail.com>
 <CAOYmi+n4EDOOUL27_OqYT2-F2rS6S+3mK-ppWb2Ec92UEoUbYA@mail.gmail.com>
 <CA+hUKGKmyShTB_rDmn3Zy-+9-iNFeMJZnS9iMMHFtUAohjK=Ow@mail.gmail.com>
 <CAOYmi+kC9232rEPTMUV8NsGZOFWw-2dmPs=Zz0MT4HXmoBwPqQ@mail.gmail.com>
 <CA+hUKGK4YwqNhFcg=TaQky=sJ5YRH_n54hd0msfRHHG+mbM9Rg@mail.gmail.com>
 <CAOYmi+n8jHAjKKk0oT+HaOdVt7fn2w==MGoFk348ih1j-L8TDg@mail.gmail.com>
 <CAN55FZ2K_aXC89mq3UfB8Z8Okj4Qq-FRxzdrH5me5J+ytY64pg@mail.gmail.com>
 <CAOYmi+kKjhOnwU1LmDksf6RSZtVe9QXnH+6HDuiR=Cv9Z+MnFw@mail.gmail.com>
 <CA+hUKG+dMm6FyQvXM2oD269u6BBnaDoPM4DEyYzZJK6SAFCEag@mail.gmail.com>
 <636879.1742357835@sss.pgh.pa.us> <641687.1742360249@sss.pgh.pa.us>
 <A50E37E8-05A4-4406-945D-14C757AE4AD6@yesql.se> <CA+hUK!
 G+xJF7TrO0wrDzwFWxnuZgH3E89uD0YXABQwm9O0RO5gA@mail.gmail.com>
Comments: In-reply-to Thomas Munro <thomas.munro@gmail.com>
	message dated "Thu, 20 Mar 2025 09:11:43 +1300"
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-ID: <814793.1742418239.1@sss.pgh.pa.us>
Content-Transfer-Encoding: 8bit
Date: Wed, 19 Mar 2025 17:03:59 -0400
Message-ID: <814794.1742418239@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/814794.1742418239%40sss.pgh.pa.us>
Precedence: bulk

Thomas Munro <thomas.munro@gmail.com> writes:
> On Thu, Mar 20, 2025 at 2:38 AM Daniel Gustafsson <daniel@yesql.se> wrote:
>> On 19 Mar 2025, at 05:57, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>>> BTW, I was pretty seriously disheartened just now to realize that
>>> this feature was implemented by making libpq depend on libcurl.

> How feasible/fragile/weird would it be to dlopen() it on demand?

FWIW, that would not really move the needle one bit so far as
my worries are concerned.  What I'm unhappy about is the very
sizable expansion of our build dependency footprint as well
as the sizable expansion of the 'package requires' footprint.
The fact that the new dependencies are mostly indirect doesn't
soften that blow at all.

To address that (without finding some less kitchen-sink-y OAuth
implementation to depend on), we'd need to shove the whole thing
into a separately-built, separately-installable package.

What I expect is likely to happen is that packagers will try to do
that themselves to avoid the dependency bloat.  AFAICT our current
setup will make that quite painful for them, and in any case I
don't believe it's work we should make them do.  If they fail to
do that, the burden of the extra dependencies will fall on end
users.  Either way, it's not going to make us look good.

			regards, tom lane