31 lines
2.3 KiB
Markdown
31 lines
2.3 KiB
Markdown
# WorkbenchReplacement — native MySQL transport milestone
|
|
|
|
Open `WorkbenchReplacement.xcodeproj` in Xcode and build the **WorkbenchReplacement** macOS scheme.
|
|
|
|
This project removes the external `mysql` executable requirement. The app includes a **Swift MySQL wire-protocol implementation** and stores passwords in macOS Keychain. It has no Homebrew dependency or separately installed MySQL client requirement.
|
|
|
|
## Implemented
|
|
- macOS SwiftUI Xcode application
|
|
- Connection profiles and Keychain password storage
|
|
- Direct TCP MySQL handshake and `mysql_native_password` authentication
|
|
- `caching_sha2_password` fast authentication (when the server permits it)
|
|
- Query execution, text result parsing, database listing
|
|
- No external MySQL command line calls
|
|
|
|
## Known limitations (important)
|
|
- This is not yet a complete MySQL Workbench replacement.
|
|
- Only loopback TCP (`localhost`, `127.0.0.1`, `::1`) is allowed to prevent sending credentials to remote hosts without TLS. You can use an independently established local SSH tunnel.
|
|
- TLS negotiation, full `caching_sha2_password` authentication, Unix sockets, multi-result sets, server-side prepared statements, and full protocol error handling are not yet implemented.
|
|
- EER diagrams, `.mwb` support, admin features, backup/restore and integrated SSH are not yet implemented.
|
|
- MySQL servers requiring full caching_sha2 authentication will return an explicit unsupported error. Do not weaken server authentication to work around this.
|
|
- Network read/write timeout handling and production hardening remain necessary.
|
|
|
|
This code was assembled in a Linux environment without Xcode; compile and runtime testing on macOS are required.
|
|
|
|
|
|
## Authentication update (October 2026)
|
|
|
|
This build adds `caching_sha2_password` full authentication on **trusted loopback TCP connections** using the server-provided RSA public key and RSA-OAEP-SHA1, implemented with Apple's Security.framework. No Homebrew or external MySQL client is needed. The server public key is **not pinned or independently verified**, so this mode must not be used over untrusted networks or untrusted local proxies. Remote direct connections are refused. TLS, SSH tunnelling, key pinning, multi-result handling and full Workbench feature parity remain unimplemented.
|
|
|
|
The source was modified and packaged on Linux; it has **not** been compiled or integration-tested in Xcode.
|