[patch] Preserve generated asset ownership

images/base/rootfs/usr/local/bin/generate-certs.sh

@@ -34,9 +34,9 @@ if [ ! -s "${LEAF_CERT}" ]; then
     -set_serial "0x$(openssl rand -hex 16)" -out "${LEAF_CERT}" -days 825 -extfile "${workdir}/leaf.ext"
 fi
 chmod 0644 "${LEAF_CERT}"
-if [ -n "${HOST_UID:-}" ]; then
-  printf '%s\n' "${HOST_UID}" >"${CERT_DIR}/UID"
-  chmod 0644 "${CERT_DIR}/UID"
-  chown -R "${HOST_UID}:${HOST_GID:-${HOST_UID}}" "${CERT_DIR}"
-fi
+owner_uid="${HOST_UID:-$(stat -c %u -- "${CERT_DIR}")}"
+owner_gid="${HOST_GID:-$(stat -c %g -- "${CERT_DIR}")}"
+printf '%s\n' "${owner_uid}" >"${CERT_DIR}/UID"
+chmod 0644 "${CERT_DIR}/UID"
+chown -R "${owner_uid}:${owner_gid}" "${CERT_DIR}"
 echo "Development certificates are ready in ${CERT_DIR}."

images/base/rootfs/usr/local/bin/generate-compose-secrets.sh

@@ -49,6 +49,6 @@ while IFS=$'\t' read -r name declared; do
   chmod 0600 "${path}"
 done < <(yq -r '(.secrets // {}) | to_entries[] | select(.value.file != null) | [.key, .value.file] | @tsv' "${COMPOSE_FILE}")
 
-if [ -n "${HOST_UID:-}" ]; then
-  chown -R "${HOST_UID}:${HOST_GID:-${HOST_UID}}" "${SECRETS_ROOT}"
-fi
+owner_uid="${HOST_UID:-$(stat -c %u -- "${SECRETS_ROOT}")}"
+owner_gid="${HOST_GID:-$(stat -c %g -- "${SECRETS_ROOT}")}"
+chown -R "${owner_uid}:${owner_gid}" "${SECRETS_ROOT}"

images/base/tests/GeneratedAssetOwnership/docker-compose.yml

@@ -0,0 +1,10 @@
+---
+name: base-generatedassetownership
+services:
+  base:
+    image: ${BASE:-libops/base:local}
+    volumes:
+      - ./test.sh:/test.sh:ro
+    command:
+      - bash
+      - /test.sh

images/base/tests/GeneratedAssetOwnership/test.sh

@@ -0,0 +1,26 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+set -euo pipefail
+
+workdir="$(mktemp -d)"
+mkdir -p "${workdir}/secrets" "${workdir}/certs"
+chown 1234:1235 "${workdir}/secrets" "${workdir}/certs"
+cat >"${workdir}/compose.yaml" <<'YAML'
+secrets:
+  TEST_SECRET:
+    file: ./secrets/TEST_SECRET
+YAML
+
+(
+    cd "${workdir}"
+    generate-compose-secrets.sh
+    generate-certs.sh
+)
+
+test "$(stat -c %u "${workdir}/secrets/TEST_SECRET")" = 1234
+test "$(stat -c %g "${workdir}/secrets/TEST_SECRET")" = 1235
+test "$(stat -c %a "${workdir}/secrets/TEST_SECRET")" = 600
+test "$(stat -c %u "${workdir}/certs/privkey.pem")" = 1234
+test "$(stat -c %g "${workdir}/certs/privkey.pem")" = 1235
+test "$(stat -c %a "${workdir}/certs/privkey.pem")" = 600

images/drupal/rootfs/etc/s6-overlay/scripts/install.sh

@@ -52,22 +52,40 @@ function drush_cache_setup {
 }
 
 function install_site {
-    local existing_config_arg=()
-    if [[ "${DRUPAL_DEFAULT_INSTALL_EXISTING_CONFIG}" == "true" ]]; then
-        existing_config_arg=("--existing-config")
-    fi
+    local db_url
 
-    DRUSH_COMMAND_SITE_INSTALL_OPTIONS_ACCOUNT_PASS="${DRUPAL_DEFAULT_ACCOUNT_PASSWORD}" drush \
+    # A fresh site has no bootstrapped settings yet. Pass the database through
+    # Drush's command environment to keep its password out of process arguments.
+    db_url="mysql://$(php -r 'echo rawurlencode(getenv("DB_USER"));')"
+    db_url+=":$(php -r 'echo rawurlencode(getenv("DB_PASSWORD"));')"
+    db_url+="@${DB_HOST}:${DB_PORT}/$(php -r 'echo rawurlencode(getenv("DB_NAME"));')"
+
+    DRUSH_COMMAND_SITE_INSTALL_OPTIONS_DB_URL="${db_url}" \
+        DRUSH_COMMAND_SITE_INSTALL_OPTIONS_ACCOUNT_PASS="${DRUPAL_DEFAULT_ACCOUNT_PASSWORD}" drush \
         -n \
         -r /var/www/drupal/web \
         site:install "${DRUPAL_DEFAULT_PROFILE}" \
-        "${existing_config_arg[@]}" \
         --sites-subdir="${DRUPAL_DEFAULT_SUBDIR}" \
         --site-name="${DRUPAL_DEFAULT_NAME}" \
         --site-mail="${DRUPAL_DEFAULT_EMAIL}" \
         --account-name="${DRUPAL_DEFAULT_ACCOUNT_NAME}" \
         --account-mail="${DRUPAL_DEFAULT_ACCOUNT_EMAIL}" \
         --locale="${DRUPAL_DEFAULT_LOCALE}"
+
+    if [[ "${DRUPAL_DEFAULT_INSTALL_EXISTING_CONFIG}" == "true" ]]; then
+        local source_uuid
+        source_uuid="$(yq -r '.uuid // ""' "${DRUPAL_DEFAULT_CONFIGDIR}/system.site.yml")"
+        if [[ -z "${source_uuid}" ]]; then
+            echo "Existing configuration has no site UUID" >&2
+            return 1
+        fi
+        drush -n -r /var/www/drupal/web config:set system.site uuid \
+            "${source_uuid}" --uri="$(drush_uri)" --yes
+        drush -n -r /var/www/drupal/web config:import \
+            --source="${DRUPAL_DEFAULT_CONFIGDIR}" \
+            --uri="$(drush_uri)" \
+            --yes
+    fi
 }
 
 function run_install_hooks {