Repository navigation
fix(minimal): use TLS flags the installed mysql client understands (arm64 / MariaDB client) - #180
Merged
Merged
Conversation
The arm64 image's mysql is MariaDB's client (Debian's default-mysql-client; MySQL's apt repo has no arm64 packages), which rejects --ssl-mode. With DB_SSL_ENABLED=true the privileged setup and delete calls failed with "unknown variable 'ssl-mode=REQUIRED'", so no customer database could be created on Graviton against a TLS-only RDS (found on the first Canada deploy). set_db_ssl_flags now asks the client: Oracle's keeps --ssl-mode=REQUIRED --enable-cleartext-plugin (unchanged for amd64); MariaDB's gets --ssl --skip-ssl-verify-server-cert, its equivalent (TLS required, certificate not verified, cleartext plugin built in). If the client cannot be asked the historical flags are kept. Verified on an arm64 node against the Canada RDS (MySQL 8.4.8, IAM auth token): the lifted set_db_ssl_flags + mysql_setup connect over TLS as the master user. test_db_ssl_flags.sh covers both clients, the opt-in-only rule and the fallback, and fails on the old code; it runs in CI. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On the arm64 image
mysqlis MariaDB's client: Debian'sdefault-mysql-clientis installed there because MySQL's apt repo has no arm64 packages (see the Dockerfile comment; re-checked 2026-10-28:repo.mysql.com/apt/debian/dists/{trixie,bookworm}/mysql-8.4-lts/binary-arm64returns 404). MariaDB's client has no--ssl-mode. WithDB_SSL_ENABLED=true(CDK-managed RDS, IAM auth token) the privileged setup and delete calls fail:so no customer database can be created on Graviton. Found on the first Canada deploy (
simplerisk-minimal:20261020-001-php85, Debian 13, mariadb-client 11.8.6, aarch64). amd64 is unaffected because it installs Oracle'smysql-community-client.Change
set_db_ssl_flagsasks the client what it supports (mysql_client_supports_ssl_mode: doesmysql --helplist--ssl-mode):--ssl-mode=REQUIRED --enable-cleartext-plugin.--ssl --skip-ssl-verify-server-cert. TLS is required and the server certificate is not verified, the same asREQUIRED; the cleartext plugin is built in (--enable-cleartext-pluginis obsolete there and only warns).Opt-in rule is unchanged: only exactly
DB_SSL_ENABLED=trueadds flags. README row updated.This is separate from commit 3a8f83e (apply_mail_setting no longer forces
--ssl-mode=DISABLED), which is already ontestingand not the cause of this failure.Verification
test_db_ssl_flags.sh(new, runs in CI): fake clients with--helpshaped like the real ones; covers both clients, the opt-in-only rule (unset/false/TRUE/1/empty) and the fallback. Fails ontesting, passes here.test_escaping.shstill passes.mysql, the functions lifted from this entrypoint (set_db_ssl_flags+mysql_setup) connect over TLS (TLS_AES_256_GCM_SHA384) as the master user, exit 0. The old flags fail on the same node with the error above.DB_SETUP=automaticrun; the CI image build covers the Dockerfile, which is unchanged.Follow-up (not in this PR)
The arm64 image has never been exercised natively against a TLS-only RDS before; consider an arm64 smoke test in CI.
🤖 Generated with Claude Code