public inbox for [email protected]
help / color / mirror / Atom feedFrom: Bruce Momjian <[email protected]>
To: Jacob Champion <[email protected]>
Cc: Wolfgang Walther <[email protected]>
Cc: Daniel Gustafsson <[email protected]>
Cc: Christoph Berg <[email protected]>
Cc: Andres Freund <[email protected]>
Cc: Peter Eisentraut <[email protected]>
Cc: Tom Lane <[email protected]>
Cc: PostgreSQL Hackers <[email protected]>
Cc: Thomas Munro <[email protected]>
Cc: Nazir Bilal Yavuz <[email protected]>
Cc: Antonin Houska <[email protected]>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
Date: Tue, 8 Apr 2025 12:49:58 -0400
Message-ID: <[email protected]> (raw)
In-Reply-To: <CAOYmi+noNW-39C2LXOqymdxSHuWSkOYy=RwqZo3t_ppGS6650A@mail.gmail.com>
References: <CAOYmi+kt5UvPOXXXT9w_nHBNgcqiTQWS2j=D9qJaewvmO4iaAg@mail.gmail.com>
<CAOYmi+m2-2TH5AP7-8Knm_gcSiEaZVPGeUkfZeCLmYH395MYgA@mail.gmail.com>
<[email protected]>
<[email protected]>
<CAOYmi+mrYnuwMEnpYWA4FWFtDCe4rMKavDrKQPpV43u=zmR8Xg@mail.gmail.com>
<[email protected]>
<[email protected]>
<CAOYmi+mVzY5SXGeRNW+JMK-nJaX_2QL9Y6PnJOL6uhJk+YfHSA@mail.gmail.com>
<[email protected]>
<CAOYmi+noNW-39C2LXOqymdxSHuWSkOYy=RwqZo3t_ppGS6650A@mail.gmail.com>
On Tue, Apr 8, 2025 at 09:43:01AM -0700, Jacob Champion wrote:
> On Tue, Apr 8, 2025 at 9:33 AM Bruce Momjian <[email protected]> wrote:
> > On Tue, Apr 8, 2025 at 09:17:03AM -0700, Jacob Champion wrote:
> > > It allows packagers to ship the OAuth library separately, so end users
> > > that don't want the additional exposure don't have to install it at
> > > all.
> >
> > Okay, so how would they do that? I understand how that would happen if
> > it was an external extension, but how if it is under /src or /contrib.
>
> By adding the new .so to a different package. For example, RPM specs
> would just let you say "hey, this .so I just built doesn't go into the
> main client package, it goes into an add-on that depends on the client
> package." It's the same way separate client and server packages get
> generated from the same single build of Postgres.
Do we have any idea how many packagers are interested in doing this?
> > Would we have to put out minor releases for curl CVEs?
>
> In general, no.
Good.
FYI, I saw bug bounty dollar amounts next to each curl CVE:
https://curl.se/docs/security.html
No wonder some people ask for bounties.
--
Bruce Momjian <[email protected]> https://momjian.us
EDB https://enterprisedb.com
Do not let urgent matters crowd out time for investment in the future.
view thread (199+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox