Date: Tue, 8 Apr 2025 12:49:58 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Wolfgang Walther <walther@technowledgy.de>,
	Daniel Gustafsson <daniel@yesql.se>,
	Christoph Berg <myon@debian.org>,
	Andres Freund <andres@anarazel.de>,
	Peter Eisentraut <peter@eisentraut.org>,
	Tom Lane <tgl@sss.pgh.pa.us>,
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
	Thomas Munro <thomas.munro@gmail.com>,
	Nazir Bilal Yavuz <byavuz81@gmail.com>,
	Antonin Houska <ah@cybertec.at>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
Message-ID: <Z_VTtvQgL5dIOzjk@momjian.us>
References: 
 <CAOYmi+kt5UvPOXXXT9w_nHBNgcqiTQWS2j=D9qJaewvmO4iaAg@mail.gmail.com>
 <CAOYmi+m2-2TH5AP7-8Knm_gcSiEaZVPGeUkfZeCLmYH395MYgA@mail.gmail.com>
 <B2A4AB83-C99D-4DF7-A310-50BF857739DA@yesql.se>
 <Z_Uzde7a1lCFaqfW@momjian.us>
 <CAOYmi+mrYnuwMEnpYWA4FWFtDCe4rMKavDrKQPpV43u=zmR8Xg@mail.gmail.com>
 <96b5b38b-2fac-409f-b922-f7fd653bf847@technowledgy.de>
 <Z_VLaJenqQ1vYsFc@momjian.us>
 <CAOYmi+mVzY5SXGeRNW+JMK-nJaX_2QL9Y6PnJOL6uhJk+YfHSA@mail.gmail.com>
 <Z_VP84n4-3M1Z9WU@momjian.us>
 <CAOYmi+noNW-39C2LXOqymdxSHuWSkOYy=RwqZo3t_ppGS6650A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: 
 <CAOYmi+noNW-39C2LXOqymdxSHuWSkOYy=RwqZo3t_ppGS6650A@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/Z_VTtvQgL5dIOzjk%40momjian.us>
Precedence: bulk

On Tue, Apr  8, 2025 at 09:43:01AM -0700, Jacob Champion wrote:
> On Tue, Apr 8, 2025 at 9:33 AM Bruce Momjian <bruce@momjian.us> wrote:
> > On Tue, Apr  8, 2025 at 09:17:03AM -0700, Jacob Champion wrote:
> > > It allows packagers to ship the OAuth library separately, so end users
> > > that don't want the additional exposure don't have to install it at
> > > all.
> >
> > Okay, so how would they do that?  I understand how that would happen if
> > it was an external extension, but how if it is under /src or /contrib.
> 
> By adding the new .so to a different package. For example, RPM specs
> would just let you say "hey, this .so I just built doesn't go into the
> main client package, it goes into an add-on that depends on the client
> package." It's the same way separate client and server packages get
> generated from the same single build of Postgres.

Do we have any idea how many packagers are interested in doing this?

> > Would we have to put out minor releases for curl CVEs?
> 
> In general, no.

Good.

FYI, I saw bug bounty dollar amounts next to each curl CVE:

	https://curl.se/docs/security.html

No wonder some people ask for bounties.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Do not let urgent matters crowd out time for investment in the future.