Date: Thu, 28 Jan 2021 15:06:32 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Jacob Champion <pchampion@vmware.com>
Cc: "daniel@yesql.se" <daniel@yesql.se>,
	"hlinnaka@iki.fi" <hlinnaka@iki.fi>,
	"pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>,
	"andrew.dunstan@2ndquadrant.com" <andrew.dunstan@2ndquadrant.com>,
	"thomas.munro@gmail.com" <thomas.munro@gmail.com>,
	"sfrost@snowman.net" <sfrost@snowman.net>,
	"andres@anarazel.de" <andres@anarazel.de>
Subject: Re: Support for NSS as a libpq TLS backend
Message-ID: <YBJUaMj1EdpWVCgb@paquier.xyz>
References: <7B5A88DF-863A-4B00-B841-0285C1FF70DF@yesql.se>
 <5F24348B-10BA-4AA1-999B-1E2AB22B4997@vmware.com>
 <94E22878-6289-43D5-A674-804F6CB23782@yesql.se>
 <YAUz/A+KCCzjrvTr@paquier.xyz>
 <A9C4ADFC-D86B-414A-AF98-7FC14D482198@yesql.se>
 <f5974a6daae02996611caa216ab1ba469b3fa285.camel@vmware.com>
 <8D7F95DB-8F8A-4300-BFDA-656FBAB30FE2@yesql.se>
 <a9b663ae4a4b71525e88b75463c865a6693cb4ce.camel@vmware.com>
 <YBEYq7D90hEsxMbA@paquier.xyz>
 <14c55cc3114a9896a6c5fc16230a60fcef6c4819.camel@vmware.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="T8DqpODiyZlqUnPO"
Content-Disposition: inline
In-Reply-To: <14c55cc3114a9896a6c5fc16230a60fcef6c4819.camel@vmware.com>
Precedence: bulk


--T8DqpODiyZlqUnPO
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 27, 2021 at 06:47:17PM +0000, Jacob Champion wrote:
> So to check understanding: the `openssl` config variable is still alive
> for MSVC builds; it just turns that into `--with-ssl=3Dopenssl` in the
> fake CONFIGURE_ARGS?

Yeah, I think that keeping both variables separated in the MSVC
scripts is the most straight-forward option, as this passes down a
path.  Once there is a value for nss, we'd need to properly issue an
error if both OpenSSL and NSS are specified.

> Since SSL is an obsolete term, and the choice of OpenSSL vs NSS vs
> [nothing] affects server operation (such as cryptohash) regardless of
> whether or not connection-level TLS is actually used, what would you
> all think about naming this option --with-crypto? I.e.
>=20
>     --with-crypto=3Dopenssl
>     --with-crypto=3Dnss

Looking around, curl has multiple switches for each lib with one named
--with-ssl for OpenSSL, but it needs to be able to use multiple
libraries at run time.  I can spot that libssh2 uses what you are
proposing.  It seems to me that --with-ssl is a bit more popular but
not by that much: wget, wayland, some apache stuff (it uses a path as
option value).  Anyway, what you are suggesting sounds like a good in
the context of Postgres.  Daniel?
--
Michael

--T8DqpODiyZlqUnPO
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmASVGgACgkQnvQgOdby
QH3i5w//fVXxHGSaiJmAAuUiis4HYtfDKWv1nctYJvRzSm7RSib+GpHcJQ99M3ob
efPAQ4boU+S/V6aEbh8szKFataj065Nwx77S4tp0OR3XOHSgjqT2Wg4j5sCV+YC1
3kQkSEa6ezKtSTek29Lx+akPTF22nJJaiL1D2FUwSsAD5B0+iHcfpucfEx340yZa
GvDkQL7C0BxXzeQCFWg4wY9WwTbhx8lzMmfQPfTXaPjWTKmt136MtF8eJhyggpKA
YvBOVSzPH+pgMc8r0JF2tLlcpkKXL8z1wvgyhKUcvqClQ3gG5jvf+zVgY9hrosQj
f5YgGb9WxFpObfcglXP+CzIMLPYRXUZaum67de+j1DumHr4qK9/9y25XhObmq9fz
PDmqzcJOGaivXf5bwzPF7oWDgjK7NI7DgMneSsExGpsrxoPxRVIN3XEwiWtvv5bZ
Ki9LrO8vJcjyoTlrkAGify7VxZXpAq7gW23DTFA6haasBkAPWHEpmlivJJn6mQeF
2G+YbzMpw5mOBfsGQgCRtY3/pjT92dtX1ILl03+lnQsVigiMzKWedl4sVFT6qS7D
4JYkYi+CLhNu+XNMExCFx+HOv1UJ6JSPajESfBn/sn2Uj0iLugkXIolBixn8lFiE
klIzL4SJ/SrlayYeN7UQGJ39ggEZoB0lzHvVuDRyKgQ+6ENbQLw=
=xcLi
-----END PGP SIGNATURE-----

--T8DqpODiyZlqUnPO--