Horton

Re: Support for NSS as a libpq TLS backend

Stephen Frost <sfrost@snowman.net>

View thread View on postgr.es
From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: Robert Haas <robertmhaas@gmail.com>, Peter Eisentraut <peter.eisentraut@enterprisedb.com>, Daniel Gustafsson <daniel@yesql.se>, Andres Freund <andres@anarazel.de>, Julien Rouhaud <rjuju123@gmail.com>, Jacob Champion <pchampion@vmware.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>, "hlinnaka@iki.fi" <hlinnaka@iki.fi>, "andrew.dunstan@2ndquadrant.com" <andrew.dunstan@2ndquadrant.com>, "michael@paquier.xyz" <michael@paquier.xyz>, "thomas.munro@gmail.com" <thomas.munro@gmail.com>
Date: 2022-02-04T19:59:35Z
Lists: pgsql-hackers 
Greetings,

* Bruce Momjian (bruce@momjian.us) wrote:
> On Thu, Feb  3, 2022 at 02:33:37PM -0500, Robert Haas wrote:
> > As a philosophical matter, I don't think it's great for us - or the
> > Internet in general - to be too dependent on OpenSSL. Software
> > monocultures are not great, and OpenSSL has near-constant security
> > updates and mediocre documentation. Now, maybe anything else we
> 
> I don't think it is fair to be criticizing OpenSSL for its mediocre
> documentation when the alternative being considered, NSS, has no public
> documentation.  Can the source-code-defined NSS documentation be
> considered better than the mediocre OpenSSL public documentation?

This simply isn't the case and wasn't even the case at the start of this
thread.  The NSPR documentation was only available through the header
files due to it being taken down from MDN.  The NSS documentation was
actually still there.  Looks like they've now (mostly) fixed the lack of
NSPR documentation, as noted in the recent email that I sent.

> For the record, I do like the idea of adding NSS, but I am concerned
> about its long-term maintenance, we you explained.

They've come out and explicitly said that the project is active and
maintained, and they've been doing regular releases.  I don't think
there's really any reason to think that it's not being maintained at
this point.

Thanks,

Stephen

Commits

  1. Add tab-completion for CREATE FOREIGN TABLE.

  2. Add tap tests for the schema publications.

  3. Move Perl test modules to a better namespace

  4. Adjust configure to insist on Perl version >= 5.8.3.

  5. Simplify code related to compilation of SSL and OpenSSL

  6. Introduce --with-ssl={openssl} as a configure option

  7. Implement support for bulk inserts in postgres_fdw

  8. Fix redundant error messages in client tools

  9. doc: Apply more consistently <productname> markup for OpenSSL

  10. Check ssl_in_use flag when reporting statistics