mirror of
https://github.com/hanzoai/sqlite.git
synced 2026-10-30 18:22:26 +00:00
zooqueen
467c7cd910
Register the "sqlite" database/sql driver under BOTH build tags with one API:
- //go:build cgo -> mattn/go-sqlite3 linked against libsqlcipher. Encryption
uses SQLCipher's NATIVE URI key param (file:PATH?...&key=x'HEX'), applied at
sqlite3_open_v2 time. This is the ONLY mechanism that reopens an encrypted
DB: mattn runs busy_timeout/journal_mode/foreign_keys PRAGMAs before any
ConnectHook, so a ConnectHook can create but never reopen a SQLCipher file
("file is not a database"). mainline mattn has no `sqlcipher` tag and silently
ignores `_key=`/`_pragma=key` -> the old approach shipped plaintext.
- //go:build !cgo -> modernc.org/sqlite (pure Go); registers "sqlite" via its
own init. Cannot encrypt: a keyed Open returns ErrEncryptionUnavailable and
writes nothing (fail-secure, never silent plaintext).
Decomplected: HKDF CEK derivation (cek.go) and threshold attestation
(threshold.go) are pure Go and now tag-neutral; only driver registration + DSN
construction differ by tag (driver_cgo.go / driver_nocgo.go). DSN() emits the
backend-correct params (modernc `_pragma=` form vs mattn `_busy_timeout=` form),
fixing the latent bug where modernc silently ignored mattn-style pragma params.
OpenDB(path, key) returns a *sql.DB for xorm.NewEngineWithDB callers (IAM).
TestEncryptionProof is the anti-silent-plaintext CI gate: under cgo it asserts
real ciphertext on disk + keyed reopen + wrong-key rejection, so a build that
forgets to link libsqlcipher FAILS instead of shipping plaintext.
Build (prod): CGO_ENABLED=1 -tags "libsqlite3 sqlite_fts5"
CGO_CFLAGS="-DSQLITE_HAS_CODEC -DSQLITE_USE_URI=1 -I<sqlcipher>/include/sqlcipher"
CGO_LDFLAGS="-lsqlcipher"
22 lines
595 B
AMPL
22 lines
595 B
AMPL
module github.com/hanzoai/sqlite
|
|
|
|
go 1.26.4
|
|
|
|
require (
|
|
github.com/mattn/go-sqlite3 v1.14.47
|
|
golang.org/x/crypto v0.50.0
|
|
modernc.org/sqlite v1.48.0
|
|
)
|
|
|
|
require (
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
golang.org/x/sys v0.43.0 // indirect
|
|
modernc.org/libc v1.70.0 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|