From 63cd16ec44b08d5b966316618f05bb2dcf048da8 Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Wed, 27 May 2026 11:08:44 +0200 Subject: [PATCH] [bitnami/percona-mysql] Release 8.4.8-8-debian-12-r9 (#94015) Signed-off-by: Bitnami Bot --- .../percona-mysql/8.4/debian-12/Dockerfile | 12 +++--- ...4.9-10-linux-amd64-debian-12.tar.gz.sha256 | 1 + ...4.9-10-linux-arm64-debian-12.tar.gz.sha256 | 1 + ....4.9-1-linux-amd64-debian-12.tar.gz.sha256 | 1 + ....8-8-0-linux-amd64-debian-12.tar.gz.sha256 | 1 + .../prebuildfs/opt/bitnami/scripts/libfile.sh | 37 +++++++++++++++++++ .../rootfs/opt/bitnami/scripts/libmysql.sh | 18 +++++++-- .../opt/bitnami/scripts/mysql/healthcheck.sh | 2 + .../rootfs/opt/bitnami/scripts/mysql/setup.sh | 4 +- 9 files changed, 65 insertions(+), 12 deletions(-) create mode 100644 bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-arm64-debian-12.tar.gz.sha256 create mode 100644 bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/mysql-shell-8.4.9-1-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/percona-mysql-8.4.8-8-0-linux-amd64-debian-12.tar.gz.sha256 diff --git a/bitnami/percona-mysql/8.4/debian-12/Dockerfile b/bitnami/percona-mysql/8.4/debian-12/Dockerfile index 902dfe2578d0..764bc31348ec 100644 --- a/bitnami/percona-mysql/8.4/debian-12/Dockerfile +++ b/bitnami/percona-mysql/8.4/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-23T10:13:29Z" \ + org.opencontainers.image.created="2026-05-27T08:50:55Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/percona-mysql/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/percona-mysql" \ @@ -35,12 +35,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ for COMPONENT in "${COMPONENTS[@]}"; do \ if [ ! -f "${COMPONENT}.tar.gz" ]; then \ curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \ - curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \ fi ; \ - sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \ + sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \ tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \ - rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \ - done + rm -rf "${COMPONENT}".tar.gz ; \ + done ; \ + rm -rf /opt/bitnami/checksums ; RUN apt-get update && apt-get upgrade -y && \ apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives RUN chmod g+rwX /opt/bitnami @@ -52,7 +52,7 @@ COPY rootfs / RUN /opt/bitnami/scripts/mysql/postunpack.sh ENV APP_VERSION="8.4.8-8" \ BITNAMI_APP_NAME="percona-mysql" \ - IMAGE_REVISION="8" \ + IMAGE_REVISION="9" \ MYSQL_HOME="/opt/bitnami/mysql/conf" \ PATH="/opt/bitnami/mysql/bin:/opt/bitnami/common/bin:/opt/bitnami/mysql/sbin:$PATH" diff --git a/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..f7f6d777442b --- /dev/null +++ b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +7576302f2870643e4c48e7a4be12fef12e472e68b0b407e6033f812c8742c1f1 ini-file-1.4.9-10-linux-amd64-debian-12.tar.gz diff --git a/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..fd41b7a8f0ce --- /dev/null +++ b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/ini-file-1.4.9-10-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +83dd2355db6b63fc46bb02008fdace7510b339c88d91d45abaa256f2a7ae54bd ini-file-1.4.9-10-linux-arm64-debian-12.tar.gz diff --git a/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/mysql-shell-8.4.9-1-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/mysql-shell-8.4.9-1-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..16cbffdecf3c --- /dev/null +++ b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/mysql-shell-8.4.9-1-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +b0499f1e606fe8100a0715bec8712657408cbea95d3e3fd6b0253282362326fe mysql-shell-8.4.9-1-linux-amd64-debian-12.tar.gz diff --git a/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/percona-mysql-8.4.8-8-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/percona-mysql-8.4.8-8-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..acfb036bff21 --- /dev/null +++ b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/checksums/percona-mysql-8.4.8-8-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +db234922cc08b1003609d1b4fbee94cd875e83aeb37b60b2e490bb567db8279a percona-mysql-8.4.8-8-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh index 1c69e0e48a5d..335c1c7c9ef7 100644 --- a/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh +++ b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh @@ -139,3 +139,40 @@ wait_for_log_entry() { return 1 fi } + +######################## +# Creates a secure temporary file containing the provided secret +# Arguments: +# $1 - secret to write to the temporary file +# Returns: +# String +######################### +credential_to_temp_file() { + local secret="$1" + local tmp_file + + # Use mktemp with a specific prefix for easier debugging if something lingers + if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then + echo "Error: Failed to create temp file" >&2 + return 1 + fi + + # Restrict permissions before writing the secret + chmod 0600 "$tmp_file" + # Write secret and ensure it's flushed to disk + printf "%s" "$secret" > "$tmp_file" + # Output the filename so the caller can capture it + echo "$tmp_file" +} + +######################## +# Cleans up temporary files created by credential_to_temp_file +# Arguments: +# None +# Returns: +# None +######################### +cleanup_credentials() { + debug "Cleaning up temporary files containing credentials" + rm -rf "${TMPDIR:-/tmp}"/at.cred.* +} diff --git a/bitnami/percona-mysql/8.4/debian-12/rootfs/opt/bitnami/scripts/libmysql.sh b/bitnami/percona-mysql/8.4/debian-12/rootfs/opt/bitnami/scripts/libmysql.sh index 5645ef1ea6f0..56ae47397ceb 100644 --- a/bitnami/percona-mysql/8.4/debian-12/rootfs/opt/bitnami/scripts/libmysql.sh +++ b/bitnami/percona-mysql/8.4/debian-12/rootfs/opt/bitnami/scripts/libmysql.sh @@ -192,7 +192,10 @@ mysql_exec_initial_dump() { local -r dump_file="${DB_DATA_DIR}/dump_all_databases.sql" info "MySQL dump master data start..." - mysqldump --verbose --single-transaction --quick --source-data=2 --all-databases -h "$DB_MASTER_HOST" -P "$DB_MASTER_PORT_NUMBER" -u "$DB_MASTER_ROOT_USER" -p"$DB_MASTER_ROOT_PASSWORD" > "$dump_file" + # Avoid passing credentials as arguments to mysqldump, to avoid leaking them given a local observer with /proc read access can read them + local root_password_file + root_password_file="$(credential_to_temp_file "$DB_MASTER_ROOT_PASSWORD")" + mysqldump --verbose --single-transaction --quick --source-data=2 --all-databases -h "$DB_MASTER_HOST" -P "$DB_MASTER_PORT_NUMBER" -u "$DB_MASTER_ROOT_USER" -p"$(<"$root_password_file")" > "$dump_file" debug "Finish dump databases" # Look for the line containing "CHANGE REPLICATION SOURCE" @@ -632,7 +635,12 @@ mysql_execute_print_output() { fi args+=("-N" "-u" "$user") [[ -n "$db" ]] && args+=("$db") - [[ -n "$pass" ]] && args+=("-p$pass") + # Avoid passing credentials as arguments to mysql, to avoid leaking them given a local observer with /proc read access can read them + if [[ -n "$pass" ]]; then + local pass_file + pass_file="$(credential_to_temp_file "$pass")" + args+=("-p$(<"$pass_file")") + fi [[ "${#opts[@]}" -gt 0 ]] && args+=("${opts[@]}") [[ "${#extra_opts[@]}" -gt 0 ]] && args+=("${extra_opts[@]}") @@ -640,7 +648,6 @@ mysql_execute_print_output() { if [[ "${BITNAMI_DEBUG:-false}" = true ]]; then local mysql_cmd mysql_cmd="$(