tuhaihe commented on PR #2004:
URL: https://github.com/apache/cloudberry/pull/2004#issuecomment-5723979349
Good catch, thanks — you are right, and I have added it in b23b9e6.
I checked it against a release-configuration build on Rocky 9 rather than
going by the source alone:
- `pg_config.h` carries `#define USE_OPENSSL 1`, so the `USE_SSL` blocks you
found are compiled in
- `bin/gpfdist` ships in the packages and links `libssl.so.3` and
`libcrypto.so.3`, with 14 SSL symbols in the binary
- its help text offers `--ssl dir : start HTTPS server. Use the certificates
from the specified directory`
- `gpfdist.c:4364` calls `SSL_CTX_use_certificate_chain_file()` to load the
chain
So it terminates TLS as a server using X.509 certificates, which is squarely
within 5D002.
I listed it on its own line rather than folding it into the first entry, for
two reasons: it is a standalone executable that people often deploy on hosts
away from the database, and it acts as a TLS server loading certificates
rather than just encrypting a client connection.
My first pass covered the server process and pgcrypto and missed the separate
binaries, so this was a real gap.
One related note: the eccnmatrix entry in apache/www-site#749 does not need a
change for this. Its controlled-source link points at the whole cloudberry
repository, so gpfdist is already covered.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
