Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.12\))
Subject: Re: PostgreSQL and OpenSSL 4.0.0
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: <ahU3irfvsoO5Ul9S@paquier.xyz>
Date: Tue, 26 May 2026 10:16:40 +0200
Cc: Tom Lane <tgl@sss.pgh.pa.us>,
 PostgreSQL-development <pgsql-hackers@lists.postgresql.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <D0390DDA-4F5E-404C-A710-6D458452B833@yesql.se>
References: <066B07BB-85FA-487C-BE8C-40F791CFC3C4@yesql.se>
 <aeKrQfeyDLVE3cmw@paquier.xyz>
 <65C5DC15-DE27-4D36-8AEE-A854C23B3834@yesql.se>
 <af0OcVKUaAMW1RaR@paquier.xyz> <898414.1778192534@sss.pgh.pa.us>
 <1A5104C0-E9EF-4D90-9627-23D3D909104B@yesql.se>
 <af2ODKxUkLzFIiuX@paquier.xyz>
 <95045A62-9A81-4AD8-BA25-D8648BD68499@yesql.se>
 <A6A15B8A-FCAE-455A-A5AE-EC3A7934F987@yesql.se>
 <ahU3irfvsoO5Ul9S@paquier.xyz>
To: Michael Paquier <michael@paquier.xyz>
Archived-At: 
 <https://www.postgresql.org/message-id/D0390DDA-4F5E-404C-A710-6D458452B833%40yesql.se>
Precedence: bulk

> On 26 May 2026, at 08:02, Michael Paquier <michael@paquier.xyz> wrote:
>=20
> On Tue, May 19, 2026 at 02:18:08PM -0700, Daniel Gustafsson wrote:
>>> On 8 May 2026, at 00:21, Daniel Gustafsson <daniel@yesql.se> wrote:
>>=20
>>> I think the changes are straightforward enough that we can go ahead =
with them.
>>> I'll re-test and re-post a new patchset for all branches once the =
minors ship.
>>=20
>> Attached are rebased versions of this patchset for v14-master.
>=20
> I have a question here.  Most of the changes relate to the use of =
const
> where the OpenSSL APIs require these to be so, but why is this a new
> requirement for 4.0?  I can see that for most of the upstream
> routines, the const changes are much older, like in 8cc86b81ac20 for
> X509_NAME_get_text_by_NID() applying down to branch openssl-3.0.

It is very true that OpenSSL has been constifying the API over time, the =
change
in 4.0 revolves around making more returnvalues const.  In the case at =
hand,
X509_get_subject_name() now returns a const X509_NAME pointer since =
commit
b0f2107b4404.  This wouldn't be a problem since =
X509_NAME_get_text_by_NID()
does as you say take a const parameter, but since we have shoehorned =
LibreSSL
support into the same file we are tied to the least common denominator =
and
LibreSSL is far behind OpenSSL on constifying.  So in this case, we need =
to
unconstify() to keep LibreSSL compiling.

I have plans for fixing this in v20 but for 14-19 there isn't much we =
can do
except unconstifying.

--
Daniel Gustafsson