Re: Support for NSS as a libpq TLS backend

Daniel Gustafsson <daniel@yesql.se>

From: Daniel Gustafsson <daniel@yesql.se>

To: Kevin Burke <kevin@burke.dev>

Cc: Jacob Champion <pchampion@vmware.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>, "hlinnaka@iki.fi" <hlinnaka@iki.fi>, "andrew.dunstan@2ndquadrant.com" <andrew.dunstan@2ndquadrant.com>, "sfrost@snowman.net" <sfrost@snowman.net>, "rachelmheaton@gmail.com" <rachelmheaton@gmail.com>, "thomas.munro@gmail.com" <thomas.munro@gmail.com>, "michael@paquier.xyz" <michael@paquier.xyz>, "andres@anarazel.de" <andres@anarazel.de>

Date: 2021-10-29T11:54:29Z

Lists: pgsql-hackers

Attachments

v46-0001-nss-Support-libnss-as-TLS-library-in-libpq.patch (application/octet-stream) patch v46-0001
v46-0002-Refactor-SSL-testharness-for-multiple-library.patch (application/octet-stream) patch v46-0002
v46-0003-nss-Add-NSS-specific-tests.patch (application/octet-stream) patch v46-0003
v46-0004-test-check-for-empty-stderr-during-connect_ok.patch (application/octet-stream) patch v46-0004
v46-0005-nss-pg_strong_random-support.patch (application/octet-stream) patch v46-0005
v46-0006-nss-Documentation.patch (application/octet-stream) patch v46-0006
v46-0007-nss-Support-NSS-in-pgcrypto.patch (application/octet-stream) patch v46-0007
v46-0008-nss-Support-NSS-in-sslinfo.patch (application/octet-stream) patch v46-0008
v46-0009-nss-Support-NSS-in-cryptohash.patch (application/octet-stream) patch v46-0009
v46-0010-nss-Build-infrastructure.patch (application/octet-stream) patch v46-0010

> On 29 Oct 2021, at 06:31, Kevin Burke <kevin@burke.dev> wrote:

Thanks for testing the patch!

> I believe that these patches need to integrate the refactoring in commit
> b3b4d8e68ae83f432f43f035c7eb481ef93e1583 - git is searching for the wrong text
> in the existing file

Correct, b3b4d8e68 as well as b4c4a00ea both created conflicts with this
patchset.  Attached is an updated patchset fixing both of those as well as
adding version checks for NSS and NSPR to autoconf (with fallbacks for
non-{nss|nspr}-config systems).  The versions picked are semi-arbitrary and
definitely up for discussion.  I chose them mainly as they were the oldest
commonly available packages I found, and they satisfy the requirements we have.

> I'm not sure how to submit a patch against a patch.

If you've done the work of fixing the conflicts in a rebase, the best option is
IMO to supply a whole new version of the patchset since that will make the CF
patch tester be able to build and test the version.

--
Daniel Gustafsson		https://vmware.com/

Commits

Add tab-completion for CREATE FOREIGN TABLE.
- 74527c3e022d 15.0 cited
Add tap tests for the schema publications.
- 6b0f6f79eef2 15.0 cited
Move Perl test modules to a better namespace
- b3b4d8e68ae8 15.0 cited
Adjust configure to insist on Perl version >= 5.8.3.
- 92e6a98c3636 15.0 cited
Simplify code related to compilation of SSL and OpenSSL
- 092b785fad3d 14.0 landed
Introduce --with-ssl={openssl} as a configure option
- fe61df7f82aa 14.0 landed
Implement support for bulk inserts in postgres_fdw
- b663a4136331 14.0 cited
Fix redundant error messages in client tools
- 6be725e70161 14.0 cited
doc: Apply more consistently <productname> markup for OpenSSL
- 089da3c4778f 14.0 landed
Check ssl_in_use flag when reporting statistics
- 6a5c750f3f72 14.0 cited