--conf password silently truncated at ; (gcfg treats it as a comment), causing spurious Error 1045
- Dominant language
- Go
- Stars
- 13.6k
- Forks
- 1.4k
- Avg merge
- 2h 31m
- Merged PRs (30d)
- 4
Description
### Summary
When the MySQL password supplied via `--conf` contains a semicolon (`;`), gh-ost authenticates with only the portion **before** the `;`, resulting in `Error 1045: Access denied`. The same credentials work when passed on the command line or used directly with the `mysql` CLI, which makes this look like an auth/driver/MySQL-version problem when it is actually a config-parsing issue.
```
2026-08-14 12:54:31 INFO starting gh-ost 1.1.10 (git commit: 835f5379afe7318d80d4f347016e3d81721327c7)
2026-08-14 12:54:31 INFO Migrating `ABC`.`Table1`
2026-08-14 12:54:31 INFO Tearing down inspector
2026-08-14 12:54:31 FATAL Error 1045 (28000): Access denied for user 'ghost'@'server.domain' (using password: YES)
```
### Environment
- gh-ost version: `1.1.10 (git commit: 835f5379afe7318d80d4f347016e3d81721327c7)`
- MySQL server: `8.4.8-8 Percona Server (GPL), Release 8, Revision 1c288264`
- OS: `Rocky Linux 9.7 (Blue Onyx)`
### Steps to reproduce
1. Create a config file with a password that contains a `;`:
```ini
[client]
user=migrator
password=foo;bar
```
2. Run gh-ost with `--conf=/path/to/that.cnf`.
3. Observe authentication failure.
### Expected
The full password `foo;bar` is used and authentication succeeds.
### Actual
Only `foo` is sent as the password, producing `Error 1045: Access denied for user 'migrator'`.
### Root cause
gh-ost parses `--conf` with the [`gcfg`](https://github.com/go-gcfg/gcfg) library, which treats `;` (and `#`) as inline comment characters. An unquoted value containing `;` is truncated at the first `;`. This is not a MySQL 8.4, driver, or authentication-plugin issue — the credentials are correct; they are being read incorrectly.
### Quoting does not help
Wrapping the value in double quotes does **not** work — the password still fails to authenticate:
```ini
[client]
password="foo;bar"
```
### Workarounds
Either of these avoids the broken `--conf` parsing:
- Pass the password on the command line instead of via `--conf`: `--password='foo;bar'` (shell-quoted, bypasses gcfg).
- Change/regenerate the account password so it contains no `;` (or `#`).
### Suggested fix
Handle passwords containing `;` (and `#`) correctly when read from `--conf`, or at minimum document that these characters are unsupported in a `--conf` password so users don't hit a misleading `Error 1045`.
Contributor guide
Research direction
Start by tracing how the --conf option is parsed with gcfg and reproduce the issue using the [client] password=foo;bar configuration shown here. Done means the full password, including ; and # where supported, is preserved for authentication, or the configuration limitation is clearly documented; verify against the command-line workaround and the reported Error 1045 case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, mysql
- Domain
- cli, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100