feat(minimal): add opt-in DB_SSL_ENABLED for TLS-required DB setup connections

.grype.yaml

@@ -1,2 +1,24 @@
 ignore:
   - vulnerability: CVE-2025-27558 # Not able to fix it at the moment
+  # False positive: Grype's binary classifier reads the PHP interpreter's own version
+  # string (embedded in /usr/local/bin/php, libphp.so, and the bundled extensions such
+  # as curl.so) as a "curl" binary, then flags these curl CVEs (all fixed in curl
+  # 8.21.0). The REAL curl is the Debian package, patched (8.14.1-2+deb13u4) and
+  # correctly not flagged. Scoped per-CVE to binary-classified curl so a genuine future
+  # curl finding still surfaces instead of being blanket-ignored.
+  - vulnerability: CVE-2026-11856
+    package:
+      name: curl
+      type: binary
+  - vulnerability: CVE-2026-10536
+    package:
+      name: curl
+      type: binary
+  - vulnerability: CVE-2026-8927
+    package:
+      name: curl
+      type: binary
+  - vulnerability: CVE-2026-8924
+    package:
+      name: curl
+      type: binary

CLAUDE.md

@@ -91,6 +91,7 @@ The entrypoint script handles:
 |---|---|
 | `DB_SETUP` | `automatic`, `automatic-only`, `manual`, `delete` |
 | `DB_SETUP_PASS` | Password used when setting up the DB |
+| `DB_SSL_ENABLED` | Opt-in, **default off**. Set to exactly `true` to add `--ssl-mode=REQUIRED --enable-cleartext-plugin` to the privileged setup/delete MySQL client (for databases that require the cleartext auth plugin to be sent over TLS). Any other value / unset ⇒ unchanged plaintext-capable connection. |
 | `SIMPLERISK_DB_HOSTNAME` | External DB host |
 | `SIMPLERISK_DB_USERNAME/PASSWORD/DATABASE` | DB credentials |
 | `SIMPLERISK_CRON_SETUP` | Enable/disable PHP cron (default: enabled) |

simplerisk-minimal/Dockerfile

@@ -24,7 +24,11 @@ ARG TARGETARCH
 # NOTE: The MySQL key was taken from https://dev.mysql.com/doc/refman/8.4/en/checking-gpg-signature.html
 # amd64: mysql-community-client from MySQL's Debian repo
 # arm64: default-mysql-client from Debian (MySQL's apt repo has no arm64 packages)
+# apt-get upgrade patches base-image packages (apache2, curl, ...) with Debian
+# security updates -- the pinned php:${php_version}-apache base ships them at its
+# own build-time versions, so without this they accumulate fixed CVEs (Grype gate).
 RUN apt-get update && \
+    apt-get -y upgrade && \
     apt-get install -y --no-install-recommends \
         libldap2-dev \
         libicu-dev \

simplerisk-minimal/README.md

@@ -64,6 +64,7 @@ docker run -d --name simplerisk -e SIMPLERISK_DB_PASSWORD=pass -e SIMPLERISK_DB_
 | `DB_SETUP_USER` | `root` | Used when `DB_SETUP=automatic\|automatic-only\|delete`. User name of database privileged user to install SimpleRisk schema and other components |
 | `DB_SETUP_PASS` | `root` (the bundled `stack.yml` ships `simplerisk_setup`) | Used when `DB_SETUP=automatic\|automatic-only\|delete`. Password of the privileged MySQL user used **only** to install the SimpleRisk schema and create the app DB user. In `stack.yml` it is also the bundled MySQL root password; since that MySQL is not exposed outside the stack network, a documented default is used for the zero-config trial. Override it (and `MYSQL_ROOT_PASSWORD` in `stack.yml`) for any non-trial deployment. |
 | `DB_SETUP_WAIT` | 20 | Used when `DB_SETUP=automatic\|automatic-only`. Time, in seconds, the application is going to wait to set up the database. Useful if you are deploying the database and SimpleRisk at the same time |
+| `DB_SSL_ENABLED` | `false` (off) | Opt-in, used when `DB_SETUP=automatic\|automatic-only\|delete`. Set to exactly `true` to require TLS on the privileged setup/delete MySQL client connection (adds `--ssl-mode=REQUIRED --enable-cleartext-plugin`). Any other value, or unset, leaves the connection unchanged (plaintext-capable) |
 | `SIMPLERISK_DB_HOSTNAME` | `localhost` | Hostname of the database server |
 | `SIMPLERISK_DB_PORT` | 3306 | Port to contact the database |
 | `SIMPLERISK_DB_USERNAME` |`simplerisk` | User name to be used to access the SimpleRisk database |

simplerisk-minimal/common/entrypoint.sh

@@ -252,13 +252,24 @@ set_mail_settings(){
 	[ -n "${MAIL_PASSWORD:-}" ] && apply_mail_setting phpmailer_password "$MAIL_PASSWORD" || true
 }
 
+set_db_ssl_flags(){
+	# Some databases require the privileged setup/delete mysql client to send
+	# its credential via the cleartext auth plugin, which the server only
+	# accepts over TLS (e.g. when DB_SETUP_PASS is a short-lived auth token
+	# rather than a static password). Set DB_SSL_ENABLED=true to opt in.
+	DB_SSL_FLAGS=""
+	if [ "${DB_SSL_ENABLED:-}" = "true" ]; then
+		DB_SSL_FLAGS="--ssl-mode=REQUIRED --enable-cleartext-plugin"
+	fi
+}
+
 delete_db(){
 	print_log "db_deletion: prepare" "Performing database deletion"
 
 	# Pass password via env var to avoid shell interpretation of special characters in the value
 	export MYSQL_PWD="$DB_SETUP_PASS"
 	# Needed to separate the GRANT statement from the rest because it was providing a syntax error
-	exec_cmd "mysql -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
+	exec_cmd "mysql ${DB_SSL_FLAGS:-} -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
 	SET sql_mode = 'ANSI_QUOTES';
 	DROP DATABASE \"${SIMPLERISK_DB_DATABASE}\";
 	USE mysql;
@@ -291,15 +302,15 @@ db_setup(){
 	# Pass password via env var to avoid shell interpretation of special characters in the value
 	export MYSQL_PWD="$DB_SETUP_PASS"
 	# Using sql_mode = ANSI_QUOTES to avoid using backticks
-	exec_cmd "mysql -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
+	exec_cmd "mysql ${DB_SSL_FLAGS:-} -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
 	SET sql_mode = 'ANSI_QUOTES';
 	CREATE DATABASE \"${SIMPLERISK_DB_DATABASE}\";
 	USE \"${SIMPLERISK_DB_DATABASE}\";
 	\. ${SCHEMA_FILE}
 	CREATE USER \"${SIMPLERISK_DB_USERNAME}\"@\"%\" IDENTIFIED BY \"${SIMPLERISK_DB_PASSWORD}\";
 EOSQL" "Was not able to apply settings on database. Check error above. Exiting."
 	# Needed to separate the GRANT statement from the rest because it was providing a syntax error
-	exec_cmd "mysql -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
+	exec_cmd "mysql ${DB_SSL_FLAGS:-} -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <<EOSQL
 	SET sql_mode = 'ANSI_QUOTES';
 	GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER ON \"${SIMPLERISK_DB_DATABASE}\".* TO \"${SIMPLERISK_DB_USERNAME}\"@\"%\";
 EOSQL" "Was not able to apply settings on database. Check error above. Exiting."
@@ -323,6 +334,8 @@ unset_variables() {
 	unset DB_SETUP_USER
 	unset DB_SETUP_PASS
 	unset DB_SETUP_WAIT
+	unset DB_SSL_ENABLED
+	unset DB_SSL_FLAGS
 	unset SIMPLERISK_DB_HOSTNAME
 	unset SIMPLERISK_DB_PORT
 	unset SIMPLERISK_DB_USERNAME
@@ -379,6 +392,7 @@ _main() {
 	if [[ -n ${DB_SETUP:-} ]]; then
 	  DB_SETUP_USER="${DB_SETUP_USER:-root}"
 	  DB_SETUP_PASS="${DB_SETUP_PASS:-root}"
+	  set_db_ssl_flags
 	fi
 
 	if [[ -n ${SIMPLERISK_CSRF_SECRET:-} ]]; then

simplerisk-minimal/generate_dockerfile.sh

@@ -48,7 +48,11 @@ ARG TARGETARCH
 # NOTE: The MySQL key was taken from https://dev.mysql.com/doc/refman/8.4/en/checking-gpg-signature.html
 # amd64: mysql-community-client from MySQL's Debian repo
 # arm64: default-mysql-client from Debian (MySQL's apt repo has no arm64 packages)
+# apt-get upgrade patches base-image packages (apache2, curl, ...) with Debian
+# security updates -- the pinned php:\${php_version}-apache base ships them at its
+# own build-time versions, so without this they accumulate fixed CVEs (Grype gate).
 RUN apt-get update && \\
+    apt-get -y upgrade && \\
     apt-get install -y --no-install-recommends \\
         libldap2-dev \\
         libicu-dev \\