fix: mysqltuner comes from Debian's package, not an unpinned download #3

Merged

marcos-mendez merged 1 commit from fix/mysqltuner-from-debian into main

2026-10-07 12:56:22 -03:00

marcos-mendez commented

2026-10-07 12:46:31 -03:00

(Migrated from github.com)

What

conf downloaded mysqltuner.pl, basic_passwords.txt and vulnerabilities.csv from refs/heads/master of jmrenouard/MySQLTuner-perl into /usr/local/bin, unpinned and unchecked. Found by the 2026-10-03 audit of the data service layers.

Debian trixie ships mysqltuner 2.6.0-1 (main), so the package is used instead of pinning a tag and keeping a SHA-256:

plan: adds mysqltuner. It installs /usr/bin/mysqltuner and keeps the data files in /usr/share/mysqltuner, which is where the packaged script looks for them.
conf: the download is removed, and with it the tkl-bashlib source (its dl was the only use) and the TKL_BASHLIB/BIN defaults.
tests/conf.bats: fails if the conf script fetches anything (URL, dl, curl, wget, gh_releases outside a comment); runs without tkl-bashlib.
tests/unit.bats: the plan names four packages, mysqltuner among them.
Version 1.0.1, changelog entry.

Behaviour change for the image: mysqltuner moves from /usr/local/bin to /usr/bin (still on PATH). Nothing in keel-mariadb or this repo referenced the old path.

Test plan

Tests written first and failed against the download
bats tests: 19/19
tests/coverage.sh 100: conf 5/5, mysqloptimize 1/1
CI green
Next layer built from this unit has /usr/bin/mysqltuner from the package and nothing of it in /usr/local/bin

## What `conf` downloaded `mysqltuner.pl`, `basic_passwords.txt` and `vulnerabilities.csv` from `refs/heads/master` of jmrenouard/MySQLTuner-perl into `/usr/local/bin`, unpinned and unchecked. Found by the 2026-10-03 audit of the data service layers. Debian trixie ships `mysqltuner` 2.6.0-1 (main), so the package is used instead of pinning a tag and keeping a SHA-256: - `plan`: adds `mysqltuner`. It installs `/usr/bin/mysqltuner` and keeps the data files in `/usr/share/mysqltuner`, which is where the packaged script looks for them. - `conf`: the download is removed, and with it the `tkl-bashlib` source (its `dl` was the only use) and the `TKL_BASHLIB`/`BIN` defaults. - `tests/conf.bats`: fails if the conf script fetches anything (URL, `dl`, `curl`, `wget`, `gh_releases` outside a comment); runs without tkl-bashlib. - `tests/unit.bats`: the plan names four packages, `mysqltuner` among them. - Version 1.0.1, changelog entry. Behaviour change for the image: `mysqltuner` moves from `/usr/local/bin` to `/usr/bin` (still on PATH). Nothing in keel-mariadb or this repo referenced the old path. ## Test plan - [x] Tests written first and failed against the download - [x] `bats tests`: 19/19 - [x] `tests/coverage.sh 100`: conf 5/5, mysqloptimize 1/1 - [ ] CI green - [ ] Next layer built from this unit has `/usr/bin/mysqltuner` from the package and nothing of it in `/usr/local/bin`