c4patino/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-06 17:13:24 -05:00
Code Issues Projects Releases Packages Wiki Activity

[Backport release-26.05] nixos/mysql: fix initialScript option after security fix (#534914)

Browse source
This commit is contained in:
Thomas Gerbet 2026-06-24 12:41:04 +00:00 • committed by GitHub
commit 4c3d4ca14e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 13 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nixos/modules/services/databases/mysql.nix
View file

@ -662,11 +662,6 @@ in
) | ${cfg.package}/bin/mysql -u ${superUser} -N
''}
# Secure root@localhost for MySQL/Percona on first initialization
${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
''}
${lib.optionalString (cfg.initialScript != null) ''
# Execute initial script
# using toString to avoid copying the file to nix store if given as path instead of string,
@ -674,6 +669,11 @@ in
cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
''}
# Secure root@localhost for MySQL/Percona on first initialization
${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
''}
rm ${cfg.dataDir}/mysql_init
fi

12
pkgs/by-name/my/mysql84/package.nix
View file

@ -112,10 +112,14 @@ stdenv.mkDerivation (finalAttrs: {
connector-c = finalAttrs.finalPackage;
server = finalAttrs.finalPackage;
mysqlVersion = lib.versions.majorMinor finalAttrs.version;
tests.mysql-secure-root-by-default =
nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
tests.mysql-root-can-be-kept-insecure =
nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
tests = {
mysql =
nixosTests.mysql."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
mysql-secure-root-by-default =
nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
mysql-root-can-be-kept-insecure =
nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
};
};
meta = {