release: 1.9.9 - #108
Merged
Merged
Conversation
A security release: three holes in the replication surface, all reachable in 1.9.8. The first needs no credentials and no handshake -- connecting to the replication port returned a full copy of the database. docs/installation.md gets a danger-level upgrade note rather than the usual warning. It says plainly that the fixes are breaking (a primary and a replica both need ELYRASQL_CLUSTER_SECRET, and they must be upgraded together because the handshake gained a step), that a refused endpoint keeps the server running so the log is the only signal, and that anyone who ran an exposed endpoint should rotate what the data would have revealed -- the port left no access log. Bumps the three things the release workflow does not validate: SERVER_VERSION, the testbench lockfile, and the version strings in README and the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A security release. Three independent holes in the replication surface
(#107, superseding #103–#105), all reachable in 1.9.8.
The first needs no credentials and no handshake: connecting to the replication
port returned a full copy of the database. Reproduced against 1.9.8 — zero bytes
sent, 560 bytes back with the canary row in them. The guard only covered
non-loopback binds, so
--replication-listen 127.0.0.1:...without a clustersecret was readable by any local process.
The upgrade note is a
dangerblock, not awarningBecause the fixes are deliberately breaking and the exposure is real:
--replication-listenand a replica both now requireELYRASQL_CLUSTER_SECRETstep, so a 1.9.9 replica will not accept a 1.9.8 primary
--user/--password/--auth)replication endpoint stoppedin the log is the only signal that replication is not happening —the note says to watch for it rather than assume
revealed: the port left no access log
ELYRASQL_ALLOW_OPEN_AUTH=1opts out of all four, described as the honest way tosay "this port is on a network I control" rather than as a convenience.
The three things the release workflow does not validate
Per
CONTRIBUTING.md:SERVER_VERSION→8.0.12-ElyraSQL-1.9.9(confirmed withelyrasql version),testbench/sql-dump/Cargo.lockrefreshed withcargo metadata --lockedgreen in both workspaces, and the version strings inREADME, installation, deployment and mysql-compatibility. The
Upgrading to 1.9.8block keeps its title, and the 1.9.8 changelog section isbyte-identical (verified by digest).
Testing
cargo fmt --all --checkcargo clippy --workspace --all-targets --all-features --locked -- -D warningscargo nextest run --workspace --locked— 448/448cargo metadata --lockedin both workspacesThe fix itself was verified both ways before merging: without a secret the
endpoint refuses to start and its port does not listen; with one, an
unauthenticated peer receives the 16-byte challenge and no data.
Checklist
docs/