mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-12-15 08:20:16 +08:00
70a7732007
Andres Freund pointed out that allowing non-superusers to run "CREATE EXTENSION ... FROM unpackaged" has security risks, since the unpackaged-to-1.0 scripts don't try to verify that the existing objects they're modifying are what they expect. Just attaching such objects to an extension doesn't seem too dangerous, but some of them do more than that. We could have resolved this, perhaps, by still requiring superuser privilege to use the FROM option. However, it's fair to ask just what we're accomplishing by continuing to lug the unpackaged-to-1.0 scripts forward. None of them have received any real testing since 9.1 days, so they may not even work anymore (even assuming that one could still load the previous "loose" object definitions into a v13 database). And an installation that's trying to go from pre-9.1 to v13 or later in one jump is going to have worse compatibility problems than whether there's a trivial way to convert their contrib modules into extension style. Hence, let's just drop both those scripts and the core-code support for "CREATE EXTENSION ... FROM". Discussion: https://postgr.es/m/20200213233015.r6rnubcvl4egdh5r@alap3.anarazel.de
89 lines
2.1 KiB
Makefile
89 lines
2.1 KiB
Makefile
# contrib/pgcrypto/Makefile
|
|
|
|
INT_SRCS = md5.c sha1.c internal.c internal-sha2.c blf.c rijndael.c \
|
|
pgp-mpi-internal.c imath.c
|
|
INT_TESTS = sha2
|
|
|
|
OSSL_SRCS = openssl.c pgp-mpi-openssl.c
|
|
OSSL_TESTS = sha2 des 3des cast5
|
|
|
|
ZLIB_TST = pgp-compression
|
|
ZLIB_OFF_TST = pgp-zlib-DISABLED
|
|
|
|
CF_SRCS = $(if $(subst no,,$(with_openssl)), $(OSSL_SRCS), $(INT_SRCS))
|
|
CF_TESTS = $(if $(subst no,,$(with_openssl)), $(OSSL_TESTS), $(INT_TESTS))
|
|
CF_PGP_TESTS = $(if $(subst no,,$(with_zlib)), $(ZLIB_TST), $(ZLIB_OFF_TST))
|
|
|
|
SRCS = \
|
|
$(CF_SRCS) \
|
|
crypt-blowfish.c \
|
|
crypt-des.c \
|
|
crypt-gensalt.c \
|
|
crypt-md5.c \
|
|
mbuf.c \
|
|
pgcrypto.c \
|
|
pgp-armor.c \
|
|
pgp-cfb.c \
|
|
pgp-compress.c \
|
|
pgp-decrypt.c \
|
|
pgp-encrypt.c \
|
|
pgp-info.c \
|
|
pgp-mpi.c \
|
|
pgp-pgsql.c \
|
|
pgp-pubdec.c \
|
|
pgp-pubenc.c \
|
|
pgp-pubkey.c \
|
|
pgp-s2k.c \
|
|
pgp.c \
|
|
px-crypt.c \
|
|
px-hmac.c \
|
|
px.c
|
|
|
|
MODULE_big = pgcrypto
|
|
OBJS = \
|
|
$(SRCS:.c=.o) \
|
|
$(WIN32RES)
|
|
|
|
EXTENSION = pgcrypto
|
|
DATA = pgcrypto--1.3.sql pgcrypto--1.2--1.3.sql pgcrypto--1.1--1.2.sql \
|
|
pgcrypto--1.0--1.1.sql
|
|
PGFILEDESC = "pgcrypto - cryptographic functions"
|
|
|
|
REGRESS = init md5 sha1 hmac-md5 hmac-sha1 blowfish rijndael \
|
|
$(CF_TESTS) \
|
|
crypt-des crypt-md5 crypt-blowfish crypt-xdes \
|
|
pgp-armor pgp-decrypt pgp-encrypt $(CF_PGP_TESTS) \
|
|
pgp-pubkey-decrypt pgp-pubkey-encrypt pgp-info
|
|
|
|
EXTRA_CLEAN = gen-rtab
|
|
|
|
ifdef USE_PGXS
|
|
PG_CONFIG = pg_config
|
|
PGXS := $(shell $(PG_CONFIG) --pgxs)
|
|
include $(PGXS)
|
|
else
|
|
subdir = contrib/pgcrypto
|
|
top_builddir = ../..
|
|
include $(top_builddir)/src/Makefile.global
|
|
include $(top_srcdir)/contrib/contrib-global.mk
|
|
endif
|
|
|
|
# Add libraries that pgcrypto depends (or might depend) on into the
|
|
# shared library link. (The order in which you list them here doesn't
|
|
# matter.)
|
|
SHLIB_LINK += $(filter -lcrypto -lz, $(LIBS))
|
|
ifeq ($(PORTNAME), win32)
|
|
SHLIB_LINK += $(filter -leay32, $(LIBS))
|
|
# those must be at the end
|
|
SHLIB_LINK += -lws2_32
|
|
endif
|
|
|
|
# Upstream uses a larger subset of C99.
|
|
imath.o: CFLAGS+=$(PERMIT_DECLARATION_AFTER_STATEMENT)
|
|
|
|
rijndael.o: rijndael.tbl
|
|
|
|
rijndael.tbl:
|
|
$(CC) $(CPPFLAGS) $(CFLAGS) -DPRINT_TABS rijndael.c -o gen-rtab
|
|
./gen-rtab > rijndael.tbl
|