mirror of
https://github.com/hanzoai/sqlite.git
synced 2026-10-30 18:22:26 +00:00
zeekayandHanzo Dev
dc2f7a4603
The pure-Go SQLCipher envelope decrypts to a plaintext scratch copy and
demanded that copy be RAM-backed, failing closed otherwise. On macOS that
meant `sudo mount_tmpfs` before any keyed store would open, and a dev
machine or a test run should not pay that.
scratchBase now PREFERS RAM-backed scratch — an operator's
HANZO_SQLITE_RAMFS_DIR if it is RAM-backed, then /dev/shm — so the
plaintext copy stays off disk wherever RAM is free (Linux, a k8s
emptyDir{medium:Memory}), and falls back to the OS temp dir where neither
exists. It never fails closed and takes no dev/test env switch; the copy
is shredded on close either way. The real at-rest guarantee is the live
libsqlcipher codec (CodecLinked), which materialises no plaintext at all
and is what a deployment that must keep plaintext off disk unconditionally
links (SQLITE_REQUIRE_CODEC=1).
Removes the ramfsBase fail-closed error, the HANZO_SQLITE_INSECURE_DEV /
HANZO_DEV opt-out, and the per-platform ramfsHint files. isRAMBacked stays
as the RAM preference. Tests follow: a keyed open with no RAM scratch now
succeeds through temp, round-trips, and writes only ciphertext at rest.
Co-authored-by: Hanzo Dev <[email protected]>
64 lines
2.2 KiB
Go
64 lines
2.2 KiB
Go
package sqlite
|
|
|
|
import (
|
|
"bytes"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/hanzoai/sqlcipher"
|
|
)
|
|
|
|
// A keyed store is SQLCipher 4, and OUR pure-Go reader is what proves it.
|
|
//
|
|
// TestEncryptionProof beside this asserts the file is not plaintext, which any
|
|
// cipher satisfies — a backend that invented its own format would pass it and
|
|
// leave a database no other Hanzo build could open. This asserts the FORMAT:
|
|
// `github.com/hanzoai/sqlcipher` decrypts the file with the same key and finds a
|
|
// real SQLite database with the row in it.
|
|
//
|
|
// It runs under BOTH build tags on purpose, and that is the interoperability the
|
|
// estate depends on: the C libsqlcipher writes what our pure-Go codec reads, so a
|
|
// store written by a CGO_ENABLED=0 build opens in the image, and one written by
|
|
// the image opens in a pure-Go tool. Under cgo it additionally proves the C
|
|
// library really is SQLCipher rather than a plain SQLite that ignored the key.
|
|
func TestKeyedFileIsOurSQLCipher(t *testing.T) {
|
|
|
|
const marker = "sqlcipher-format-canary-1d4e"
|
|
key := make([]byte, 32)
|
|
for i := range key {
|
|
key[i] = byte(i*11 + 3)
|
|
}
|
|
|
|
path := filepath.Join(t.TempDir(), "format.db")
|
|
db, err := Open(path, WithRawKey(key))
|
|
if err != nil {
|
|
t.Fatalf("open with key: %v", err)
|
|
}
|
|
if _, err := db.Exec(`CREATE TABLE c (v TEXT)`); err != nil {
|
|
t.Fatalf("create: %v", err)
|
|
}
|
|
if _, err := db.Exec(`INSERT INTO c (v) VALUES (?)`, marker); err != nil {
|
|
t.Fatalf("insert: %v", err)
|
|
}
|
|
if err := db.Close(); err != nil {
|
|
t.Fatalf("close: %v", err)
|
|
}
|
|
|
|
raw, err := os.ReadFile(path)
|
|
if err != nil {
|
|
t.Fatalf("read: %v", err)
|
|
}
|
|
|
|
var plain bytes.Buffer
|
|
if err := sqlcipher.DecryptFile(&plain, bytes.NewReader(raw), sqlcipher.RawKey(key), sqlcipher.Params{}); err != nil {
|
|
t.Fatalf("hanzoai/sqlcipher could not decrypt the keyed store, so it is not SQLCipher 4 under this key: %v", err)
|
|
}
|
|
if !bytes.HasPrefix(plain.Bytes(), []byte("SQLite format 3\x00")) {
|
|
t.Fatal("decrypted bytes are not a SQLite database: the file is ciphertext of something else")
|
|
}
|
|
if !bytes.Contains(plain.Bytes(), []byte(marker)) {
|
|
t.Fatal("the row is not in the decrypted database: the key opened it and the content is not ours")
|
|
}
|
|
}
|