Re: Naming of Module to generate an encrypted password in the PostgreSQL SCRAM format
[email protected] (Guido Brugnara via module-authors) Tue, 7 Jan 2025 08:39:32 +0100
| Newsgroups | perl.module-authors |
|---|---|
| Message-ID | <[email protected]> |
--------------7LnApCzk7i0JQZLQuVqAt03E Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Il 06/01/25 20:28, Dan ha scritto: > On Mon, Jan 6, 2025 at 1:09 PM Guido Brugnara via module-authors > <[email protected]> wrote: > > I will preface this by saying that I am a beginner in the use of > PAUSE, even though I registered my name (BRUGNARA) many years ago, > without using it until now. > > I read [1] that it is recommended to ask for advice in this > mail-list in naming new modules. > > I would like to publish a new module to generate SCRAM encrypted > password in the format used by PostgreSQL. > > A source code (usable from the command line) can be found here: > > https://www.leader.it/en/Blog/PostgreSQL_SCRAM-SHA-256_authentication > > I just need to rewrite it using the appropriate package by making > available method, or an exported function > > A name, I think suitable, could be: > > Postgresql::Password::SCRAM > > I would be grateful in receiving your opinion. > > > Seems reasonable to me; if you think a name less tied specifically to > Postgres would be appropriate, you could consider the Crypt:: top > level namespace, possibly still with a reference to PostgreSQL if it > is a specific algorithm for that. You also might avoid "Password" as > the function is an encryption scheme not a password generator. Note > that for discoverability, searches on metacpan will also easily find > terms mentioned in the module's abstract in the NAME section, and the > DESCRIPTION (see perldoc perlpodstyle). If that's okay: Crypt::PostgreSQL implementing the method "crypt" implementing the tree format described in: https://www.postgresql.org/docs/current/auth-password.html |scram_sha_256 - SCRAM method using keys embedded in the code ||md5 - trivial as MD5 crypt |concatenating login and password |||password - |it is useless because the password is in clear text || > > As a side note, Crypt::Salt uses the built in rand() which is not > cryptographically secure; you may consider something like > Crypt::URandom or Math::Random::Secure to retrieve securely random > bytes for a salt. Well! I will use one of the two. > > In case you need any tips regarding distribution layout and authoring, > you may find the beginning of my Dist::Zilla::Starter guide[1] useful > (whether or not you decide the bundle itself or dzil is useful). > Thank you for the suggestion. I have been trying Dist::Zilla since yesterday. Guido P.S. I would need to change the e-mail for the account on PAUSE but the password has expired and the old e-mail is in a subdomain now no longer used. Who can I turn to? > Welcome to CPAN authoring! > > -Dan > > [1] https://metacpan.org/pod/Dist::Zilla::Starter --------------7LnApCzk7i0JQZLQuVqAt03E Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <div class="moz-cite-prefix">Il 06/01/25 20:28, Dan ha scritto:<br> </div> <blockquote type="cite" cite="mid:CABMkAVXV_qOKfqHJW_QtSw+QX1_vh1yrOKFC_u5J6vuxBguxog@mail.gmail.com"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div dir="ltr"> <div dir="ltr">On Mon, Jan 6, 2025 at 1:09 PM Guido Brugnara via module-authors <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>> wrote:</div> <div class="gmail_quote gmail_quote_container"> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div> <p><span>I will preface this by saying that I am a beginner in the use of PAUSE, </span><span>even though I registered my name (BRUGNARA) many years ago, </span><span>without using it until now</span><span>.</span></p> <p><span>I read [1] that it is recommended to ask for advice in this mail-list in naming new modules.</span></p> <p><span>I would like to publish a new module to generate SCRAM encrypted password in the format used by PostgreSQL.</span></p> <p><span>A source code (usable from the command line) can be found here:<br> </span></p> <p><span> <a href="https://www.leader.it/en/Blog/PostgreSQL_SCRAM-SHA-256_authentication" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.leader.it/en/Blog/PostgreSQL_SCRAM-SHA-256_authentication</a></span></p> <p><span>I just need to rewrite it using the appropriate package by making available method, or an exported function</span><span></span></p> <p><span>A name, I think suitable, could be:</span></p> <p><span> Postgresql::Password::SCRAM</span></p> <p><span>I would be grateful in receiving your opinion.</span></p> </div> </blockquote> <div><br> </div> <div>Seems reasonable to me; if you think a name less tied specifically to Postgres would be appropriate, you could consider the Crypt:: top level namespace, possibly still with a reference to PostgreSQL if it is a specific algorithm for that. You also might avoid "Password" as the function is an encryption scheme not a password generator. Note that for discoverability, searches on metacpan will also easily find terms mentioned in the module's abstract in the NAME section, and the DESCRIPTION (see perldoc perlpodstyle).</div> </div> </div> </blockquote> <p><span _d-id="22981" class="--l --r sentence_highlight">If that's okay:</span></p> <p> Crypt::PostgreSQL implementing the method "crypt" implementing the tree format described in: <a class="moz-txt-link-freetext" href="https://www.postgresql.org/docs/current/auth-password.html">https://www.postgresql.org/docs/current/auth-password.html</a><br> <br> <span class="term"><code class="literal">scram_sha_256 - SCRAM method using keys embedded in the code<br> </code></span><span class="term"><code class="literal">md5 - trivial as MD5 crypt </code></span><span _d-id="22020" class="--l --r sentence_highlight">concatenating login and password</span><br> <span class="term"><code class="literal"> </code></span><span class="term"><code class="literal">password - </code></span><span _d-id="20921" class="--l --r sentence_highlight">it is useless because the password is in clear text</span><br> <span class="term"><code class="literal"></code></span><br> </p> <blockquote type="cite" cite="mid:CABMkAVXV_qOKfqHJW_QtSw+QX1_vh1yrOKFC_u5J6vuxBguxog@mail.gmail.com"> <div dir="ltr"> <div class="gmail_quote gmail_quote_container"> <div><br> </div> <div>As a side note, Crypt::Salt uses the built in rand() which is not cryptographically secure; you may consider something like Crypt::URandom or Math::Random::Secure to retrieve securely random bytes for a salt.</div> </div> </div> </blockquote> <br> Well! <span _d-id="815" class="--l --r sentence_highlight">I will use one of the two.</span> <br> <blockquote type="cite" cite="mid:CABMkAVXV_qOKfqHJW_QtSw+QX1_vh1yrOKFC_u5J6vuxBguxog@mail.gmail.com"> <div dir="ltr"> <div class="gmail_quote gmail_quote_container"> <div><br> </div> <div>In case you need any tips regarding distribution layout and authoring, you may find the beginning of my Dist::Zilla::Starter guide[1] useful (whether or not you decide the bundle itself or dzil is useful).</div> <div><br> </div> </div> </div> </blockquote> <p _d-id="5123"><span _d-id="5919" class="--l --r sentence_highlight">Thank you for the suggestion. </span><span _d-id="5922" class="--l sentence_highlight">I have been trying Dist::Zilla since yesterday.<br> <br> Guido<br> <br> P.S. </span><span _d-id="32529" class="--l --r sentence_highlight">I would need to change the e-mail for the account on PAUSE but the password has expired and the old e-mail is in a subdomain now no longer used. </span><span _d-id="32532" class="--l --r sentence_highlight">Who can I turn to?</span></p> <p></p> <p><br> </p> <blockquote type="cite" cite="mid:CABMkAVXV_qOKfqHJW_QtSw+QX1_vh1yrOKFC_u5J6vuxBguxog@mail.gmail.com"> <div dir="ltr"> <div class="gmail_quote gmail_quote_container"> <div>Welcome to CPAN authoring!</div> <div><br> </div> <div>-Dan </div> <div><br> </div> <div>[1] <a href="https://metacpan.org/pod/Dist::Zilla::Starter" moz-do-not-send="true" class="moz-txt-link-freetext">https://metacpan.org/pod/Dist::Zilla::Starter</a></div> </div> </div> </blockquote> </body> </html> --------------7LnApCzk7i0JQZLQuVqAt03E--