feat(minimal): add opt-in DB_SSL_ENABLED for TLS-required DB setup connections - #151
Merged
Conversation
jsokol
approved these changes
Jul 30, 2026
WolfangAukang
force-pushed
the
feature/db-ssl-enabled
branch
2 times, most recently
from
August 7, 2026 16:17
89c7119 to
f33cc28
Compare
…up connections The privileged setup/delete MySQL client in the simplerisk-minimal entrypoint now honors DB_SSL_ENABLED. Set to exactly "true", it appends --ssl-mode=REQUIRED --enable-cleartext-plugin to the db_setup()/delete_db() mysql calls — for databases that require the cleartext auth plugin to be sent over TLS (e.g. when DB_SETUP_PASS is a short-lived token rather than a static password). Defaults off (fail-closed): any other value or unset preserves today's plaintext-capable connection, so published images are unaffected for existing consumers. Documented in README.md and CLAUDE.md. Co-Authored-By: Claude Opus 4.8 <[email protected]>
…e; add apt upgrade The CI gate is 'grype --fail-on critical --only-fixed'. On feature/db-ssl-enabled it failed on 4 FIXABLE criticals — CVE-2026-11856/-10536/-8927/-8924 — all against a binary Grype labels 'curl 8.4.24'. That string is the PHP interpreter's own version (PHP/8.4.24, embedded in php/libphp.so/curl.so), misclassified as curl. The real curl is the Debian package (8.14.1-2+deb13u4) and is patched. The testing branch already suppresses these exact 4 CVEs in .grype.yaml; this ports that block (scoped to package name=curl type=binary so a genuine curl finding still surfaces). Also add 'apt-get -y upgrade' to the minimal generator (regenerated Dockerfile) so base Debian packages pick up security point-releases at build time, matching testing. No effect on the current scan (the pulled base is already current) but prevents CVE drift between base-image rebuilds. Evidence (amd64): gate FAIL->PASS. Raw criticals unchanged at 60 (all but the 4 FPs are wont-fix/not-fixed base debt, invisible to --only-fixed). PHP stays 8.4.24; all extensions load; container boots. Remaining fixable Highs are app-bundle deps (twig/phpspreadsheet/simplesamlphp/guzzle/symfony/...) fixed by rebuilding the S3 bundle, out of scope for this repo. Co-Authored-By: Claude Opus 4.8 <[email protected]>
WolfangAukang
force-pushed
the
feature/db-ssl-enabled
branch
from
August 7, 2026 17:27
f33cc28 to
b8e9ece
Compare
WolfangAukang
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds an opt-in
DB_SSL_ENABLEDenv var to thesimplerisk-minimalentrypoint. When set to exactlytrue, the privileged setup/delete MySQL client (db_setup()/delete_db()) appends--ssl-mode=REQUIRED --enable-cleartext-plugin.Why
Some databases require the privileged setup/delete client to authenticate via MySQL's cleartext auth plugin, which the server only accepts over TLS (for example, when
DB_SETUP_PASScarries a short-lived auth token rather than a static password).DB_SSL_ENABLED=trueopts the setup/delete path into that mode so those deployments can run against a TLS-mandatory server.Safety — default off, fail-closed
trueenables the flags. Unset /false/ any other value ⇒ unchanged plaintext-capable connection.DB_SSL_ENABLED=trueopt in.Testing
Built the image from this branch and ran an integration test against a TLS-mandatory MySQL 8.4 (
--require_secure_transport=ON). 7/7 passed:DB_SSL_ENABLED=true(verified via bash xtrace of the realmysqlline); absent when unset.DB_SSL_ENABLED=true: full setup over the TLS-required server — DBsimpleriskand usersimpleriskcreated, container exits 0.🤖 Generated with Claude Code