Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1u2C22-00ESqa-Gp for pgsql-hackers@arkaria.postgresql.org; Tue, 08 Apr 2025 16:42:38 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1u2C20-00BiUv-V5 for pgsql-hackers@arkaria.postgresql.org; Tue, 08 Apr 2025 16:42:37 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1u2C20-00BiS5-HC for pgsql-hackers@lists.postgresql.org; Tue, 08 Apr 2025 16:42:36 +0000 Received: from smtp.outgoing.loopia.se ([93.188.3.37]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1u2C1x-003i9t-2i for pgsql-hackers@postgresql.org; Tue, 08 Apr 2025 16:42:35 +0000 Received: from s807.loopia.se (localhost [127.0.0.1]) by s807.loopia.se (Postfix) with ESMTP id A00581599D for ; Tue, 08 Apr 2025 18:42:30 +0200 (CEST) Received: from s979.loopia.se (unknown [172.22.191.6]) by s807.loopia.se (Postfix) with ESMTP id 84E6214F32; Tue, 08 Apr 2025 18:42:30 +0200 (CEST) Received: from s473.loopia.se (unknown [172.22.191.6]) by s979.loopia.se (Postfix) with ESMTP id 7E14B10BC4BF; Tue, 08 Apr 2025 18:42:30 +0200 (CEST) X-Virus-Scanned: amavisd-new at amavis.loopia.se X-Spam-Flag: NO X-Spam-Score: -1.2 X-Spam-Level: X-Spam-Status: No, score=-1.2 tagged_above=-999 required=6.2 tests=[ALL_TRUSTED=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1] autolearn=disabled Authentication-Results: s473.loopia.se (amavisd-new); dkim=pass (2048-bit key) header.d=yesql.se Received: from s981.loopia.se ([172.22.191.5]) by s473.loopia.se (s473.loopia.se [172.22.190.13]) (amavisd-new, port 10024) with LMTP id GGtST_FF_Mnm; Tue, 8 Apr 2025 18:42:30 +0200 (CEST) X-Loopia-Auth: user X-Loopia-User: daniel@yesql.se X-Loopia-Originating-IP: 89.255.232.193 Received: from smtpclient.apple (customer-89-255-232-193.stosn.net [89.255.232.193]) (Authenticated sender: daniel@yesql.se) by s981.loopia.se (Postfix) with ESMTPSA id C000422B179B; Tue, 08 Apr 2025 18:42:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yesql.se; s=loopiadkim1707475645; t=1744130550; bh=bBL8RlM8LANRoyzJMlowBgWtanoFaBdIbM0pRf2BXLs=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=YQxKrQ+sib2YLzWuVLYl34f769+GBgk747ps1xjspVdrFNNGyKmrf72e8nm+lruET vUVbDJanz/DxCLiyH7bQ8GqC9vZNItZmmmCSoEW0CFOBHuCoAiMgqyBtVwrEyDUs1W 15pOnySJyo3zUqqY9hVWSARJc6Ik8ygf3zIHWoBkHqn5X3wnsbjmuUalTR75HRSXOO YslSwLth/9BeD4mJHYRZO4vK/yJXKZUtdjsiFaBXIp460yCnPhYAcFt2I7ZcCsY2ez lQJog9fzbHtcmZpl/hdJ9D2/4fFEvWcK+xdQOtPeeNsxueEKLXJ1/yb4j3BwFckUay 40iWovRarDQng== Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.1\)) Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER From: Daniel Gustafsson In-Reply-To: Date: Tue, 8 Apr 2025 18:42:19 +0200 Cc: Jacob Champion , Wolfgang Walther , Christoph Berg , Andres Freund , Peter Eisentraut , Tom Lane , PostgreSQL Hackers , Thomas Munro , Nazir Bilal Yavuz , Antonin Houska Content-Transfer-Encoding: 7bit Message-Id: <95D38828-C54C-494F-BAB9-71E62A3B8B57@yesql.se> References: <96b5b38b-2fac-409f-b922-f7fd653bf847@technowledgy.de> To: Bruce Momjian X-Mailer: Apple Mail (2.3776.700.51.11.1) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk > On 8 Apr 2025, at 18:33, Bruce Momjian wrote: > Would we have to put out minor releases for curl CVEs? I don't think we > have to for OpenSSL so would curl be the same? Why do you envision this being different from all other dependencies we have? For OpenSSL we also happily build against a version (and until recently, several versions) which is EOL and don't even recieve security fixes. -- Daniel Gustafsson