Skip to content

Commit 431aa55

Browse files
silverqxsilverqx
committed
workflows get rid of mysqld --initialize-insecure
Also used [SecureString] to store a temporary password.
1 parent e629e2b commit 431aa55

File tree

4 files changed

+72
-12
lines changed

4 files changed

+72
-12
lines changed

‎.github/workflows/clang-cl-qt6.yml

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -270,9 +270,18 @@ jobs:
270270
env:
271271
DB_MYSQL_HOST: ${{ secrets.DB_MYSQL_HOST_SSL }}
272272

273+
# The ConvertFrom-SecureString must be called on the [SecureString] instance to be able to
274+
# store it in the environment or output variable
273275
- name: MySQL initialize data directory
274-
run: |
275-
mysqld.exe --initialize-insecure --console
276+
id: initializes-initialize-mysql-data-folder
277+
run: >-
278+
$regEx = '(?:\[MY-010454\].*temporary.*: )(?<password>.+)'
279+
280+
$securedPassword = (mysqld.exe --initialize --console 2>&1 |
281+
Select-String -Pattern $regEx).Matches[0].Groups['password'].Value |
282+
ConvertTo-SecureString -AsPlainText | ConvertFrom-SecureString
283+
284+
"SecuredPassword=$securedPassword" >> $env:GITHUB_OUTPUT
276285
277286
# We can't generate certificates first and then initialize MySQL data folder, MySQL throws
278287
# error, it also generates all keys and certificates so we have remove them to generate are own
@@ -393,18 +402,24 @@ jobs:
393402
394403
# Securing the root account even on localhost is for testing to make sure that everything
395404
# works as expected
405+
# The secured_password is store in the string form so we have to re-create the [SecureString]
406+
# from this encrypted string and then it can be decrypted as normally would 😬
396407
- name: MySQL change ${{ secrets.DB_MYSQL_ROOT_USERNAME }} password
397408
run: >-
398409
"alter user '$env:DB_MYSQL_ROOT_USERNAME'@'localhost'
399410
identified with caching_sha2_password by '$env:DB_MYSQL_ROOT_PASSWORD'
400411
require issuer '${{ env.DB_MYSQL_SSL_SUBJECT_CA }}' and
401412
subject '${{ env.DB_MYSQL_SSL_SUBJECT_CLIENT }}';" |
402-
mysql.exe --user=$env:DB_MYSQL_ROOT_USERNAME --skip-password
413+
mysql.exe --user=$env:DB_MYSQL_ROOT_USERNAME
414+
--password=$($env:secured_password | ConvertTo-SecureString |
415+
ConvertFrom-SecureString -AsPlainText)
416+
--connect-expired-password
403417
env:
404418
DB_MYSQL_ROOT_PASSWORD: ${{ secrets.DB_MYSQL_ROOT_PASSWORD }}
405419
DB_MYSQL_ROOT_USERNAME: ${{ secrets.DB_MYSQL_ROOT_USERNAME }}
406420
DB_MYSQL_SSL_SUBJECT_CA: ${{ secrets.DB_MYSQL_SSL_SUBJECT_CA }}
407421
DB_MYSQL_SSL_SUBJECT_CLIENT: ${{ secrets.DB_MYSQL_SSL_SUBJECT_CLIENT }}
422+
secured_password: ${{ steps.initializes-initialize-mysql-data-folder.outputs.SecuredPassword }}
408423

409424
- name: MySQL time zone POSIX tables initialize download
410425
id: downloads-initialize-mysql-timezone-tables

‎.github/workflows/msvc2019-qt5.yml

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -94,23 +94,38 @@ jobs:
9494
env:
9595
DB_MYSQL_HOST: ${{ secrets.DB_MYSQL_HOST }}
9696

97+
# The ConvertFrom-SecureString must be called on the [SecureString] instance to be able to
98+
# store it in the environment or output variable
9799
- name: MySQL initialize data directory
98-
run: |
99-
mysqld.exe --initialize-insecure --console
100+
id: initializes-initialize-mysql-data-folder
101+
run: >-
102+
$regEx = '(?:\[MY-010454\].*temporary.*: )(?<password>.+)'
103+
104+
$securedPassword = (mysqld.exe --initialize --console 2>&1 |
105+
Select-String -Pattern $regEx).Matches[0].Groups['password'].Value |
106+
ConvertTo-SecureString -AsPlainText | ConvertFrom-SecureString
107+
108+
"SecuredPassword=$securedPassword" >> $env:GITHUB_OUTPUT
100109
101110
- name: MySQL service install/start
102111
run: |
103112
mysqld.exe --install MySQL
104113
Start-Service MySQL
105114
115+
# The secured_password is store in the string form so we have to re-create the [SecureString]
116+
# from this encrypted string and then it can be decrypted as normally would 😬
106117
- name: MySQL change ${{ secrets.DB_MYSQL_ROOT_USERNAME }} password
107118
run: >-
108119
"alter user '$env:DB_MYSQL_ROOT_USERNAME'@'localhost'
109120
identified by '$env:DB_MYSQL_ROOT_PASSWORD';" |
110-
mysql.exe --user=$env:DB_MYSQL_ROOT_USERNAME --skip-password
121+
mysql.exe --user=$env:DB_MYSQL_ROOT_USERNAME
122+
--password=$($env:secured_password | ConvertTo-SecureString |
123+
ConvertFrom-SecureString -AsPlainText)
124+
--connect-expired-password
111125
env:
112126
DB_MYSQL_ROOT_PASSWORD: ${{ secrets.DB_MYSQL_ROOT_PASSWORD }}
113127
DB_MYSQL_ROOT_USERNAME: ${{ secrets.DB_MYSQL_ROOT_USERNAME }}
128+
secured_password: ${{ steps.initializes-initialize-mysql-data-folder.outputs.SecuredPassword }}
114129

115130
- name: MySQL time zone POSIX tables initialize download
116131
id: downloads-initialize-mysql-timezone-tables

‎.github/workflows/msvc2022-qt6.yml

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -283,9 +283,18 @@ jobs:
283283
env:
284284
DB_MYSQL_HOST: ${{ secrets.DB_MYSQL_HOST_SSL }}
285285

286+
# The ConvertFrom-SecureString must be called on the [SecureString] instance to be able to
287+
# store it in the environment or output variable
286288
- name: MySQL initialize data directory
287-
run: |
288-
mysqld.exe --initialize-insecure --console
289+
id: initializes-initialize-mysql-data-folder
290+
run: >-
291+
$regEx = '(?:\[MY-010454\].*temporary.*: )(?<password>.+)'
292+
293+
$securedPassword = (mysqld.exe --initialize --console 2>&1 |
294+
Select-String -Pattern $regEx).Matches[0].Groups['password'].Value |
295+
ConvertTo-SecureString -AsPlainText | ConvertFrom-SecureString
296+
297+
"SecuredPassword=$securedPassword" >> $env:GITHUB_OUTPUT
289298
290299
# We can't generate certificates first and then initialize MySQL data folder, MySQL throws
291300
# error, it also generates all keys and certificates so we have remove them to generate are own
@@ -406,18 +415,24 @@ jobs:
406415
407416
# Securing the root account even on localhost is for testing to make sure that everything
408417
# works as expected
418+
# The secured_password is store in the string form so we have to re-create the [SecureString]
419+
# from this encrypted string and then it can be decrypted as normally would 😬
409420
- name: MySQL change ${{ secrets.DB_MYSQL_ROOT_USERNAME }} password
410421
run: >-
411422
"alter user '$env:DB_MYSQL_ROOT_USERNAME'@'localhost'
412423
identified with caching_sha2_password by '$env:DB_MYSQL_ROOT_PASSWORD'
413424
require issuer '${{ env.DB_MYSQL_SSL_SUBJECT_CA }}' and
414425
subject '${{ env.DB_MYSQL_SSL_SUBJECT_CLIENT }}';" |
415-
mysql.exe --user=$env:DB_MYSQL_ROOT_USERNAME --skip-password
426+
mysql.exe --user=$env:DB_MYSQL_ROOT_USERNAME
427+
--password=$($env:secured_password | ConvertTo-SecureString |
428+
ConvertFrom-SecureString -AsPlainText)
429+
--connect-expired-password
416430
env:
417431
DB_MYSQL_ROOT_PASSWORD: ${{ secrets.DB_MYSQL_ROOT_PASSWORD }}
418432
DB_MYSQL_ROOT_USERNAME: ${{ secrets.DB_MYSQL_ROOT_USERNAME }}
419433
DB_MYSQL_SSL_SUBJECT_CA: ${{ secrets.DB_MYSQL_SSL_SUBJECT_CA }}
420434
DB_MYSQL_SSL_SUBJECT_CLIENT: ${{ secrets.DB_MYSQL_SSL_SUBJECT_CLIENT }}
435+
secured_password: ${{ steps.initializes-initialize-mysql-data-folder.outputs.SecuredPassword }}
421436

422437
- name: MySQL time zone POSIX tables initialize download
423438
id: downloads-initialize-mysql-timezone-tables

‎.github/workflows/msys2-ucrt64.yml

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -112,23 +112,38 @@ jobs:
112112
env:
113113
DB_MYSQL_HOST: ${{ secrets.DB_MYSQL_HOST }}
114114

115+
# The ConvertFrom-SecureString must be called on the [SecureString] instance to be able to
116+
# store it in the environment or output variable
115117
- name: MySQL initialize data directory
116-
run: |
117-
mysqld.exe --initialize-insecure --console
118+
id: initializes-initialize-mysql-data-folder
119+
run: >-
120+
$regEx = '(?:\[MY-010454\].*temporary.*: )(?<password>.+)'
121+
122+
$securedPassword = (mysqld.exe --initialize --console 2>&1 |
123+
Select-String -Pattern $regEx).Matches[0].Groups['password'].Value |
124+
ConvertTo-SecureString -AsPlainText | ConvertFrom-SecureString
125+
126+
"SecuredPassword=$securedPassword" >> $env:GITHUB_OUTPUT
118127
119128
- name: MySQL service install/start
120129
run: |
121130
mysqld.exe --install MySQL
122131
Start-Service MySQL
123132
133+
# The secured_password is store in the string form so we have to re-create the [SecureString]
134+
# from this encrypted string and then it can be decrypted as normally would 😬
124135
- name: MySQL change ${{ secrets.DB_MYSQL_ROOT_USERNAME }} password
125136
run: >-
126137
"alter user '$env:DB_MYSQL_ROOT_USERNAME'@'localhost'
127138
identified with caching_sha2_password by '$env:DB_MYSQL_ROOT_PASSWORD';" |
128-
mysql.exe --user=$env:DB_MYSQL_ROOT_USERNAME --skip-password
139+
mysql.exe --user=$env:DB_MYSQL_ROOT_USERNAME
140+
--password=$($env:secured_password | ConvertTo-SecureString |
141+
ConvertFrom-SecureString -AsPlainText)
142+
--connect-expired-password
129143
env:
130144
DB_MYSQL_ROOT_PASSWORD: ${{ secrets.DB_MYSQL_ROOT_PASSWORD }}
131145
DB_MYSQL_ROOT_USERNAME: ${{ secrets.DB_MYSQL_ROOT_USERNAME }}
146+
secured_password: ${{ steps.initializes-initialize-mysql-data-folder.outputs.SecuredPassword }}
132147

133148
- name: MySQL time zone POSIX tables initialize download
134149
id: downloads-initialize-mysql-timezone-tables

0 commit comments

Comments
 (0)