ey_cloud_server 1.5.0 → 1.5.1

checksums.yaml

@@ -1,15 +1,7 @@
 ---
-!binary "U0hBMQ==":
-  metadata.gz: !binary |-
-    ZmFkNjBkYjY1OTNhZjQwNjMxNjUxMmNmOTRmOWQyZDMxMDJlNTUzYQ==
-  data.tar.gz: !binary |-
-    YTA0NTBmMTAxYzk5ZmE5YjQ0MzViYjE4NWE2YjRjZGM5YWYxZDNiNQ==
+SHA256:
+  metadata.gz: bfb2b6fa4059f5c796ba0cedbb4784c6a564a22adf1cd91dcc8efac32d44a1f6
+  data.tar.gz: e2dab140765f7438ccb743c40169a186e23f6b72d5acd36d5be5aaf759ca50a0
 SHA512:
-  metadata.gz: !binary |-
-    ZmRlZTQ1YThjMWU0N2RkMzVlNmFkNGY3YThmMDJhMzRjZTE4MzU4ZGJjOTAx
-    NzM5MDc4OGZmNTMxNzM1OGI1ZTk4NDgxZjY5MTIwYmZmMTI1NmNjNjc0NmFl
-    OTI3OWFmMjdiZGE0N2QwZmEyNjljYzQ0NTg0MjBmZWI3NTBiOWU=
-  data.tar.gz: !binary |-
-    MTdlZDkwYmQ1ZmNiYTJmY2U0YWMzMmQ2YjZmNzA5NWEzYTVlNTA4ODM1ZGZj
-    ZTBkN2EwZmVlODczYTAxMjYwNzA3OTk3ODcxODlkOTQwZjYwZDNhNjE4Mjk2
-    YThjMTZiNjBmMmY3NTE5Yjg0NjI2YjRkOGQwMDg0YmQ4OTY3ZGM=
+  metadata.gz: e0f3941d55b673e5fbe7c3fea6e41ad72447e556cdfcaa7e29ea7226929042ea8e1806bc566bab07f245ad23302b4ad244c4aedde0780c1e3101cda41c4a39e3
+  data.tar.gz: 0f9a2d0689d4ba021eef298a7df7786abe731d13aa8aba68a59b9ea0e0e5d6e8dc568723ed97e886c07d9fd875513260d3a44950c93cd054b84e81e7c66348c1

data/bin/eybackup

@@ -16,5 +16,6 @@ rescue => e
   puts "******* Trace *******"
   puts e.inspect
   EY.notify_backup_error(e) unless STDOUT.isatty
+  exit 1
 end
 

data/lib/ey_backup/engines/mysql_engine.rb

@@ -1,3 +1,5 @@
+require 'shellwords'
+
 module EY
   module Backup
     class MysqlEngine < Engine
@@ -45,10 +47,10 @@ module EY
       
       def check_if_replica
         err_msg="ERROR: Target host: '#{host}' is currently: "
-        err_msg=err_msg + "a replica based on 'show slave status', " if db_replicating?
+        err_msg=err_msg + "a replica, " if db_replicating?
         err_msg=err_msg + "in read_only mode, " if read_only_on?
         err_msg=err_msg + "restores should be processed against the master."
-        
+
         EY::Backup.logger.fatal(%Q{#{err_msg}}) if db_replicating? or read_only_on?
       end
 
@@ -90,10 +92,50 @@ module EY
       end
       
       def db_replicating?
-        stdout = %x{mysql #{username_option} #{host_option} -BN -e"show slave status"|wc -l}
-        stdout.to_i > 0
+        statement = replica_status_statement
+        stdout = %x(mysql #{username_option} #{host_option} -BN -e #{Shellwords.escape(statement)})
+        probe_status = $?
+
+        unless probe_status.success?
+          # The replication-status probe itself failed -- e.g. the statement
+          # is unsupported on this server version, or a connection/permission
+          # problem. We cannot prove the host is NOT a replica, so fail
+          # closed and treat it as a possible replica rather than silently
+          # letting the restore proceed (this is how MySQL 8.4's removal of
+          # `SHOW SLAVE STATUS` used to defeat this check entirely).
+          warn("Unable to determine replication status on '#{host}' via #{statement.inspect}: #{stdout.strip}; treating host as a possible replica.")
+          return true
+        end
+
+        !stdout.strip.empty?
       end
-      
+
+      # `SHOW SLAVE STATUS` was deprecated in MySQL 8.0.22 and removed in
+      # 8.4, replaced by `SHOW REPLICA STATUS`.
+      def replica_status_statement
+        mysql_8_4_or_newer? ? "show replica status" : "show slave status"
+      end
+
+      def mysql_8_4_or_newer?
+        stdout = %x(mysql #{username_option} #{host_option} -BN -e #{Shellwords.escape('select @@version')})
+        return false unless $?.success?
+
+        version = stdout.strip
+        # MariaDB keeps its own version numbering (10.x, 11.x) and retains
+        # `SHOW SLAVE STATUS` across all versions, so we must not compare
+        # its major.minor against MySQL's 8.4 boundary.
+        return false if version =~ /mariadb/i
+
+        # Anchor at the start of the string so we only inspect the leading
+        # version tuple (e.g. "8.4.11-11" → "8.4"), not any later digit-dot-digit
+        # pattern in suffixes or build metadata.
+        numeric = version[/\A\d+\.\d+/]
+        return false unless numeric
+
+        major, minor = numeric.split('.').map(&:to_i)
+        major > 8 || (major == 8 && minor >= 4)
+      end
+
       def read_only_on?
         stdout = %x{mysql #{username_option} #{host_option} -BN -e"select @@global.read_only"}
         stdout.to_i == 1
@@ -105,13 +147,57 @@ module EY
       end
       
       def cycle_database(database_name)
-        query = "show create database #{database_name} \\G"
-        create_cmd = %x(mysql #{username_option} #{host_option} -NB -e "#{query}"|tail -n 1)
-        create_cmd="Create database #{database_name}" if create_cmd==""
-        
-        %x(mysql #{username_option} #{host_option} -e 'DROP DATABASE IF EXISTS #{database_name}')
-        %x(mysql #{username_option} #{host_option} -e '#{create_cmd}')
-        
+        create_cmd = capture_create_database_statement(database_name)
+
+        unless create_cmd =~ /\ACREATE\s+DATABASE\b/i
+          raise "Refusing to restore '#{database_name}': could not obtain a valid CREATE DATABASE statement (got #{create_cmd.inspect}). The existing database has NOT been touched."
+        end
+
+        drop_database!(database_name)
+        recreate_database!(create_cmd, database_name)
+      end
+
+      def capture_create_database_statement(database_name)
+        query = "show create database `#{database_name}` \\G"
+        raw = %x(mysql #{username_option} #{host_option} -NB -e #{Shellwords.escape(query)})
+        capture_status = $?
+
+        # `-N` strips the field-name labels that `\G` would otherwise print,
+        # so the last non-blank line is the CREATE DATABASE statement text.
+        create_cmd = raw.to_s.split("\n").map(&:strip).reject(&:empty?).last.to_s
+
+        if create_cmd.empty? || !capture_status.success?
+          # No existing database to read from (e.g. this is the first-ever
+          # restore against a fresh target), or the probe itself failed.
+          # Fall back to a bare CREATE DATABASE so the restore can still
+          # proceed.
+          "CREATE DATABASE `#{database_name}`"
+        else
+          create_cmd
+        end
+      end
+
+      def drop_database!(database_name)
+        %x(mysql #{username_option} #{host_option} -e #{Shellwords.escape("DROP DATABASE IF EXISTS `#{database_name}`")})
+        raise "Failed to drop database '#{database_name}' prior to restore; the existing database was left intact." unless $?.success?
+      end
+
+      def recreate_database!(create_cmd, database_name)
+        # Feed the CREATE DATABASE statement to `mysql` on STDIN rather than
+        # interpolating it into a quoted shell `-e` argument. From MySQL
+        # 8.0.16 onward, `SHOW CREATE DATABASE` output can contain a
+        # single-quoted clause (e.g. `/*!80016 DEFAULT ENCRYPTION='N' */`)
+        # whose quote would otherwise terminate a single-quoted shell string
+        # and truncate the statement mid-SQL -- which is exactly what turned
+        # a syntax error into a dropped, never-recreated database.
+        IO.popen(['mysql', username_option, host_option], 'w') do |io|
+          io.write(create_cmd)
+          io.write(";\n")
+        end
+
+        unless $?.success?
+          raise "Failed to recreate database '#{database_name}' after DROP -- the database has been dropped and NOT recreated. Statement attempted: #{create_cmd.inspect}"
+        end
       end
 
       def suffix

data/lib/ey_backup/engines/postgresql_engine.rb

@@ -127,10 +127,27 @@ module EY
         create_cmd = create_command(database_name).chomp
         if create_cmd == ''
           create_database(database_name)
+          unless $?.success?
+            raise "Failed to create database '#{database_name}' before restore."
+          end
         else
           check_connections(database_name)
           drop_database(database_name)
+          unless $?.success?
+            raise "Failed to drop database '#{database_name}' prior to restore; the existing database was left intact."
+          end
+          # Note: create_cmd is embedded inside a double-quoted shell argument
+          # rather than single-quoted, so the single-quote chars that appear
+          # in PostgreSQL CREATE DATABASE output (e.g. ENCODING 'UTF8') are
+          # not shell-special within double quotes and do not cause the
+          # statement-termination break seen in the MySQL path. The risk class
+          # is different but we still check the exit status so that a failed
+          # create (permissions, malformed content, etc.) is caught before
+          # the missing database causes a load failure.
           %x{PGPASSWORD='#{password}' psql -U#{username} -h #{host} -t postgres -c "#{create_cmd}"}
+          unless $?.success?
+            raise "Failed to recreate database '#{database_name}' after DROP -- the database has been dropped and NOT recreated."
+          end
         end
       end
 

data/lib/ey_cloud_server/version.rb

@@ -1,5 +1,5 @@
 module EY
   module CloudServer
-    VERSION = '1.5.0'
+    VERSION = '1.5.1'
   end
 end

data/spec/ey_backup/mysql_engine_spec.rb

@@ -0,0 +1,346 @@
+# Unit tests for the two defects fixed in mysql_engine.rb (ey-all#204):
+#
+#   A — cycle_database drops the database and never recreates it when MySQL
+#       8.0.16+ injects a `DEFAULT ENCRYPTION='N'` single-quoted clause into
+#       `SHOW CREATE DATABASE` output, which broke out of the original
+#       single-quoted `-e` shell argument and truncated the SQL mid-statement.
+#
+#   B — db_replicating? silently returned false on MySQL 8.4+ because
+#       `SHOW SLAVE STATUS` was removed there; it must fail closed (return
+#       true) whenever the probe itself errors, on any MySQL version.
+#
+# (Defect C — eybackup exiting 0 after a failed restore — is a one-line fix
+# in bin/eybackup's top-level rescue block; the CLI entrypoint requires the
+# full ey-flex / ey_enzyme dependency chain from the private NextGem gem
+# server, which isn't available in this environment, so it isn't covered by
+# an executable spec here. See the PR description.)
+#
+# Strategy: rather than re-implementing the engine's logic inline (which
+# would test the test, not the code), these specs put a small fake `mysql`
+# executable on PATH and let the REAL, unmodified engine methods run against
+# it. The fake script's behavior (output, exit status) is controlled per
+# example via environment variables, and it echoes back what it was given so
+# we can assert on exactly what the engine sent it (in particular: whether
+# the single-quote-containing CREATE DATABASE statement survives intact).
+#
+# This file intentionally does NOT require lib/ey_backup.rb (which pulls in
+# ey-flex / ey_enzyme from NextGem); it loads only the engine class and its
+# stdlib dependencies, so it runs on any modern Ruby + rspec (verified here
+# under Ruby 3 / rspec 3 via Docker, since the project's pinned Ruby 1.9.3
+# cannot run on this host). It therefore uses modern `expect`/`allow` syntax
+# rather than the legacy suite's `.should`/`stub`, since it is not part of
+# the (currently non-executable-in-this-environment) bundled spec run.
+
+require 'forwardable'
+require 'stringio'
+require 'shellwords'
+require 'fileutils'
+require 'tmpdir'
+
+# ---- Minimal EY::Backup bootstrap (avoids requiring ey-flex) -------------
+
+module EY
+  module Backup
+    class << self
+      attr_accessor :logger, :tmp_dir, :log_dir
+    end
+
+    class Logger
+      extend Forwardable
+
+      attr_reader :stdout, :stderr
+
+      alias_method :fatal, :abort
+      public :fatal
+
+      def_delegator :stdout, :puts, :puts
+
+      def initialize(stdout = $stdout, stderr = $stderr)
+        @stdout, @stderr = stdout, stderr
+      end
+
+      def info(msg);  stdout.puts("#{Time.now} #{msg}"); end
+      def warn(msg, db = nil); stdout.puts("#{Time.now} WARNING: #{msg}"); end
+      def error(msg, db = nil); stdout.puts("#{Time.now} ERROR: #{msg}"); end
+      def verbose(msg); end
+      def debug(msg); stdout.puts("#{Time.now} DEBUG: #{msg}"); end
+      def say(msg, newline = true); newline ? info(msg) : stdout.print(msg); end
+    end
+
+    module Logging
+      extend Forwardable
+      def_delegator EY::Backup, :logger
+      def_delegators :logger, :fatal, :error, :warn, :info, :verbose, :debug, :say
+    end
+  end
+end
+
+EY::Backup.logger = EY::Backup::Logger.new(StringIO.new, StringIO.new)
+
+lib_dir = File.expand_path(File.dirname(__FILE__) + '/../../lib/ey_backup')
+require lib_dir + '/spawner'
+require lib_dir + '/base'
+require lib_dir + '/engine'
+require lib_dir + '/engines/mysql_engine'
+
+# ---- Fake `mysql` binary --------------------------------------------------
+#
+# Routes on the `-e` query text (or, absent `-e`, treats the invocation as
+# stdin-fed — exactly what recreate_database! does). Controlled entirely via
+# environment variables so each example can script a distinct scenario.
+
+FAKE_MYSQL_SCRIPT = <<~'SCRIPT'
+  #!/usr/bin/env bash
+  if [ -n "$FAKE_MYSQL_CALL_LOG" ]; then
+    printf '%s\n' "$*" >> "$FAKE_MYSQL_CALL_LOG"
+  fi
+
+  query=""
+  has_e=0
+  for arg in "$@"; do
+    if [ "$has_e" = "1" ]; then
+      query="$arg"
+      break
+    fi
+    if [ "$arg" = "-e" ]; then
+      has_e=1
+    fi
+  done
+
+  if [ "$has_e" = "0" ]; then
+    # No -e flag => stdin-fed invocation (recreate_database!).
+    if [ -n "$FAKE_MYSQL_STDIN_CAPTURE_FILE" ]; then
+      cat > "$FAKE_MYSQL_STDIN_CAPTURE_FILE"
+    else
+      cat > /dev/null
+    fi
+    exit "${FAKE_MYSQL_STDIN_EXIT:-0}"
+  fi
+
+  case "$query" in
+    "select @@version")
+      printf '%s' "$FAKE_MYSQL_VERSION"
+      exit "${FAKE_MYSQL_VERSION_EXIT:-0}"
+      ;;
+    "show replica status")
+      printf '%s' "$FAKE_MYSQL_REPLICA_OUTPUT"
+      exit "${FAKE_MYSQL_REPLICA_EXIT:-0}"
+      ;;
+    "show slave status")
+      printf '%s' "$FAKE_MYSQL_SLAVE_OUTPUT"
+      exit "${FAKE_MYSQL_SLAVE_EXIT:-0}"
+      ;;
+    show\ create\ database*)
+      printf '%s' "$FAKE_MYSQL_CREATE_OUTPUT"
+      exit "${FAKE_MYSQL_CREATE_EXIT:-0}"
+      ;;
+    DROP\ DATABASE*)
+      exit "${FAKE_MYSQL_DROP_EXIT:-0}"
+      ;;
+    *)
+      exit 0
+      ;;
+  esac
+SCRIPT
+
+RSpec.describe EY::Backup::MysqlEngine do
+  around(:each) do |example|
+    @fake_bin_dir = Dir.mktmpdir('fake-mysql-bin')
+    script_path = File.join(@fake_bin_dir, 'mysql')
+    File.write(script_path, FAKE_MYSQL_SCRIPT)
+    FileUtils.chmod('+x', script_path)
+
+    @call_log = File.join(@fake_bin_dir, 'calls.log')
+    ENV['FAKE_MYSQL_CALL_LOG'] = @call_log
+
+    original_path = ENV['PATH']
+    ENV['PATH'] = "#{@fake_bin_dir}:#{original_path}"
+    begin
+      example.run
+    ensure
+      ENV['PATH'] = original_path
+      %w[
+        FAKE_MYSQL_CALL_LOG FAKE_MYSQL_VERSION FAKE_MYSQL_VERSION_EXIT
+        FAKE_MYSQL_REPLICA_OUTPUT FAKE_MYSQL_REPLICA_EXIT
+        FAKE_MYSQL_SLAVE_OUTPUT FAKE_MYSQL_SLAVE_EXIT
+        FAKE_MYSQL_CREATE_OUTPUT FAKE_MYSQL_CREATE_EXIT
+        FAKE_MYSQL_DROP_EXIT FAKE_MYSQL_STDIN_EXIT
+        FAKE_MYSQL_STDIN_CAPTURE_FILE
+      ].each { |k| ENV.delete(k) }
+      FileUtils.remove_entry(@fake_bin_dir)
+    end
+  end
+
+  let(:engine) do
+    described_class.new('root', '', 'localhost', nil, true, false, false, false)
+  end
+
+  def call_log
+    File.exist?(@call_log) ? File.readlines(@call_log) : []
+  end
+
+  # =========================================================================
+  # B — replication-status detection on MySQL 8.4+ (and fail-closed on error)
+  # =========================================================================
+
+  describe '#db_replicating?' do
+    context 'on MySQL 8.4+, host is a replica' do
+      it 'uses SHOW REPLICA STATUS and returns true' do
+        ENV['FAKE_MYSQL_VERSION'] = '8.4.11-11'
+        ENV['FAKE_MYSQL_REPLICA_OUTPUT'] = "Source_Host\treplica-source\tSource_Port\t3306\n"
+        ENV['FAKE_MYSQL_REPLICA_EXIT'] = '0'
+
+        expect(engine.db_replicating?).to eq(true)
+        expect(call_log.any? { |l| l.include?('show replica status') }).to eq(true)
+        expect(call_log.any? { |l| l.include?('show slave status') }).to eq(false)
+      end
+    end
+
+    context 'on MySQL 8.4+, host is NOT a replica (plain master)' do
+      it 'uses SHOW REPLICA STATUS and returns false' do
+        ENV['FAKE_MYSQL_VERSION'] = '8.4.11-11'
+        ENV['FAKE_MYSQL_REPLICA_OUTPUT'] = ''
+        ENV['FAKE_MYSQL_REPLICA_EXIT'] = '0'
+
+        expect(engine.db_replicating?).to eq(false)
+      end
+    end
+
+    context 'on MySQL 8.0 (below the 8.4 cutover), host is a replica' do
+      it 'uses SHOW SLAVE STATUS and returns true' do
+        ENV['FAKE_MYSQL_VERSION'] = '8.0.16'
+        ENV['FAKE_MYSQL_SLAVE_OUTPUT'] = "Slave_IO_State\tWaiting\n"
+        ENV['FAKE_MYSQL_SLAVE_EXIT'] = '0'
+
+        expect(engine.db_replicating?).to eq(true)
+        expect(call_log.any? { |l| l.include?('show slave status') }).to eq(true)
+      end
+    end
+
+    context 'the pre-fix bug scenario: MySQL 8.4 but the probe uses the removed statement' do
+      it 'fails closed (treats as a possible replica) rather than silently returning false' do
+        ENV['FAKE_MYSQL_VERSION'] = '8.4.11-11'
+        # Simulate SHOW REPLICA STATUS itself erroring (e.g. permissions, or
+        # some future removal) -- the probe fails outright.
+        ENV['FAKE_MYSQL_REPLICA_OUTPUT'] = "ERROR 1064 (42000): syntax error"
+        ENV['FAKE_MYSQL_REPLICA_EXIT'] = '1'
+
+        expect(engine.db_replicating?).to eq(true)
+      end
+    end
+
+    context 'probe fails for a connectivity reason' do
+      it 'fails closed (treats as a possible replica)' do
+        ENV['FAKE_MYSQL_VERSION'] = '8.4.0'
+        ENV['FAKE_MYSQL_REPLICA_OUTPUT'] = "ERROR 2003 (HY000): Can't connect"
+        ENV['FAKE_MYSQL_REPLICA_EXIT'] = '1'
+
+        expect(engine.db_replicating?).to eq(true)
+      end
+    end
+  end
+
+  describe '#mysql_8_4_or_newer?' do
+    [
+      ['8.4.0',       true],
+      ['8.4.11-11',   true],
+      ['9.0.0',       true],
+      ['8.3.9',       false],
+      ['8.0.16',      false],
+      ['5.7.36',      false],
+      ['10.6.12-MariaDB', false],
+    ].each do |version, expected|
+      it "returns #{expected} for server version #{version}" do
+        ENV['FAKE_MYSQL_VERSION'] = version
+        ENV['FAKE_MYSQL_VERSION_EXIT'] = '0'
+        expect(engine.mysql_8_4_or_newer?).to eq(expected)
+      end
+    end
+
+    it 'returns false (safe default) when the version probe itself fails' do
+      ENV['FAKE_MYSQL_VERSION'] = ''
+      ENV['FAKE_MYSQL_VERSION_EXIT'] = '1'
+      expect(engine.mysql_8_4_or_newer?).to eq(false)
+    end
+  end
+
+  # =========================================================================
+  # A — cycle_database no longer destroys the database on a quoting break
+  # =========================================================================
+
+  describe '#capture_create_database_statement' do
+    it 'returns the SHOW CREATE DATABASE output verbatim, including an embedded single quote' do
+      stmt = "CREATE DATABASE `myapp` /*!40100 DEFAULT CHARACTER SET utf8mb3 */ /*!80016 DEFAULT ENCRYPTION='N' */"
+      ENV['FAKE_MYSQL_CREATE_OUTPUT'] = stmt
+      ENV['FAKE_MYSQL_CREATE_EXIT'] = '0'
+
+      result = engine.capture_create_database_statement('myapp')
+      expect(result).to eq(stmt)
+      expect(result).to include("ENCRYPTION='N'")
+    end
+
+    it 'falls back to a bare CREATE DATABASE when the probe fails (fresh target, no existing db)' do
+      ENV['FAKE_MYSQL_CREATE_OUTPUT'] = ''
+      ENV['FAKE_MYSQL_CREATE_EXIT'] = '1'
+
+      expect(engine.capture_create_database_statement('newdb')).to eq('CREATE DATABASE `newdb`')
+    end
+
+    it 'falls back to a bare CREATE DATABASE when the probe succeeds but returns nothing' do
+      ENV['FAKE_MYSQL_CREATE_OUTPUT'] = ''
+      ENV['FAKE_MYSQL_CREATE_EXIT'] = '0'
+
+      expect(engine.capture_create_database_statement('newdb')).to eq('CREATE DATABASE `newdb`')
+    end
+  end
+
+  describe '#cycle_database' do
+    it 'drops then recreates, delivering the FULL statement (with embedded quote) to mysql via stdin intact' do
+      stmt = "CREATE DATABASE `myapp` /*!80016 DEFAULT ENCRYPTION='N' */"
+      ENV['FAKE_MYSQL_CREATE_OUTPUT'] = stmt
+      ENV['FAKE_MYSQL_CREATE_EXIT'] = '0'
+      ENV['FAKE_MYSQL_DROP_EXIT'] = '0'
+      ENV['FAKE_MYSQL_STDIN_EXIT'] = '0'
+      stdin_capture = File.join(@fake_bin_dir, 'stdin_capture.sql')
+      ENV['FAKE_MYSQL_STDIN_CAPTURE_FILE'] = stdin_capture
+
+      expect { engine.cycle_database('myapp') }.not_to raise_error
+
+      # The database WAS dropped...
+      expect(call_log.any? { |l| l.start_with?('DROP DATABASE') || l.include?('DROP DATABASE') }).to eq(true)
+      # ...and the recreate step received the statement UNTRUNCATED, quote and all.
+      # This is the crux of the fix: under the old `-e '#{create_cmd}'` code,
+      # this content would never have reached mysql intact (the shell would
+      # have truncated it at the embedded quote).
+      received = File.read(stdin_capture)
+      expect(received).to include(stmt)
+      expect(received).to include("ENCRYPTION='N'")
+    end
+
+    it 'never drops the database if the captured statement is not a valid CREATE DATABASE' do
+      ENV['FAKE_MYSQL_CREATE_OUTPUT'] = 'garbage: mysql client misconfiguration warning text'
+      ENV['FAKE_MYSQL_CREATE_EXIT'] = '0'
+      ENV['FAKE_MYSQL_DROP_EXIT'] = '0'
+
+      expect { engine.cycle_database('myapp') }.to raise_error(/Refusing to restore/)
+      expect(call_log.any? { |l| l.include?('DROP DATABASE') }).to eq(false)
+    end
+
+    it 'raises (does not swallow the failure) if DROP DATABASE itself fails' do
+      ENV['FAKE_MYSQL_CREATE_OUTPUT'] = 'CREATE DATABASE `myapp`'
+      ENV['FAKE_MYSQL_CREATE_EXIT'] = '0'
+      ENV['FAKE_MYSQL_DROP_EXIT'] = '1'
+
+      expect { engine.cycle_database('myapp') }.to raise_error(/Failed to drop database/)
+    end
+
+    it 'raises clearly (dropped-but-not-recreated) if the recreate step fails after a successful DROP' do
+      ENV['FAKE_MYSQL_CREATE_OUTPUT'] = 'CREATE DATABASE `myapp`'
+      ENV['FAKE_MYSQL_CREATE_EXIT'] = '0'
+      ENV['FAKE_MYSQL_DROP_EXIT'] = '0'
+      ENV['FAKE_MYSQL_STDIN_EXIT'] = '1'
+
+      expect { engine.cycle_database('myapp') }.to raise_error(/dropped and NOT recreated/)
+    end
+  end
+end

data/spec/ey_backup/postgresql_engine_spec.rb

@@ -0,0 +1,188 @@
+# Regression coverage for postgresql_engine.rb's #cycle_database, added
+# alongside the ey-all#204 MySQL fix (see mysql_engine_spec.rb).
+#
+# postgresql_engine.rb's #cycle_database was audited for the same shell-
+# quoting break as MySQL's (defect A): it also captures a statement
+# (create_command) and interpolates it into a shell -c argument. It is NOT
+# vulnerable to the same trigger, because the captured statement is embedded
+# in a DOUBLE-quoted shell argument while its own internal quoting uses
+# single quotes (`ENCODING 'UTF8'`) -- single quotes are not shell-special
+# inside double quotes, so they cannot terminate the argument early the way
+# they did for MySQL's single-quoted `-e` argument. See the PR description
+# for the full analysis.
+#
+# It DID share the other half of defect A's pattern, though: neither
+# drop_database nor the final recreate call checked $? at all, so a failed
+# recreate after a successful drop would silently leave the database
+# dropped. These specs cover the exit-status hardening added for that.
+#
+# Same loading strategy as mysql_engine_spec.rb: avoids lib/ey_backup.rb's
+# ey-flex/NextGem dependency chain, uses a fake `psql`/`dropdb`/`createdb`
+# on PATH instead of a real PostgreSQL server, and uses modern rspec syntax.
+
+require 'forwardable'
+require 'stringio'
+require 'fileutils'
+require 'tmpdir'
+
+module EY
+  module Backup
+    class << self
+      attr_accessor :logger, :tmp_dir, :log_dir
+    end
+
+    class Logger
+      extend Forwardable
+      attr_reader :stdout, :stderr
+      alias_method :fatal, :abort
+      public :fatal
+      def_delegator :stdout, :puts, :puts
+
+      def initialize(stdout = $stdout, stderr = $stderr)
+        @stdout, @stderr = stdout, stderr
+      end
+
+      def info(msg);  stdout.puts("#{Time.now} #{msg}"); end
+      def warn(msg, db = nil); stdout.puts("#{Time.now} WARNING: #{msg}"); end
+      def error(msg, db = nil); stdout.puts("#{Time.now} ERROR: #{msg}"); end
+      def verbose(msg); end
+      def debug(msg); stdout.puts("#{Time.now} DEBUG: #{msg}"); end
+      def say(msg, newline = true); newline ? info(msg) : stdout.print(msg); end
+    end
+
+    module Logging
+      extend Forwardable
+      def_delegator EY::Backup, :logger
+      def_delegators :logger, :fatal, :error, :warn, :info, :verbose, :debug, :say
+    end
+  end
+end
+
+EY::Backup.logger = EY::Backup::Logger.new(StringIO.new, StringIO.new)
+
+lib_dir = File.expand_path(File.dirname(__FILE__) + '/../../lib/ey_backup')
+require lib_dir + '/spawner'
+require lib_dir + '/base'
+require lib_dir + '/engine'
+require lib_dir + '/engines/postgresql_engine'
+
+# ---- Fake psql / dropdb / createdb ---------------------------------------
+
+FAKE_PSQL_SCRIPT = <<~'SCRIPT'
+  #!/usr/bin/env bash
+  # Route by the -c argument content:
+  #  - contains "SELECT 'CREATE DATABASE" => the create_command probe
+  #  - contains "select count(*)"         => check_connections probe
+  #  - otherwise                          => the final recreate DDL execution
+  cflag=""
+  has_c=0
+  for arg in "$@"; do
+    if [ "$has_c" = "1" ]; then
+      cflag="$arg"
+      break
+    fi
+    if [ "$arg" = "-c" ]; then
+      has_c=1
+    fi
+  done
+
+  case "$cflag" in
+    *"select count(*)"*)
+      printf '%s' "${FAKE_PSQL_CONN_COUNT:-0}"
+      exit 0
+      ;;
+    *"SELECT 'CREATE DATABASE"*)
+      printf '%s' "$FAKE_PSQL_CREATE_COMMAND_OUTPUT"
+      exit "${FAKE_PSQL_CREATE_COMMAND_EXIT:-0}"
+      ;;
+    *)
+      # Final CREATE DATABASE execution
+      exit "${FAKE_PSQL_RECREATE_EXIT:-0}"
+      ;;
+  esac
+SCRIPT
+
+FAKE_DROPDB_SCRIPT = <<~'SCRIPT'
+  #!/usr/bin/env bash
+  exit "${FAKE_DROPDB_EXIT:-0}"
+SCRIPT
+
+FAKE_CREATEDB_SCRIPT = <<~'SCRIPT'
+  #!/usr/bin/env bash
+  exit "${FAKE_CREATEDB_EXIT:-0}"
+SCRIPT
+
+RSpec.describe EY::Backup::Postgresql do
+  around(:each) do |example|
+    @fake_bin_dir = Dir.mktmpdir('fake-psql-bin')
+    { 'psql' => FAKE_PSQL_SCRIPT, 'dropdb' => FAKE_DROPDB_SCRIPT, 'createdb' => FAKE_CREATEDB_SCRIPT }.each do |name, script|
+      path = File.join(@fake_bin_dir, name)
+      File.write(path, script)
+      FileUtils.chmod('+x', path)
+    end
+
+    original_path = ENV['PATH']
+    ENV['PATH'] = "#{@fake_bin_dir}:#{original_path}"
+    begin
+      example.run
+    ensure
+      ENV['PATH'] = original_path
+      %w[
+        FAKE_PSQL_CONN_COUNT FAKE_PSQL_CREATE_COMMAND_OUTPUT
+        FAKE_PSQL_CREATE_COMMAND_EXIT FAKE_PSQL_RECREATE_EXIT
+        FAKE_DROPDB_EXIT FAKE_CREATEDB_EXIT
+      ].each { |k| ENV.delete(k) }
+      FileUtils.remove_entry(@fake_bin_dir)
+    end
+  end
+
+  let(:engine) do
+    described_class.new('postgres', 'pw', 'localhost', nil, true, false, false, false)
+  end
+
+  describe '#cycle_database' do
+    context 'database does not yet exist (create_command returns empty)' do
+      it 'creates it and does not raise when createdb succeeds' do
+        ENV['FAKE_PSQL_CREATE_COMMAND_OUTPUT'] = ''
+        ENV['FAKE_CREATEDB_EXIT'] = '0'
+
+        expect { engine.cycle_database('newdb') }.not_to raise_error
+      end
+
+      it 'raises if createdb fails' do
+        ENV['FAKE_PSQL_CREATE_COMMAND_OUTPUT'] = ''
+        ENV['FAKE_CREATEDB_EXIT'] = '1'
+
+        expect { engine.cycle_database('newdb') }.to raise_error(/Failed to create database/)
+      end
+    end
+
+    context 'database exists (normal restore path)' do
+      it 'drops then recreates without raising on success' do
+        ENV['FAKE_PSQL_CONN_COUNT'] = '0'
+        ENV['FAKE_PSQL_CREATE_COMMAND_OUTPUT'] = "CREATE DATABASE myapp WITH OWNER deploy ENCODING 'UTF8' LC_COLLATE 'en_US.UTF-8' LC_CTYPE 'en_US.UTF-8' CONNECTION LIMIT -1;"
+        ENV['FAKE_DROPDB_EXIT'] = '0'
+        ENV['FAKE_PSQL_RECREATE_EXIT'] = '0'
+
+        expect { engine.cycle_database('myapp') }.not_to raise_error
+      end
+
+      it 'raises and does not attempt to recreate if dropdb fails' do
+        ENV['FAKE_PSQL_CONN_COUNT'] = '0'
+        ENV['FAKE_PSQL_CREATE_COMMAND_OUTPUT'] = "CREATE DATABASE myapp WITH OWNER deploy ENCODING 'UTF8';"
+        ENV['FAKE_DROPDB_EXIT'] = '1'
+
+        expect { engine.cycle_database('myapp') }.to raise_error(/Failed to drop database/)
+      end
+
+      it 'raises clearly (dropped-but-not-recreated) if the final recreate fails after a successful drop' do
+        ENV['FAKE_PSQL_CONN_COUNT'] = '0'
+        ENV['FAKE_PSQL_CREATE_COMMAND_OUTPUT'] = "CREATE DATABASE myapp WITH OWNER deploy ENCODING 'UTF8';"
+        ENV['FAKE_DROPDB_EXIT'] = '0'
+        ENV['FAKE_PSQL_RECREATE_EXIT'] = '1'
+
+        expect { engine.cycle_database('myapp') }.to raise_error(/dropped and NOT recreated/)
+      end
+    end
+  end
+end

metadata

@@ -1,173 +1,173 @@
 --- !ruby/object:Gem::Specification
 name: ey_cloud_server
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.5.1
 platform: ruby
 authors:
 - EngineYard
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-12-15 00:00:00.000000000 Z
+date: 2026-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 2.6.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 2.6.1
 - !ruby/object:Gem::Dependency
   name: open4
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.3.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.3.0
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.6.6.2
-    - - <=
+    - - "<="
       - !ruby/object:Gem::Version
         version: 1.6.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.6.6.2
-    - - <=
+    - - "<="
       - !ruby/object:Gem::Version
         version: 1.6.8.1
 - !ruby/object:Gem::Dependency
   name: mime-types
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 3.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 3.3.1
 - !ruby/object:Gem::Dependency
   name: fog-aws
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.1
 - !ruby/object:Gem::Dependency
   name: ey_enzyme
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 2.0.7pre1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 2.0.7pre1
 - !ruby/object:Gem::Dependency
   name: ey_instance_api_client
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.1.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.1.11
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 10.4.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 10.4.2
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
 - !ruby/object:Gem::Dependency
   name: randexp
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.1.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.1.7
 - !ruby/object:Gem::Dependency
   name: cucumber
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 2.4.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 2.4.0
 - !ruby/object:Gem::Dependency
@@ -202,28 +202,28 @@ dependencies:
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.13.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.13.7
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.16.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.16.1
 description: Miscellaneous EY server utilities
@@ -281,7 +281,9 @@ files:
 - spec/ey_backup/backup_spec.rb
 - spec/ey_backup/cli_spec.rb
 - spec/ey_backup/mysql_backups_spec.rb
+- spec/ey_backup/mysql_engine_spec.rb
 - spec/ey_backup/postgres_backups_spec.rb
+- spec/ey_backup/postgresql_engine_spec.rb
 - spec/ey_backup/spec_helper.rb
 - spec/fakefs_hax.rb
 - spec/gpg.public
@@ -298,17 +300,16 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.14
+rubygems_version: 3.2.33
 signing_key: 
 specification_version: 4
 summary: Server side components for Engine Yard's cloud
@@ -321,7 +322,9 @@ test_files:
 - spec/ey_backup/backup_spec.rb
 - spec/ey_backup/cli_spec.rb
 - spec/ey_backup/mysql_backups_spec.rb
+- spec/ey_backup/mysql_engine_spec.rb
 - spec/ey_backup/postgres_backups_spec.rb
+- spec/ey_backup/postgresql_engine_spec.rb
 - spec/ey_backup/spec_helper.rb
 - spec/fakefs_hax.rb
 - spec/gpg.public