Date: Sat, 30 Jan 2021 10:27:22 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Jacob Champion <pchampion@vmware.com>,
	"hlinnaka@iki.fi" <hlinnaka@iki.fi>,
	"pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>,
	"andrew.dunstan@2ndquadrant.com" <andrew.dunstan@2ndquadrant.com>,
	"thomas.munro@gmail.com" <thomas.munro@gmail.com>,
	"sfrost@snowman.net" <sfrost@snowman.net>,
	"andres@anarazel.de" <andres@anarazel.de>
Subject: Re: Support for NSS as a libpq TLS backend
Message-ID: <YBS1+otETipGbenX@paquier.xyz>
References: <A9C4ADFC-D86B-414A-AF98-7FC14D482198@yesql.se>
 <f5974a6daae02996611caa216ab1ba469b3fa285.camel@vmware.com>
 <8D7F95DB-8F8A-4300-BFDA-656FBAB30FE2@yesql.se>
 <a9b663ae4a4b71525e88b75463c865a6693cb4ce.camel@vmware.com>
 <YBEYq7D90hEsxMbA@paquier.xyz>
 <14c55cc3114a9896a6c5fc16230a60fcef6c4819.camel@vmware.com>
 <YBJUaMj1EdpWVCgb@paquier.xyz>
 <51C8D20D-41D2-46EE-84BE-A672584C64E8@yesql.se>
 <YBOkxETLk5KZ8yvX@paquier.xyz>
 <D644A03D-2247-493F-A1EB-FC174EF15940@yesql.se>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="ihmVudDgVv29N6Nb"
Content-Disposition: inline
In-Reply-To: <D644A03D-2247-493F-A1EB-FC174EF15940@yesql.se>
Precedence: bulk


--ihmVudDgVv29N6Nb
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Fri, Jan 29, 2021 at 02:13:30PM +0100, Daniel Gustafsson wrote:
> I'm still not convinced that adding --with-ssl=openssl is worth it before the
> rest of NSS goes in (and more importantly, *if* it goes in).
>
> On the one hand, we already have pluggable (for some value of) support for
> adding TLS libraries, and adding --with-ssl is one more piece of that puzzle.
> We could of course have endless --with-X options instead but as you say,
> --with-uuid has set the tone here (and I believe that's good).  On the other
> hand, if we never add any other library than OpenSSL then it's just complexity
> without benefit.

IMO, one could say the same thing for any piece of refactoring we have
done in the past to make the TLS/crypto code more modular.  There is
demand for being able to choose among multiple SSL libs at build time,
and we are still in a phase where we evaluate the options at hand.
This refactoring is just careful progress, and this is one step in
this direction.  The piece about refactoring the SSL tests is
similar.

> As mentioned elsewhere in the thread, the current v23 patchset has the
> --with-ssl change as a separate commit to at least make it visual what it looks
> like.  The documentation changes are in the main NSS patch though since
> documenting --with-ssl when there is only one possible value didn't seem to be
> helpful to users whom are fully expected to use --with-openssl still.

The documentation changes should be part of the patch introducing the
switch IMO: a description of the new switch, as well as a paragraph
about the old value being deprecated.  That's done this way for UUID.
--
Michael

--ihmVudDgVv29N6Nb
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmAUtfoACgkQnvQgOdby
QH0B4g//THij3YCYJ5x/KP7oFlFd52hJLK0PUuwvHSjsCO61qXgZ7pTOwBVqk1b0
Vfino0Y4IUF9aj3A21Js5KLMJQLw+MSSRp5m5coVngFuivyZ82pDMw3k6gWevCJj
LOBm46wavC91zKnkYG/LVno2QbYkqtEOaVrKqw9fQoo5whxfVRFpZVSAAqx6dnew
KgQG2Rt539l8mWPNmWynsb/ZIQlOlfaTH2jmP2ELXNz+iU/JaZmvM2333pBOVK9L
ISkcRV8QEGV8vW93eVRbJNk5apQLMMgrn2K4VzY8isE4kBCrtBnvBWwHuRaUh2Ur
8BTDEV6IahifkAHii/GYypxV7Ib06L2bBFA2pvI3wzqwbIdKDeugXSt1D1ouDiKd
O2QO6oOpVEjCooxyds3juCxgObRWeC22+8kFe1PfLeLbvGwhBYdr/gsX5lqEhFAl
zs8GUyGUIkSkjTgsO7yapYHIpez7ezU9wlmOvAD0SdvrnuQYjhn0RErs+EQX6azq
HjBdOHZhItPrc2hHJ/Ie3BaGAImQRXETiYsbqu/uClN1M4QD2tuykdCikt8LSBk/
eYajn4Dr4mFbpC/C1yQFtrOxi68glG8OTudpgq/YD8wtf9E7K5aDw4kewHbtuUAg
eSbJo6JiayiVb/IJp0C0g0k7bAwwGvtrD6oD9NJuauJSxyL+9QU=
=79Yk
-----END PGP SIGNATURE-----

--ihmVudDgVv29N6Nb--