Date: Wed, 19 Mar 2025 19:11:28 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Thomas Munro <thomas.munro@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Daniel Gustafsson <daniel@yesql.se>,
	Jacob Champion <jacob.champion@enterprisedb.com>,
	Nazir Bilal Yavuz <byavuz81@gmail.com>,
	Andres Freund <andres@anarazel.de>,
	Peter Eisentraut <peter@eisentraut.org>,
	Antonin Houska <ah@cybertec.at>,
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
Message-ID: <Z9tPIM10tCYnb0bW@momjian.us>
References: 
 <CAN55FZ2K_aXC89mq3UfB8Z8Okj4Qq-FRxzdrH5me5J+ytY64pg@mail.gmail.com>
 <CAOYmi+kKjhOnwU1LmDksf6RSZtVe9QXnH+6HDuiR=Cv9Z+MnFw@mail.gmail.com>
 <CA+hUKG+dMm6FyQvXM2oD269u6BBnaDoPM4DEyYzZJK6SAFCEag@mail.gmail.com>
 <636879.1742357835@sss.pgh.pa.us>
 <641687.1742360249@sss.pgh.pa.us>
 <A50E37E8-05A4-4406-945D-14C757AE4AD6@yesql.se>
 <CA+hUKG+xJF7TrO0wrDzwFWxnuZgH3E89uD0YXABQwm9O0RO5gA@mail.gmail.com>
 <CA+hUKGJpWwVubuiOzcU4xM88r-8Lu0Ht_oXDtdw9qUHPgTxY9w@mail.gmail.com>
 <827519.1742422763@sss.pgh.pa.us>
 <CA+hUKG+Wb3E5arfwpFjbRxSGoUcVWWFVXUzHSMSGmiRpBerA1Q@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: 
 <CA+hUKG+Wb3E5arfwpFjbRxSGoUcVWWFVXUzHSMSGmiRpBerA1Q@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/Z9tPIM10tCYnb0bW%40momjian.us>
Precedence: bulk

On Thu, Mar 20, 2025 at 11:28:50AM +1300, Thomas Munro wrote:
> On Thu, Mar 20, 2025 at 11:19 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > Thomas Munro <thomas.munro@gmail.com> writes:
> > > It would increase the build dependencies, assuming a package
> > > maintainer wants to enable as many features as possible, but it would
> > > *not* increase the 'package requires' footprint, merely the 'package
> > > suggests' footprint (as Debian calls it), and it's up to the user
> > > whether they install suggested extra packages, no?
> >
> > Maybe I'm confused, but what I saw was a hard dependency on libcurl,
> > as well as several of its dependencies:
> 
> > I don't think that will be satisfied by 'package suggests'.
> > Even if it somehow manages to load, the result of trying to
> > use OAuth would be a segfault rather than any useful message.
> 
> I was imagining that it would just error out if you try to use that
> stuff and it fails to open libcurl.  Then it's up to end users: if
> they want to use libpq + OAuth, they have to install both libpq5 and
> libcurl packages, and if they don't their connections will just fail,
> presumably with some error message explaining why.  Or something like
> that...

Am I understanding that curl is being used just to honor the RFC and it
is only for testing?  That seems like a small reason to add such a
dependency.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Do not let urgent matters crowd out time for investment in the future.