sneak/vaultik
1
0
Fork 0
Code Issues 13 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Remove the unused crypto path and write the blob-ID hash step once (closes #151)
check / check (pull_request) Successful in 1m22s
Details

Browse Source 
Production encryption and decryption already run through blobgen; the
crypto package (Encryptor, Decryptor, UpdateRecipients, the fx Module)
and Vaultik.GetEncryptor/GetDecryptor had no production caller. Delete
crypto and route verify --deep through the same blobgen reader restore
uses: it parses the age key once and reads both the database (still
streamed to a temp file) and every blob through blobgen.NewReader.

The second, blob-ID hash step is now one exported function,
blobgen.DoubleSHA256, called by the three former copies. Writer.Sum256
(the double hash) becomes Writer.ContentID so it no longer shares the
name Sum256 with Reader.Sum256 (the single plaintext hash). CompressData
and CompressStream, unused outside tests, are deleted.

Delete the unused, never-adopted secret/config newtypes in internal/types
(the redacting AgeSecretKey and AWSSecretAccessKey plus AgeRecipient,
S3Endpoint, BucketName, S3Prefix, AWSRegion, AWSAccessKeyID). Delete the
uncalled CleanupIncompleteSnapshots (and deleteSnapshot, its only caller,
now dead) and correct ARCHITECTURE.md. The only multi-recipient test
moves to blobgen; the pre-#131 encrypted-bytes hash test is removed.

Model: opus-4-8
This commit is contained in:
sneak
2026-09-22 11:17:33 +00:00
parent 548a7ae156
commit 9ec1c005df
18 changed files with 154 additions and 976 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/types/types.go
+14 -59
View File
@@ -1,7 +1,7 @@
// Package types provides custom types for better type safety across the
// vaultik codebase. Using distinct types for IDs, hashes, paths, and
// credentials prevents accidental mixing of semantically different values
// that happen to share the same underlying type.
// vaultik codebase. Using distinct types for IDs, hashes, and paths prevents
// accidental mixing of semantically different values that happen to share the
// same underlying type.
package types //nolint:revive,nolintlint // rename decision tracked in #76
import (
@@ -157,34 +157,6 @@ type FilePath string
// Used during restore to strip the source prefix from paths.
type SourcePath string
// AgeRecipient is an age public key used for encryption.
// Format: age1... (Bech32-encoded X25519 public key)
type AgeRecipient string
// AgeSecretKey is an age private key used for decryption.
// Format: AGE-SECRET-KEY-... (Bech32-encoded X25519 private key)
// This type should never be logged or serialized in plaintext.
type AgeSecretKey string
// S3Endpoint is the URL of an S3-compatible storage endpoint.
type S3Endpoint string
// BucketName is the name of an S3 bucket.
type BucketName string
// S3Prefix is the path prefix within an S3 bucket.
type S3Prefix string
// AWSRegion is an AWS region identifier (e.g., "us-east-1").
type AWSRegion string
// AWSAccessKeyID is an AWS access key ID for authentication.
type AWSAccessKeyID string
// AWSSecretAccessKey is an AWS secret access key for authentication.
// This type should never be logged or serialized in plaintext.
type AWSSecretAccessKey string
// Hostname identifies a host machine.
type Hostname string
@@ -199,31 +171,14 @@ type GlobPattern string
// String methods for Stringer interface
func (id FileID) String() string { return uuid.UUID(id).String() }
func (id BlobID) String() string { return uuid.UUID(id).String() }
func (id SnapshotID) String() string { return string(id) }
func (h ChunkHash) String() string { return string(h) }
func (h BlobHash) String() string { return string(h) }
func (p FilePath) String() string { return string(p) }
func (p SourcePath) String() string { return string(p) }
func (r AgeRecipient) String() string { return string(r) }
func (e S3Endpoint) String() string { return string(e) }
func (b BucketName) String() string { return string(b) }
func (p S3Prefix) String() string { return string(p) }
func (r AWSRegion) String() string { return string(r) }
func (k AWSAccessKeyID) String() string { return string(k) }
func (h Hostname) String() string { return string(h) }
func (v Version) String() string { return string(v) }
func (r GitRevision) String() string { return string(r) }
func (p GlobPattern) String() string { return string(p) }
// Redacted String methods for sensitive types - prevents accidental logging
func (k AgeSecretKey) String() string { return "[REDACTED]" }
func (k AWSSecretAccessKey) String() string { return "[REDACTED]" }
// Raw returns the actual value for sensitive types when explicitly needed.
func (k AgeSecretKey) Raw() string { return string(k) }
// Raw returns the actual value for sensitive types when explicitly needed.
func (k AWSSecretAccessKey) Raw() string { return string(k) }
func (id FileID) String() string { return uuid.UUID(id).String() }
func (id BlobID) String() string { return uuid.UUID(id).String() }
func (id SnapshotID) String() string { return string(id) }
func (h ChunkHash) String() string { return string(h) }
func (h BlobHash) String() string { return string(h) }
func (p FilePath) String() string { return string(p) }
func (p SourcePath) String() string { return string(p) }
func (h Hostname) String() string { return string(h) }
func (v Version) String() string { return string(v) }
func (r GitRevision) String() string { return string(r) }
func (p GlobPattern) String() string { return string(p) }