[bitnami/mariadb-galera] Release 12.3.2-debian-12-r2 (#94576)

Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>

bitnami/mariadb-galera/12.3/debian-12/Dockerfile

@@ -3,11 +3,11 @@
 
 FROM docker.io/bitnami/minideb:bookworm
 
-ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith"
+ARG DOWNLOADS_URL="https://downloads.bitnami.com/files/stacksmith"
 ARG TARGETARCH
 
 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-06-02T12:29:09Z" \
+      org.opencontainers.image.created="2026-06-10T18:33:48Z" \
       org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
       org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/mariadb-galera/README.md" \
       org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/mariadb-galera" \
@@ -28,12 +28,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
     DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \
     mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \
     COMPONENTS=( \
-      "ini-file-1.4.9-10-linux-${OS_ARCH}-debian-12" \
-      "mariadb-galera-12.3.2-1-linux-${OS_ARCH}-debian-12" \
+      "ini-file-1.4.9-12-linux-${OS_ARCH}-debian-12" \
+      "mariadb-galera-12.3.2-2-linux-${OS_ARCH}-debian-12" \
     ) ; \
     for COMPONENT in "${COMPONENTS[@]}"; do \
       if [ ! -f "${COMPONENT}.tar.gz" ]; then \
-        curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \
+        curl -SsLf "${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \
       fi ; \
       sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \
       tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \
@@ -51,7 +51,7 @@ COPY rootfs /
 RUN /opt/bitnami/scripts/mariadb-galera/postunpack.sh
 ENV APP_VERSION="12.3.2" \
     BITNAMI_APP_NAME="mariadb-galera" \
-    IMAGE_REVISION="1" \
+    IMAGE_REVISION="2" \
     PATH="/opt/bitnami/common/bin:/opt/bitnami/mariadb/bin:/opt/bitnami/mariadb/sbin:/opt/bitnami/common/sbin:$PATH"
 
 EXPOSE 3306 4444 4567 4568

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-amd64-debian-12.tar.gz.sha256

@@ -1 +0,0 @@
-7576302f2870643e4c48e7a4be12fef12e472e68b0b407e6033f812c8742c1f1  ini-file-1.4.9-10-linux-amd64-debian-12.tar.gz

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-arm64-debian-12.tar.gz.sha256

@@ -1 +0,0 @@
-83dd2355db6b63fc46bb02008fdace7510b339c88d91d45abaa256f2a7ae54bd  ini-file-1.4.9-10-linux-arm64-debian-12.tar.gz

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-12-linux-amd64-debian-12.tar.gz.sha256

@@ -0,0 +1 @@
+aba4a9b96e5a3b29743fe09c4b3279c789bace4171fe34574d166668dfc59523  ini-file-1.4.9-12-linux-amd64-debian-12.tar.gz

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-12-linux-arm64-debian-12.tar.gz.sha256

@@ -0,0 +1 @@
+262a2d83e7294bb3adf0664ece04686f162a6355713981c7677634f2645505f0  ini-file-1.4.9-12-linux-arm64-debian-12.tar.gz

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/checksums/mariadb-galera-12.3.2-1-linux-amd64-debian-12.tar.gz.sha256

@@ -1 +0,0 @@
-23a217a0b5fe6e33766af3dbe787a032405eac7eed88ce5cb405e8d3857bccb7  mariadb-galera-12.3.2-1-linux-amd64-debian-12.tar.gz

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/checksums/mariadb-galera-12.3.2-1-linux-arm64-debian-12.tar.gz.sha256

@@ -1 +0,0 @@
-52f8ea05e676f0987768dc50203772e21f4a09567ec5ebdac72101110b4f8d7b  mariadb-galera-12.3.2-1-linux-arm64-debian-12.tar.gz

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/checksums/mariadb-galera-12.3.2-2-linux-amd64-debian-12.tar.gz.sha256

@@ -0,0 +1 @@
+25ae7b9d4358cf8aebf99c7af9f55ca4fdad912cc24cd22e1debd119a4c3d8b4  mariadb-galera-12.3.2-2-linux-amd64-debian-12.tar.gz

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/checksums/mariadb-galera-12.3.2-2-linux-arm64-debian-12.tar.gz.sha256

@@ -0,0 +1 @@
+4eda700ce46c557b69d0abdf01a29b2c608e365b5b025416cc2f30726202e5dc  mariadb-galera-12.3.2-2-linux-arm64-debian-12.tar.gz

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/scripts/libos.sh

@@ -170,7 +170,7 @@ ensure_user_exists() {
     if [[ -n "$home" ]]; then
         mkdir -p "$home"
         usermod -d "$home" "$user" >/dev/null 2>&1
-        configure_permissions_ownership "$home" -d "775" -f "664" -u "$user" -g "$group"
+        configure_permissions_ownership "$home" -d "775" -f "664" -u "$user" -g "$group" -n
     fi
 }
 

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/scripts/libvalidations.sh

@@ -20,7 +20,7 @@
 #########################
 is_int() {
     local -r int="${1:?missing value}"
-    if [[ "$int" =~ ^-?[0-9]+ ]]; then
+    if [[ "$int" =~ ^-?[0-9]+$ ]]; then
         true
     else
         false

bitnami/mariadb-galera/12.3/debian-12/prebuildfs/opt/bitnami/scripts/libversion.sh

@@ -49,3 +49,36 @@ get_sematic_version () {
         fi
     fi
 }
+
+########################
+# Compares two semantic versions
+# Arguments:
+#   $1 - version1: first version to compare
+#   $2 - version2: second version to compare
+# Returns:
+#   -1 if version1 is less than version2
+#   0 if version1 is equal to version2
+#   1 if version1 is greater than version2
+#########################
+compare_semantic_versions() {
+    local version1="${1:?version1 is required}"
+    local version2="${2:?version2 is required}"
+    local major1 major2 minor1 minor2 patch1 patch2
+
+    major1="$(get_sematic_version "$version1" 1)"
+    major2="$(get_sematic_version "$version2" 1)"
+    minor1="$(get_sematic_version "$version1" 2)"
+    minor2="$(get_sematic_version "$version2" 2)"
+    patch1="$(get_sematic_version "$version1" 3)"
+    patch2="$(get_sematic_version "$version2" 3)"
+
+    if [[ "$major1" -eq "$major2" ]] && [[ "$minor1" -eq "$minor2" ]] && [[ "$patch1" -eq "$patch2" ]]; then
+        echo "0"
+    elif [[ "$major1" -lt "$major2" ]] ||
+      { [[ "$major1" -eq "$major2" ]] && [[ "$minor1" -lt "$minor2" ]]; } ||
+      { [[ "$major1" -eq "$major2" ]] && [[ "$minor1" -eq "$minor2" ]] && [[ "$patch1" -lt "$patch2" ]]; }; then
+        echo "-1"
+    else
+        echo "1"
+    fi
+}

bitnami/mariadb-galera/12.3/debian-12/rootfs/opt/bitnami/scripts/libmariadbgalera.sh

@@ -190,10 +190,7 @@ mariadb_exec_initial_dump() {
     local -r dump_file="${DB_DATA_DIR}/dump_all_databases.sql"
 
     info "MariaDB dump master data start..."
-    # Avoid passing credentials as arguments to mariadb-dump, to avoid leaking them given a local observer with /proc read access can read them
-    local root_password_file
-    root_password_file="$(credential_to_temp_file "$DB_MASTER_ROOT_PASSWORD")"
-    mariadb-dump --verbose --single-transaction --quick --source-data=2 --all-databases -h "$DB_MASTER_HOST" -P "$DB_MASTER_PORT_NUMBER" -u "$DB_MASTER_ROOT_USER" -p"$(<"$root_password_file")" > "$dump_file"
+    MYSQL_PWD="$DB_MASTER_ROOT_PASSWORD" mariadb-dump --verbose --single-transaction --quick --source-data=2 --all-databases -h "$DB_MASTER_HOST" -P "$DB_MASTER_PORT_NUMBER" -u "$DB_MASTER_ROOT_USER" > "$dump_file"
     debug "Finish dump databases"
 
     # Look for the line containing "CHANGE REPLICATION SOURCE"
@@ -536,14 +533,12 @@ mariadb_upgrade() {
     local -a args=("--defaults-file=${DB_CONF_FILE}" "-u" "$DB_ROOT_USER")
     info "Running mariadb_upgrade"
     mariadb_start_bg
-    if is_boolean_yes "${ROOT_AUTH_ENABLED:-false}"; then
-        # Avoid passing credentials as arguments to mariadb_upgrade, to avoid leaking them given a local observer with /proc read access can read them
-        local root_password_file
-        root_password_file="$(credential_to_temp_file "$(get_master_env_var_value ROOT_PASSWORD)")"
-        args+=("-p$(<"$root_password_file")")
-    fi
     [[ "${DB_UPGRADE}" == "FORCE" ]] && args+=("--force")
-    debug_execute "${DB_BIN_DIR}/mariadb_upgrade" "${args[@]}" || info "This installation is already upgraded"
+    if is_boolean_yes "${ROOT_AUTH_ENABLED:-false}"; then
+        MYSQL_PWD="$(get_master_env_var_value ROOT_PASSWORD)" debug_execute "${DB_BIN_DIR}/mariadb_upgrade" "${args[@]}" || info "This installation is already upgraded"
+    else
+        debug_execute "${DB_BIN_DIR}/mariadb_upgrade" "${args[@]}" || info "This installation is already upgraded"
+    fi
 }
 
 #!/bin/bash
@@ -1457,12 +1452,6 @@ mysql_execute_print_output() {
     fi
     args+=("-N" "-u" "$user")
     [[ -n "$db" ]] && args+=("$db")
-    # Avoid passing credentials as arguments to mysql, to avoid leaking them given a local observer with /proc read access can read them
-    if [[ -n "$pass" ]]; then
-        local pass_file
-        pass_file="$(credential_to_temp_file "$pass")"
-        args+=("-p$(<"$pass_file")")
-    fi
     [[ "${#opts[@]}" -gt 0 ]] && args+=("${opts[@]}")
     [[ "${#extra_opts[@]}" -gt 0 ]] && args+=("${extra_opts[@]}")
 
@@ -1470,11 +1459,19 @@ mysql_execute_print_output() {
     if [[ "${BITNAMI_DEBUG:-false}" = true ]]; then
         local mysql_cmd
         mysql_cmd="$(</dev/stdin)"
-        "$(mysql_binary)" "${args[@]}" <<<"$mysql_cmd"
+        if [[ -n "$pass" ]]; then
+            MYSQL_PWD="$pass" "$(mysql_binary)" "${args[@]}" <<<"$mysql_cmd"
+        else
+            "$(mysql_binary)" "${args[@]}" <<<"$mysql_cmd"
+        fi
     else
         # Do not store the command(s) as a variable, to avoid issues when importing large files
         # https://github.com/bitnami/bitnami-docker-mariadb/issues/251
-        "$(mysql_binary)" "${args[@]}"
+        if [[ -n "$pass" ]]; then
+            MYSQL_PWD="$pass" "$(mysql_binary)" "${args[@]}"
+        else
+            "$(mysql_binary)" "${args[@]}"
+        fi
     fi
 }
 
@@ -2186,13 +2183,10 @@ mysql_healthcheck() {
 
     root_password="$(get_master_env_var_value ROOT_PASSWORD)"
     if [[ -n "$root_password" ]]; then
-        # Avoid passing credentials as arguments to mysqladmin, to avoid leaking them given a local observer with /proc read access can read them
-        local root_password_file
-        root_password_file="$(credential_to_temp_file "$root_password")"
-        args+=("-p$(<"$root_password_file")")
+        MYSQL_PWD="$root_password" mysqladmin "${args[@]}" ping && MYSQL_PWD="$root_password" mysqladmin "${args[@]}" status
+    else
+        mysqladmin "${args[@]}" ping && mysqladmin "${args[@]}" status
     fi
-
-    mysqladmin "${args[@]}" ping && mysqladmin "${args[@]}" status
 }
 
 ########################
@@ -2212,6 +2206,17 @@ mysql_client_flavor() {
     fi
 }
 
+# Helper to get the proper value for the MySQL client environment variable
+mysql_client_env_value() {
+    local env_name="MYSQL_CLIENT_${1:?missing name}"
+    if [[ -n "${!env_name:-}" ]]; then
+        echo "${!env_name:-}"
+    else
+        env_name="DB_CLIENT_${1}"
+        echo "${!env_name:-}"
+    fi
+}
+
 ########################
 # Prints extra options for MySQL client calls (i.e. SSL options)
 # Globals:
@@ -2222,16 +2227,6 @@ mysql_client_flavor() {
 #   List of options to pass to "mysql" CLI
 #########################
 mysql_client_extra_opts() {
-    # Helper to get the proper value for the MySQL client environment variable
-    mysql_client_env_value() {
-        local env_name="MYSQL_CLIENT_${1:?missing name}"
-        if [[ -n "${!env_name:-}" ]]; then
-            echo "${!env_name:-}"
-        else
-            env_name="DB_CLIENT_${1}"
-            echo "${!env_name:-}"
-        fi
-    }
     local -a opts=()
     local key value
     if is_boolean_yes "${DB_ENABLE_SSL:-no}"; then

bitnami/mariadb-galera/12.3/debian-12/rootfs/opt/bitnami/scripts/mariadb-env.sh

@@ -50,6 +50,7 @@ mariadb_env_vars=(
     MARIADB_UPGRADE
     MARIADB_SKIP_TEST_DB
     MARIADB_CLIENT_ENABLE_SSL
+    MARIADB_REPLICATION_USE_SSL
     MARIADB_CLIENT_SSL_CA_FILE
     MARIADB_CLIENT_SSL_CERT_FILE
     MARIADB_CLIENT_SSL_KEY_FILE
@@ -176,6 +177,8 @@ export MARIADB_SKIP_TEST_DB="${MARIADB_SKIP_TEST_DB:-no}"
 export DB_SKIP_TEST_DB="$MARIADB_SKIP_TEST_DB"
 export MARIADB_CLIENT_ENABLE_SSL="${MARIADB_CLIENT_ENABLE_SSL:-no}"
 export DB_CLIENT_ENABLE_SSL="$MARIADB_CLIENT_ENABLE_SSL"
+export MARIADB_REPLICATION_USE_SSL="${MARIADB_REPLICATION_USE_SSL:-$DB_CLIENT_ENABLE_SSL}"
+export DB_REPLICATION_USE_SSL="$MARIADB_REPLICATION_USE_SSL"
 export MARIADB_CLIENT_SSL_CA_FILE="${MARIADB_CLIENT_SSL_CA_FILE:-}"
 export DB_CLIENT_SSL_CA_FILE="$MARIADB_CLIENT_SSL_CA_FILE"
 export MARIADB_CLIENT_SSL_CERT_FILE="${MARIADB_CLIENT_SSL_CERT_FILE:-}"

bitnami/mariadb-galera/12.3/debian-12/rootfs/opt/bitnami/scripts/mariadb-galera/healthcheck.sh

@@ -10,12 +10,9 @@ set -o pipefail
 # set -o xtrace # Uncomment this line for debugging purposes
 
 # Load libraries
-. /opt/bitnami/scripts/libfile.sh
 . /opt/bitnami/scripts/libmariadbgalera.sh
 
 # Load MariaDB environment variables
 . /opt/bitnami/scripts/mariadb-env.sh
 
-# Ensure we clean up temporary files when this script ends
-trap "cleanup_credentials" EXIT
 mysql_healthcheck

bitnami/mariadb-galera/12.3/debian-12/rootfs/opt/bitnami/scripts/mariadb-galera/setup.sh

@@ -10,7 +10,6 @@ set -o pipefail
 # set -o xtrace # Uncomment this line for debugging purposes
 
 # Load libraries
-. /opt/bitnami/scripts/libfile.sh
 . /opt/bitnami/scripts/libfs.sh
 . /opt/bitnami/scripts/libos.sh
 . /opt/bitnami/scripts/libmariadbgalera.sh
@@ -26,8 +25,8 @@ eval "$(ldap_env)"
 rm -rf "${DB_SOCKET_FILE}.lock"
 # Ensure MariaDB environment variables settings are valid
 mysql_validate
-# Ensure MariaDB is stopped when this script ends and we clean up temporary files
-trap "mysql_stop; cleanup_credentials" EXIT
+# Ensure MariaDB is stopped when this script ends
+trap "mysql_stop" EXIT
 if am_i_root; then
     # Ensure 'daemon' user exists when running as 'root'
     ensure_user_exists "$DB_DAEMON_USER" --group "$DB_DAEMON_GROUP"

bitnami/mariadb-galera/README.md

@@ -106,6 +106,7 @@ The following tables list the main variables you can set.
 | `MARIADB_UPGRADE`                             | MariaDB Galera upgrade option.                                                                                            | `AUTO`                                    |
 | `MARIADB_SKIP_TEST_DB`                        | Whether to skip creating the test database.                                                                               | `no`                                      |
 | `MARIADB_CLIENT_ENABLE_SSL`                   | Whether to force SSL for connections to the MariaDB Galera database.                                                      | `no`                                      |
+| `MARIADB_REPLICATION_USE_SSL`                 | Whether to force SSL for MariaDB Galera replication.                                                                      | `$DB_CLIENT_ENABLE_SSL`                   |
 | `MARIADB_CLIENT_SSL_CA_FILE`                  | Path to CA certificate to use for SSL connections to the MariaDB Galera database server.                                  | `nil`                                     |
 | `MARIADB_CLIENT_SSL_CERT_FILE`                | Path to client public key certificate to use for SSL connections to the MariaDB Galera database server.                   | `nil`                                     |
 | `MARIADB_CLIENT_SSL_KEY_FILE`                 | Path to client private key to use for SSL connections to the MariaDB Galera database server.                              | `nil`                                     |