Add secure native runtime installation

scripts/smoke-native-runtime.cjs

@@ -1,7 +1,8 @@
 'use strict'
 /* eslint-disable @typescript-eslint/no-require-imports */
 
-const { existsSync, readFileSync } = require('fs')
+const { existsSync, mkdtempSync, readFileSync, rmSync } = require('fs')
+const { tmpdir } = require('os')
 const { join, resolve } = require('path')
 const { spawnSync } = require('child_process')
 
@@ -38,3 +39,27 @@ for (const [name, command, args, version] of checks) {
     throw new Error(`${name} did not report expected version ${version}: ${output}`)
   process.stdout.write(`${name} ${version} OK\n`)
 }
+
+const databaseDirectory = mkdtempSync(join(tmpdir(), 'aurora-native-mariadb-'))
+const temporaryDirectory = mkdtempSync(join(tmpdir(), 'aurora-native-mariadb-tmp-'))
+try {
+  const result = spawnSync(
+    join(root, 'bin/mariadb-install-db'),
+    [
+      '--no-defaults',
+      `--datadir=${databaseDirectory}`,
+      `--tmpdir=${temporaryDirectory}`,
+      '--auth-root-authentication-method=normal',
+      '--skip-test-db'
+    ],
+    { encoding: 'utf8' }
+  )
+  if (result.error || result.status !== 0)
+    throw result.error || new Error(`MariaDB initialization failed: ${result.stderr}`)
+  if (!existsSync(join(databaseDirectory, 'mysql')))
+    throw new Error('MariaDB initialization did not create system tables.')
+  process.stdout.write('MariaDB initialization OK\n')
+} finally {
+  rmSync(databaseDirectory, { recursive: true, force: true })
+  rmSync(temporaryDirectory, { recursive: true, force: true })
+}