On Tue, Apr 8, 2025 at 9:33 AM Bruce Momjian <br...@momjian.us> wrote: > On Tue, Apr 8, 2025 at 09:17:03AM -0700, Jacob Champion wrote: > > It allows packagers to ship the OAuth library separately, so end users > > that don't want the additional exposure don't have to install it at > > all. > > Okay, so how would they do that? I understand how that would happen if > it was an external extension, but how if it is under /src or /contrib.
By adding the new .so to a different package. For example, RPM specs would just let you say "hey, this .so I just built doesn't go into the main client package, it goes into an add-on that depends on the client package." It's the same way separate client and server packages get generated from the same single build of Postgres. > Would we have to put out minor releases for curl CVEs? In general, no. Thanks, --Jacob
