From: Tom Lane <tgl@sss.pgh.pa.us>
To: Thomas Munro <thomas.munro@gmail.com>
cc: Daniel Gustafsson <daniel@yesql.se>,
        Jacob Champion <jacob.champion@enterprisedb.com>,
        Nazir Bilal Yavuz <byavuz81@gmail.com>,
        Andres Freund <andres@anarazel.de>,
        Peter Eisentraut <peter@eisentraut.org>,
        Antonin Houska <ah@cybertec.at>,
        PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
In-reply-to: 
 <CA+hUKGJpWwVubuiOzcU4xM88r-8Lu0Ht_oXDtdw9qUHPgTxY9w@mail.gmail.com>
References: <83C44AB4-24B0-437F-B139-B5CBC5821BB1@yesql.se>
 <CAOYmi+=zgJinCoqdQ70fvKmvyrLekd9-supkuj57Poa1FmX8bw@mail.gmail.com>
 <2A1511A0-C04B-47E4-B1C3-54C2A1C765B8@yesql.se>
 <CAOYmi+=1_AqPL0Y7qdqg1ER0-bBjCUKUZfrLcgob5bHjzSsvbA@mail.gmail.com>
 <CAOYmi+nP8AM9xm+xUW5kDz7XDF7MKBjuDnQ4LjMEm07tpwDgrg@mail.gmail.com>
 <AACF415F-894A-434F-9FE2-272ED8FA4981@yesql.se>
 <13F329B6-86BC-40A5-96F4-102784A0357A@yesql.se>
 <CAOYmi+nZUivtO3Ed4X3tBh3sLmMQTe+ir7utyc1Gv5L6ZDU5cA@mail.gmail.com>
 <p4bd7mn6dxr2zdak74abocyltpfdxif4pxqzixqpxpetjwt34h@qc6jgfmoddvq>
 <CAOYmi+nePFefTKmeRtajfVhunbXFq64etBr7VwbhxzDBQL-BBw@mail.gmail.com>
 <uqzksikuuprgcu4mrpqdu65s7loh52pghdaq5rkzdruhgy4wse@4ojpvnsfumpc>
 <CAOYmi+=Pyf9EuR7dRn46ymV-P9fhUft3qH8mqdS-m9ZksmooEg@mail.gmail.com>
 <CAOYmi+mhqahb65y1zXtv60T9=mDYTaepV9b-wq-GHey00zuGOg@mail.gmail.com>
 <CA+hUKGJ+WyJ26QGvO_nkgvbxgw+03U4EQ4Hxw+QBft6Np+XW7w@mail.gmail.com>
 <CAOYmi+mf+hw7x+E3XkRypEGy=yR3n6zowjjXeXaSK20WxX3UGw@mail.gmail.com>
 <CA+hUKGL59uY=UpCHEmTL6dpzuWJBVf!
 1Kc4bQADYDEWG9ZDCffA@mail.gmail.com>
 <CAOYmi+k6HUMK4XQAfnxsmgs1oPOKnchyj2O2a+R7H9jOTU4LPQ@mail.gmail.com>
 <CA+hUKG+mUfH81RuYm5fJrOxdm85hvxLEm=KxXm+n-12FJJH9jA@mail.gmail.com>
 <CAOYmi+nk-KHGGBHz6BGik4+xHPmyPrwOj3ezSM3F4d=-kH_n2Q@mail.gmail.com>
 <CAOYmi+n4EDOOUL27_OqYT2-F2rS6S+3mK-ppWb2Ec92UEoUbYA@mail.gmail.com>
 <CA+hUKGKmyShTB_rDmn3Zy-+9-iNFeMJZnS9iMMHFtUAohjK=Ow@mail.gmail.com>
 <CAOYmi+kC9232rEPTMUV8NsGZOFWw-2dmPs=Zz0MT4HXmoBwPqQ@mail.gmail.com>
 <CA+hUKGK4YwqNhFcg=TaQky=sJ5YRH_n54hd0msfRHHG+mbM9Rg@mail.gmail.com>
 <CAOYmi+n8jHAjKKk0oT+HaOdVt7fn2w==MGoFk348ih1j-L8TDg@mail.gmail.com>
 <CAN55FZ2K_aXC89mq3UfB8Z8Okj4Qq-FRxzdrH5me5J+ytY64pg@mail.gmail.com>
 <CAOYmi+kKjhOnwU1LmDksf6RSZtVe9QXnH+6HDuiR=Cv9Z+MnFw@mail.gmail.com>
 <CA+hUKG+dMm6FyQvXM2oD269u6BBnaDoPM4DEyYzZJK6SAFCEag@mail.gmail.com>
 <636879.1742357835@sss.pgh.pa.us> <641687.1742360249@sss.pgh.pa.us>
 <A50E37E8-05A4-4406-945D-14C757AE4AD6@yesql.se>
 <CA+hUKG+xJF7TrO0wrDzwFWxnuZgH3E89uD0YXABQwm9O0RO5gA@mail.gmail.com> <814794!
 .1742418239@sss.pgh.pa.us>
 <CA+hUKGJpWwVubuiOzcU4xM88r-8Lu0Ht_oXDtdw9qUHPgTxY9w@mail.gmail.com>
Comments: In-reply-to Thomas Munro <thomas.munro@gmail.com>
	message dated "Thu, 20 Mar 2025 11:02:57 +1300"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <827518.1742422763.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 19 Mar 2025 18:19:23 -0400
Message-ID: <827519.1742422763@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/827519.1742422763%40sss.pgh.pa.us>
Precedence: bulk

Thomas Munro <thomas.munro@gmail.com> writes:
> It would increase the build dependencies, assuming a package
> maintainer wants to enable as many features as possible, but it would
> *not* increase the 'package requires' footprint, merely the 'package
> suggests' footprint (as Debian calls it), and it's up to the user
> whether they install suggested extra packages, no?

Maybe I'm confused, but what I saw was a hard dependency on libcurl,
as well as several of its dependencies:

$ ./configure --with-libcurl
...
$ make
...
$ ldd src/interfaces/libpq/libpq.so.5.18 =

        linux-vdso.so.1 (0x00007ffc145fe000)
        libcurl.so.4 =3D> /lib64/libcurl.so.4 (0x00007f2c2fa36000)
        libm.so.6 =3D> /lib64/libm.so.6 (0x00007f2c2f95b000)
        libc.so.6 =3D> /lib64/libc.so.6 (0x00007f2c2f600000)
        libnghttp2.so.14 =3D> /lib64/libnghttp2.so.14 (0x00007f2c2f931000)
        libidn2.so.0 =3D> /lib64/libidn2.so.0 (0x00007f2c2f910000)
        libssh.so.4 =3D> /lib64/libssh.so.4 (0x00007f2c2f89b000)
        libpsl.so.5 =3D> /lib64/libpsl.so.5 (0x00007f2c2f885000)
        libssl.so.3 =3D> /lib64/libssl.so.3 (0x00007f2c2f51a000)
        libcrypto.so.3 =3D> /lib64/libcrypto.so.3 (0x00007f2c2f000000)
        libgssapi_krb5.so.2 =3D> /lib64/libgssapi_krb5.so.2 (0x00007f2c2f8=
2f000)
        libkrb5.so.3 =3D> /lib64/libkrb5.so.3 (0x00007f2c2ef26000)
        libk5crypto.so.3 =3D> /lib64/libk5crypto.so.3 (0x00007f2c2f816000)
        libcom_err.so.2 =3D> /lib64/libcom_err.so.2 (0x00007f2c2f80d000)
        libldap.so.2 =3D> /lib64/libldap.so.2 (0x00007f2c2eebf000)
        liblber.so.2 =3D> /lib64/liblber.so.2 (0x00007f2c2eead000)
        libbrotlidec.so.1 =3D> /lib64/libbrotlidec.so.1 (0x00007f2c2ee9f00=
0)
        libz.so.1 =3D> /lib64/libz.so.1 (0x00007f2c2ee85000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f2c2fb43000)
        libunistring.so.2 =3D> /lib64/libunistring.so.2 (0x00007f2c2ed0000=
0)
        libkrb5support.so.0 =3D> /lib64/libkrb5support.so.0 (0x00007f2c2ec=
ef000)
        libkeyutils.so.1 =3D> /lib64/libkeyutils.so.1 (0x00007f2c2ece8000)
        libresolv.so.2 =3D> /lib64/libresolv.so.2 (0x00007f2c2ecd4000)
        libevent-2.1.so.7 =3D> /lib64/libevent-2.1.so.7 (0x00007f2c2ec7b00=
0)
        libsasl2.so.3 =3D> /lib64/libsasl2.so.3 (0x00007f2c2ec5b000)
        libbrotlicommon.so.1 =3D> /lib64/libbrotlicommon.so.1 (0x00007f2c2=
ec38000)
        libselinux.so.1 =3D> /lib64/libselinux.so.1 (0x00007f2c2ec0b000)
        libcrypt.so.2 =3D> /lib64/libcrypt.so.2 (0x00007f2c2ebd1000)
        libpcre2-8.so.0 =3D> /lib64/libpcre2-8.so.0 (0x00007f2c2eb35000)

I don't think that will be satisfied by 'package suggests'.
Even if it somehow manages to load, the result of trying to
use OAuth would be a segfault rather than any useful message.

			regards, tom lane