mirror of
https://github.com/hanzoai/sqlite.git
synced 2026-10-30 18:22:26 +00:00
zooqueenandHanzo Dev
3af61e415c
macOS ships a native tmpfs (mount_tmpfs), and statfs names the filesystem type, so the envelope's fail-closed guard can now say yes to a real tmpfs mount on darwin instead of refusing the platform outright. Until now every encrypted store was untestable on a Mac: isRAMBacked was hard false off Linux, so cek-backed suites failed on any commit and that noise is where real failures go to hide. A RAM disk image still fails closed — statfs cannot tell its HFS+/APFS volume from a real disk, and the guard only accepts what it can verify. The positive test binds to any tmpfs already mounted and skips otherwise, since creating one needs root. Co-authored-by: Hanzo Dev <[email protected]>
12 lines
546 B
Go
12 lines
546 B
Go
//go:build !linux && !darwin
|
|
|
|
package sqlite
|
|
|
|
// isRAMBacked can only be verified where statfs names the filesystem — Linux
|
|
// (magic numbers) and darwin (type name) have their own files. Everywhere else
|
|
// it reports false, so the envelope's scratch resolver fails closed rather than
|
|
// risk materialising a decrypted database on persistent storage. A host here
|
|
// that needs the pure-Go codec must first gain a verified check like those two;
|
|
// until then, use the CGO+libsqlcipher backend.
|
|
func isRAMBacked(dir string) bool { return false }
|