Message-ID: <9badbeeb-a432-48d4-8710-c8254a54d428@technowledgy.de>
Date: Sun, 4 May 2025 14:58:48 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
Content-Language: en-US
To: Jacob Champion <jacob.champion@enterprisedb.com>,
 Nathan Bossart <nathandbossart@gmail.com>
Cc: Daniel Gustafsson <daniel@yesql.se>, Christoph Berg <myon@debian.org>,
 Jelte Fennema-Nio <postgres@jeltef.nl>,
 Peter Eisentraut <peter@eisentraut.org>, Andres Freund <andres@anarazel.de>,
 Tom Lane <tgl@sss.pgh.pa.us>, Bruce Momjian <bruce@momjian.us>,
 PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
 Thomas Munro <thomas.munro@gmail.com>, Nazir Bilal Yavuz
 <byavuz81@gmail.com>, Antonin Houska <ah@cybertec.at>,
 =?UTF-8?B?RGV2cmltIEfDvG5kw7x6?= <devrim@gunduz.org>
References: 
 <CAOYmi+=WA4ZfyHWt+4=yFV7VAXQWvNKsn4R=3PwLd4GfmSTiBA@mail.gmail.com>
 <aAkXb1wdZUDycyWi@msg.df7cb.de>
 <CAOYmi+=cs+gDTAH0L+3JzpRLeHPOXDQxu7MOfsbjah9SkAP_kw@mail.gmail.com>
 <CAOYmi+=UsSnLM4K+hYkhrezpQROQ5jr=72feAkQ0Te8GJf3Fbg@mail.gmail.com>
 <8210C830-DDBB-4CD7-AB39-F5F59C36D547@yesql.se>
 <CAOYmi+mXoq9dUagnkXDgWa72QjCg8SdagBz_yGPUdh1Px0XD5g@mail.gmail.com>
 <FE299814-66B2-47B4-8F06-2B6A7AB508EF@yesql.se>
 <CAOYmi+nF+ov5JxLrLuL6z3Zj7ng3-yJbv0AQFH8VpZm-DNDYUg@mail.gmail.com>
 <CAOYmi+kSX0bdXXSYfv0De6rTx1d77KJAYoHA7+9fmJ64z5dOjw@mail.gmail.com>
 <CAOYmi+kQCDY8+8URaUpYuwyYQuSqj8Woc=02N_tCk-YK7XC-qw@mail.gmail.com>
 <aBTgjDfrdOZmaPgv@nathan>
 <CAOYmi+=CgA=RfvhcKgT6k+G=tFBi0BFk1gWsi6jAZ9dSYV0auQ@mail.gmail.com>
 <CAOYmi+mjsgLkqPzg66h0VmYrnUQrxntYccpx1ubL-ykxRDu6zA@mail.gmail.com>
 <CAOYmi+=pwswyjjXUiL-ej2eUiHxPPWx9u9AZimSmZu3kA2REAA@mail.gmail.com>
From: Wolfgang Walther <walther@technowledgy.de>
In-Reply-To: 
 <CAOYmi+=pwswyjjXUiL-ej2eUiHxPPWx9u9AZimSmZu3kA2REAA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/9badbeeb-a432-48d4-8710-c8254a54d428%40technowledgy.de>
Precedence: bulk

Jacob Champion:
>> libintl is already coming in via frontend_stlib_code, so that's fine.
>> So now I'm wondering if any other static clients of libpq-int.h (if
>> there are any) need the ssl dependency too, for correctness, or if
>> it's just me.
> 
> Looks like it's just me. And using partial_dependency for the includes
> seems like overkill, so I've kept the full ssl dependency object, but
> moved it to the staticlib only, which is enough to solve the breakage
> on my machine.
> 
> Nathan, if you get a chance, does the attached patch work for you?

I couldn't reproduce the problem, so did not test the latest patch. But 
I tested a lot of scenarios on nixpkgs with latest master (250a718a):

- aarch64 + x86_64 architectures, both Linux and MacOS

- Autoconf and Meson

- Various features enabled / disabled in different configurations (NLS, 
OpenSSL, GSSAPI)

- And additionally some cross-compiling from x86_64 Linux to aarch64 
Linux and x86_64 FreeBSD

Worked very well.


The only inconsistency I was able to find is the autoconf-generated 
libpq.pc file, which has this:

   Requires.private: libssl, libcrypto libcurl

Note the missing "," before libcurl.

It does *not* affect functionality, though:

   pkg-config --print-requires-private libpq
   libssl
   libcrypto
   libcurl


The meson-generated libpq.pc looks like this:

   Requires.private: openssl, krb5-gssapi, libcurl >=  7.61.0

I was only able to test the latter in an end-to-end fully static build 
of a downstream dependency - works great. The final executable has all 
the expected oauth strings in it.

Best,

Wolfgang