Description:
`mysql.spec.in` enables the FIDO/WebAuthn client plugin on el8/el9 but never declares the `BuildRequires` needed to build it.
This breaks rebuilding the rpms if you do not explicitly install all required packages.
## Component
- `mysql-server` git repo, file `packaging/rpm-oel/mysql.spec.in`
(becomes `mysql.spec` inside the generated `.src.rpm`)
- Confirmed present as of tag `mysql-9.7.1` (also present, unchanged, in the
`mysql-community-9.7.1-1.el9.src.rpm` / `...-1.el10.src.rpm` source RPMs)
- Reproduced on el9 (AlmaLinux 9, Rocky Linux 9); el8 is not separately
reproduced here but the spec's `%if 0%{?rhel} >= 8` gate for
`add_fido_plugins` (see below) implies el8 is affected identically —
worth confirming on an el8 host before filing
How to repeat:
## Summary
`mysql.spec.in` turns on packaging of the FIDO2/WebAuthn client authentication
plugin (`authentication_webauthn_client.so` and its debug build) for **every**
RHEL-family target from el8 upward:
```spec
%if 0%{?rhel} >= 8
%global add_fido_plugins 1
%else
%global add_fido_plugins 0
%endif # rhel8 or above
```
`%files client-plugins` then unconditionally requires the built `.so` whenever
`add_fido_plugins` (and the also-default-on `ssl_default`) are set:
```spec
%files client-plugins
...
%if 0%{?ssl_default}
%if 0%{?add_fido_plugins}
%attr(755, root, root) %{_libdir}/mysql/plugin/authentication_webauthn_client.so
%attr(755, root, root) %{_libdir}/mysql/private/libfido2.so.1
%attr(755, root, root) %{_libdir}/mysql/private/libfido2.so.1.15.0
%endif # add_fido_plugins
...
%if 0%{?ssl_default}
%if 0%{?add_fido_plugins}
%attr(755, root, root) %{_libdir}/mysql/plugin/debug/authentication_webauthn_client.so
%endif # add_fido_plugins
```
But the `BuildRequires` for the two system packages that plugin actually needs
to compile — `libfido2-devel` and `libudev-devel` — are declared **only**
inside the el10 block:
```spec
%if 0%{?rhel} == 10
BuildRequires: annobin-annocheck
BuildRequires: annobin-plugin-gcc
BuildRequires: binutils
BuildRequires: dwz
BuildRequires: gcc-c++
BuildRequires: gcc
BuildRequires: libfido2-devel
%ifnarch aarch64
BuildRequires: libquadmath-devel
%endif
BuildRequires: libudev-devel
%endif # el10
```
The preceding el8/el9 `BuildRequires` block (immediately above, closed by
`%endif # el8 / el9`) has no equivalent `libfido2-devel` / `libudev-devel`
entries.
## Impact
On a clean el8/el9 build host where `libfido2-devel`/`libudev-devel` are not
already installed for unrelated reasons:
1. `cmake` cannot find `libudev.h`, prints a warning
(`cmake/fido2.cmake:70`) suggesting `yum install libudev-devel`, and
**silently skips** the FIDO client library and the
`authentication_webauthn_client` plugin (`libmysql/fido_client/authentication_webauthn/CMakeLists.txt:38`
— "Skipping the webauthn client authentication plugin").
2. `rpmbuild` proceeds through the entire multi-hour compile (both release
and debug configurations) and only fails at the very end, during `%files`
processing of the `mysql-community-test`/client-plugins subpackage:
```
Processing files: mysql-community-test-9.7.1-1.el9.x86_64
error: File not found: .../BUILDROOT/mysql-community-9.7.1-1.el9.x86_64/usr/lib64/mysql/plugin/debug/authentication_webauthn_client.so
```
Because `dnf`/`yum-builddep` resolves dependencies purely from the spec's
declared `BuildRequires`, it has nothing to install on el8/el9 and cannot
compensate for the gap — the missing packages must be known and supplied out
of band. Anyone building this src.rpm with a standard
`yum-builddep`/`dnf builddep` + `rpmbuild -ba` workflow on el8/el9 hits this
failure after paying the full build cost.
## Expected behaviour
The el8/el9 `BuildRequires` block should declare `libfido2-devel` and
`libudev-devel` the same way the el10 block does, e.g.:
```spec
%if 0%{?rhel} == 8 || 0%{?rhel} == 9
...
BuildRequires: libfido2-devel
BuildRequires: libudev-devel
%endif # el8 / el9
```
(or move the two `BuildRequires` lines out of the `%if 0%{?rhel} == 10`
block entirely and gate them the same way `add_fido_plugins` itself is gated,
`%if 0%{?rhel} >= 8`, so the two conditions can never drift apart again.)
## Actual behaviour
`libfido2-devel`/`libudev-devel` are absent from `BuildRequires` on el8/el9,
while `add_fido_plugins` (and thus the packaged `%files` expectations) is
enabled for el8/el9 exactly as it is for el10. The `BuildRequires` gating and
the `add_fido_plugins`/`%files` gating have drifted out of sync.
## How this was found
Building `mysql-community-9.7.1-1.el9.src.rpm` on AlmaLinux 9 and Rocky
Linux 9 via `dnf builddep` (against the extracted `mysql.spec`, which
correctly evaluates the platform's `%{?el9}`/`%{?rhel}` macros — see the
companion report
[`yum-builddep-define-srpm-bug.md`](yum-builddep-define-srpm-bug.md) for why
the spec rather than the `.src.rpm` is used as the `builddep` target)
followed by `rpmbuild -ba mysql.spec` reproduces the failure on a stock,
fully-updated image with no other build customisation. Building the
identical srpm on el10 (Rocky Linux 10) succeeds, because there
`libfido2-devel`/`libudev-devel` are pulled in automatically. Building on el9
(Oracle Linux 9) also succeeds if `libfido2-devel` and `libudev-devel` are
installed manually before `rpmbuild` runs (confirming these two packages are
the entire gap).
Also an updated mysql-rpm-builder script I have now allows me to install only explicitly defined dependencies and thus to determines if there are missing dependencies. Oracle must be explicitly installing required dependencies but this is not visible in the BuildRequires: definitions used by rpm.
See: https://github.com/sjmudd/mysql-rpm-builder/. I will add the broken and fixed (by adding explicit package list for reference in my repo so you can see this.
Suggested fix:
## Workaround
Install `libfido2-devel` and `libudev-devel` explicitly before running
`rpmbuild`/`yum-builddep` on el8/el9 targets, rather than relying on
`yum-builddep`/`dnf builddep` to resolve the full dependency set from the
spec.
## Solution
Adjust the BuildRequires to explicitly require the full dependencies.
Description: `mysql.spec.in` enables the FIDO/WebAuthn client plugin on el8/el9 but never declares the `BuildRequires` needed to build it. This breaks rebuilding the rpms if you do not explicitly install all required packages. ## Component - `mysql-server` git repo, file `packaging/rpm-oel/mysql.spec.in` (becomes `mysql.spec` inside the generated `.src.rpm`) - Confirmed present as of tag `mysql-9.7.1` (also present, unchanged, in the `mysql-community-9.7.1-1.el9.src.rpm` / `...-1.el10.src.rpm` source RPMs) - Reproduced on el9 (AlmaLinux 9, Rocky Linux 9); el8 is not separately reproduced here but the spec's `%if 0%{?rhel} >= 8` gate for `add_fido_plugins` (see below) implies el8 is affected identically — worth confirming on an el8 host before filing How to repeat: ## Summary `mysql.spec.in` turns on packaging of the FIDO2/WebAuthn client authentication plugin (`authentication_webauthn_client.so` and its debug build) for **every** RHEL-family target from el8 upward: ```spec %if 0%{?rhel} >= 8 %global add_fido_plugins 1 %else %global add_fido_plugins 0 %endif # rhel8 or above ``` `%files client-plugins` then unconditionally requires the built `.so` whenever `add_fido_plugins` (and the also-default-on `ssl_default`) are set: ```spec %files client-plugins ... %if 0%{?ssl_default} %if 0%{?add_fido_plugins} %attr(755, root, root) %{_libdir}/mysql/plugin/authentication_webauthn_client.so %attr(755, root, root) %{_libdir}/mysql/private/libfido2.so.1 %attr(755, root, root) %{_libdir}/mysql/private/libfido2.so.1.15.0 %endif # add_fido_plugins ... %if 0%{?ssl_default} %if 0%{?add_fido_plugins} %attr(755, root, root) %{_libdir}/mysql/plugin/debug/authentication_webauthn_client.so %endif # add_fido_plugins ``` But the `BuildRequires` for the two system packages that plugin actually needs to compile — `libfido2-devel` and `libudev-devel` — are declared **only** inside the el10 block: ```spec %if 0%{?rhel} == 10 BuildRequires: annobin-annocheck BuildRequires: annobin-plugin-gcc BuildRequires: binutils BuildRequires: dwz BuildRequires: gcc-c++ BuildRequires: gcc BuildRequires: libfido2-devel %ifnarch aarch64 BuildRequires: libquadmath-devel %endif BuildRequires: libudev-devel %endif # el10 ``` The preceding el8/el9 `BuildRequires` block (immediately above, closed by `%endif # el8 / el9`) has no equivalent `libfido2-devel` / `libudev-devel` entries. ## Impact On a clean el8/el9 build host where `libfido2-devel`/`libudev-devel` are not already installed for unrelated reasons: 1. `cmake` cannot find `libudev.h`, prints a warning (`cmake/fido2.cmake:70`) suggesting `yum install libudev-devel`, and **silently skips** the FIDO client library and the `authentication_webauthn_client` plugin (`libmysql/fido_client/authentication_webauthn/CMakeLists.txt:38` — "Skipping the webauthn client authentication plugin"). 2. `rpmbuild` proceeds through the entire multi-hour compile (both release and debug configurations) and only fails at the very end, during `%files` processing of the `mysql-community-test`/client-plugins subpackage: ``` Processing files: mysql-community-test-9.7.1-1.el9.x86_64 error: File not found: .../BUILDROOT/mysql-community-9.7.1-1.el9.x86_64/usr/lib64/mysql/plugin/debug/authentication_webauthn_client.so ``` Because `dnf`/`yum-builddep` resolves dependencies purely from the spec's declared `BuildRequires`, it has nothing to install on el8/el9 and cannot compensate for the gap — the missing packages must be known and supplied out of band. Anyone building this src.rpm with a standard `yum-builddep`/`dnf builddep` + `rpmbuild -ba` workflow on el8/el9 hits this failure after paying the full build cost. ## Expected behaviour The el8/el9 `BuildRequires` block should declare `libfido2-devel` and `libudev-devel` the same way the el10 block does, e.g.: ```spec %if 0%{?rhel} == 8 || 0%{?rhel} == 9 ... BuildRequires: libfido2-devel BuildRequires: libudev-devel %endif # el8 / el9 ``` (or move the two `BuildRequires` lines out of the `%if 0%{?rhel} == 10` block entirely and gate them the same way `add_fido_plugins` itself is gated, `%if 0%{?rhel} >= 8`, so the two conditions can never drift apart again.) ## Actual behaviour `libfido2-devel`/`libudev-devel` are absent from `BuildRequires` on el8/el9, while `add_fido_plugins` (and thus the packaged `%files` expectations) is enabled for el8/el9 exactly as it is for el10. The `BuildRequires` gating and the `add_fido_plugins`/`%files` gating have drifted out of sync. ## How this was found Building `mysql-community-9.7.1-1.el9.src.rpm` on AlmaLinux 9 and Rocky Linux 9 via `dnf builddep` (against the extracted `mysql.spec`, which correctly evaluates the platform's `%{?el9}`/`%{?rhel}` macros — see the companion report [`yum-builddep-define-srpm-bug.md`](yum-builddep-define-srpm-bug.md) for why the spec rather than the `.src.rpm` is used as the `builddep` target) followed by `rpmbuild -ba mysql.spec` reproduces the failure on a stock, fully-updated image with no other build customisation. Building the identical srpm on el10 (Rocky Linux 10) succeeds, because there `libfido2-devel`/`libudev-devel` are pulled in automatically. Building on el9 (Oracle Linux 9) also succeeds if `libfido2-devel` and `libudev-devel` are installed manually before `rpmbuild` runs (confirming these two packages are the entire gap). Also an updated mysql-rpm-builder script I have now allows me to install only explicitly defined dependencies and thus to determines if there are missing dependencies. Oracle must be explicitly installing required dependencies but this is not visible in the BuildRequires: definitions used by rpm. See: https://github.com/sjmudd/mysql-rpm-builder/. I will add the broken and fixed (by adding explicit package list for reference in my repo so you can see this. Suggested fix: ## Workaround Install `libfido2-devel` and `libudev-devel` explicitly before running `rpmbuild`/`yum-builddep` on el8/el9 targets, rather than relying on `yum-builddep`/`dnf builddep` to resolve the full dependency set from the spec. ## Solution Adjust the BuildRequires to explicitly require the full dependencies.