Date: Wed, 9 Apr 2025 10:14:32 +0200
From: Christoph Berg <myon@debian.org>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Peter Eisentraut <peter@eisentraut.org>,
	Andres Freund <andres@anarazel.de>, Tom Lane <tgl@sss.pgh.pa.us>,
	Bruce Momjian <bruce@momjian.us>,
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
	Daniel Gustafsson <daniel@yesql.se>,
	Thomas Munro <thomas.munro@gmail.com>,
	Nazir Bilal Yavuz <byavuz81@gmail.com>,
	Antonin Houska <ah@cybertec.at>,
	Wolfgang Walther <walther@technowledgy.de>
Subject: Re: [PoC] Federated Authn/z with OAUTHBEARER
Message-ID: <Z_YsaLBiv9LfUM-e@msg.df7cb.de>
Mail-Followup-To: Christoph Berg <myon@debian.org>,
	Jacob Champion <jacob.champion@enterprisedb.com>,
	Peter Eisentraut <peter@eisentraut.org>,
	Andres Freund <andres@anarazel.de>, Tom Lane <tgl@sss.pgh.pa.us>,
	Bruce Momjian <bruce@momjian.us>,
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
	Daniel Gustafsson <daniel@yesql.se>,
	Thomas Munro <thomas.munro@gmail.com>,
	Nazir Bilal Yavuz <byavuz81@gmail.com>,
	Antonin Houska <ah@cybertec.at>,
	Wolfgang Walther <walther@technowledgy.de>
References: <1120967.1742504934@sss.pgh.pa.us>
 <wbqaa72xxfnqtsspanbteoycmtpb6oshtwbrm7uwiw3pur4ll4@tybxmaasfjkv>
 <Z-qheTno9lYmjrJu@msg.df7cb.de>
 <CAOYmi+n+WB9fuQeoPL-0FWvC+fzJXUEfH=Ne1q7q5xT936TE=A@mail.gmail.com>
 <CAOYmi+moTsgohh5Tf1gn7dBynARV9EFfWaBVPcJD9O=h6RkSCw@mail.gmail.com>
 <5bec3d4f-613f-425b-88c4-59e71c70f7d6@eisentraut.org>
 <t66lxwxgaxinug7zr4pgf72anhzkqwgrudmqnczgjdu4rv3ll5@jkcxvyvkgcqc>
 <CAOYmi+kc=YXZvZ8YtSPRt57N1Tp9_gRwyXfMO5TJYtCLnEXo1A@mail.gmail.com>
 <CAOYmi+n65_Lj4s8bDq_FX97NasapA57zf9k-OHc+PURsQJRGcQ@mail.gmail.com>
 <CAOYmi+=mGJfJUdz13Ty86-epEX4g9zRNVq0+i+KmHsodAJ2FdQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
 <CAOYmi+=mGJfJUdz13Ty86-epEX4g9zRNVq0+i+KmHsodAJ2FdQ@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/Z_YsaLBiv9LfUM-e%40msg.df7cb.de>
Precedence: bulk

Re: Jacob Champion
> Is it acceptable/desirable for a build, which has not been configured
> --with-libcurl, to still pick up a compatible OAuth implementation
> installed by the distro? If so, we can go with a "bare" dlopen(). If
> that's not okay, I think we will probably need to use pkglibdir or
> some derivative, and introduce a way for tests (and users?) to
> override that directory selection. Unless someone has a good idea on
> how we can split the difference.

One design goal could be reproducible builds-alike, that is, have
libpq configured with or without libcurl be completely identical, and
the feature being present is simply the libpq-oauth.so file existing
or not. That might make using plain dlopen() more attractive.

Christoph