"Todd M. Kover" <kov...@omniscient.com> writes:
> 2) some option that makes the code path for gss_store_cred_into optional
> (what would you want to call it?)
If we do this, I see no need to call it anything. Just make configure
probe for whether the selected GSS library has gss_store_cred_into.
The other options you mention seem strictly worse from a documentation
and testing standpoint, and all of them open the question of exactly
how much we care to rely on Heimdal. I take your point that if a
particular platform has an insecure version of Heimdal, it's their
problem not ours. However, my recollection from the discussion a
couple years back is that different platforms offer significantly
different Heimdal releases, and making our code work with all of
those would be our problem. (That consideration is why I'm so
allergic to the client-side-support-only proposal. It is NOT okay
if we can't test it.)
regards, tom lane
