SE2-752/add caching_sha2_password support for MySQL 8.4#15
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the runtime Docker image to support MySQL 8.4’s default caching_sha2_password authentication for both PHP (mysqlnd) connections and mysql CLI shell-outs used by sprout commands.
Changes:
- Bump runtime base image from
graze/php-alpine:7.3tograze/php-alpine:7.4to pick up mysqlnd support forcaching_sha2_password. - Install
mariadb-connector-calongsidemariadb-clientso themysqlCLI can load thecaching_sha2_passwordclient plugin.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
rick-lam
force-pushed
the
SE2-752/add-caching-sha2-password-support
branch
from
bee1a7f to
5d536cf
Compare
rick-lam
force-pushed
the
SE2-752/add-caching-sha2-password-support
branch
from
84c5e39 to
302806b
Compare
MySQL 8.4 makes caching_sha2_password the mandatory default auth plugin and disables mysql_native_password. The sprout image could not connect to 8.4 servers because: - graze/php-alpine:7.3 mysqlnd was compiled without auth_plugin_caching_sha2_password, causing PDO/mysqli connects to fail with "The server requested authentication method unknown to the client [caching_sha2_password]". - The Alpine mysql/mariadb-client did not ship the caching_sha2_password.so plugin, so shell-outs to the mysql CLI failed with "ERROR 1045 (28000): Plugin caching_sha2_password could not be loaded". Bump runtime base to graze/php-alpine:7.4 (mysqlnd has caching_sha2 built in) and install mariadb-connector-c (provides the CLI plugin). Composer platform stays at 7.3; vendor code runs unchanged on 7.4. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
rick-lam
force-pushed
the
SE2-752/add-caching-sha2-password-support
branch
from
302806b to
631bdc6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
graze/php-alpine:7.3tograze/php-alpine:7.4—mysqlndin 7.4 hasauth_plugin_caching_sha2_passwordbuilt in, unlike the Alpine 3.9 / PHP 7.3 build.mariadb-connector-cso themysqlCLI can loadcaching_sha2_password.so.composer.jsonunchanged); vendor code runs unmodified on 7.4.Why now
MySQL 8.4 (being rolled out under SE2-752) removes
mysql_native_passwordas a default plugin and mandatescaching_sha2_password. The currentgraze/sprout:latestfails on both code paths when talking to 8.4:SQLSTATE[HY000] [2054] The server requested authentication method unknown to the client— mysqlnd in the old base lacks the plugin.mysqlCLI (used bysprout chop/seed):ERROR 1045 (28000): Plugin caching_sha2_password could not be loaded— plugin file not shipped.Both are fixed by this PR.
Test plan
make build && make build-dockersucceeds.php -r phpinfo()in the built image showsauth_plugin_caching_sha2_passwordin mysqlnd plugins./usr/lib/mariadb/plugin/caching_sha2_password.sois present.caching_sha2_passwordsucceeds.mysqlCLI connect against the same server succeeds.make db-data-web/db-data-dispatchin thewebrepo (which invokessprout chop+seedagainst mysql:8.4) completes with exit 0 and zero auth errors.🤖 Generated with Claude Code