MIME-Version: 1.0
References: <16a91d02795cb991963326a902afa764e4d721db.camel@gmail.com>
 <3D82D240-1CC5-4CE6-BE30-6065B693D40C@yesql.se>
 <CAOYmi+=fbZNJSkHVci=GpR8XPYObK=H+2ERRha0LDTS+ifsWnw@mail.gmail.com>
 <CAN4CZFPhm2NCRWzZpX=kRLqyxu4Ps-d0xE5W75a-iDoKrLbXBw@mail.gmail.com>
 <CAOYmi+=HcXJub1rDsQ7vpKMHuBB6NTA2Z5T=zAkaFdRThf+9zg@mail.gmail.com>
 <b08bf613bba131eaf15ac163d84604db452d4fde.camel@gmail.com>
 <CAOYmi+mMx1DnNpKG8RdknH0-GuPR9jv+G9r2iFND=Yve7DOF6g@mail.gmail.com>
 <7a0464f0c05db689eb97ba963b212d477d03f5a3.camel@gmail.com>
 <CAOYmi+nQawWHzC4mRhJnzZzzqjnUDg-yxN3f3ZqPX=+jpKU+zg@mail.gmail.com>
 <711e10411f81a2f554fec97b340b60abf5331c9a.camel@gmail.com>
 <CAOYmi+mTHahYXqBZH-bE1Z3Yc5SJ0gTHsM69LSVna2h7ftgVzQ@mail.gmail.com>
 <0eb07ab7217fe6da36ab0f96fad8a644982871b2.camel@gmail.com>
 <CAOYmi+kNGJXy3YqPDoceb1doNfA-S6fmdKv-AH3j0PPUicyUQQ@mail.gmail.com>
 <2373b0487573c9f780590709881ecc84e965abcc.camel@gmail.com>
 <9850AB21-78A7-43CD-94C6-FA8E3BC9F1B3@yesql.se>
 <8c169e088c585cf675be893670825056f473fa9f.camel@gmail.com>
In-Reply-To: <8c169e088c585cf675be893670825056f473fa9f.camel@gmail.com>
From: Zsolt Parragi <zsolt.parragi@percona.com>
Date: Tue, 10 Mar 2026 22:40:48 +0000
Message-ID: 
 <CAN4CZFMtcRDBQACw==1aHRBmdQDWNz=v4RqY0--iF=G6QfiQ3A@mail.gmail.com>
Subject: Re: Make PGOAUTHCAFILE in libpq-oauth work out of debug mode
To: "Jonathan Gonzalez V." <jonathan.abdiel@gmail.com>
Cc: Daniel Gustafsson <daniel@yesql.se>,
 Jacob Champion <jacob.champion@enterprisedb.com>,
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: 
 <https://www.postgresql.org/message-id/CAN4CZFMtcRDBQACw%3D%3D1aHRBmdQDWNz%3Dv4RqY0--iF%3DG6QfiQ3A%40mail.gmail.com>
Precedence: bulk

Hello

I only have a few minor comments/questions:

Shouldn't we free oauth_ca_file in freePGconn?

Would a test case with an invalid/incorrect CA file be also useful, or
is that too much testing of curl internals?

diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml
index 6db823808fc..24fda826dd1 100644
--- a/doc/src/sgml/libpq.sgml
+++ b/doc/src/sgml/libpq.sgml

Shouldn't the doc update also include oauth_ca_file?

+ {"oauth_ca_file", "PGOAUTHCAFILE", NULL, NULL,
+ "Oauth-CA-File", "", 64,
+ offsetof(struct pg_conn, oauth_ca_file)}

That should be OAuth-CA-File

+ * Allow to set the CA even if we're not in debug mode, this would make it easy
+ * to work on environments were the CA could be internal and available on every
+ * system, like big companies with airgap systems.

where the CA