From: Hans Buschmann <buschmann@nidsa.net>
To: Matthias van de Meent <boekewurm+postgres@gmail.com>
CC: Peter Eisentraut <peter@eisentraut.org>, "pgsql-hackers@postgresql.org"
	<pgsql-hackers@postgresql.org>
Subject: AW: Increased SECURITY RISCS from omitting some compikler options
 when building PG with meson; e.g. -fcf-protection=full
Thread-Topic: Increased SECURITY RISCS from omitting some compikler options
 when building PG with meson; e.g. -fcf-protection=full
Thread-Index: AQHdDgvEBR5VR+6/dkmCjQqZoZnn3rZjX8sO///zlwCAACW3qA==
Date: Wed, 8 Jul 2026 11:24:55 +0000
Message-ID: <f2761ed18e744f1993935c0e05aca2ee@nidsa.net>
References: <01e60576b689490a9388b3d840f23cd8@nidsa.net>
 <bef61bf1-ba50-420e-a94e-564663f0a0f2@eisentraut.org>
 <9412859e22d74f218562a535a7271a40@nidsa.net>,<CAEze2Wh+ZzS=CpOa1HA2uJd2tqsJcqUyz=PamvNGaJBtgmQyXw@mail.gmail.com>
In-Reply-To: 
 <CAEze2Wh+ZzS=CpOa1HA2uJd2tqsJcqUyz=PamvNGaJBtgmQyXw@mail.gmail.com>
Accept-Language: de-DE, en-US
Content-Language: de-DE
Content-Type: multipart/alternative;
	boundary="_000_f2761ed18e744f1993935c0e05aca2eenidsanet_"
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/f2761ed18e744f1993935c0e05aca2ee%40nidsa.net>
Precedence: bulk

--_000_f2761ed18e744f1993935c0e05aca2eenidsanet_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hello Matthias,


Thank you for pointing me to the pg_config options. I didn't know and will =
take a look.


> If the normal user cannot handle compiler options, then should they
> really be self-compiling PostgreSQL with custom compiler options, for
> a platform that already has pre-compiled binary distributions?

As already mentioned in my original post, there are some cases a "normal" u=
ser (in my terminology it is a db responsible not experienced with C progra=
mming practice) may use a manual recompile:

- blocksize change
- emergency patch: see current planet postgres:
- test on beta versions of the OS
- etc...

https://www.credativ.de/blog/postgresql/replikations-deadlock-fehler-in-akt=
uellen-postgres-versionen-14-16/

The user should be able to recompile the package (which is really very easy=
 with meson after some setup of developer packages) without deeper knowledg=
e of C programming with the original configuration of the distribution.

In production I use the binary distribution from PGDG and additionally comp=
ile the latest/beta versions for a compatibility check.

Best regards

Hans Buschmann


--_000_f2761ed18e744f1993935c0e05aca2eenidsanet_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"><!-- P {margin-top:0;margi=
n-bottom:0;} --></style>
</head>
<body dir=3D"ltr">
<div id=3D"divtagdefaultwrapper" style=3D"font-size:12pt;color:#000000;font=
-family:Calibri,Helvetica,sans-serif;" dir=3D"ltr">
<p>Hello Matthias,</p>
<p><br>
</p>
<p>Thank you for pointing me to the pg_config options. I didn't know and wi=
ll take a look.</p>
<p><br>
</p>
<p><br>
</p>
<div style=3D"color: rgb(0, 0, 0);"><font size=3D"2"><span style=3D"font-si=
ze:10pt;">
<div class=3D"PlainText">&gt;&nbsp;If the normal user cannot handle compile=
r options, then should they<br>
&gt;&nbsp;really be self-compiling PostgreSQL with custom compiler options,=
 for<br>
&gt;&nbsp;a platform that already has pre-compiled binary distributions?<br=
>
<br>
As already mentioned in my original post, there are some cases a &quot;norm=
al&quot; user (in my terminology it is a db responsible not experienced wit=
h C programming practice) may use a manual recompile:</div>
<div class=3D"PlainText"><br>
</div>
<div class=3D"PlainText">- blocksize change</div>
<div class=3D"PlainText">- emergency patch: see current planet postgres:</d=
iv>
<div class=3D"PlainText">- test on beta versions of the OS</div>
<div class=3D"PlainText">- etc...</div>
<div class=3D"PlainText"><br>
</div>
<div class=3D"PlainText"><a href=3D"https://www.credativ.de/blog/postgresql=
/replikations-deadlock-fehler-in-aktuellen-postgres-versionen-14-16/" class=
=3D"OWAAutoLink">https://www.credativ.de/blog/postgresql/replikations-deadl=
ock-fehler-in-aktuellen-postgres-versionen-14-16/</a><br>
</div>
<div class=3D"PlainText"><br>
</div>
<div class=3D"PlainText">The user should be able to recompile the package (=
which is really very easy with meson after some setup of developer packages=
) without deeper knowledge of C programming with the original configuration=
 of the distribution.</div>
<div class=3D"PlainText"><br>
</div>
<div class=3D"PlainText">In production I use the binary distribution from P=
GDG and additionally compile the latest/beta versions for a compatibility c=
heck.</div>
<div class=3D"PlainText"><br>
</div>
<div class=3D"PlainText">Best regards</div>
<div class=3D"PlainText"><br>
</div>
<div class=3D"PlainText">Hans Buschmann</div>
<div class=3D"PlainText"><br>
</div>
</span></font></div>
</div>
</body>
</html>

--_000_f2761ed18e744f1993935c0e05aca2eenidsanet_--