exwiw 1.1.7 → 1.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a93af3fb75c47b5f8e477716a595c3dd2909e23285c3c5838a965adf640d2db6
-  data.tar.gz: c98c7197342539af1faa5fce7c4acc759566cca3b96ea07585cc99e78a297572
+  metadata.gz: ef76bef2bd961b6bf50afcdd7f28e87e5c78ab587385519bbbfc3d66e3438c6d
+  data.tar.gz: 99c7d8cb5250fd3cfb7951a586d575dd76b3dbfa20f6c9aa5125643ce7bd12cb
 SHA512:
-  metadata.gz: b7beec90b827baf014bbe16dcb6954374885ee40b2a3be13a17bb354cf51a88611d0dcfbe0273d00f987dc07032f61264d9cd160a9aac1fa5e2608cbceea0ee0
-  data.tar.gz: 41c69598a4564af9f6fad2108673101abb0a544f8f721032d9804d860caeaa440d0934b31c14038a988cc39cc98ef7594d5f8530ba7fcee76bdc0b4ab77f62cb
+  metadata.gz: 271ef2c7496ab0d6d118a0e27195d0b411f8642914cc0a0eca68abc3d47df02b8876261c40933790f99a637f6e2eb1f63e8fc2ce2f618315151c3622370c7a1a
+  data.tar.gz: 356b3c7e579c980a38ab649e2c986bbb33310f4906593ff504f14ed2839f3d3249e60337fe355d8b32ddf2e72e6439b07bfa5da5845d194cceaa2a0d933a21b8

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [1.1.8] - 2026-10-29
+
+### Added
+
+- **`--ssl-mode` and `--ssl-ca` connect to MySQL over TLS.** exwiw passed no TLS options to the driver or to `mysqldump`, so with a client library that does not use TLS by default (MariaDB Connector/C, for one) every command failed against a server with `require_secure_transport=ON` — `Connections using insecure transport are prohibited`. The two options take the MySQL client's values (`disabled`, `preferred`, `required`, `verify_ca`, `verify_identity`) and a CA file, and apply to the `mysql2` / `trilogy` connection and to `mysqldump`; MariaDB's `mysqldump`, which has no `--ssl-mode`, gets the equivalent `--ssl` / `--ssl-verify-server-cert` flags, and where MariaDB's client library or `mysqldump` lacks a mode, `verify_ca` also checks the host name and `preferred` leaves the client default. Without the options nothing changes. mysql adapter only.
+
 ## [1.1.7] - 2026-10-01
 
 ### Added

data/README.md

@@ -21,6 +21,8 @@ You usually want `require: false` on the Gemfile entry. Without bundler, run `ge
 
 For MySQL, exwiw uses the `mysql2` gem if it is available and `trilogy` otherwise; pass `--adapter=mysql` either way. Set `EXWIW_MYSQL_DRIVER=trilogy` (or `mysql2`) to choose one. `trilogy` helps when `mysql2` is linked against a client library that cannot load the server's auth plugin, such as a MySQL 9.x client connecting to a server that uses `mysql_native_password`.
 
+To connect to MySQL over TLS, pass `--ssl-mode` (`disabled`, `preferred`, `required`, `verify_ca` or `verify_identity`) and `--ssl-ca=<CA file>`. The server certificate is verified only with `verify_ca` or `verify_identity`; `--ssl-ca` is rejected without `--ssl-mode`. Both apply to the driver connection and to `mysqldump`. Without them, exwiw uses the client library's default, which may connect without TLS and then fail against a server with `require_secure_transport=ON`. MariaDB's client library and `mysqldump` do not have every mode, so with them `verify_ca` also checks the host name and `preferred` leaves the client default (`mysqldump` gets `--ssl` / `--ssl-verify-server-cert` in place of `--ssl-mode`).
+
 ## Usage
 
 exwiw has three subcommands:

data/lib/exwiw/adapter/mysql_adapter.rb

@@ -103,6 +103,7 @@ module Exwiw
         # MariaDB's mysqldump does not recognise the MySQL-specific
         # --set-gtid-purged flag and exits with code 7.
         gtid_flags = mariadb_mysqldump?(mysqldump_bin) ? [] : ['--set-gtid-purged=OFF']
+        ssl_flags = mysqldump_ssl_flags(mariadb: mariadb_mysqldump?(mysqldump_bin))
 
         cmd = [
           mysqldump_bin,
@@ -115,6 +116,7 @@ module Exwiw
           '--skip-set-charset',
           '--no-tablespaces', # skip tablespace query that requires PROCESS privilege (unavailable on managed MySQL like RDS)
           *gtid_flags,
+          *ssl_flags,
           '--compact',
           @connection_config.database_name,
         ]
@@ -437,6 +439,23 @@ module Exwiw
           end
       end
 
+      private def mysqldump_ssl_flags(mariadb:)
+        mode = @connection_config.ssl_mode
+        ca_flags = @connection_config.ssl_ca ? ["--ssl-ca=#{@connection_config.ssl_ca}"] : []
+        return ca_flags + (mode ? ["--ssl-mode=#{mode.upcase}"] : []) unless mariadb
+
+        # MariaDB's client has no --ssl-mode, and from 11.4 verifies the server
+        # certificate by default, so `required` must opt out to stay unverified.
+        mode_flags =
+          case mode
+          when nil, "preferred" then []
+          when "disabled" then ["--skip-ssl"]
+          when "required" then ["--ssl", "--skip-ssl-verify-server-cert"]
+          else ["--ssl", "--ssl-verify-server-cert"]
+          end
+        ca_flags + mode_flags
+      end
+
       private def connection
         @connection ||= MysqlClient.new(@connection_config)
       end

data/lib/exwiw/adapter/mysql_client.rb

@@ -20,6 +20,16 @@ module Exwiw
 
       DRIVERS = [:mysql2, :trilogy].freeze
 
+      SSL_MODES = %w[disabled preferred required verify_ca verify_identity].freeze
+
+      TRILOGY_SSL_MODE_CONSTANTS = {
+        "disabled" => :SSL_DISABLED,
+        "preferred" => :SSL_PREFERRED_NOVERIFY,
+        "required" => :SSL_REQUIRED_NOVERIFY,
+        "verify_ca" => :SSL_VERIFY_CA,
+        "verify_identity" => :SSL_VERIFY_IDENTITY,
+      }.freeze
+
       # Pick the available driver, preferring mysql2 (exwiw's historical default).
       # require returns false when already loaded, so this is safe to call repeatedly.
       #
@@ -188,10 +198,31 @@ module Exwiw
         }.compact
 
         case @driver
-        when :mysql2 then Mysql2::Client.new(options)
-        when :trilogy then Trilogy.new(options)
+        when :mysql2 then Mysql2::Client.new(options.merge(mysql2_ssl_options))
+        when :trilogy then Trilogy.new(options.merge(trilogy_ssl_options))
         end
       end
+
+      private def mysql2_ssl_options
+        { ssl_mode: mysql2_ssl_mode, sslca: @connection_config.ssl_ca }.compact
+      end
+
+      # mysql2 linked against MariaDB Connector/C defines unsupported modes as 0 and
+      # ignores them with a warning, so fall back to the nearest mode it supports.
+      private def mysql2_ssl_mode
+        mode = @connection_config.ssl_mode
+        return mode if mode.nil? || !Mysql2::Client.const_get("SSL_MODE_#{mode.upcase}").zero?
+
+        "verify_identity" if mode == "verify_ca"
+      end
+
+      private def trilogy_ssl_options
+        mode = @connection_config.ssl_mode
+        {
+          ssl_mode: mode && Trilogy.const_get(TRILOGY_SSL_MODE_CONSTANTS.fetch(mode)),
+          ssl_ca: @connection_config.ssl_ca,
+        }.compact
+      end
     end
   end
 end

data/lib/exwiw/cli.rb

@@ -65,7 +65,7 @@ module Exwiw
     # Database connection settings are environment-specific (and sometimes
     # secret-adjacent), so they must be passed via CLI/env, never the committed
     # config file. `adapter` is the one connection-ish key allowed in config.
-    REJECTED_CONNECTION_KEYS = %w[host port user database uri password].freeze
+    REJECTED_CONNECTION_KEYS = %w[host port user database uri password ssl_mode ssl_ca].freeze
 
     # Keys that only make sense for `export`. They are skipped when merging config
     # for `explain` so a shared config file does not trip validate_explain_only!,
@@ -103,6 +103,8 @@ module Exwiw
       @database_user = nil
       @database_password = ENV["DATABASE_PASSWORD"]
       @connection_uri = nil
+      @ssl_mode = nil
+      @ssl_ca = nil
       @output_dir = nil
       @schema_dir = nil
       @from_db = false
@@ -148,6 +150,8 @@ module Exwiw
         database_name: @database_name,
         uri: @connection_uri,
         mongodb_query_timeout_ms: @mongodb_query_timeout_ms,
+        ssl_mode: @ssl_mode,
+        ssl_ca: @ssl_ca,
       )
 
       dump_target = DumpTarget.new(
@@ -324,6 +328,7 @@ module Exwiw
       resolve_scope_column!
       resolve_ids_field!
       resolve_uri_option!
+      resolve_ssl_options!
       resolve_parallel_workers!
       resolve_mongodb_query_timeout_ms!
 
@@ -654,6 +659,31 @@ module Exwiw
       end
     end
 
+    private def resolve_ssl_options!
+      return if @ssl_mode.nil? && @ssl_ca.nil?
+
+      if @database_adapter != "mysql"
+        $stderr.puts "--ssl-mode / --ssl-ca are only supported by the mysql adapter"
+        exit 1
+      end
+
+      if @ssl_ca&.empty?
+        $stderr.puts "--ssl-ca must be a path to a CA certificate file"
+        exit 1
+      end
+
+      if @ssl_mode.nil?
+        $stderr.puts "--ssl-ca requires --ssl-mode (verify_ca or verify_identity to verify the server)"
+        exit 1
+      end
+
+      @ssl_mode = @ssl_mode.downcase
+      unless Adapter::MysqlClient::SSL_MODES.include?(@ssl_mode)
+        $stderr.puts "Invalid --ssl-mode. Available options are: #{Adapter::MysqlClient::SSL_MODES.join(', ')}"
+        exit 1
+      end
+    end
+
     # `--parallel-workers` opts into the MongoDB fork-parallel dump schedule
     # (docs/mongodb-dump-parallelism-2x-notes.md). It is mongodb-only (the SQL
     # adapters shell out to their own dumpers) and must be a positive integer;
@@ -919,6 +949,8 @@ module Exwiw
         end
         opts.on("-a", "--adapter=ADAPTER", "Database adapter: mysql, sqlite, postgresql, mongodb (aliases: mysql2, sqlite3)") { |v| @database_adapter = v }
         opts.on("--uri=URI", "Full MongoDB connection URI (mongodb:// or mongodb+srv://). mongodb adapter only; takes precedence over --host/--port/--user. TLS, replicaSet, authSource and credentials are read from the URI.") { |v| @connection_uri = v }
+        opts.on("--ssl-mode=MODE", "TLS mode for the connection and mysqldump: #{Adapter::MysqlClient::SSL_MODES.join(', ')}. mysql adapter only; defaults to the client library's behavior.") { |v| @ssl_mode = v }
+        opts.on("--ssl-ca=PATH", "CA certificate file used to verify the server. mysql adapter only.") { |v| @ssl_ca = v }
         opts.on("--database=DATABASE", "Target database name") { |v| @database_name = v }
         opts.on("--target-table=[TABLE]", "Target table for extraction. If omitted with --ids, run in scope-column mode (SQL adapters; the schema must declare `scope_column:`). If omitted without --ids, dump all tables.") { |v| @target_table_name = v }
         opts.on("--target-collection=[COLLECTION]", "Alias of --target-table for the mongodb adapter.") { |v| @target_collection_name = v }

data/lib/exwiw/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Exwiw
-  VERSION = "1.1.7"
+  VERSION = "1.1.8"
 end

data/lib/exwiw.rb

@@ -116,5 +116,7 @@ module Exwiw
   # source: the server aborts the operation past the deadline. nil leaves it
   # unset (no timeout). A per-collection `query_timeout_ms` overrides it.
   # mongodb adapter only.
-  ConnectionConfig = Struct.new(:adapter, :host, :port, :user, :password, :database_name, :uri, :mongodb_query_timeout_ms, keyword_init: true)
+  #
+  # `ssl_mode` / `ssl_ca` apply to both the driver connection and mysqldump. mysql adapter only.
+  ConnectionConfig = Struct.new(:adapter, :host, :port, :user, :password, :database_name, :uri, :mongodb_query_timeout_ms, :ssl_mode, :ssl_ca, keyword_init: true)
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: exwiw
 version: !ruby/object:Gem::Version
-  version: 1.1.7
+  version: 1.1.8
 platform: ruby
 authors:
 - Shia