Bug 41099 - koha-mysql doesn't work out of the box on Debian 13
Summary: koha-mysql doesn't work out of the box on Debian 13
Status: Passed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Command-line Utilities (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major
Assignee: Tomás Cohen Arazi (tcohen)
QA Contact: Victor Grousset/tuxayo
URL:
Keywords:
Depends on:
Blocks: 40680
  Show dependency treegraph
 
Reported: 2025-10-24 18:45 UTC by Tomás Cohen Arazi (tcohen)
Modified: 2025-10-28 14:09 UTC (History)
5 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Crowdfunding goal: 0
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 41099: Make `koha-mysql` disable SSL if required (1.53 KB, patch)
2025-10-24 18:57 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 41099: Make `koha-mysql` disable SSL if required (1.65 KB, patch)
2025-10-28 01:52 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 41099: Make `koha-mysql` disable SSL if required (1.70 KB, patch)
2025-10-28 03:21 UTC, David Nind
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi (tcohen) 2025-10-24 18:45:33 UTC
The shipped mysql client on Debian 13 has `ssl=on` by default. So, on newer Debian and Ubuntu versions, we would need to add a configuration step for disabling SSL if you're not using it.

I propose we disable it by default in `koha-mysql` as we are already setting `ssl=on` when SSL/TLS is properly configured in Koha (i.e. it is a change that will keep the current behavior, both of them).
Comment 1 Tomás Cohen Arazi (tcohen) 2025-10-24 18:57:18 UTC
Created attachment 188434 [details] [review]
Bug 41099: Make `koha-mysql` disable SSL if required

Now that Debian 13 (and Ubuntu 25.04) set `ssl=on` by default, we should
make the `koha-mysql` helper script disable it by default if not
configured.
This patch does that.
To test:
1. Run:
   $ ktd --shell
  k$ koha-mysql kohadev
=> SUCCESS: You get into the DB shell
2. Apply this patch
3. Run:
  k$ debian/scripts/koha-mysql kohadev
=> SUCCESS: It works as step 1!
4. Make sure you enable SSL in my.cnf:
[client]
ssl = on
5. Repeat 1
=> FAIL: You get an error about SSL in the server being disabled
6. Repeat 4
=> SUCCESS: The patch fixes it!
7. This steps imply we reproduced the issue, and it gets fixed, while
   keeping the current behavior.
8. Sign off :-D
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Comment 2 Tomás Cohen Arazi (tcohen) 2025-10-24 18:57:20 UTC
Now that Debian 13 (and Ubuntu 25.04) set `ssl=on` by default, we should
make the `koha-mysql` helper script disable it by default if not
configured.
This patch does that.
To test:
1. Run:
   $ ktd --shell
  k$ koha-mysql kohadev
=> SUCCESS: You get into the DB shell
2. Apply this patch
3. Run:
  k$ debian/scripts/koha-mysql kohadev
=> SUCCESS: It works as step 1!
4. Make sure you enable SSL in my.cnf:
[client]
ssl = on
5. Repeat 1
=> FAIL: You get an error about SSL in the server being disabled
6. Repeat 4
=> SUCCESS: The patch fixes it!
7. This steps imply we reproduced the issue, and it gets fixed, while
   keeping the current behavior.
8. Sign off :-D
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Comment 3 David Nind 2025-10-25 20:00:46 UTC
For step 3 and 4 of the test plan, do I need to do anything else?

I don't get an SSL failure error.

Using KTD with Debian 12. Do I need to use a Debian 13 image?
Comment 4 Victor Grousset/tuxayo 2025-10-28 01:52:36 UTC
Created attachment 188493 [details] [review]
Bug 41099: Make `koha-mysql` disable SSL if required

Now that Debian 13 (and Ubuntu 25.04) set `ssl=on` by default, we should
make the `koha-mysql` helper script disable it by default if not
configured.

This patch does that.

To test:
0. Start a Debian 13 KTD e.g. with:
   $ KOHA_IMAGE=main-trixie ktd up
1. Run:
   $ ktd --shell
  k$ koha-mysql kohadev
=> SUCCESS: You get into the DB shell
2. Apply this patch
3. Run:
  k$ debian/scripts/koha-mysql kohadev
=> SUCCESS: It works as step 1!
4. Make sure you enable SSL in my.cnf:

[client]
ssl = on

5. Repeat 1
=> FAIL: You get an error about SSL in the server being disabled
6. Repeat 4
=> SUCCESS: The patch fixes it!
7. This steps imply we reproduced the issue, and it gets fixed, while
   keeping the current behavior.
8. Sign off :-D

Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 5 Victor Grousset/tuxayo 2025-10-28 01:56:19 UTC
It works!

(In reply to David Nind from comment #3)
> Using KTD with Debian 12. Do I need to use a Debian 13 image?

Yes, I amended the test plan to reflect this.


Also, with MariaDB 12 (latest) the issue isn't reproducible. But with the default (10.5) it can be reproduced. So anyone else having trouble should also check that.
Comment 6 David Nind 2025-10-28 03:21:38 UTC
Created attachment 188495 [details] [review]
Bug 41099: Make `koha-mysql` disable SSL if required

Now that Debian 13 (and Ubuntu 25.04) set `ssl=on` by default, we should
make the `koha-mysql` helper script disable it by default if not
configured.

This patch does that.

To test:
0. Start a Debian 13 KTD e.g. with:
   $ KOHA_IMAGE=main-trixie ktd up
1. Run:
   $ ktd --shell
  k$ koha-mysql kohadev
=> SUCCESS: You get into the DB shell
2. Apply this patch
3. Run:
  k$ debian/scripts/koha-mysql kohadev
=> SUCCESS: It works as step 1!
4. Make sure you enable SSL in my.cnf:

[client]
ssl = on

5. Repeat 1
=> FAIL: You get an error about SSL in the server being disabled
6. Repeat 4
=> SUCCESS: The patch fixes it!
7. This steps imply we reproduced the issue, and it gets fixed, while
   keeping the current behavior.
8. Sign off :-D

Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: David Nind <david@davidnind.com>
Comment 7 David Nind 2025-10-28 03:22:52 UTC
(In reply to Victor Grousset/tuxayo from comment #5)
> It works!
> 
> (In reply to David Nind from comment #3)
> > Using KTD with Debian 12. Do I need to use a Debian 13 image?
> 
> Yes, I amended the test plan to reflect this.
> 
> 
> Also, with MariaDB 12 (latest) the issue isn't reproducible. But with the
> default (10.5) it can be reproduced. So anyone else having trouble should
> also check that.

Thanks Victor!

Using a Debian 13 image worked.

I've added my sign off, so your sign off can probably be counted as QA.

David
Comment 8 Tomás Cohen Arazi (tcohen) 2025-10-28 14:09:50 UTC
Thanks for the amended test plan. I wrote it without explicitly mentioning Debian 13 because the issue was reproducible by tweaking the mysql config. And by the time I submitted the main-trixie image was not tweaked to launch regardless of this fix.

But it is great that we test on Debian 13. Once we push this patch, we can remove the workaround on KTD.

Thanks everyone!