Re: Replace current implementations in crypt() and gen_salt() to OpenSSL

Daniel Gustafsson <daniel@yesql.se>

From: Daniel Gustafsson <daniel@yesql.se>

To: Joe Conway <mail@joeconway.com>

Cc: Peter Eisentraut <peter@eisentraut.org>, Robert Haas <robertmhaas@gmail.com>, "Koshi Shibagaki (Fujitsu)" <shibagaki.koshi@fujitsu.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>

Date: 2025-01-13T14:18:37Z

Lists: pgsql-hackers

Attachments

v7-0001-pgcrypto-Make-it-possible-to-disable-built-in-cry.patch (application/octet-stream) patch v7-0001

Circling back to wrap up this thread I retested with, and without, OpenSSL FIPS
and tweaked the docs and code a little to ensure it detects the right function
to use.  The attached is what I propose we go ahead with.

--
Daniel Gustafsson

Commits

pgcrypto: Make it possible to disable built-in crypto
- 035f99cbebe5 18.0 landed
pgcrypto: Add function to check FIPS mode
- 924d89a35475 18.0 landed
citext: Allow tests to pass in OpenSSL FIPS mode
- 3c551ebede46 17.0 cited
pgcrypto: Remove non-OpenSSL support
- db7d1a7b0530 15.0 cited