From 54ac430cd97823cfa1880cd660ff326b642776fa Mon Sep 17 00:00:00 2001 From: eabdullin Date: Tue, 6 Jan 2026 17:19:03 +0000 Subject: [PATCH] import UBI mariadb10.11-10.11.15-1.el10_1 --- .gitignore | 2 +- mariadb.tmpfiles.d.in | 5 ++ mariadb10.11.spec | 131 +++++++++++++++++++++++++----------------- pcre_bundling.patch | 15 +++++ sources | 2 +- 5 files changed, 101 insertions(+), 54 deletions(-) create mode 100644 pcre_bundling.patch diff --git a/.gitignore b/.gitignore index 7d430eb..9f7c56e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ fmt-11.0.2.zip -mariadb-10.11.11.tar.gz +mariadb-10.11.15.tar.gz diff --git a/mariadb.tmpfiles.d.in b/mariadb.tmpfiles.d.in index 9e6b6e8..e59968a 100644 --- a/mariadb.tmpfiles.d.in +++ b/mariadb.tmpfiles.d.in @@ -1,3 +1,8 @@ # Do not edit this file. # To override this, put /etc/tmpfiles.d/mariadb.conf instead. d @PID_FILE_DIR@ 0755 mysql mysql - + +# Rules for ephemeral file systems (ImageMode) +d /var/lib/mysql 0755 mysql mysql - +d /var/log/mariadb 0750 mysql mysql - +f /var/log/mariadb/mariadb.log 0660 mysql mysql - diff --git a/mariadb10.11.spec b/mariadb10.11.spec index d841c32..927fb33 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -1,6 +1,6 @@ # Plain package name for cases, where %%{name} differs (e.g. for versioned packages) %global majorname mariadb -%define package_version 10.11.11 +%define package_version 10.11.15 %define majorversion %(echo %{package_version} | cut -d'.' -f1-2 ) # Set if this package will be the default one in distribution @@ -15,7 +15,7 @@ # The last version on which the full testsuite has been run # In case of further rebuilds of that version, don't require full testsuite to be run # run only "main" suite -%global last_tested_version 10.11.11 +%global last_tested_version 10.11.15 # Set to 1 to force run the testsuite even if it was already tested in current version %global force_run_testsuite 0 @@ -116,12 +116,8 @@ # MariaDB 10.0 and later requires pcre >= 10.34, otherwise we need to use # the bundled library, since the package cannot be build with older version # https://mariadb.com/kb/en/pcre/ -%if 0%{?fedora} || 0%{?rhel} > 8 -%bcond_without unbundled_pcre -%else %bcond_with unbundled_pcre -%global pcre_bundled_version 10.44 -%endif +%global pcre_bundled_version 10.46 # To avoid issues with a breaking change in FMT library, bundle it on systems where FMT wasn't fixed yet # See mariadb-libfmt.patch for detailed description. @@ -223,6 +219,8 @@ Patch12: rocksdb-6.8-gcc13.patch Patch13: %{majorname}-libfmt.patch # Patch14: make MTR port calculation reasonably predictable Patch14: %{majorname}-mtr.patch +# Patch15: fix bundled pcre version to 10.46 because of CVE-2025-58050 +Patch15: pcre_bundling.patch # This macro is used for package/sub-package names in the entire specfile %if %?mariadb_default @@ -331,10 +329,10 @@ Recommends: %{pkgname}-client-utils Suggests: %{pkgname}-server%{?_isa} = %{sameevr} -%{?with_conflicts_mysql:Conflicts: mysql} +%{?with_conflicts_mysql:Conflicts: mysql-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql} # Explicitly disallow combination mariadb + mysql-server -%{?with_conflicts_mysql:Conflicts: mysql-server} +%{?with_conflicts_mysql:Conflicts: mysql-server-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-server} %define conflict_with_other_streams() %{expand:\ @@ -366,13 +364,14 @@ a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. +%if %?mariadb_default %description -n %{pkgname} MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. - +%endif %package -n %{pkgname}-client-utils Summary: Non-essential client utilities for MariaDB/MySQL applications @@ -395,7 +394,7 @@ Requires: %{pkgname}-common = %{sameevr} %virtual_conflicts_and_provides libs -%{?with_conflicts_mysql:Conflicts: mysql-libs} +%{?with_conflicts_mysql:Conflicts: mysql-libs-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-libs} %description -n %{pkgname}-libs @@ -543,11 +542,13 @@ Requires: systemd %{?systemd_requires} # RHBZ#1496131; use 'iproute' instead of 'net-tools' Requires: iproute +# The 'wsrep_sst_common' and 'wsrep_sst_rsync_tunnel' calls 'which' utility +%{?with_galera:Requires: which} -%{?with_conflicts_mysql:Conflicts: mysql-server} +%{?with_conflicts_mysql:Conflicts: mysql-server-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-server} # Explicitly disallow combination mariadb-server + mysql -%{?with_conflicts_mysql:Conflicts: mysql} +%{?with_conflicts_mysql:Conflicts: mysql-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql} %description -n %{pkgname}-server @@ -616,6 +617,7 @@ For InnoDB, "hot online" backups are possible. Summary: The RocksDB storage engine for MariaDB Requires: %{pkgname}-server%{?_isa} = %{sameevr} Provides: bundled(rocksdb) +Conflicts: rocksdb-tools %virtual_conflicts_and_provides rocksdb-engine @@ -716,7 +718,7 @@ Requires: perl(DBI) perl(DBD::MariaDB) %virtual_conflicts_and_provides server-utils -%{?with_conflicts_mysql:Conflicts: mysql-server} +%{?with_conflicts_mysql:Conflicts: mysql-server-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-server} %description -n %{pkgname}-server-utils @@ -737,7 +739,7 @@ Requires: mariadb-connector-c-devel >= 3.0 %virtual_conflicts_and_provides devel -%{?with_conflicts_mysql:Conflicts: mysql-devel} +%{?with_conflicts_mysql:Conflicts: mysql-devel-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-devel} %description -n %{pkgname}-devel @@ -810,7 +812,7 @@ Requires: perl(Time::HiRes) %virtual_conflicts_and_provides test -%{?with_conflicts_mysql:Conflicts: mysql-test} +%{?with_conflicts_mysql:Conflicts: mysql-test-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-test} %description -n %{pkgname}-test @@ -840,7 +842,7 @@ mv %{SOURCE1} redhat-linux-build/extra/libfmt/ # Remove JAR files that upstream puts into tarball find . -name "*.jar" -type f -exec rm --verbose -f {} \; # Remove testsuite for the mariadb-connector-c -rm -rf libmariadb/unittest +rm -r libmariadb/unittest %if %{without rocksdb} rm -r storage/rocksdb/ %endif @@ -857,6 +859,9 @@ rm -r storage/rocksdb/ %endif %patch -P14 -p1 +%if %{without unbundled_pcre} +%patch -P15 -p1 +%endif # generate a list of tests that fail, but are not disabled by upstream cat %{SOURCE50} | tee -a mysql-test/unstable-tests @@ -877,6 +882,12 @@ cat %{SOURCE53} | tee -a mysql-test/unstable-tests cp %{SOURCE2} %{SOURCE3} %{SOURCE10} %{SOURCE11} %{SOURCE12} \ %{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE18} %{SOURCE70} %{SOURCE73} scripts +# Create a sysusers.d config file +# We no longer enforce the hardcoded UID/GID 27. +cat > support-files/%{name}.sysusers.conf << EOF +u mysql 27 'MariaDB and MySQL Server' %{dbdatadir} - +EOF + %if %{with galera} # prepare selinux policy mkdir selinux @@ -885,7 +896,7 @@ sed 's/mariadb-server-galera/%{majorname}-server-galera/' %{SOURCE72} > selinux/ # Get version of PCRE, that upstream use -pcre_version=`grep -e "https://github.com/PCRE2Project/pcre2/releases/download" cmake/pcre.cmake | sed -r "s;.*pcre2-([[:digit:]]+\.[[:digit:]]+).*;\1;" ` +pcre_version=`grep -e "URL \"" cmake/pcre.cmake | sed -r "s;.*pcre2-([[:digit:]]+\.[[:digit:]]+).*;\1;" ` # Check if the PCRE version in macro 'pcre_bundled_version', used in Provides: bundled(...), is the same version as upstream actually bundles %if %{without unbundled_pcre} @@ -915,6 +926,27 @@ fi fi %endif + +# Adjust the compliation flags: +# First initialize the distribution default values +%{set_build_flags} +# Add custom tweaks +CFLAGS="$CFLAGS -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE" +# Force the 'PIC' mode so that we can build libmysqld.so +CFLAGS="$CFLAGS -fPIC" + +# When making a debug build, remove all optimizations +%if %{with debug} +# -D_FORTIFY_SOURCE requires optimizations enabled. Disable the fortify. +%undefine _fortify_level +CFLAGS=`echo "$CFLAGS" | sed -r 's/-O[0123]//'` +CFLAGS="$CFLAGS -O0 -g" +%endif + +# Apply the updated values +CXXFLAGS="$CFLAGS"; CPPFLAGS="$CFLAGS"; export CFLAGS CXXFLAGS CPPFLAGS + + # The INSTALL_xxx macros have to be specified relative to CMAKE_INSTALL_PREFIX # so we can't use %%{_datadir} and so forth here. %cmake \ @@ -972,6 +1004,7 @@ fi -DPLUGIN_SPHINX=%{?with_sphinx:DYNAMIC}%{!?with_sphinx:NO} \ -DPLUGIN_CONNECT=%{?with_connect:DYNAMIC}%{!?with_connect:NO} \ -DPLUGIN_S3=%{?with_s3:DYNAMIC}%{!?with_s3:NO} \ + -DPLUGIN_AUTH_GSSAPI=%{?with_gssapi:DYNAMIC}%{!?with_gssapi:NO} \ -DPLUGIN_AUTH_PAM=%{?with_pam:YES}%{!?with_pam:NO} \ -DPLUGIN_AUTH_PAM_V1=%{?with_pam:DYNAMIC}%{!?with_pam:NO} \ -DPLUGIN_COLUMNSTORE=NO \ @@ -987,35 +1020,8 @@ fi # The issue is that the MariaDB upstream level of hardening is lower than expected by Red Hat # We disable this option to the default compilation flags (which have higher level of hardening) will be used - -CFLAGS="$CFLAGS -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE" -# force PIC mode so that we can build libmysqld.so -CFLAGS="$CFLAGS -fPIC" - -%if %{with debug} -# Override all optimization flags when making a debug build -# -D_FORTIFY_SOURCE requires optimizations enabled. Disable the fortify. -%undefine _fortify_level -CFLAGS=`echo "$CFLAGS" | sed -r 's/-O[0123]//'` - -CFLAGS="$CFLAGS -O0 -g" - -# Fixes for Fedora 32 & Rawhide (GCC 10.0): -%if 0%{?fedora} >= 32 -CFLAGS="$CFLAGS -Wno-error=class-memaccess" -CFLAGS="$CFLAGS -Wno-error=enum-conversion" -# endif f32 -%endif -# endif debug -%endif - -CXXFLAGS="$CFLAGS" -CPPFLAGS="$CFLAGS" -export CFLAGS CXXFLAGS CPPFLAGS - - -# Print all Cmake options values; "-LAH" means "List Advanced Help" -cmake -B %{_vpath_builddir} -LAH +# Print all cached CMake options values; "-N" means to run in read-only mode; "-LAH" means "List Advanced Help" for each option +cmake -B %{_vpath_builddir} -N -LAH %cmake_build @@ -1078,9 +1084,6 @@ mv %{buildroot}%{_sysconfdir}/my.cnf.d/server.cnf %{buildroot}%{_sysconfdir}/my. rm %{buildroot}%{_libexecdir}/rcmysql # Remove upstream Systemd service files rm -r %{buildroot}%{_datadir}/%{majorname}/systemd -# Our downstream Systemd service file have set aliases to the "mysql" names in the [Install] section. -# They can be enabled / disabled by "systemctl enable / diable " -rm %{buildroot}%{_unitdir}/{mysql,mysqld}.service # install systemd unit files and scripts for handling server startup install -D -p -m 644 %{_vpath_builddir}/scripts/mysql.service %{buildroot}%{_unitdir}/%{daemon_name}.service @@ -1094,7 +1097,9 @@ install -p -m 644 %{_vpath_builddir}/scripts/mariadb-scripts-common %{buildroot} # Install downstream version of tmpfiles install -D -p -m 0644 %{_vpath_builddir}/scripts/mariadb.tmpfiles.d %{buildroot}%{_tmpfilesdir}/%{majorname}.conf -echo "d %{pidfiledir} 0755 mysql mysql -" >>%{buildroot}%{_tmpfilesdir}/%{majorname}.conf + +# Install downstream version of sysusers.d config +install -m0644 -D support-files/%{name}.sysusers.conf %{buildroot}%{_sysusersdir}/%{majorname}.conf # Install additional cracklib selinux policy %if %{with cracklib} @@ -1211,7 +1216,7 @@ unlink %{buildroot}%{_libdir}/libmariadb.so rm %{buildroot}%{_mandir}/man3/* # Client plugins rm %{buildroot}%{_libdir}/%{majorname}/plugin/{dialog.so,mysql_clear_password.so,sha256_password.so} -%if %{with gssapi} +%if %{with gssapi} || %{with hashicorp} rm %{buildroot}%{_libdir}/%{majorname}/plugin/auth_gssapi_client.so %endif %endif @@ -1654,6 +1659,7 @@ fi # More on socket activation or extra port service at # https://mariadb.com/kb/en/systemd/ %{_unitdir}/%{daemon_name}.service +%{_unitdir}/mysql{,d}.service %{_unitdir}/%{daemon_name}@.service %{_unitdir}/%{daemon_name}.socket %{_unitdir}/%{daemon_name}@.socket @@ -1666,6 +1672,7 @@ fi %{_libexecdir}/mariadb-check-upgrade %{_libexecdir}/mariadb-scripts-common +# Remember to also update the mariadb.tmpfiles.d.in file when updating these permissions %attr(0755,mysql,mysql) %dir %{pidfiledir} %attr(0755,mysql,mysql) %dir %{dbdatadir} %attr(0750,mysql,mysql) %dir %{logfiledir} @@ -1805,6 +1812,26 @@ fi %endif %changelog +* Mon Dec 01 2025 Petr Khartskhaev - 3:10.11.15-1 +- Rebase to 10.11.15 +- Resolves: RHBZ#2417697 + +* Wed Nov 19 2025 Petr Khartskhaev - 3:10.11.14-3 +- Add installation of downstream sysusers.d config file in place of the upstream one + +* Wed Oct 29 2025 Nikola Davidova - 3:10.11.14-3 +- Bump release for tmpfiles.d change + +* Mon Oct 27 2025 Lukas Javorsky - 3:10.11.14-2 +- Revert to soft static allocation of MariaDB and MySQL sysusers.d files + +* Tue Aug 12 2025 Pavol Sloboda - 3:10.11.14-1 +- Rebase to 10.11.14 +- Resolves: RHBZ#2386961 + +* Fri Jun 06 2025 Pavol Sloboda - 3:10.11.13-1 +- Rebase to 10.11.13 + * Fri Feb 07 2025 Michal Schorm - 3:10.11.11-1 - Rebase to 10.11.11 diff --git a/pcre_bundling.patch b/pcre_bundling.patch new file mode 100644 index 0000000..1ad84c9 --- /dev/null +++ b/pcre_bundling.patch @@ -0,0 +1,15 @@ +diff --git a/cmake/pcre.cmake b/cmake/pcre.cmake +index 08353e92..fc869ba9 100644 +--- a/cmake/pcre.cmake ++++ b/cmake/pcre.cmake +@@ -64,8 +64,8 @@ MACRO(BUNDLE_PCRE2) + ExternalProject_Add( + pcre2 + PREFIX "${dir}" +- URL "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.45/pcre2-10.45.zip" +- URL_MD5 873da56c6469ec207ca5c5ae9688b83a ++ URL "file:///${dir}/pcre2-10.46.zip" ++ URL_MD5 261f3f9e14b6ce175103c5118a189faa + INSTALL_COMMAND "" + CMAKE_ARGS + "-DCMAKE_WARN_DEPRECATED=FALSE" diff --git a/sources b/sources index a7605d2..4c96ae1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (fmt-11.0.2.zip) = 06eba9a2a8d1c2269801e10a00ed26a9344b79bca0391a6b10f35e9716682f8345125fceb96e9ca36ffbd4c0558b0e63e4c45a9dff09a8ee186458ec68e34198 -SHA512 (mariadb-10.11.11.tar.gz) = d9c154207a9f435ce08d5fbfe31814a739e577c656ef9996cf7e60c2cad8b4c07e2de8d94b6191fefa2b5cbde56437b586f85f144d3b4fcec8533449ed8411ac +SHA512 (mariadb-10.11.15.tar.gz) = 98d1e54954b69cf87a96be7d76f80333f27832a29279e6b0a9615b830e171713222abcb9ec9b9a545c0fc4a0f9f8e3d4774babcabf534a6fa3cb3dfdaed0dedc