RE: Replace current implementations in crypt() and gen_salt() to OpenSSL

Hayato Kuroda (Fujitsu) <kuroda.hayato@fujitsu.com>

From: "Hayato Kuroda (Fujitsu)" <kuroda.hayato@fujitsu.com>
To: 'Daniel Gustafsson' <daniel@yesql.se>
Cc: Peter Eisentraut <peter@eisentraut.org>, Robert Haas <robertmhaas@gmail.com>, "Koshi Shibagaki (Fujitsu)" <shibagaki.koshi@fujitsu.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>, Joe Conway <mail@joeconway.com>
Date: 2025-01-14T12:12:50Z
Lists: pgsql-hackers
Dear Daniel,

Thanks for working on the project. I have few cosmetic comments.

```
+      built in legacy crypto functions <literal>gen_salt()</literal>,
```

According to other lines, `<literal>gen_salt()</literal>` should be `<function>gen_salt()</function>`.

```
+      <literal>pg_gen_salt_rounds()</literal>, and <literal>crypt()</literal>
```

Similar with [1], `pg_gen_salt_rounds` is not an SQL function.
I think we do not have to mention the function because it's just another implementation of gen_salt().
Also, use <function> instead of <literal>.

```
+void
+_PG_init(void)
+{
+	DefineCustomEnumVariable("pgcrypto.legacy_crypto_enabled",
+							 "Sets if builtin crypto functions are enabled.",
+							 "\"on\" enables builtin crypto, \"off\" unconditionally disables and \"fips\" "
+							 "will disable builtin crypto if OpenSSL is in FIPS mode",
+							 &legacy_crypto_enabled,
+							 LGC_ON,
+							 legacy_crypto_options,
+							 PGC_SUSET,
+							 0,
+							 NULL,
+							 NULL,
+							 NULL);
+}
```

I think we must call MarkGUCPrefixReserved() to catch the mis-spell.

Also: I'm not sure whether we should bump the version of pgcrypto. It should be done when
the API is changed, but the patch does not do. Thought?

[1]: https://www.postgresql.org/message-id/1f32ff67-255d-4c0c-8433-c8c721842aa3%40eisentraut.org

Best regards,
Hayato Kuroda
FUJITSU LIMITED




Commits

  1. pgcrypto: Make it possible to disable built-in crypto

  2. pgcrypto: Add function to check FIPS mode

  3. citext: Allow tests to pass in OpenSSL FIPS mode

  4. pgcrypto: Remove non-OpenSSL support