db import doesn't support --ssl flag

[michaelryanmcneill]

Bug Report

Summary

Running wp db import with the --ssl flag fails to properly connect to the database as expected.

How to reproduce

To reproduce, simply attempt to import with a user that requires SSL. For example:

$ wp db import --ssl database-2022-01-24-a50feb0.sql
Error: Failed to get current SQL modes. Reason: ERROR 1045 (28000): Access denied for user 'dbuser'@'127.0.0.1' (using password: YES)

But, if you run wp db cli --ssl, you can successfully connect to the database:

$ wp db cli --ssl
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 44
Server version: 8.0.27 Source distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [database]>

Environment

OS:	Linux 5.11.0-1025-aws #27~20.04.1-Ubuntu SMP Fri Jan 7 13:09:56 UTC 2022 x86_64
Shell:	/bin/bash
PHP binary:	/RunCloud/Packages/php74rc/bin/php
PHP version:	7.4.26
php.ini used:	/etc/php74rc/php.ini
MySQL binary:	/usr/bin/mysql
MySQL version:	mysql  Ver 15.1 Distrib 10.5.13-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2
SQL modes:
WP-CLI root dir:	phar://wp-cli.phar/vendor/wp-cli/wp-cli
WP-CLI vendor dir:	phar://wp-cli.phar/vendor
WP_CLI phar path:	/home/runcloud/webapps/example-com
WP-CLI packages dir:
WP-CLI global config:
WP-CLI project config:
WP-CLI version:	2.5.0

Temporary workaround

To temporarily workaround this issue, use wp db cli --ssl and then source the file.

$ wp db cli --ssl

MySQL [database]> source database-2022-01-24-a50feb0.sql

[AdsonCicilioti]

The --http flag don't help on this case?

(I ask because also don't know very well this scenario)

[michaelryanmcneill]

@AdsonCicilioti no, the --http flag will not help in this case. In this case the database is using TLS over TCP.

[danielbachhuber]

Thanks for the report, @michaelryanmcneill !

It looks like wp db cli --ssl works because the assoc args are passed directly through:

db-command/src/DB_Command.php

Lines 382 to 393 in 196f4d3

	public function cli( $_, $assoc_args ) {
	$command = sprintf( '/usr/bin/env mysql%s --no-auto-rehash', $this->get_defaults_flag_string( $assoc_args ) );
	WP_CLI::debug( "Running shell command: {$command}", 'db' );
	if ( ! isset( $assoc_args['database'] ) ) {
	$assoc_args['database'] = DB_NAME;
	}
	WP_CLI::debug( 'Associative arguments: ' . json_encode( $assoc_args ), 'db' );
	self::run( $command, $assoc_args, null, true );
	}

However, wp db import runs the arguments through some processing function:

db-command/src/DB_Command.php

Lines 722 to 734 in 196f4d3

	public function import( $args, $assoc_args ) {
	if ( ! empty( $args[0] ) ) {
	$result_file = $args[0];
	} else {
	$result_file = sprintf( '%s.sql', DB_NAME );
	}
	// Process options to MySQL.
	$mysql_args = array_merge(
	[ 'database' => DB_NAME ],
	self::get_dbuser_dbpass_args( $assoc_args ),
	self::get_mysql_args( $assoc_args )
	);

It looks like this was added in #123

I think we'll need to adapt ::get_mysql_args() to support --ssl.

[mmihelic13]

All db related commands listed on https://developer.wordpress.org/cli/commands/db/ would benefit from using the --ssl flag. As it stands some work over SSL and some do not.

[anthonyeden]

Hello,

I was just wondering what the path to resolving this is? Or if it's already been resolved?

Running db import on Alpine 3.21 with AWS RDS MySQL returns the following:

Failed to get current SQL modes. Reason: mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead
TLS/SSL error: Certificate verification failure: The certificate is NOT trusted.

It looks like work is underway to fix the mysql/mariadb program name warning (#271 and d44bf0d, but I'm unsure if https://github.com/wp-cli/wp-cli/blob/0187f2b4ce7e83f31bf4beecd5ad4f11ddf8b57b/php/utils.php#L1823 also needs work), but I'm not sure if anything has happened abut the SSL parameters?

[mickaelperrin]

And by extension, --skip-ssl isn't supported also and I now have issues running wp db import commands with MariaDB 10.6.21.

It looks like something changed in MariaDB configuration between 10.6.17 and 10.6.21.

Note also that skip-ssl is a MariaDB only parameter which isn't list in the mysql supported arguments of wp cli (mysql equivalent seems to be ssl-mode)

[jfernandezr]

Hi, I'm in the same situation about skipping SSL, I cannot use wp-cli in my CI scripts because of the following error:

Error: Failed to get current SQL modes. Reason: mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead
ERROR 2026 (HY000): TLS/SSL error: self-signed certificate in certificate chain

Is there any temporary solution to fix this? I've tried disabling SSL in the ~/.my.cnf but it seems it's not used by wp-cli.

For the reference, I'm using the Docker Hub wordpress:6.6.2-php8.2 image for WP and wordpress:cli-2.11.0-php8.2 for WP-CLI, with a MySQL server mysql:8.0.41.

Thanks!

[Vilasamuni]

++metoo

[Vilasamuni]

Is this related to #271 ?