feat: opt-in IBM DB2 support behind the db2 build tag#140
Conversation
The go_ibm_db driver is cgo and links IBM's native CLI driver, so it is excluded from default builds: make build stays pure Go (CGO_ENABLED=0, cross-compilable, no clidriver needed) and a db2:// DSN on a default binary returns a clear rebuild hint. make build-db2 scopes the CGO flags to that one invocation and bakes the library path into the binary (rpath on Linux, install_name_tool on macOS) so no LD_LIBRARY_PATH or DYLD_LIBRARY_PATH is needed at run time. URL-form DSNs brace-quote credentials containing DSN metacharacters and forward query parameters as DB2 connection keywords, rejecting collisions with URL-derived keywords.
The db2 binary now resolves the clidriver relative to itself first ($ORIGIN/clidriver/lib on Linux, @executable_path on macOS) before falling back to the build-time DB2HOME, so make package-db2 can ship a single archive (binary + clidriver + IBM license files) that customers untar and run anywhere with no installation or environment variables. Verified end-to-end on macOS and on linux/amd64 in a bare debian:bookworm-slim container; the clidriver's one OS dependency, libxml2, is documented and added to the Docker example.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| // Build DB2 DSN format | ||
| // HOSTNAME=SERVER_NAME;PORT=DB_PORT;DATABASE=DATABASE_NAME;UID=USER_ID;PWD=PASSWORD | ||
| var dsnParts []string | ||
| dsnParts = append(dsnParts, fmt.Sprintf("HOSTNAME=%s", hostname)) |
There was a problem hiding this comment.
🟡 Suggestion: hostname is the only URL-derived value not passed through quoteDB2Value, unlike UID/PWD/DATABASE and query keywords. Go's url.Parse permits ; in the host (a sub-delim), so a configured DSN like db2://h;SECURITY=NONE@host/db would splice an extra HOSTNAME=h;SECURITY=NONE keyword pair into the DB2 connection string, bypassing the reserved-keyword rejection the rest of the code enforces. Low exploitability since the DSN comes from operator config, but for consistency run hostname through quoteDB2Value (or reject ;{= in it). (medium confidence)
Connector PR Review: feat: opt-in IBM DB2 support behind the db2 build tagBlocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0 Review SummaryScanned the full PR diff for security and correctness. This adds opt-in IBM DB2 support gated behind the Security IssuesNone found. Correctness IssuesNone found. Suggestions
Prompt for AI agents |
1 participant
Description
Adds IBM DB2 as a supported engine, fully isolated behind a
db2Go build tag.DB2 is unlike every other engine here: no pure-Go driver exists (the only two DRDA-in-Go attempts are abandoned), so the only viable driver is IBM's
github.com/ibmdb/go_ibm_db— cgo, linking IBM's native ODBC/CLI driver ("clidriver"). Left unguarded, that import breaks default builds, cross-compilation, and the goreleaser release pipeline. This PR quarantines it so the cost is paid only by builds that opt in.Default build: zero behavior change
make build,go test, lint, and the release pipeline stay pure Go — no IBM software, no CGO flags, no env vars,CGO_ENABLED=0cross-compilation intact.db2://DSN fails fast with:baton-sql: DB2 support not compiled into this binary; rebuild with -tags db2 (see docs/db2.md).What
-tags db2addspkg/database/db2: driver registration (tagged), stubConnect(!db2), URL→native DSN conversion.;in a password would otherwise silently truncate it or inject connection keywords), URL query params are forwarded as connection keywords, and params colliding with URL-derived keywords are rejected.pkg/bsql.Build & distribution
make build-db2— CGO flags scoped inline to that one command (never exported),-tags db2.$ORIGIN/clidriver/libon Linux,@executable_pathon macOS with the load command rewritten to@rpath), falling back to the build-timeDB2HOME. NoLD_LIBRARY_PATH/DYLD_LIBRARY_PATHat run time in either layout.make package-db2— self-contained ~55 MB tarball (binary + clidriver + IBM'slicense/directory, which the redistribution terms require shipping). Customers untar and run; no installation, no root, no env vars.docs/db2.md— setup, troubleshooting, Docker example, and redistribution-licensing notes (including the GSKit TLS and Db2 Connect caveats).Verification
CGO_ENABLED=0;GOOS=linuxcross-compile; full test suite; golangci-lint (no new findings);go vet -tags db2.debian:bookworm-slimcontainer with the fallback pointed at a nonexistent directory.libxml2— documented and added to the Docker example (it is preinstalled on full server distros, absent in slim images).Notes for reviewers
vendor/github.com/ibmdb+vendor/github.com/ibmruntimes; the reviewable surface ispkg/database/db2, small switch additions inpkg/database/database.goandpkg/bsql, the Makefile targets, and docs.package-db2bundle or a Docker image until releng wants to own a DB2 artifact.Useful links: