Juts a clarification: 
The Fedora Git repository for MariaDB is accesible here:
https://src.fedoraproject.org/cgit/rpms/mariadb.git/
The link to github leads to my own developement repository, that containts actual version, as I work on it, before it is pushed to the Fedora project.
Comment is good. Will probably add User/Group to the table here https://mariadb.com/kb/en/mariadb/systemd/ and use this URL as a reference as this seems to be a lot more specific to mariadb than the fedora systemd page.
Setting log-error prevents the output going to stdout/error and hence going to file rather than the systemd-journald service. mschorm is this still intended? Are datadir, pid and socket still needed as these seem to be the default?
Systemd and supporting scripts
- mysql-check-socket.sh
- mysql-wait-ready.sh
There seem to pre-date the systemd Type=notify which advises systemd when the socket is listening as as such aren't necessary.
- mysql-wait-stop.sh
This might be a workaround for MDEV-9202 if systemd uses this script before counting TimeoutStopSec. Is this the case? Can ExecStartPost be used to avoid the counting of TimeoutStartSec until after the script is complete? Upstream systemd RFE lodged which might be an option (https://github.com/systemd/systemd/issues/5868).
Might be able to consider merging mysql-check-upgrade.sh and mysql-prepare-db-dir.sh.
mariadb-server-galera.te differences to mariadb-server-galera.te added in MDEV-6829
- FC has "allow anon_inodefs_t:file getattr" while MariaDB has "anon_inodefs_t:file write"
Generally MariaDB has more allows to allow for xtradb sst mechanism.
mariadb-ssl-cypher.patch -> is part of 56c4cfe0 (MDEV-9293)
mariadb-string-overflow.patch -> fixed in a different way looking at the mysql upstream bugs
my.cnf.in -> same as ./support-files/rpm/my.cnf except for reference to symlinks - > is there really any security risks here? Possibly some if its pointed to a user writeable area however that has just the same level of risks without symlinks.
mysql.service.in -> https://github.com/MariaDB/server/pull/387 - will need defining the @SYSTEMD_EXECSTARTPRE@ and @SYSTEMD_EXECSTARTPOST@ to refer to the distro pre/post scripts. Note PermissionsStartOnly=true meaning scipts may need to change privs.
mysql@.service.in - does multi instance using --defaults-group-suffix=.%I which is different from mariadb version. Could consolidate with ConditionPathExists, the header comments and ExecStart args however its a bit messy.
Overdue PR. (which is quite minimal)
mschorm The PR was merged into 10.2. I believe the root cause for the --basedir patch was fixed with https://github.com/MariaDB/server/commit/355ee6877beccf27bcd07d845c985fc1a2845aca as I was unable to reproduce it in 10.3.
I will revert that change in 10.3. Can you please double check that you can not reproduce it either.