Re: Adding support for SSLKEYLOGFILE in the frontend

Daniel Gustafsson <daniel@yesql.se>

From: Daniel Gustafsson <daniel@yesql.se>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jacob Champion <jacob.champion@enterprisedb.com>, Abhishek Chanda <abhishek.becs@gmail.com>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Date: 2025-03-13T22:07:33Z
Lists: pgsql-hackers

Attachments


> On 13 Mar 2025, at 19:31, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> 
> Jacob Champion <jacob.champion@enterprisedb.com> writes:
>> Adding the PG prefix to the envvar name addresses my collision
>> concern, but I think Tom's comment upthread [1] was saying that we
>> should not provide any envvar at all:
> 
>>> I think it might be safer if we only accepted it as a connection
>>> parameter and not via an environment variable.
> 
>> Is the addition of the PG prefix enough to address that concern too?
> 
> Indeed, I was advocating for *no* environment variable.  The PG prefix
> does not comfort me.

Attached is a rebased version which fixes the test failure under autoconf (I
had missed git adding the configure file..) and Windows where the backslashes
weren't escaped properly.  It also removes the environment variable and has
documentation touchups.

--
Daniel Gustafsson

Commits

  1. Fix sslkeylogfile error handling logging

  2. Mark sslkeylogfile as Debug option

  3. libpq: Add support for dumping SSL key material to file