From c42e5dbc067ab4a0ef31a0fd7727ced55ecc9131 Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Fri, 29 May 2026 21:25:59 +0200 Subject: [PATCH] [bitnami/percona-mysql] Release 8.4.8-8-debian-12-r10 (#94076) Signed-off-by: Bitnami Bot --- .../percona-mysql/8.4/debian-12/Dockerfile | 4 ++-- .../prebuildfs/opt/bitnami/scripts/libfs.sh | 24 ++++++++++++++----- .../rootfs/opt/bitnami/scripts/libmysql.sh | 12 +++++++--- 3 files changed, 29 insertions(+), 11 deletions(-) diff --git a/bitnami/percona-mysql/8.4/debian-12/Dockerfile b/bitnami/percona-mysql/8.4/debian-12/Dockerfile index 764bc31348ec..c47992f32152 100644 --- a/bitnami/percona-mysql/8.4/debian-12/Dockerfile +++ b/bitnami/percona-mysql/8.4/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-27T08:50:55Z" \ + org.opencontainers.image.created="2026-05-29T19:03:52Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/percona-mysql/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/percona-mysql" \ @@ -52,7 +52,7 @@ COPY rootfs / RUN /opt/bitnami/scripts/mysql/postunpack.sh ENV APP_VERSION="8.4.8-8" \ BITNAMI_APP_NAME="percona-mysql" \ - IMAGE_REVISION="9" \ + IMAGE_REVISION="10" \ MYSQL_HOME="/opt/bitnami/mysql/conf" \ PATH="/opt/bitnami/mysql/bin:/opt/bitnami/common/bin:/opt/bitnami/mysql/sbin:$PATH" diff --git a/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh index 1337f6c2dd59..b16efabd3230 100644 --- a/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh +++ b/bitnami/percona-mysql/8.4/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh @@ -131,6 +131,7 @@ relativize() { # -d|--dir-mode - mode for files. # -u|--user - user # -g|--group - group +# -n|--no-dereference - do not follow symlinks (use for runtime root chown of daemon-writable dirs) # Returns: # None ######################### @@ -140,6 +141,7 @@ configure_permissions_ownership() { local file_mode="" local user="" local group="" + local follow_symlinks="yes" # Validate arguments shift 1 @@ -161,6 +163,9 @@ configure_permissions_ownership() { shift group="${1:?missing group}" ;; + -n | --no-dereference) + follow_symlinks="no" + ;; *) echo "Invalid command line flag $1" >&2 return 1 @@ -169,22 +174,29 @@ configure_permissions_ownership() { shift done + # -L: follow symlinks and emits the target path + # This is dangerous at runtime, given a co-located lower-privileged process with write access + # to the target path can redirect the chown/chmod to arbitrary paths. Example: + # Lower-privileged process run: ln -s /etc /tmp/etc + # Then, setup.sh runs: configure_permissions_ownership --dir-mode 775 /tmp + local find_L_flag=(); [[ "$follow_symlinks" == "yes" ]] && find_L_flag=("-L") + # -h: changes symlink inode ownership without touching the target. + local chown_flags=(); [[ "$follow_symlinks" == "no" ]] && chown_flags=("-h") read -r -a filepaths <<<"$paths" for p in "${filepaths[@]}"; do if [[ -e "$p" ]]; then - find -L "$p" -printf "" if [[ -n $dir_mode ]]; then - find -L "$p" -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" fi if [[ -n $file_mode ]]; then - find -L "$p" -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" fi if [[ -n $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}:${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}:${group}" elif [[ -n $user ]] && [[ -z $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}" elif [[ -z $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chgrp "${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chgrp "${chown_flags[@]}" "${group}" fi else stderr_print "$p does not exist" diff --git a/bitnami/percona-mysql/8.4/debian-12/rootfs/opt/bitnami/scripts/libmysql.sh b/bitnami/percona-mysql/8.4/debian-12/rootfs/opt/bitnami/scripts/libmysql.sh index 56ae47397ceb..efe3e1c2cc2a 100644 --- a/bitnami/percona-mysql/8.4/debian-12/rootfs/opt/bitnami/scripts/libmysql.sh +++ b/bitnami/percona-mysql/8.4/debian-12/rootfs/opt/bitnami/scripts/libmysql.sh @@ -1413,15 +1413,21 @@ mysql_client_extra_opts() { local -a opts=() local key value if is_boolean_yes "${DB_ENABLE_SSL:-no}"; then + ca_file="$(mysql_client_env_value "SSL_CA_FILE")" if [[ "$(mysql_client_flavor)" = "mysql" ]]; then - opts+=("--ssl-mode=REQUIRED") + if [[ -f "$ca_file " ]]; then + opts+=("--ssl-mode=VERIFY_CA") + else + opts+=("--ssl-mode=REQUIRED") + fi else opts+=("--ssl=TRUE") + [[ -f "$ca_file" ]] && opts+=("--ssl-verify-server-cert") fi - # Add "--ssl-ca", "--ssl-key" and "--ssl-cert" options if the env vars are defined + # Add "--ssl-ca", "--ssl-key" and "--ssl-cert" options if the env vars are defined and the files exist for key in ca key cert; do value="$(mysql_client_env_value "SSL_${key^^}_FILE")" - [[ -n "${value}" ]] && opts+=("--ssl-${key}=${value}") + [[ -f "${value}" ]] && opts+=("--ssl-${key}=${value}") done else # Skip SSL validation