Skip to content

Fix SYSDBA.password not working in Firebird 3 images #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fdcastel wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fix SYSDBA.password not working in Firebird 3 images #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
20ff405
fix(fb3): provision FB3 libraries before running the installer (issue…
fdcastel Sep 23, 2026
3d3ed63
fix(fb3): bump libncurses5/libtinfo5 pin for Noble to 6.3-2ubuntu0.3
fdcastel Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions DECISIONS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,3 +121,9 @@ Also adds `tzdata` to Noble's distro `extraPackages` (matching Jammy). FB3 relie
**Decision:** The `update-repo` job in `publish-fork.yaml` only commits and pushes regenerated `generated/` and `README.md` when running on the fork's default branch (`github.event.repository.default_branch`). Dispatches on PR or feature branches still run `Invoke-Build Prepare` and `Invoke-Build Update-Readme` (so a template-substitution regression still fails the workflow) but skip the `git commit` / `git push`. Amends D-014 for the publish-fork case; `publish.yaml` (the official-repo publish) is unchanged.

**Rationale:** `publish-fork.yaml` passes `-Registry 'ghcr.io/<owner>'` to `Update-Readme`, which substitutes the fork's registry into the README table header. The previous unguarded auto-commit pushed that fork-specific README back to whatever branch was dispatched, including branches with open upstream PRs — directly polluting the PR diff with content that must not land upstream, and breaking GitHub's linear rebase when the upstream master had its own concurrent `README.md` changes (observed during PR #43, which required a force-pushed clean rebase to unblock). Branch-gating preserves D-014's "generated/ tracked in git" invariant on the fork's default branch while keeping PR/feature branches diff-clean against upstream. Confines the `-Registry` rewrite to the only place the fork wants it (its own showcased README on `master`).

## D-019: FB3 library provisioning runs before the Firebird installer

**Decision:** The FB3-only `libtommath.so.0` symlink and the `libncurses5`/`libtinfo5` provisioning (D-017) run inside the main `RUN` step, after the prerequisite `apt-get install` and before `./install.sh -silent`. They are no longer separate `RUN` steps after the install. Amends the placement described in D-017; the provisioning logic itself is unchanged.

**Rationale:** The FB3 installer sets the generated SYSDBA password with `gsec -add sysdba -pw <password>`, and then writes that password to `/opt/firebird/SYSDBA.password`. FB3's `gsec` (and `libfbclient`, `libSrp.so`) link against `libtommath.so.0` and `libncurses.so.5`/`libtinfo.so.5`. With the libraries provisioned only after the install, `gsec` failed with `error while loading shared libraries: libtommath.so.0`; the installer's `runSilent` wrapper printed the error and carried on. The image therefore shipped the tarball's pristine `security3.fdb` — no Srp user, no `PLG$SRP` table — alongside a `SYSDBA.password` file holding a password that was never set. Any Srp login then failed with the misleading `Install incomplete, please read the Compatibility chapter in the release notes for this version`. The defect stayed hidden because `FIREBIRD_ROOT_PASSWORD` (used in every documented example) and `FIREBIRD_USER` both go through the Srp user manager at container start, which creates the missing structures. The test suite now covers the stock, no-environment container. FB4+ is unaffected: its binaries' dependencies are satisfied by the prerequisite packages. See [issue #47](https://github.com/FirebirdSQL/firebird-docker/issues/47).
82 changes: 34 additions & 48 deletions generated/3.0.10/bookworm/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,40 @@ RUN set -eux; \
ca-certificates \
curl; \
\
# FB 3.0 only: provide libtommath.so.0 and libncurses5/libtinfo5 BEFORE running the installer.
# The installer sets the SYSDBA password with 'gsec', which cannot start without them.
# See DECISIONS.md D-019 and https://github.com/FirebirdSQL/firebird-docker/issues/47
if [ "$FIREBIRD_MAJOR" = "3" ]; then \
# Fix libtommath -- https://github.com/FirebirdSQL/firebird/issues/5716#issuecomment-826239174
MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null || echo "$(uname -m)-linux-gnu"); \
ln -sf /usr/lib/$MULTIARCH/libtommath.so.1 /usr/lib/$MULTIARCH/libtommath.so.0; \
\
# libncurses5/libtinfo5 were dropped from apt on Debian Trixie and Ubuntu Noble; pull them from the previous release pool.
# See DECISIONS.md D-017 and https://github.com/FirebirdSQL/firebird-docker/issues/42
. /etc/os-release; \
case "$ID-$VERSION_CODENAME" in \
debian-bookworm|debian-bullseye|ubuntu-jammy) \
apt-get install -y --no-install-recommends libtinfo5 libncurses5 \
;; \
debian-trixie) \
curl -fSL -o /tmp/libtinfo5.deb http://deb.debian.org/debian/pool/main/n/ncurses/libtinfo5_6.4-4_amd64.deb; \
curl -fSL -o /tmp/libncurses5.deb http://deb.debian.org/debian/pool/main/n/ncurses/libncurses5_6.4-4_amd64.deb; \
dpkg -i /tmp/libtinfo5.deb /tmp/libncurses5.deb; \
rm -f /tmp/libtinfo5.deb /tmp/libncurses5.deb \
;; \
ubuntu-noble) \
curl -fSL -o /tmp/libtinfo5.deb http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.3_amd64.deb; \
curl -fSL -o /tmp/libncurses5.deb http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libncurses5_6.3-2ubuntu0.3_amd64.deb; \
dpkg -i /tmp/libtinfo5.deb /tmp/libncurses5.deb; \
rm -f /tmp/libtinfo5.deb /tmp/libncurses5.deb \
;; \
*) \
echo "FB3: no libncurses5 provisioning path for $ID-$VERSION_CODENAME" >&2; \
exit 1 \
;; \
esac; \
fi; \
\
# Download
ARCH=$(dpkg --print-architecture); \
case "$ARCH" in \
Expand Down Expand Up @@ -67,54 +101,6 @@ RUN set -eux; \
apt-get clean; \
rm -rf /var/lib/apt/lists/*

# Fix libtommath for FB 3.0 -- https://github.com/FirebirdSQL/firebird/issues/5716#issuecomment-826239174
RUN set -eux; \
ARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null || echo "$(uname -m)-linux-gnu"); \
[ $FIREBIRD_MAJOR -eq 3 ] && ln -sf /usr/lib/$ARCH/libtommath.so.1 /usr/lib/$ARCH/libtommath.so.0 || true

# FB 3.0 needs libncurses5/libtinfo5. On Debian Trixie and Ubuntu Noble those
# packages were dropped from apt; pull them from the previous release pool.
# See DECISIONS.md D-017 and https://github.com/FirebirdSQL/firebird-docker/issues/42
RUN set -eux; \
if [ "$FIREBIRD_MAJOR" = "3" ]; then \
. /etc/os-release; \
case "$ID-$VERSION_CODENAME" in \
debian-bookworm|debian-bullseye|ubuntu-jammy) \
apt-get update; \
apt-get install -y --no-install-recommends libtinfo5 libncurses5; \
rm -rf /var/lib/apt/lists/* \
;; \
debian-trixie) \
apt-get update; \
apt-get install -y --no-install-recommends ca-certificates curl; \
cd /tmp; \
curl -fSL -O http://deb.debian.org/debian/pool/main/n/ncurses/libtinfo5_6.4-4_amd64.deb; \
curl -fSL -O http://deb.debian.org/debian/pool/main/n/ncurses/libncurses5_6.4-4_amd64.deb; \
dpkg -i libtinfo5_6.4-4_amd64.deb libncurses5_6.4-4_amd64.deb; \
rm -f libtinfo5_6.4-4_amd64.deb libncurses5_6.4-4_amd64.deb; \
apt-get purge -y --auto-remove curl ca-certificates; \
apt-get clean; \
rm -rf /var/lib/apt/lists/* \
;; \
ubuntu-noble) \
apt-get update; \
apt-get install -y --no-install-recommends ca-certificates curl; \
cd /tmp; \
curl -fSL -O http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.2_amd64.deb; \
curl -fSL -O http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libncurses5_6.3-2ubuntu0.2_amd64.deb; \
dpkg -i libtinfo5_6.3-2ubuntu0.2_amd64.deb libncurses5_6.3-2ubuntu0.2_amd64.deb; \
rm -f libtinfo5_6.3-2ubuntu0.2_amd64.deb libncurses5_6.3-2ubuntu0.2_amd64.deb; \
apt-get purge -y --auto-remove curl ca-certificates; \
apt-get clean; \
rm -rf /var/lib/apt/lists/* \
;; \
*) \
echo "FB3: no libncurses5 provisioning path for $ID-$VERSION_CODENAME" >&2; \
exit 1 \
;; \
esac; \
fi

# System path
ENV PATH=/opt/firebird/bin:$PATH

Expand Down
82 changes: 34 additions & 48 deletions generated/3.0.10/bullseye/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,40 @@ RUN set -eux; \
ca-certificates \
curl; \
\
# FB 3.0 only: provide libtommath.so.0 and libncurses5/libtinfo5 BEFORE running the installer.
# The installer sets the SYSDBA password with 'gsec', which cannot start without them.
# See DECISIONS.md D-019 and https://github.com/FirebirdSQL/firebird-docker/issues/47
if [ "$FIREBIRD_MAJOR" = "3" ]; then \
# Fix libtommath -- https://github.com/FirebirdSQL/firebird/issues/5716#issuecomment-826239174
MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null || echo "$(uname -m)-linux-gnu"); \
ln -sf /usr/lib/$MULTIARCH/libtommath.so.1 /usr/lib/$MULTIARCH/libtommath.so.0; \
\
# libncurses5/libtinfo5 were dropped from apt on Debian Trixie and Ubuntu Noble; pull them from the previous release pool.
# See DECISIONS.md D-017 and https://github.com/FirebirdSQL/firebird-docker/issues/42
. /etc/os-release; \
case "$ID-$VERSION_CODENAME" in \
debian-bookworm|debian-bullseye|ubuntu-jammy) \
apt-get install -y --no-install-recommends libtinfo5 libncurses5 \
;; \
debian-trixie) \
curl -fSL -o /tmp/libtinfo5.deb http://deb.debian.org/debian/pool/main/n/ncurses/libtinfo5_6.4-4_amd64.deb; \
curl -fSL -o /tmp/libncurses5.deb http://deb.debian.org/debian/pool/main/n/ncurses/libncurses5_6.4-4_amd64.deb; \
dpkg -i /tmp/libtinfo5.deb /tmp/libncurses5.deb; \
rm -f /tmp/libtinfo5.deb /tmp/libncurses5.deb \
;; \
ubuntu-noble) \
curl -fSL -o /tmp/libtinfo5.deb http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.3_amd64.deb; \
curl -fSL -o /tmp/libncurses5.deb http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libncurses5_6.3-2ubuntu0.3_amd64.deb; \
dpkg -i /tmp/libtinfo5.deb /tmp/libncurses5.deb; \
rm -f /tmp/libtinfo5.deb /tmp/libncurses5.deb \
;; \
*) \
echo "FB3: no libncurses5 provisioning path for $ID-$VERSION_CODENAME" >&2; \
exit 1 \
;; \
esac; \
fi; \
\
# Download
ARCH=$(dpkg --print-architecture); \
case "$ARCH" in \
Expand Down Expand Up @@ -67,54 +101,6 @@ RUN set -eux; \
apt-get clean; \
rm -rf /var/lib/apt/lists/*

# Fix libtommath for FB 3.0 -- https://github.com/FirebirdSQL/firebird/issues/5716#issuecomment-826239174
RUN set -eux; \
ARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null || echo "$(uname -m)-linux-gnu"); \
[ $FIREBIRD_MAJOR -eq 3 ] && ln -sf /usr/lib/$ARCH/libtommath.so.1 /usr/lib/$ARCH/libtommath.so.0 || true

# FB 3.0 needs libncurses5/libtinfo5. On Debian Trixie and Ubuntu Noble those
# packages were dropped from apt; pull them from the previous release pool.
# See DECISIONS.md D-017 and https://github.com/FirebirdSQL/firebird-docker/issues/42
RUN set -eux; \
if [ "$FIREBIRD_MAJOR" = "3" ]; then \
. /etc/os-release; \
case "$ID-$VERSION_CODENAME" in \
debian-bookworm|debian-bullseye|ubuntu-jammy) \
apt-get update; \
apt-get install -y --no-install-recommends libtinfo5 libncurses5; \
rm -rf /var/lib/apt/lists/* \
;; \
debian-trixie) \
apt-get update; \
apt-get install -y --no-install-recommends ca-certificates curl; \
cd /tmp; \
curl -fSL -O http://deb.debian.org/debian/pool/main/n/ncurses/libtinfo5_6.4-4_amd64.deb; \
curl -fSL -O http://deb.debian.org/debian/pool/main/n/ncurses/libncurses5_6.4-4_amd64.deb; \
dpkg -i libtinfo5_6.4-4_amd64.deb libncurses5_6.4-4_amd64.deb; \
rm -f libtinfo5_6.4-4_amd64.deb libncurses5_6.4-4_amd64.deb; \
apt-get purge -y --auto-remove curl ca-certificates; \
apt-get clean; \
rm -rf /var/lib/apt/lists/* \
;; \
ubuntu-noble) \
apt-get update; \
apt-get install -y --no-install-recommends ca-certificates curl; \
cd /tmp; \
curl -fSL -O http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.2_amd64.deb; \
curl -fSL -O http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libncurses5_6.3-2ubuntu0.2_amd64.deb; \
dpkg -i libtinfo5_6.3-2ubuntu0.2_amd64.deb libncurses5_6.3-2ubuntu0.2_amd64.deb; \
rm -f libtinfo5_6.3-2ubuntu0.2_amd64.deb libncurses5_6.3-2ubuntu0.2_amd64.deb; \
apt-get purge -y --auto-remove curl ca-certificates; \
apt-get clean; \
rm -rf /var/lib/apt/lists/* \
;; \
*) \
echo "FB3: no libncurses5 provisioning path for $ID-$VERSION_CODENAME" >&2; \
exit 1 \
;; \
esac; \
fi

# System path
ENV PATH=/opt/firebird/bin:$PATH

Expand Down
82 changes: 34 additions & 48 deletions generated/3.0.10/jammy/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,40 @@ RUN set -eux; \
ca-certificates \
curl; \
\
# FB 3.0 only: provide libtommath.so.0 and libncurses5/libtinfo5 BEFORE running the installer.
# The installer sets the SYSDBA password with 'gsec', which cannot start without them.
# See DECISIONS.md D-019 and https://github.com/FirebirdSQL/firebird-docker/issues/47
if [ "$FIREBIRD_MAJOR" = "3" ]; then \
# Fix libtommath -- https://github.com/FirebirdSQL/firebird/issues/5716#issuecomment-826239174
MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null || echo "$(uname -m)-linux-gnu"); \
ln -sf /usr/lib/$MULTIARCH/libtommath.so.1 /usr/lib/$MULTIARCH/libtommath.so.0; \
\
# libncurses5/libtinfo5 were dropped from apt on Debian Trixie and Ubuntu Noble; pull them from the previous release pool.
# See DECISIONS.md D-017 and https://github.com/FirebirdSQL/firebird-docker/issues/42
. /etc/os-release; \
case "$ID-$VERSION_CODENAME" in \
debian-bookworm|debian-bullseye|ubuntu-jammy) \
apt-get install -y --no-install-recommends libtinfo5 libncurses5 \
;; \
debian-trixie) \
curl -fSL -o /tmp/libtinfo5.deb http://deb.debian.org/debian/pool/main/n/ncurses/libtinfo5_6.4-4_amd64.deb; \
curl -fSL -o /tmp/libncurses5.deb http://deb.debian.org/debian/pool/main/n/ncurses/libncurses5_6.4-4_amd64.deb; \
dpkg -i /tmp/libtinfo5.deb /tmp/libncurses5.deb; \
rm -f /tmp/libtinfo5.deb /tmp/libncurses5.deb \
;; \
ubuntu-noble) \
curl -fSL -o /tmp/libtinfo5.deb http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.3_amd64.deb; \
curl -fSL -o /tmp/libncurses5.deb http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libncurses5_6.3-2ubuntu0.3_amd64.deb; \
dpkg -i /tmp/libtinfo5.deb /tmp/libncurses5.deb; \
rm -f /tmp/libtinfo5.deb /tmp/libncurses5.deb \
;; \
*) \
echo "FB3: no libncurses5 provisioning path for $ID-$VERSION_CODENAME" >&2; \
exit 1 \
;; \
esac; \
fi; \
\
# Download
ARCH=$(dpkg --print-architecture); \
case "$ARCH" in \
Expand Down Expand Up @@ -68,54 +102,6 @@ RUN set -eux; \
apt-get clean; \
rm -rf /var/lib/apt/lists/*

# Fix libtommath for FB 3.0 -- https://github.com/FirebirdSQL/firebird/issues/5716#issuecomment-826239174
RUN set -eux; \
ARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null || echo "$(uname -m)-linux-gnu"); \
[ $FIREBIRD_MAJOR -eq 3 ] && ln -sf /usr/lib/$ARCH/libtommath.so.1 /usr/lib/$ARCH/libtommath.so.0 || true

# FB 3.0 needs libncurses5/libtinfo5. On Debian Trixie and Ubuntu Noble those
# packages were dropped from apt; pull them from the previous release pool.
# See DECISIONS.md D-017 and https://github.com/FirebirdSQL/firebird-docker/issues/42
RUN set -eux; \
if [ "$FIREBIRD_MAJOR" = "3" ]; then \
. /etc/os-release; \
case "$ID-$VERSION_CODENAME" in \
debian-bookworm|debian-bullseye|ubuntu-jammy) \
apt-get update; \
apt-get install -y --no-install-recommends libtinfo5 libncurses5; \
rm -rf /var/lib/apt/lists/* \
;; \
debian-trixie) \
apt-get update; \
apt-get install -y --no-install-recommends ca-certificates curl; \
cd /tmp; \
curl -fSL -O http://deb.debian.org/debian/pool/main/n/ncurses/libtinfo5_6.4-4_amd64.deb; \
curl -fSL -O http://deb.debian.org/debian/pool/main/n/ncurses/libncurses5_6.4-4_amd64.deb; \
dpkg -i libtinfo5_6.4-4_amd64.deb libncurses5_6.4-4_amd64.deb; \
rm -f libtinfo5_6.4-4_amd64.deb libncurses5_6.4-4_amd64.deb; \
apt-get purge -y --auto-remove curl ca-certificates; \
apt-get clean; \
rm -rf /var/lib/apt/lists/* \
;; \
ubuntu-noble) \
apt-get update; \
apt-get install -y --no-install-recommends ca-certificates curl; \
cd /tmp; \
curl -fSL -O http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.2_amd64.deb; \
curl -fSL -O http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libncurses5_6.3-2ubuntu0.2_amd64.deb; \
dpkg -i libtinfo5_6.3-2ubuntu0.2_amd64.deb libncurses5_6.3-2ubuntu0.2_amd64.deb; \
rm -f libtinfo5_6.3-2ubuntu0.2_amd64.deb libncurses5_6.3-2ubuntu0.2_amd64.deb; \
apt-get purge -y --auto-remove curl ca-certificates; \
apt-get clean; \
rm -rf /var/lib/apt/lists/* \
;; \
*) \
echo "FB3: no libncurses5 provisioning path for $ID-$VERSION_CODENAME" >&2; \
exit 1 \
;; \
esac; \
fi

# System path
ENV PATH=/opt/firebird/bin:$PATH

Expand Down
Loading
Loading