From c836d824a5675f559b40ddf4a42d21f4b1461e6e Mon Sep 17 00:00:00 2001 From: Pavol Sloboda Date: Fri, 6 Jun 2025 10:47:56 +0200 Subject: [PATCH 01/17] Rebase to 10.11.13 Release notes: https://mariadb.com/kb/en/mariadb-10-11-13-release-notes/ Changlelog: https://mariadb.com/kb/en/mariadb-10-11-13-changelog/ Resolves: RHEL-80164 Resolves: https://gitlab.com/redhat/centos-stream/rpms/mariadb10.11/-/merge_requests/11 --- mariadb10.11.spec | 7 +++++-- sources | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index d841c32..b5a0482 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -1,6 +1,6 @@ # Plain package name for cases, where %%{name} differs (e.g. for versioned packages) %global majorname mariadb -%define package_version 10.11.11 +%define package_version 10.11.13 %define majorversion %(echo %{package_version} | cut -d'.' -f1-2 ) # Set if this package will be the default one in distribution @@ -15,7 +15,7 @@ # The last version on which the full testsuite has been run # In case of further rebuilds of that version, don't require full testsuite to be run # run only "main" suite -%global last_tested_version 10.11.11 +%global last_tested_version 10.11.13 # Set to 1 to force run the testsuite even if it was already tested in current version %global force_run_testsuite 0 @@ -1805,6 +1805,9 @@ fi %endif %changelog +* Fri Jun 06 2025 Pavol Sloboda - 3:10.11.13-1 +- Rebase to 10.11.13 + * Fri Feb 07 2025 Michal Schorm - 3:10.11.11-1 - Rebase to 10.11.11 diff --git a/sources b/sources index 4eb0c10..5b0f312 100755 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (mariadb-10.11.11.tar.gz) = d9c154207a9f435ce08d5fbfe31814a739e577c656ef9996cf7e60c2cad8b4c07e2de8d94b6191fefa2b5cbde56437b586f85f144d3b4fcec8533449ed8411ac +SHA512 (mariadb-10.11.13.tar.gz) = 4eff7f30fdbfdbeafb6c708262a89bcb2065261c384b5b027720dd7a7a7dc79ecbdb70339aec05c813d7991c3807af09c300841e731e5c925a1adf5b3fcd0580 SHA512 (fmt-11.0.2.zip) = 06eba9a2a8d1c2269801e10a00ed26a9344b79bca0391a6b10f35e9716682f8345125fceb96e9ca36ffbd4c0558b0e63e4c45a9dff09a8ee186458ec68e34198 From a46c31310a1922e97aeb46160e7f013f93e2c800 Mon Sep 17 00:00:00 2001 From: Michal Schorm Date: Thu, 15 May 2025 15:36:48 +0200 Subject: [PATCH 02/17] [bugfix] Add Requires to 'which' for the server. The 'wsrep_sst_common' and 'wsrep_sst_rsync_tunnel' scripts requires 'which' utility https://github.com/MariaDB/server/blob/main/scripts/wsrep_sst_common.sh#L39 https://src.fedoraproject.org/rpms/mariadb10.11/blob/rawhide/f/wsrep_sst_rsync_tunnel#_94 --- mariadb10.11.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index b5a0482..9f4277d 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -543,6 +543,8 @@ Requires: systemd %{?systemd_requires} # RHBZ#1496131; use 'iproute' instead of 'net-tools' Requires: iproute +# The 'wsrep_sst_common' and 'wsrep_sst_rsync_tunnel' calls 'which' utility +%{?with_galera:Requires: which} %{?with_conflicts_mysql:Conflicts: mysql-server} %{?with_conflicts_community_mysql:Conflicts: community-mysql-server} From b703671d0a1e710b066f69d744e2829565112529 Mon Sep 17 00:00:00 2001 From: Michal Schorm Date: Sat, 3 May 2025 08:18:34 +0200 Subject: [PATCH 03/17] [packaging enahncement] Remove 'force' from 'rm -rf', to be be notified of unexpected changes in the removed files --- mariadb10.11.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index 9f4277d..f7a2928 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -842,7 +842,7 @@ mv %{SOURCE1} redhat-linux-build/extra/libfmt/ # Remove JAR files that upstream puts into tarball find . -name "*.jar" -type f -exec rm --verbose -f {} \; # Remove testsuite for the mariadb-connector-c -rm -rf libmariadb/unittest +rm -r libmariadb/unittest %if %{without rocksdb} rm -r storage/rocksdb/ %endif From df8c149e1f966b7561a1fa3c28ef61ecaee8b14b Mon Sep 17 00:00:00 2001 From: Michal Schorm Date: Thu, 29 May 2025 15:13:56 +0200 Subject: [PATCH 04/17] [packaging enhancement] Pack the symlinks to the mariadb systemd service so that the user can access it using the 'mysql.service' and 'mysqld.service' names even before the first call of 'systemctl enable mariadb.service' which creates the symlinks. This has been consulted with the systemd team and approved by them. The update is acutally a mirror of what MariaDB upstream is doing in their RPMs. --- mariadb10.11.spec | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index f7a2928..4aaafb3 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -1080,9 +1080,6 @@ mv %{buildroot}%{_sysconfdir}/my.cnf.d/server.cnf %{buildroot}%{_sysconfdir}/my. rm %{buildroot}%{_libexecdir}/rcmysql # Remove upstream Systemd service files rm -r %{buildroot}%{_datadir}/%{majorname}/systemd -# Our downstream Systemd service file have set aliases to the "mysql" names in the [Install] section. -# They can be enabled / disabled by "systemctl enable / diable " -rm %{buildroot}%{_unitdir}/{mysql,mysqld}.service # install systemd unit files and scripts for handling server startup install -D -p -m 644 %{_vpath_builddir}/scripts/mysql.service %{buildroot}%{_unitdir}/%{daemon_name}.service @@ -1656,6 +1653,7 @@ fi # More on socket activation or extra port service at # https://mariadb.com/kb/en/systemd/ %{_unitdir}/%{daemon_name}.service +%{_unitdir}/mysql{,d}.service %{_unitdir}/%{daemon_name}@.service %{_unitdir}/%{daemon_name}.socket %{_unitdir}/%{daemon_name}@.socket From ad10e0311daa168a59a7d3961ba71c5b00fda1dd Mon Sep 17 00:00:00 2001 From: Michal Schorm Date: Tue, 29 Apr 2025 15:16:38 +0200 Subject: [PATCH 05/17] [bugfix] Fixup of the versioned package layout control code --- mariadb10.11.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index 4aaafb3..de582af 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -366,13 +366,14 @@ a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. +%if %?mariadb_default %description -n %{pkgname} MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. - +%endif %package -n %{pkgname}-client-utils Summary: Non-essential client utilities for MariaDB/MySQL applications From 69f2e2a9fd05c86adc2439c7701fc0e677770040 Mon Sep 17 00:00:00 2001 From: Michal Schorm Date: Thu, 12 Jun 2025 10:17:55 +0200 Subject: [PATCH 06/17] [SPECfile bugfix] Fix the control code for the GSSAPI plugin - we were missing the CMake control variable - I also discovered that the build of the gssapi client plugin - which we remove, since it is shipped as a part of the 'mariadb-connector-c' package in Fedora, is somehow also controlled bz the build of the hashicorp plugin. Need further examination. --- mariadb10.11.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index de582af..0afb9f4 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -975,6 +975,7 @@ fi -DPLUGIN_SPHINX=%{?with_sphinx:DYNAMIC}%{!?with_sphinx:NO} \ -DPLUGIN_CONNECT=%{?with_connect:DYNAMIC}%{!?with_connect:NO} \ -DPLUGIN_S3=%{?with_s3:DYNAMIC}%{!?with_s3:NO} \ + -DPLUGIN_AUTH_GSSAPI=%{?with_gssapi:DYNAMIC}%{!?with_gssapi:NO} \ -DPLUGIN_AUTH_PAM=%{?with_pam:YES}%{!?with_pam:NO} \ -DPLUGIN_AUTH_PAM_V1=%{?with_pam:DYNAMIC}%{!?with_pam:NO} \ -DPLUGIN_COLUMNSTORE=NO \ @@ -1211,7 +1212,7 @@ unlink %{buildroot}%{_libdir}/libmariadb.so rm %{buildroot}%{_mandir}/man3/* # Client plugins rm %{buildroot}%{_libdir}/%{majorname}/plugin/{dialog.so,mysql_clear_password.so,sha256_password.so} -%if %{with gssapi} +%if %{with gssapi} || %{with hashicorp} rm %{buildroot}%{_libdir}/%{majorname}/plugin/auth_gssapi_client.so %endif %endif From ac4e188a26c4ff4c8ab7d89cf2209dd868e8f2cc Mon Sep 17 00:00:00 2001 From: Michal Schorm Date: Tue, 6 May 2025 21:35:44 +0200 Subject: [PATCH 07/17] [packaging bugfix] Fix the application of the compilation flags I discovered that the second call of "cmake -LAH" further changes the cache. That was definitelly unintended. Applying "-N" to operate in "cache read-only" mode. That however broke the build, since the compilation flags are set up during the "cmake" call. Up until now, the code flow was: 1) %cmake ... 2) 3) cmake -LAH And since the "cmake -LAH" without the "-N" argument changed the cache, it actually applied all the adjustements in the second step. When switched to "-N" mode, the flags failed to be applied, and the build broke. What we actually need to do is to: 1) initialize the compilation flags with the distribution default values 2) adjust the compilation flags 3) %cmake ... 3) cmake -N -LAH This way the compilation flags are correctly applied during the first CMake call, and the CMake cache remains unchanged during the second CMake call. -- The '%cmake' macro contains the '%{set_build_flags}' macro at it's beginning https://src.fedoraproject.org/rpms/cmake/blob/b3bf0e/f/macros.cmake.in#_20 and the '%{set_build_flags}' macro is constructed with the: CFLAGS="${CFLAGS:-...} syntax, which translates to "Use the content of the $CFLAGS variable. If empty, use the following default value: '...' ". So we first need to call the '%{set_build_flags}' macro separately, so we apply the default values. Then we append to them. And then the '%cmake' macro calls the '%{set_build_flags}' macro that finds the existing values, and uses them, instead of the default ones. Resolves: RHEL-93751 --- mariadb10.11.spec | 52 +++++++++++++++++++++-------------------------- 1 file changed, 23 insertions(+), 29 deletions(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index 0afb9f4..3a0a776 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -918,6 +918,27 @@ fi fi %endif + +# Adjust the compliation flags: +# First initialize the distribution default values +%{set_build_flags} +# Add custom tweaks +CFLAGS="$CFLAGS -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE" +# Force the 'PIC' mode so that we can build libmysqld.so +CFLAGS="$CFLAGS -fPIC" + +# When making a debug build, remove all optimizations +%if %{with debug} +# -D_FORTIFY_SOURCE requires optimizations enabled. Disable the fortify. +%undefine _fortify_level +CFLAGS=`echo "$CFLAGS" | sed -r 's/-O[0123]//'` +CFLAGS="$CFLAGS -O0 -g" +%endif + +# Apply the updated values +CXXFLAGS="$CFLAGS"; CPPFLAGS="$CFLAGS"; export CFLAGS CXXFLAGS CPPFLAGS + + # The INSTALL_xxx macros have to be specified relative to CMAKE_INSTALL_PREFIX # so we can't use %%{_datadir} and so forth here. %cmake \ @@ -991,35 +1012,8 @@ fi # The issue is that the MariaDB upstream level of hardening is lower than expected by Red Hat # We disable this option to the default compilation flags (which have higher level of hardening) will be used - -CFLAGS="$CFLAGS -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE" -# force PIC mode so that we can build libmysqld.so -CFLAGS="$CFLAGS -fPIC" - -%if %{with debug} -# Override all optimization flags when making a debug build -# -D_FORTIFY_SOURCE requires optimizations enabled. Disable the fortify. -%undefine _fortify_level -CFLAGS=`echo "$CFLAGS" | sed -r 's/-O[0123]//'` - -CFLAGS="$CFLAGS -O0 -g" - -# Fixes for Fedora 32 & Rawhide (GCC 10.0): -%if 0%{?fedora} >= 32 -CFLAGS="$CFLAGS -Wno-error=class-memaccess" -CFLAGS="$CFLAGS -Wno-error=enum-conversion" -# endif f32 -%endif -# endif debug -%endif - -CXXFLAGS="$CFLAGS" -CPPFLAGS="$CFLAGS" -export CFLAGS CXXFLAGS CPPFLAGS - - -# Print all Cmake options values; "-LAH" means "List Advanced Help" -cmake -B %{_vpath_builddir} -LAH +# Print all cached CMake options values; "-N" means to run in read-only mode; "-LAH" means "List Advanced Help" for each option +cmake -B %{_vpath_builddir} -N -LAH %cmake_build From ac4c828b29c907b616bc74d6ddd24126ef6252bc Mon Sep 17 00:00:00 2001 From: Michal Schorm Date: Tue, 17 Jun 2025 10:36:00 +0200 Subject: [PATCH 08/17] [packaging bugfix] Fix undeclared file conflicts with rocksdb-tools rpmdeplint error: mariadb-rocksdb-engine-3:10.11.13-8.fc43.x86_64 provides /usr/bin/sst_dump which is also provided by rocksdb-tools-10.1.3-1.fc43.x86_64 --- mariadb10.11.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index 3a0a776..b77a2ea 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -619,6 +619,7 @@ For InnoDB, "hot online" backups are possible. Summary: The RocksDB storage engine for MariaDB Requires: %{pkgname}-server%{?_isa} = %{sameevr} Provides: bundled(rocksdb) +Conflicts: rocksdb-tools %virtual_conflicts_and_provides rocksdb-engine From 55c454ec7aa353441943e3191fa8b0c43779e1cd Mon Sep 17 00:00:00 2001 From: Michal Schorm Date: Fri, 1 Aug 2025 09:58:18 +0200 Subject: [PATCH 09/17] Fix the 'Conflicts:' with MySQL packages The package conflicts between MariaDB and MySQL packages are only set against the un-versioned names. (the un-versioned names are only provided by the distribution default version) The conflicts has to be extended to cover the '-any' virtually provided names, which are provided by all versions of the versioned packages. --- mariadb10.11.spec | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index b77a2ea..dbc57d7 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -331,10 +331,10 @@ Recommends: %{pkgname}-client-utils Suggests: %{pkgname}-server%{?_isa} = %{sameevr} -%{?with_conflicts_mysql:Conflicts: mysql} +%{?with_conflicts_mysql:Conflicts: mysql-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql} # Explicitly disallow combination mariadb + mysql-server -%{?with_conflicts_mysql:Conflicts: mysql-server} +%{?with_conflicts_mysql:Conflicts: mysql-server-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-server} %define conflict_with_other_streams() %{expand:\ @@ -396,7 +396,7 @@ Requires: %{pkgname}-common = %{sameevr} %virtual_conflicts_and_provides libs -%{?with_conflicts_mysql:Conflicts: mysql-libs} +%{?with_conflicts_mysql:Conflicts: mysql-libs-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-libs} %description -n %{pkgname}-libs @@ -547,10 +547,10 @@ Requires: iproute # The 'wsrep_sst_common' and 'wsrep_sst_rsync_tunnel' calls 'which' utility %{?with_galera:Requires: which} -%{?with_conflicts_mysql:Conflicts: mysql-server} +%{?with_conflicts_mysql:Conflicts: mysql-server-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-server} # Explicitly disallow combination mariadb-server + mysql -%{?with_conflicts_mysql:Conflicts: mysql} +%{?with_conflicts_mysql:Conflicts: mysql-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql} %description -n %{pkgname}-server @@ -720,7 +720,7 @@ Requires: perl(DBI) perl(DBD::MariaDB) %virtual_conflicts_and_provides server-utils -%{?with_conflicts_mysql:Conflicts: mysql-server} +%{?with_conflicts_mysql:Conflicts: mysql-server-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-server} %description -n %{pkgname}-server-utils @@ -741,7 +741,7 @@ Requires: mariadb-connector-c-devel >= 3.0 %virtual_conflicts_and_provides devel -%{?with_conflicts_mysql:Conflicts: mysql-devel} +%{?with_conflicts_mysql:Conflicts: mysql-devel-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-devel} %description -n %{pkgname}-devel @@ -814,7 +814,7 @@ Requires: perl(Time::HiRes) %virtual_conflicts_and_provides test -%{?with_conflicts_mysql:Conflicts: mysql-test} +%{?with_conflicts_mysql:Conflicts: mysql-test-any} %{?with_conflicts_community_mysql:Conflicts: community-mysql-test} %description -n %{pkgname}-test From 68bc191611d61e6c25af53fc2b6dc3c0626e2a8c Mon Sep 17 00:00:00 2001 From: Pavol Sloboda Date: Tue, 12 Aug 2025 12:44:17 +0200 Subject: [PATCH 10/17] Rebase to 10.11.14 Release notes: https://mariadb.com/docs/release-notes/community-server/mariadb-10-11-series/mariadb-10.11.14-release-notes Changelog: https://mariadb.com/docs/release-notes/community-server/changelogs/changelogs-mariadb-10-11-series/mariadb-10.11.14-changelog Resolves: RHBZ#2386961 --- mariadb10.11.spec | 8 ++++++-- sources | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index dbc57d7..b111a94 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -1,6 +1,6 @@ # Plain package name for cases, where %%{name} differs (e.g. for versioned packages) %global majorname mariadb -%define package_version 10.11.13 +%define package_version 10.11.14 %define majorversion %(echo %{package_version} | cut -d'.' -f1-2 ) # Set if this package will be the default one in distribution @@ -15,7 +15,7 @@ # The last version on which the full testsuite has been run # In case of further rebuilds of that version, don't require full testsuite to be run # run only "main" suite -%global last_tested_version 10.11.13 +%global last_tested_version 10.11.14 # Set to 1 to force run the testsuite even if it was already tested in current version %global force_run_testsuite 0 @@ -1802,6 +1802,10 @@ fi %endif %changelog +* Tue Aug 12 2025 Pavol Sloboda - 3:10.11.14-1 +- Rebase to 10.11.14 +- Resolves: RHBZ#2386961 + * Fri Jun 06 2025 Pavol Sloboda - 3:10.11.13-1 - Rebase to 10.11.13 diff --git a/sources b/sources index 5b0f312..0fc74b0 100755 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (mariadb-10.11.13.tar.gz) = 4eff7f30fdbfdbeafb6c708262a89bcb2065261c384b5b027720dd7a7a7dc79ecbdb70339aec05c813d7991c3807af09c300841e731e5c925a1adf5b3fcd0580 +SHA512 (mariadb-10.11.14.tar.gz) = 24276e8b0f7ad555bf8faab8e5e065cbaeeb5d92b66964e470f41ac00db29a148e36b0f9f8078392a5fdae4cc3e77df28d0a570ef3735a73f4837ded3a50e476 SHA512 (fmt-11.0.2.zip) = 06eba9a2a8d1c2269801e10a00ed26a9344b79bca0391a6b10f35e9716682f8345125fceb96e9ca36ffbd4c0558b0e63e4c45a9dff09a8ee186458ec68e34198 From b0e9e736d7241632178055db79ee0ed849cf5d8d Mon Sep 17 00:00:00 2001 From: Lukas Javorsky Date: Wed, 29 Oct 2025 14:55:34 +0000 Subject: [PATCH 11/17] Revert to soft static allocation of MariaDB and MySQL sysusers.d files Resolves: RHEL-119790 Related PR for `setup` RPM: https://src.fedoraproject.org/rpms/setup/pull-request/30 Reverts commit: 3577147 The MariaDB and MySQL sysusers.d files has to use soft static allocation in order to correctly handle the MariaDB PAM v2 plugin which utilizes setuid-to-root binary "/usr/lib64/mariadb/plugin/auth_pam_tool_dir/auth_pam_tool". --- mariadb10.11.spec | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index b111a94..0624f76 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -157,7 +157,7 @@ Name: %{majorname}%{majorversion} Version: %{package_version} -Release: 1%{?with_debug:.debug}%{?dist} +Release: 2%{?with_debug:.debug}%{?dist} Epoch: 3 Summary: A very fast and robust SQL database server @@ -881,6 +881,12 @@ cat %{SOURCE53} | tee -a mysql-test/unstable-tests cp %{SOURCE2} %{SOURCE3} %{SOURCE10} %{SOURCE11} %{SOURCE12} \ %{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE18} %{SOURCE70} %{SOURCE73} scripts +# Create a sysusers.d config file +# We no longer enforce the hardcoded UID/GID 27. +cat > support-files/%{name}.sysusers.conf << EOF +u mysql 27 'MariaDB and MySQL Server' %{dbdatadir} - +EOF + %if %{with galera} # prepare selinux policy mkdir selinux @@ -1802,6 +1808,9 @@ fi %endif %changelog +* Mon Oct 27 2025 Lukas Javorsky - 3:10.11.14-2 +- Revert to soft static allocation of MariaDB and MySQL sysusers.d files + * Tue Aug 12 2025 Pavol Sloboda - 3:10.11.14-1 - Rebase to 10.11.14 - Resolves: RHBZ#2386961 From 8217a7fb022ee5bd028b060fc7ba5e49612ea9a2 Mon Sep 17 00:00:00 2001 From: Nikola Davidova Date: Wed, 29 Oct 2025 10:46:18 +0100 Subject: [PATCH 12/17] [tmpfiles.d] Extend tmpfiles.d rules for ImageMode After switching to a container image with bootc switch, systemd failed to start MariaDB because required runtime directories were missing or had wrong permissions. Adding tmpfiles entries with correct ownership ensures systemd creates the necessary directories at boot and gives them correct permissions, allowing the MariaDB daemon to start. "In a container build, you can write to '/var'. However, this will have a semantic similar to a Dockerfile VOLUME instruction; the content from the container image is only copied at initial install time. Any subsequent system updates will not by default see new changes. It's recommended instead to use e.g. systemd tmpfiles.d as a way to ensure that newly added state "reconciles" across upgrades as desired." https://docs.fedoraproject.org/en-US/bootc/filesystem/#_filesystem_bind_mount_var This covers all the files in /var sicne we only ship these as can be seen here: find | grep /var/ ./mariadb11.8-server-11.8.2-3.fc43.x86_64.rpm/var/lib ./mariadb11.8-server-11.8.2-3.fc43.x86_64.rpm/var/lib/mysql ./mariadb11.8-server-11.8.2-3.fc43.x86_64.rpm/var/log ./mariadb11.8-server-11.8.2-3.fc43.x86_64.rpm/var/log/mariadb The '/usr' directory is not persistent therefore this change does not affect it and the '/etc' directory is merged in a different way and also not under the 'mysql:mysql' user. --- mariadb.tmpfiles.d.in | 5 +++++ mariadb10.11.spec | 1 + 2 files changed, 6 insertions(+) diff --git a/mariadb.tmpfiles.d.in b/mariadb.tmpfiles.d.in index 9e6b6e8..e59968a 100644 --- a/mariadb.tmpfiles.d.in +++ b/mariadb.tmpfiles.d.in @@ -1,3 +1,8 @@ # Do not edit this file. # To override this, put /etc/tmpfiles.d/mariadb.conf instead. d @PID_FILE_DIR@ 0755 mysql mysql - + +# Rules for ephemeral file systems (ImageMode) +d /var/lib/mysql 0755 mysql mysql - +d /var/log/mariadb 0750 mysql mysql - +f /var/log/mariadb/mariadb.log 0660 mysql mysql - diff --git a/mariadb10.11.spec b/mariadb10.11.spec index 0624f76..034fd73 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -1669,6 +1669,7 @@ fi %{_libexecdir}/mariadb-check-upgrade %{_libexecdir}/mariadb-scripts-common +# Remember to also update the mariadb.tmpfiles.d.in file when updating these permissions %attr(0755,mysql,mysql) %dir %{pidfiledir} %attr(0755,mysql,mysql) %dir %{dbdatadir} %attr(0750,mysql,mysql) %dir %{logfiledir} From 1094151779a6ac38a69ac4750647d698ad107dac Mon Sep 17 00:00:00 2001 From: Nikola Davidova Date: Wed, 29 Oct 2025 10:54:35 +0100 Subject: [PATCH 13/17] Bump release for tmpfiles.d change --- mariadb10.11.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index 034fd73..6b50ade 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -157,7 +157,7 @@ Name: %{majorname}%{majorversion} Version: %{package_version} -Release: 2%{?with_debug:.debug}%{?dist} +Release: 3%{?with_debug:.debug}%{?dist} Epoch: 3 Summary: A very fast and robust SQL database server @@ -1809,6 +1809,9 @@ fi %endif %changelog +* Wed Oct 29 2025 Nikola Davidova - 3:10.11.14-3 +- Bump release for tmpfiles.d change + * Mon Oct 27 2025 Lukas Javorsky - 3:10.11.14-2 - Revert to soft static allocation of MariaDB and MySQL sysusers.d files From 618f2dde18cc723ac1b44684ecb618f70c866915 Mon Sep 17 00:00:00 2001 From: Nikola Davidova Date: Wed, 29 Oct 2025 11:55:17 +0100 Subject: [PATCH 14/17] [tmpfiles.d] Remove duplicate tmpfiles.d entry --- mariadb10.11.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index 6b50ade..17e2302 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -1096,7 +1096,6 @@ install -p -m 644 %{_vpath_builddir}/scripts/mariadb-scripts-common %{buildroot} # Install downstream version of tmpfiles install -D -p -m 0644 %{_vpath_builddir}/scripts/mariadb.tmpfiles.d %{buildroot}%{_tmpfilesdir}/%{majorname}.conf -echo "d %{pidfiledir} 0755 mysql mysql -" >>%{buildroot}%{_tmpfilesdir}/%{majorname}.conf # Install additional cracklib selinux policy %if %{with cracklib} From ce6bf1f438b3e7813244db20206f841f4c3fe297 Mon Sep 17 00:00:00 2001 From: Petr Khartskhaev Date: Wed, 19 Nov 2025 12:21:31 +0100 Subject: [PATCH 15/17] Add installation of downstream sysusers.d config file In downstream commit 1926e2685d884ba468783417f77b0c4b57882f84, we reverted from using unenforced UID/GIDs to enforced ones to 27. In order to do this, I need to install the sysusers.d config file instead of the upstream MariaDB one. This was already added in Fedora commit ee5c679bb34335cab8b9878696f0d8604223f91f that never got into RHEL. --- mariadb10.11.spec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mariadb10.11.spec b/mariadb10.11.spec index 17e2302..a3444c3 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -1097,6 +1097,9 @@ install -p -m 644 %{_vpath_builddir}/scripts/mariadb-scripts-common %{buildroot} # Install downstream version of tmpfiles install -D -p -m 0644 %{_vpath_builddir}/scripts/mariadb.tmpfiles.d %{buildroot}%{_tmpfilesdir}/%{majorname}.conf +# Install downstream version of sysusers.d config +install -m0644 -D support-files/%{name}.sysusers.conf %{buildroot}%{_sysusersdir}/%{majorname}.conf + # Install additional cracklib selinux policy %if %{with cracklib} mkdir -p %{buildroot}%{_datadir}/selinux/packages/targeted/ @@ -1808,6 +1811,9 @@ fi %endif %changelog +* Wed Nov 19 2025 Petr Khartskhaev - 3:10.11.14-3 +- Add installation of downstream sysusers.d config file in place of the upstream one + * Wed Oct 29 2025 Nikola Davidova - 3:10.11.14-3 - Bump release for tmpfiles.d change From 3a73ef72db8b1460c9152a024a9acb5a13a52b3e Mon Sep 17 00:00:00 2001 From: Petr Khartskhaev Date: Tue, 25 Nov 2025 12:07:05 +0100 Subject: [PATCH 16/17] Add gating.yaml and required new test files, deleted old tests --- ci.fmf | 1 + gating.yaml | 4 +- plans.fmf | 19 +++++++++ plans/tier1-internal.fmf | 10 ----- tests/basic_service/Makefile | 62 ----------------------------- tests/basic_service/PURPOSE | 3 -- tests/basic_service/runtest.sh | 72 ---------------------------------- tests/tests.yml | 30 -------------- 8 files changed, 22 insertions(+), 179 deletions(-) create mode 100644 ci.fmf create mode 100644 plans.fmf delete mode 100644 plans/tier1-internal.fmf delete mode 100644 tests/basic_service/Makefile delete mode 100644 tests/basic_service/PURPOSE delete mode 100755 tests/basic_service/runtest.sh delete mode 100644 tests/tests.yml diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate diff --git a/gating.yaml b/gating.yaml index af54d4f..ef0472f 100644 --- a/gating.yaml +++ b/gating.yaml @@ -3,5 +3,5 @@ product_versions: - rhel-10 decision_context: osci_compose_gate rules: - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} - - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/rhel-gating.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/centos-stream} diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..c551275 --- /dev/null +++ b/plans.fmf @@ -0,0 +1,19 @@ +/rhel-gating: + plan: + import: + url: https://pkgs.devel.redhat.com/git/tests/mariadb + name: /plans/versioned/mariadb10.11/gating + +/rhel-no-gating: + plan: + import: + url: https://pkgs.devel.redhat.com/git/tests/mariadb + name: /plans/versioned/mariadb10.11/no-gating + +/centos-stream: + environment: + BUILD_PACKAGE: mariadb-server + plan: + import: + url: https://gitlab.com/redhat/centos-stream/tests/mariadb + name: /plans/versioned/base-package diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf deleted file mode 100644 index d46bbf3..0000000 --- a/plans/tier1-internal.fmf +++ /dev/null @@ -1,10 +0,0 @@ -summary: Internal Tier1 tests plan -discover: - how: fmf - filter: 'tier: 1' - url: https://pkgs.devel.redhat.com/git/tests/mariadb55 -execute: - how: tmt -adjust: - enabled: false - when: distro == centos-stream or distro == fedora diff --git a/tests/basic_service/Makefile b/tests/basic_service/Makefile deleted file mode 100644 index 838ac65..0000000 --- a/tests/basic_service/Makefile +++ /dev/null @@ -1,62 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/tests/Sanity/basic_service -# Description: The very basic service testing -# Author: Michal Schorm -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2018 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=basic_service -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Michal Schorm " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: The very basic service testing" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: mariadb" >> $(METADATA) - @echo "Requires: mariadb" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - - rhts-lint $(METADATA) diff --git a/tests/basic_service/PURPOSE b/tests/basic_service/PURPOSE deleted file mode 100644 index 2f49e4c..0000000 --- a/tests/basic_service/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of basic_service -Description: The very basic service testing -Author: Michal Schorm diff --git a/tests/basic_service/runtest.sh b/tests/basic_service/runtest.sh deleted file mode 100755 index c4b0a17..0000000 --- a/tests/basic_service/runtest.sh +++ /dev/null @@ -1,72 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of basic_service -# Description: The very basic service testing -# Author: Michal Schorm -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2018 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="mariadb" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "systemctl stop mariadb" - rlRun "pushd $TmpDir" - rlPhaseEnd - - - - rlPhaseStartTest - rlRun "systemctl -q status mariadb" 3 "Test status of dead service" - rlRun "systemctl -q start mariadb" 0 "Start mariadb service" - rlRun "systemctl -q status mariadb" 0 "Test status of running mariadb service" - rlPhaseEnd - - rlPhaseStartTest - rlRun "systemctl -q restart mariadb" 0 "Restart running mariadb service" - rlRun "systemctl -q status mariadb" 0 "Test status of running mariadb service" - rlPhaseEnd - - rlPhaseStartTest - rlRun "systemctl -q stop mariadb" 0 "Stop mariadb service" - rlRun "systemctl -q status mariadb" 3 "Test status of dead mariadb service" - rlPhaseEnd - - rlPhaseStartTest - rlRun "systemctl -q start mariadb" 0 "Start mariadb service" - rlRun "systemctl -q status mariadb" 0 "Test status of running mariadb service" - rlPhaseEnd - - - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index c2139ea..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,30 +0,0 @@ ---- - -# -------------------------------------------------- -# This is an experiment with Fedora CI -# -# Refer to: -# https://fedoraproject.org/wiki/CI/Tests -# -# TL;DR you have to, as root: -# 1) # dnf install ansible python2-dnf libselinux-python standard-test-roles -# 2) install the packages to be tested -# 3) # ansible-playbook tests.yml -# -# Warning !! -# DO NOT run it on a machine that SHOULD NOT be destroyed. -# -# -------------------------------------------------- - -# Tests that run in classic context -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - basic_service - required_packages: - - mariadb - - From 3141c41b9fe95d0bbc9669be38f76511a14d5fa6 Mon Sep 17 00:00:00 2001 From: Petr Khartskhaev Date: Wed, 26 Nov 2025 12:44:38 +0100 Subject: [PATCH 17/17] Enable bundling pcre2 and bump its version to 10.46 MariaDB upstream bundles pcre2 version 10.45 in 10.11.14 and .15, which is not in RHEL9 (has pcre2 10.40) or RHEL10 (has pcre2 10.44). Therefore, we need to bundle it in mariadb. Unfortunately, 10.45 has CVE-2025-58050 (critical), so I bumped it to 10.46 which should only contain the fix and no extra features. --- mariadb10.11.spec | 13 +++++++------ pcre_bundling.patch | 15 +++++++++++++++ sources | 1 + 3 files changed, 23 insertions(+), 6 deletions(-) create mode 100644 pcre_bundling.patch diff --git a/mariadb10.11.spec b/mariadb10.11.spec index a3444c3..4727546 100644 --- a/mariadb10.11.spec +++ b/mariadb10.11.spec @@ -116,12 +116,8 @@ # MariaDB 10.0 and later requires pcre >= 10.34, otherwise we need to use # the bundled library, since the package cannot be build with older version # https://mariadb.com/kb/en/pcre/ -%if 0%{?fedora} || 0%{?rhel} > 8 -%bcond_without unbundled_pcre -%else %bcond_with unbundled_pcre -%global pcre_bundled_version 10.44 -%endif +%global pcre_bundled_version 10.46 # To avoid issues with a breaking change in FMT library, bundle it on systems where FMT wasn't fixed yet # See mariadb-libfmt.patch for detailed description. @@ -223,6 +219,8 @@ Patch12: rocksdb-6.8-gcc13.patch Patch13: %{majorname}-libfmt.patch # Patch14: make MTR port calculation reasonably predictable Patch14: %{majorname}-mtr.patch +# Patch15: fix bundled pcre version to 10.46 because of CVE-2025-58050 +Patch15: pcre_bundling.patch # This macro is used for package/sub-package names in the entire specfile %if %?mariadb_default @@ -861,6 +859,9 @@ rm -r storage/rocksdb/ %endif %patch -P14 -p1 +%if %{without unbundled_pcre} +%patch -P15 -p1 +%endif # generate a list of tests that fail, but are not disabled by upstream cat %{SOURCE50} | tee -a mysql-test/unstable-tests @@ -895,7 +896,7 @@ sed 's/mariadb-server-galera/%{majorname}-server-galera/' %{SOURCE72} > selinux/ # Get version of PCRE, that upstream use -pcre_version=`grep -e "https://github.com/PCRE2Project/pcre2/releases/download" cmake/pcre.cmake | sed -r "s;.*pcre2-([[:digit:]]+\.[[:digit:]]+).*;\1;" ` +pcre_version=`grep -e "URL \"" cmake/pcre.cmake | sed -r "s;.*pcre2-([[:digit:]]+\.[[:digit:]]+).*;\1;" ` # Check if the PCRE version in macro 'pcre_bundled_version', used in Provides: bundled(...), is the same version as upstream actually bundles %if %{without unbundled_pcre} diff --git a/pcre_bundling.patch b/pcre_bundling.patch new file mode 100644 index 0000000..1ad84c9 --- /dev/null +++ b/pcre_bundling.patch @@ -0,0 +1,15 @@ +diff --git a/cmake/pcre.cmake b/cmake/pcre.cmake +index 08353e92..fc869ba9 100644 +--- a/cmake/pcre.cmake ++++ b/cmake/pcre.cmake +@@ -64,8 +64,8 @@ MACRO(BUNDLE_PCRE2) + ExternalProject_Add( + pcre2 + PREFIX "${dir}" +- URL "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.45/pcre2-10.45.zip" +- URL_MD5 873da56c6469ec207ca5c5ae9688b83a ++ URL "file:///${dir}/pcre2-10.46.zip" ++ URL_MD5 261f3f9e14b6ce175103c5118a189faa + INSTALL_COMMAND "" + CMAKE_ARGS + "-DCMAKE_WARN_DEPRECATED=FALSE" diff --git a/sources b/sources index 0fc74b0..ac4f970 100755 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (mariadb-10.11.14.tar.gz) = 24276e8b0f7ad555bf8faab8e5e065cbaeeb5d92b66964e470f41ac00db29a148e36b0f9f8078392a5fdae4cc3e77df28d0a570ef3735a73f4837ded3a50e476 SHA512 (fmt-11.0.2.zip) = 06eba9a2a8d1c2269801e10a00ed26a9344b79bca0391a6b10f35e9716682f8345125fceb96e9ca36ffbd4c0558b0e63e4c45a9dff09a8ee186458ec68e34198 +SHA512 (pcre2-10.46.zip) = 1381ba2fe352ba33b90c416c25d2ee057f167fae3ecd9a56743ee2d381fd5793cd65dec07018ed77ce8576eaac993498ad6824cb58bf9fae2f5756881f4a9f9b