mirror of
https://github.com/hanzoai/cek.git
synced 2026-10-09 02:37:18 +00:00
zeekay
9a1bb1a669
A store whose file predates cek is plaintext at rest, and until now the only answers were to leave it that way or to point cek at a different file and serve an empty one. Convert is the third: it makes the existing file encrypted under the key its namespace and subsystem already derive, without losing a row. The plaintext stays the source of truth until an atomic rename commits, and the rename happens only after the copy has reproduced the source schema, per-table row count and per-table content hash, passed integrity_check, and re-opened under the same keyed path the application uses. A key that cannot open the result is therefore caught while the original is still there. The transient plaintext left by the commit is shredded as soon as the encrypted database opens. A derived key is what makes the crash cases readable from the files alone: there is no per-file key material that could be lost or fall out of step with the database it belongs to, so an interrupted swap can always be finished. OpenAt comes with it — Open for a store whose location is settled by a mounted volume rather than by the namespace. Open is now that function over namespace.Path, so there is still one derivation and one keyed open.
cek
Opens a namespace's SQLite database encrypted at rest.
cek.SetMaster(k) // once, at boot, from KMS
db, err := cek.Open(ns, "treasury", dataDir) // everywhere else
The key is derived from the master and the namespace. It is not generated, not wrapped, not stored, and not rotated in place — so there is no unwrap step, no rewrap step, no per-file key material to lose, and no migration path to maintain. A database is born encrypted or it does not exist.
Losing the master loses the data. That is the property you want from encryption at rest, and the reason the master lives in KMS.
Where it sits
hanzoai/namespace |
names the entity, and where its file lives |
hanzoai/cek |
turns the master + that name into the file's key, and opens it |
hanzoai/sqlite |
opens a file under a raw key; knows nothing about who owns it |
hanzoai/kms |
holds the master |
Nothing here knows about orgs, users, billing or plugins. It knows a namespace, a subsystem, and a master key.