Date: Mon, 1 Feb 2021 22:25:37 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Jacob Champion <pchampion@vmware.com>,
	Heikki Linnakangas <hlinnaka@iki.fi>,
	Andres Freund <andres@anarazel.de>,
	Postgres hackers <pgsql-hackers@lists.postgresql.org>,
	Andrew Dunstan <andrew.dunstan@2ndquadrant.com>,
	Stephen Frost <sfrost@snowman.net>,
	Thomas Munro <thomas.munro@gmail.com>
Subject: Re: Support for NSS as a libpq TLS backend
Message-ID: <YBgBUQrPHTthL5ye@paquier.xyz>
References: <5C27CF6F-5BD3-4639-AAA6-73465595B6DF@vmware.com>
 <AC495586-B79D-45DB-A2ED-2E4FC24ED3C7@vmware.com>
 <FBA0C365-3B19-4E40-98F4-8B0064DB7127@vmware.com>
 <7B5A88DF-863A-4B00-B841-0285C1FF70DF@yesql.se>
 <5F24348B-10BA-4AA1-999B-1E2AB22B4997@vmware.com>
 <94E22878-6289-43D5-A674-804F6CB23782@yesql.se>
 <YAUz/A+KCCzjrvTr@paquier.xyz>
 <A9C4ADFC-D86B-414A-AF98-7FC14D482198@yesql.se>
 <YAkPV3HCSj+mihtx@paquier.xyz>
 <60DFB11D-2466-4286-84DC-F8F965DA675C@yesql.se>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="YG1UoHJE12/o72TR"
Content-Disposition: inline
In-Reply-To: <60DFB11D-2466-4286-84DC-F8F965DA675C@yesql.se>
Precedence: bulk


--YG1UoHJE12/o72TR
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Fri, Jan 29, 2021 at 01:57:02PM +0100, Daniel Gustafsson wrote:
> This has been discussed elsewhere in the thread, so let's continue that there.
> The attached v23 does however split off --with-ssl for OpenSSL in 0001, adding
> the nss option in 0002.

While going through 0001, I have found a couple of things.

-CF_SRCS = $(if $(subst no,,$(with_openssl)), $(OSSL_SRCS), $(INT_SRCS))
-CF_TESTS = $(if $(subst no,,$(with_openssl)), $(OSSL_TESTS), $(INT_TESTS))
+CF_SRCS = $(if $(subst openssl,,$(with_ssl)), $(OSSL_SRCS), $(INT_SRCS))
+CF_TESTS = $(if $(subst openssl,,$(with_ssl)), $(OSSL_TESTS), $(INT_TESTS))
It seems to me that this part is the opposite, aka here the OpenSSL
files and tests (OSSL*) would be used if with_ssl is not openssl.

-ifeq ($(with_openssl),yes)
+ifneq ($(with_ssl),no)
+OBJS += \
+       fe-secure-common.o
+endif
This split is better, good idea.

The two SSL tests still included a reference to with_openssl after
0001:
src/test/ssl/t/001_ssltests.pl:if ($ENV{with_openssl} eq 'yes')
src/test/ssl/t/002_scram.pl:if ($ENV{with_openssl} ne 'yes')

I have refreshed the docs on top to be consistent with the new
configuration, and applied it after more checks.  I'll try to look in
more details at the failures with cryptohashes I found upthread.
--
Michael

--YG1UoHJE12/o72TR
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmAYAVEACgkQnvQgOdby
QH3jyQ/9FINn+J/SwlQp1KQPgCHj4F+oPCrPwm8jTgDcFqWbt2HwfKZe6oeFacQe
4ZPUgJtlo2AwWFQEfw2LqfDhs8s+Wfm2JcFhZyhQCVlvpKvojS0HPFjgzCz5GYdd
0D4uBwNPBZtc/BQYlbxg2J8xB8ZUFeEuOERcgTIwjR7xHwyCsL4ChB8aZu+AlFoC
z6RCdkd4yPNmNWMkEOoC5KCzvrJ5kQPF1A3sWym5v1m1EVvzv+3O5jbv5fsm6MhY
fGZAO5xsq4qeW7AOrHR9MH0yDB7Mk1pOdlQ4plbxT5Q0o6nhPTSePRRIJpIUwLXx
5FwGCjT0GgsfPiE72ngITpTyL6fHuujnWTfUopCCA8/ErNVYhHeDzUYdvU0JeY2/
hq/EdcEdvYRzB4ct6HlUrxzGGJh5/N8K5qOZQ9wICPM19FogBPTz+OAaPDOOJdmJ
5pHwjK2XCUpA63WQY5w+DEsMIGGbtlZ684x1zdzB3RBIne6hTdTPq3EBLXW3NhXk
HXSA5rwRXmas2sdoZomsx3MyGeYqPYn1VF68xGVkbyk36KSDiQ59jRVRuOJ7fXZi
XIXo0L9y0HtpdUQM2tsXru6iAcFdBNnRDmJY8gJge8T7yF8qH5qgTyh1xP29QCl+
R3n1HgsD4+e/Zlsgrzh/nxBZEwTSrQwcX3ps3Bpv8CdfmzPzmAI=
=Wokl
-----END PGP SIGNATURE-----

--YG1UoHJE12/o72TR--