Message-ID: <c933b0f1-ed95-4327-aca6-538acd2c547f@darold.net>
Date: Mon, 2 Feb 2026 18:43:28 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Pasword expiration warning
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: Zsolt Parragi <zsolt.parragi@percona.com>, Japin Li
 <japinli@hotmail.com>, Yuefei Shi <shiyuefei1004@gmail.com>,
 songjinzhou <tsinghualucky912@foxmail.com>,
 PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
 Andrew Dunstan <andrew@dunslane.net>, Tom Lane <tgl@sss.pgh.pa.us>,
 liu xiaohui <liuxh.zj.cn@gmail.com>, Steven Niu <niushiji@gmail.com>
References: <CAD43U4WHJm=UkxbfhxQRxQRxtdtu7AGj77uO2fF78THQWCaYTg@mail.gmail.com>
 <MEAPR01MB30319B858B3028CA38BEDC5EB682A@MEAPR01MB3031.ausprd01.prod.outlook.com>
 <MN2PR15MB30212CEFE2F8B93C398FBF60A782A@MN2PR15MB3021.namprd15.prod.outlook.com>
 <MEAPR01MB30319C7BB75B88028E1DB7E1B682A@MEAPR01MB3031.ausprd01.prod.outlook.com>
 <f7d6e318-415a-4b98-86b0-28ae954707cc@darold.net>
 <CAN4CZFMBj-mZq_o8BtQz_TgqDTALbn31kc-SFtWE4FR1N-4RBw@mail.gmail.com>
 <MEAPR01MB3031CF12043573A245D931AAB69EA@MEAPR01MB3031.ausprd01.prod.outlook.com>
 <CAN4CZFP4AGeO-AynwE3e62XOKqaYnXtcGT1qfj=6nw2t5FOXwA@mail.gmail.com>
 <aXuehKtwtUXWVFYp@nathan> <197512e0-8116-4776-a600-822d29ee68a6@darold.net>
 <aYDZA3r3lG2oKc5D@nathan>
Content-Language: en-US
From: Gilles Darold <gilles@darold.net>
Autocrypt: addr=gilles@darold.net; keydata=
 xsBNBEyscTYBCADOHjxbECHbFaVEA8fKAh8gtdRMKCXPhYwgrhIq+435c824l0NkxxT6xAq/
 U2embiCGSBy13yVT016bzcxOnOqxgw4dJgXPE1P6RYLgjd17c5Xt7uzkbn4ChO1LOVtx+7y/
 uf8GV1fiPTtnilzGQvWdXMDDTNaFbyfIsebE6rB2p47Ns0m+cj46hS22pmEWELM4RilmQ2MX
 X7vNZPxQ/C6SKQDgeGZSHrvw9OLzFty8yY7HnExfUmCzfN4asAH3q/lCu1YQgud84bCC6hXz
 Cbw/DvR7pW8QK/ej/UkNzeGUWsWX6GYDF26P3wO9Zqk5T8JixrveiCaWA/e4DR5yr2bTABEB
 AAHNIUdpbGxlcyBEYXJvbGQgPGdpbGxlc0BkYXJvbGQubmV0PsLAjgQTAQoAOBYhBEnFnv37
 SNFcBZKyn3AqzJ89qW5hBQJfxQsiAhsjBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEHAq
 zJ89qW5hjXsIAI53R1IdrgOia4DCtL1hK3+nbqPYYAhHAbQa54V/oHFEuXubH5F+mEBRT12M
 XNibbPvOCVUHTa46CuYLyBY6GZZ83fYpPZ3IQIavCDiLmpANR7rOoVmGERKs8VLVnQuJ1a+q
 BObwo1WKOFiqR1UEeT3hfytsmJVan8l2GzNFA+OOwIGEPdLLEpuSO9K3uyEa5FMNxXVWDROR
 MIHWvcS/RLlJby9GgLUIbLCXYXNrxncQajPs4P/TLS7fsW36laBPHIBoGbIBkgGIlpXhuTj2
 PY95YOfyFelXW3AL6oXOncmV9SkfaE2iIpc33FIrN3pEbIC4XEqMANKjidFXcdM3+JfOwE0E
 TKxxNgEIALVvukwz2p2Vw37pnMk2CGWCgoj76Lnts/3sG42Jw6Ewjvjg7u9SGg2fJJ4dzywc
 oBW5ufJlZalghO3RpbZqDwT2432CUdGG500GLLzYrHIhGBw8h9SkoJqnfel3MOjGy/HZMymK
 mCy/uqx3ti3Tp0l0Is38C7GK/lG3NKnYUwQuFaM2pDkIoIx3hyogGXEMwV+IHtYpvFroCBVi
 CgkYubsOEfqJti40BMXJfKv74ecDk43I7x9V6Pzt0j0rfmj4vFbSKHF6ptJNeZBrXrNSeTmf
 AJXaPD/olDLEStWu6cr5XyMmYxYE9D2eMOQHhFb7UOZdh++HhWcPxMMyKNNB2YsAEQEAAcLA
 XwQYAQIACQUCTKxxNgIbDAAKCRBwKsyfPaluYZETB/91iP031oHNFMU62RC8x+bERW5x6Dpu
 7Kk9rOSKf7ChcSWElBQ2A7OnNAACgPNbJgYyuEquYHTdXLP43phNDJ93EhL+af5z2BLx1gkd
 V+1rotlzbzIaUv9uofRWU6UJ/emgL3kn1TRmf3PKWWgJkHRlePqKDeNVc53uApbXHoNrS4ul
 uiwD88mx3+xgZqteCQO2DhEpAckzki82S4n4Ww6fRFB3KIGyafO7fzHFK8cFuT4za4YUFQN9
 Ix6WTABleoRLz3Cn+Jde049Zhg1222l0N07KWRS3ZZxAhwr3rv+pg3cJdbNf/rDszym92rig
 79SbGEEuL3nFCUXmA/QRIE+v
In-Reply-To: <aYDZA3r3lG2oKc5D@nathan>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/c933b0f1-ed95-4327-aca6-538acd2c547f%40darold.net>
Precedence: bulk

Le 02/02/2026 à 18:04, Nathan Bossart a écrit :
> On Fri, Jan 30, 2026 at 12:33:54PM +0100, Gilles Darold wrote:
>> Here a new v12 version of the patch. Changes are the following:
> Thanks.  I spent some time preparing this for commit, and I came up with
> the attached.  Notable changes include:
>
> * Renamed the parameter to password_expiration_warning_threshold.  It's a
> mouthful, but I thought it was more descriptive.
>
> * Changed the units for the parameter to minutes.  I can't imagine anyone
> needs more granularity than hours or days, let alone seconds, so IMO
> minutes is a good middle ground.
>
> * I added a new "connection warnings" infrastructure that we can reuse
> if/when we want to emit warnings for MD5 passwords.
>
> * Moved the warning messages to Port.  ClientConnectionInfo appears to be
> meant only for parallel workers, and I don't think we will ever want to
> emit connection warnings there.
>
> * Moved the tests into 001_password.pl.  I'm a bit concerned about these
> tests being flaky, but I've tried setting the VALID UNTIL dates to make
> spurious failures virtually impossible.
>
> WDYT?


Thanks Nathan, I'm comfortable with all the changes except the first two.

I think configuration name password_expiration_warning_threshold is too 
long, why not only password_warning_threshold?  I think the description 
is here to explain more the configuration directive.

About the unit, I think using minutes is useless. It should be set in 
days to be really useful but like all other time based directives it can 
be set in seconds, minutes or hours too. This give the user the 
granularity he wants. The common use will be to set it using 'Nd' syntax 
but if someone wants to use 'Ns' syntax, it can be done.


-- 
Gilles Darold
http://www.darold.net/