mirror of
https://github.com/hanzoai/sqlite.git
synced 2026-10-30 18:22:26 +00:00
zooqueen
cc040ca365
V7 (was CI-theater): the Dockerfile built/tested with the inert -tags "sqlite_fts5 sqlcipher" recipe -> CodecLinked()=false -> TestEncryptionProof SKIPPED, so the gate ran green while asserting nothing about ciphertext. Switch to -tags "libsqlite3 sqlite_fts5" + the codec CFLAGS/LDFLAGS (-DSQLITE_HAS_CODEC -DSQLITE_USE_URI=1 -lsqlcipher, headers under /usr/include/sqlcipher) and run the test stage with SQLITE_REQUIRE_CODEC=1, which turns the 'codec unlinked' skip into a HARD FAILURE. The image's own gate now asserts real ciphertext; a regression to the inert recipe fails the build. V4 (defense-in-depth): WrapDEK/UnwrapDEK now take a principal-binding GCM aad; add PrincipalAAD(type,id) = the SAME length-prefixed injective encoding used for the KEK's HKDF info (DRY). The on-disk AAD is version-byte||aad, so a wrapped DEK is bound to its principal AND downgrade-proof; a sidecar moved to another principal fails the tag even if a KEK derivation ever collided. TestEnvelopeRotation extended with cross-principal negative checks. PATCH bump v0.1.3 -> v0.1.4. Verified: CGO=0 green; CGO=1+codec green with proof RUN (not skipped); inert-tag+REQUIRE fails as intended.
36 lines
1.6 KiB
Docker
36 lines
1.6 KiB
Docker
# hanzoai/sqlite — distributed encrypted SQLite
|
|
# CGO required for go-sqlite3 + sqlcipher
|
|
FROM golang:1.26.4-bookworm AS builder
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsqlcipher-dev gcc libc6-dev pkg-config \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
|
|
# Build + test with the CODEC ACTUALLY LINKED. The `-tags "sqlite_fts5 sqlcipher"`
|
|
# recipe is INERT: mattn/go-sqlite3 has no `sqlcipher` tag, so it links plain
|
|
# sqlite and silently ships PLAINTEXT — CodecLinked()=false and TestEncryptionProof
|
|
# SKIPS, so the "gate" proves nothing. The working recipe is `-tags libsqlite3`
|
|
# plus the codec CFLAGS/LDFLAGS (matches object/orgdb.go's CLAUDE.md and IAM's prod
|
|
# image). Debian's libsqlcipher-dev installs headers under /usr/include/sqlcipher.
|
|
ENV CGO_ENABLED=1 \
|
|
CGO_CFLAGS="-DSQLITE_HAS_CODEC -DSQLITE_USE_URI=1 -I/usr/include/sqlcipher" \
|
|
CGO_LDFLAGS="-lsqlcipher"
|
|
|
|
RUN go build -tags "libsqlite3 sqlite_fts5" -o /usr/local/bin/sqlite-test ./...
|
|
# The proof test MUST run (not skip) here: a linked codec yields CodecLinked()=true
|
|
# and asserts real ciphertext on disk. SQLITE_REQUIRE_CODEC=1 turns the test's
|
|
# "codec unlinked" skip into a HARD FAILURE, so a regression to the inert-tag
|
|
# recipe fails the build instead of shipping plaintext.
|
|
RUN SQLITE_REQUIRE_CODEC=1 go test -tags "libsqlite3 sqlite_fts5" -count=1 ./...
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsqlcipher0 ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
# Library only — no binary to ship. Used as a base image.
|