Download

0077: MariaDB, MongoDB, PostGIS and more

On this page

Status: accepted. Adds Redis itself beside Valkey (0008), which it doesn't replace.

Context

People asked for MariaDB, MongoDB, PostGIS, Redis itself and Typesense. Each one comes with a different source and license problem:

  • MySQL's macOS downloads need macOS 15.
  • MongoDB is under the SSPL.
  • PostGIS is GPL and needs GEOS and PROJ.
  • Redis 8 is RSALv2, SSPLv1 or AGPLv3, and publishes no macOS build.
  • Typesense is GPLv3, links its dependencies statically, and publishes no checksums.

Short Leash is closed source and links no copyleft code (see the licensing rules), every download must be verified (invariant 7), and everything listens on 127.0.0.1 only (invariant 2). Valkey stays Short Leash's Redis-compatible service on macOS (0008); Redis is offered beside it for apps that want Redis itself.

Decision

MariaDB 11.8 and 10.11

  • On macOS, Short Leash's own build from ShortLeash/runtimes (0017, 0019), through the signed builds manifest (Source::LeashBuild("mariadb")). It targets macOS 13 and is relocatable. The server uses MariaDB's bundled wolfSSL, and the client library uses GnuTLS with Nettle, linked statically. MariaDB pairs them this way on Unix, and it keeps OpenSSL out of GPL-2.0-only programs.
  • On Windows, mariadb.org's zip from archive.mariadb.org, checked against the sha256sums.txt in its folder (ChecksumSource::Listing). The check fails closed. An unreadable list, a missing entry, two entries with different sums, or a URL off archive.mariadb.org's exact layout all refuse the download.
  • Other installs' option files and plugins stay out. The macOS build's compiled-in prefix is /usr/local/mysql, where another MySQL may live, so Short Leash passes MariaDB's programs their options itself (0005):
    • The server, mariadbd, starts with --no-defaults and --plugin-dir set to its own install's lib/plugin, on macOS and Windows.
    • The clients, mariadb and mariadb-dump, get the same two options first on their command line (services::mariadb_client_options), on macOS and Windows, and --skip-ssl-verify-server-cert: MariaDB 11.4's clients verify the server's certificate by default and, for Short Leash's passwordless root on 127.0.0.1, turn that off themselves with a warning on every run.
    • On macOS, mariadb-install-db sets up the data folder with --no-defaults and --basedir, and passes the server that install's plugin folder itself. A --plugin-dir of Short Leash's would be split at the space in Short Leash's home.
    • On Windows, mariadb-install-db.exe gets only --datadir. Whether it also takes --no-defaults waits on a check on Windows.
  • The MySQL-family option on macOS 13 and 14. There, kind_unavailable_reason gives MySQL "Needs macOS 15 or later. MariaDB runs on this Mac and works with MySQL apps." Add service shows that reason, and the engine's add_service refuses any kind or version that can't run here with the same reason. So leash service add and coding assistants don't report a success that can never start.
  • Port 3306 is shared with MySQL. Whichever of the two is turned on second takes the next free port the first time it starts, and saves it. A service that has run before never moves by itself: if another service holds its port, it refuses and names the holder.
  • Backups use MariaDB's own mariadb-dump, as .mariadb.sql.gz (backups::Engine::Mariadb). Explain works on MariaDB (0024), limiting its statement with max_statement_time instead of MySQL's max_execution_time.
  • Every MySQL-family restore, MariaDB's included, goes through the dump check before the client starts, and MariaDB's client then runs with --sandbox (0079).

MongoDB 8.0 and 7.0

  • Downloaded, not redistributed. Short Leash gets MongoDB's own release from fastdl.mongodb.org and runs it as a separate program, as it does MySQL under the GPL. Each server archive is checked against the .sha256 beside it and against MongoDB's release signature (.sig). The release keys for 8.0 and 7.0 are pinned in Short Leash (services::mongodb::keys) and verified with rpgp (pgp, MIT OR Apache-2.0); Sequoia-PGP was ruled out because it's LGPL. File signatures need SHA-256 or stronger. If the checksum or the signature is missing, or doesn't match, the download is refused. Database Tools have no signature check, only the SHA-256 below.
  • Database Tools (mongodump, mongorestore) install beside the server. They're checked against the SHA-256 in downloads.mongodb.org's full.json, which lists every version, read before the download starts. Backups are mongodump --archive --gzip (.archive.gz).
  • No mongosh. A minimal wire-protocol client (services::mongodb::wire) lists and drops databases, with bounded nesting and element counts. MongoDB's row has no Open in Terminal. MongoDB creates a database on its first write, so Create database doesn't make one.
  • AVX. MongoDB's x86_64 builds need AVX. Without it, unavailable_reason says so instead of letting the supervisor restart a crashing server. Windows on Arm emulates AVX from Windows 11 24H2.
  • On Windows, debug files (*.pdb) are never unpacked from the roughly 900 MB zip.
  • No outbound connections. MongoDB binds 127.0.0.1 (--bind_ip), with no Unix socket on macOS. MongoDB removed free monitoring in 7.0, and Short Leash offers nothing older. Short Leash also turns off diagnostic data collection (diagnosticDataCollectionEnabled=false), which would otherwise write files in the data folder.
  • Explain doesn't cover MongoDB: a MongoDB query shows "Explain isn't for MongoDB".

PostGIS 3.6

  • Short Leash's own build for each Postgres major Short Leash installs (14 to 18), on macOS and on Windows, through the signed manifest (postgis::pick, versions 3.6.4+pg<major>). GEOS, PROJ, json-c and protobuf-c are linked statically. On Windows, libxml2 and SQLite are built and linked statically too; on macOS they're the system's own libraries. Windows uses the same layout as macOS (lib/, extension/, proj/, doc/), with no bin/, so nothing can clash with the Postgres build's own DLLs.
  • What ShortLeash/runtimes checks before building PostGIS:
    • PostGIS's source is checked against a pinned SHA-256, and against the .md5 download.osgeo.org publishes.
    • protobuf-c is checked against a pinned SHA-256, because GitHub publishes no digest for it.
    • GEOS, PROJ and json-c are checked against GitHub's release digests.
    • On Windows only, libxml2 is checked against a pinned SHA-256 and the .sha256sum download.gnome.org publishes, and SQLite against a pinned SHA-256.
    • The Windows build uses the runner's MSYS2 toolchain, whose packages pacman checks against MSYS2's keyring. GCC's runtime (libgcc, libstdc++), winpthreads and mingw-w64's start-up code come from those packages and are linked statically; they aren't pinned by file hash, and their exact versions are recorded in each build's doc/toolchain.txt.
  • No raster support. PostGIS is built --without-raster, so there's no GDAL. postgis_topology and postgis_tiger_geocoder come with it.
  • Nothing goes online from PROJ. proj.db is copied into Postgres's share/proj. Every Postgres process runs with PROJ_DATA pointing there and PROJ_NETWORK=OFF, so PROJ never fetches grids.
  • Added per service, when asked. Add PostGIS in a PostgreSQL service's details puts postgis in the service's extensions (Engine::add_service_extension). pgvector is added automatically, but PostGIS is much larger. Once added, it's put back before Postgres starts whenever that version is installed again.
  • The install can't leave Postgres half-changed (services::pgext):
    • It downloads and checks every file, and unpacks the archive into a temporary folder, before anything in Postgres changes.
    • An archive holding a link is refused before anything is copied. So is a folder in Postgres that's a link.
    • Each file is written beside its destination and renamed over it, never written through.
    • Control files are copied last, so a copy that fails part way never looks installed.
  • On Windows, a running Postgres locks the modules it has loaded. When PostGIS's files have to be replaced there, Postgres is stopped only once the build is downloaded and checked. Its row says Adding PostGIS meanwhile. The copy waits until the process has exited (wait_exited, bounded by SERVICE_EXIT_WAIT), and then Postgres starts again whether the copy worked or not. A download that fails leaves it running.
  • A PostGIS backup restored into a Postgres without PostGIS stops with a message that says to add PostGIS first, not pg_restore's raw error.

Redis 8.10, 8.2 and 7.2

  • Built locally, on macOS only. Redis publishes no macOS build. Short Leash downloads redis-8.10.2, 8.2.10 or 7.2.16 from download.redis.io and builds it on the user's Mac with Apple's command line tools.
  • Checked before unpacking against the SHA-256 in redis/redis-hashes (ChecksumSource::Hashes), read from raw.githubusercontent.com, a different host from the download. A missing, unreadable, conflicting or non-SHA-256 entry refuses. Redis's GitHub release digest covers redis-full.tar.gz, a different file from download.redis.io's tarball, so it can't vouch for what Short Leash builds and isn't used.
  • Core only. make -C src BUILD_TLS=no builds the server and redis-cli, never the modules Redis 8 bundles. The build runs with a cleared environment that keeps only PATH, HOME, TMPDIR, LANG, SDKROOT and DEVELOPER_DIR, so variables such as CFLAGS or BUILD_WITH_MODULES can't change what's built. Redis runs on 127.0.0.1 in protected mode, from Short Leash's own redis.conf.
  • Valkey is built the same way and is now checked against valkey-io/valkey-hashes.
  • License. Redis 8 is RSALv2, SSPLv1 or AGPLv3, and 7.2 is BSD-3-Clause. Short Leash doesn't redistribute Redis: it downloads the source and runs the result as a separate program.
  • Valkey and Redis share port 6379, under the same second-to-start rule as MySQL and MariaDB.

Typesense 30.2 and 29.0

  • Not redistributed. Typesense is GPLv3 and links RocksDB, brpc, ICU, OpenSSL, ONNX Runtime and more statically. Redistributing it would make Short Leash owe the corresponding source of every one of them. So Short Leash downloads Typesense's own macOS build from dl.typesense.org.
  • Pinned checksums. dl.typesense.org publishes no checksums. Short Leash carries each version's SHA-256 for both Mac architectures (services::typesense, Source::Pinned), copied from Typesense's own Homebrew tap at commit e1cbb07 (TAP_COMMIT). A mismatch refuses before anything is unpacked. A new Typesense version comes with a Short Leash update.
  • macOS 13.1 and later (MACOS_MINIMUM). Below that it shows "Needs macOS 13.1 or later". There's no Windows build, so it isn't offered on Windows.
  • Both listeners on loopback. The API (--api-address) and the peering (Raft) service (--peering-address) both bind 127.0.0.1; peering would otherwise take the first non-loopback address, even on a single node. The peering port is the one below the API port (8108 and 8107).
  • A fixed local key, leash, goes in through the TYPESENSE_API_KEY environment variable, never the command line, where ps would show it. It isn't a secret: only this computer can reach Typesense.

What every service shares

  • Second ports move with the first. services::second_port covers Typesense's peering port and RustFS's console port. The engine's port rule (ports_of, port_owner) counts both: a busy second port blocks a start, and a new or moved instance takes the next free pair.
  • One install at a time. run_service_with takes a lock per install folder (service_prep), so two starts at once install once, and the second finds it installed.

Consequences

  • MariaDB is the MySQL-family database on macOS 13 and 14. MySQL and MariaDB backups don't restore into each other.
  • Short Leash gains one Rust dependency tree, rpgp, and leashd grows by about 1.5 MB stripped. The 7.0 release key expires on 2028-01-17, so Short Leash needs an update before then.
  • MongoDB on Windows downloads about 900 MB, of which Short Leash keeps the programs.
  • PostGIS has no raster functions. Grids that PROJ would download aren't available, so transformations use what proj.db holds.
  • MariaDB and PostGIS are GPL, with LGPL libraries, so their sources go with every copy. ShortLeash/runtimes' release step refuses a MariaDB or PostGIS build without its <name>-<version>-sources.tar.gz in the same release. Short Leash's publishing step puts each GPL build's sources tarball beside its binary before MariaDB or PostGIS ship.
  • Redis needs Apple's command line tools and about a minute for its first start, and the modules Redis 8 bundles (query engine, JSON, time series, probabilistic types) aren't there.
  • Typesense versions are tied to Short Leash releases, and a version Typesense pulls or changes upstream stops installing until Short Leash's pin changes.
  • Redis and Typesense are macOS only.
Download
Theme