Add snapshot files to list a snapshot's files without restoring it (closes #435)

`vaultik snapshot files <snapshot-id> [path] [--json]` downloads and
decrypts the snapshot database, as restore does, and prints mode, size,
modification time and path for every file at or under the path. A path
that matches nothing is an error. It needs the private key. The mode is
in Go's file-mode notation, which the README spells out. The table
quotes a path that holds a non-printable character.

Named `files` because `ls` is already the alias of `snapshot list`.
The missing-key error no longer says "for restore", since this command
and deep verify return it too. The README opening now states the
private-key rule first.

Model: opus-5-5

README.md

@@ -2,9 +2,9 @@
 
 `vaultik` is an incremental backup tool written in Go. It encrypts data using an
 `age` public key and uploads each encrypted blob directly to a remote
-S3-compatible object store. It requires no private keys, secrets, or credentials
+S3-compatible object store. The backed-up system never needs the private key. A
-(other than those required to PUT to encrypted object storage, such as S3 API
+backup needs only the public key and the credentials to write to the object
-keys) stored on the backed-up system.
+store, such as S3 API keys.
 
 ## quickstart
 
@@ -171,6 +171,7 @@ vaultik [--config <path>] config get <key>
 vaultik [--config <path>] config set <key> <value>
 vaultik [--config <path>] snapshot create [snapshot-names...] [--cron] [--prune] [--keep-newer-than <duration>]
 vaultik [--config <path>] snapshot list [--json]                  # alias: ls
+vaultik [--config <path>] snapshot files <snapshot-id> [path] [--json]
 vaultik [--config <path>] snapshot verify <snapshot-id> [--deep] [--json]
 vaultik [--config <path>] snapshot purge [--keep-latest | --older-than <duration>] [--snapshot <name>...] [--force]
 vaultik [--config <path>] snapshot remove <snapshot-id> [--dry-run] [--force] [--local-only] [--json]  # alias: rm
@@ -223,12 +224,24 @@ the backup can delete it; the new snapshot then cannot be restored.
 `remote nuke` deletes everything regardless. To not depend on the grace period,
 give each host or user its own prefix (or directory) on the destination.
 
-Read-only commands — `info`, `snapshot list`, `snapshot verify`, and
+These read-only commands do not take the lock, so they are never blocked, even
-`remote info` — do not take the lock and are never blocked, so they run even
+while a backup is in progress:
-while a backup is in progress. `snapshot restore` does not take the lock either:
+
-it writes only to the target directory you name, not the local index or the
+- `info`
-destination store. `config`, `database delete`, `completion`, and `version` do
+- `snapshot list`
-not take the lock.
+- `snapshot files`
+- `snapshot verify`
+- `remote info`
+
+`snapshot restore` does not take the lock either: it writes only to the target
+directory you name, not the local index or the destination store.
+
+These commands do not take the lock either:
+
+- `config`
+- `database delete`
+- `completion`
+- `version`
 
 ### stdout and stderr
 
@@ -261,9 +274,9 @@ work as written.
 ### environment variables
 
 - `VAULTIK_AGE_SECRET_KEY`: Age private key for decryption (required for
-  `snapshot restore` and `snapshot verify --deep`). May hold the whole
+  `snapshot restore`, `snapshot files` and `snapshot verify --deep`). May hold
-  `age-keygen` file — comments and every identity in it are accepted. Set it
+  the whole `age-keygen` file — comments and every identity in it are accepted.
-  from the file, e.g.
+  Set it from the file, e.g.
   `export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"`, so
   the key is not typed into your shell history.
 - `VAULTIK_CONFIG`: Path to config file (overridden by `--config`)
@@ -408,6 +421,26 @@ point behind.
   truncated listing all go to stderr through the logger, so stdout stays a
   single parseable document.
 
+**`snapshot files`**: List the files in a snapshot without restoring it. Each
+row of the table shows mode, size in bytes, modification time and path, sorted
+by path.
+
+- Requires `VAULTIK_AGE_SECRET_KEY`: the file list is only in the snapshot's
+  encrypted database, which the command downloads and decrypts.
+- Accepts the same identifiers as `snapshot restore`.
+- An optional path limits the list to that path and what is under it. A path
+  that matches nothing in the snapshot is an error.
+- `--json`: Output an array of objects with `path`, `size`, `mode` and `mtime`.
+- In the table, a path that holds a newline or another non-printable character
+  is shown in double quotes, with that character escaped, as in `"a\nb"`.
+- The mode is in Go's file-mode notation, in the table and in `--json`. Letters
+  before the nine permission characters show the file type and any special bit,
+  as in `dtrwxrwxrwx` for a sticky directory. These letters differ from `ls -l`:
+    - `L`: a symbolic link, which `ls -l` shows as `l`.
+    - `u`: setuid, which `ls -l` shows as `s` in place of the owner's `x`.
+    - `g`: setgid, which `ls -l` shows as `s` in place of the group's `x`.
+    - `t`: sticky, which `ls -l` shows as `t` in place of the others' `x`.
+
 **`snapshot verify`**: Verify snapshot integrity.
 
 - Default (shallow): checks that every blob the manifest lists is present in
@@ -722,7 +755,7 @@ annotated example also lives in
 | Field                | Default                         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | -------------------- | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `age_recipients`     | (required by `snapshot create`) | Age public keys for encryption. Other commands run without one, so a machine that only restores can leave it empty                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| `age_secret_key`     | (unset)                         | Age private key for decryption (`snapshot restore`, `snapshot verify --deep`). Setting it in the config file places the private key on the backed-up host, defeating the public-key-only design (see "why" above). Prefer the `VAULTIK_AGE_SECRET_KEY` environment variable, supplied only on the machine you restore from.                                                                                                                                                                                                                                                                                                                                      |
+| `age_secret_key`     | (unset)                         | Age private key for decryption (`snapshot restore`, `snapshot files`, `snapshot verify --deep`). Setting it in the config file places the private key on the backed-up host, defeating the public-key-only design (see "why" above). Prefer the `VAULTIK_AGE_SECRET_KEY` environment variable, supplied only on the machine you restore from.                                                                                                                                                                                                                                                                                                                    |
 | `snapshots`          | (required)                      | Named snapshot definitions with paths and excludes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `storage_url`        |                                 | Storage backend URL (`s3://`, `file://`, `rclone://`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `s3.*`               |                                 | Legacy S3 configuration (endpoint, bucket, credentials)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
@@ -839,15 +872,27 @@ environment variable is unset (https://no-color.org/).
   `database delete`.
 - **The data a command exists to produce** is written plain, with no marker and
   no color, because a marker would corrupt a table or a parsed document. This
-  covers the `version`, `info`, `remote info` and `snapshot verify` reports, the
+  covers the report or table of each of these commands:
-  `snapshot list` table, `config get` values, and every `--json` document.
+    - `version`
-  `--quiet` silences the human reports and tables (`version`, `info`,
+    - `info`
-  `remote info`, `snapshot verify`, `snapshot list`) but never the
+    - `remote info`
-  machine-consumed `config get` value or the `--json` documents, which a script
+    - `snapshot verify`
-  depends on. The confirmation prompts of `database delete`, `prune`,
+    - `snapshot list`
-  `snapshot purge` and `snapshot remove`, each with what it asks to delete, are
+    - `snapshot files`
-  also written this way and always shown: they are an interactive exchange the
+
-  operator must see.
+    `config get` values and every `--json` document are written plain too.
+    `--quiet` silences the reports and tables above, but never a `config get`
+    value or a `--json` document, which a script depends on.
+
+    These commands write their confirmation prompt plain too, with what it asks
+    to delete:
+    - `database delete`
+    - `prune`
+    - `snapshot purge`
+    - `snapshot remove`
+
+    `--quiet` never silences these prompts: each is an interactive exchange the
+    operator must see.
 
 `internal/ui` writes to stdout; it is the output the user asked for. The
 exceptions are the startup banner and the error a failed command ends with,
@@ -1039,20 +1084,37 @@ is `git describe --tags --always --dirty`, which `script/version` runs for the
 A `docker build .` of a clone, with no build arguments, runs the same
 `git describe` (without `--dirty`) on the `.git` in its build context, so it
 stamps the same value for a clean commit; the build fails if the context carries
-`.git` and no version, commit or commit date comes out. A binary built without
+`.git` and no version, commit or commit date comes out. `make` outside a git
-git metadata reports `dev`, or `unknown` when `script/docker` or
+checkout and `docker build .` without `.git` both stamp `dev`. `script/docker`
-`script/cibuild` built it outside a git checkout.
+and `script/cibuild` stamp `unknown` when they run outside a git checkout.
+
+A binary built by plain `go install` or `go build` carries no stamped version.
+It reports the version Go recorded in it instead:
+
+- a `go install` of the tag `v1.0.0` → `v1.0.0`.
+- a `go build` of an untagged commit → a Go pseudo-version, such as
+  `v1.0.1-0.20261110231226-0123456789ab`.
+- a build where Go recorded no version → `dev`.
 
 `goreleaser` stamps a release binary with the tag minus its leading `v`, so the
 tag `v1.0.0` produces `vaultik 1.0.0`, matching the archive name
 `vaultik_1.0.0_linux_amd64.tar.gz`. `goreleaser --snapshot` stamps
 `dev-<12 chars of the commit sha>` rather than inventing the next patch number.
-`vaultik version` calls a build a development build when its version is `dev`,
+
-`unknown`, `dev-<sha>`, the short commit sha or `<tag>-<N>-g<short sha>`, with
+`vaultik version` calls a build a development build when its version is one of
-or without `-dirty`; only a plain tag, such as `v1.0.0` or `1.0.0`, is a
+these:
-release. If `script/version` cannot be run at all, `make` stops with an error
+
-instead of building an unversioned binary, and a binary that somehow carries an
+- `dev` or `unknown`.
-empty version string still reports itself as a development build.
+- `dev-<sha>`.
+- the short commit sha.
+- `<tag>-<N>-g<short sha>`.
+- a Go pseudo-version.
+- any version with a `-dirty` or `+dirty` suffix.
+
+Only a plain tag, such as `v1.0.0` or `1.0.0`, is a release. If `script/version`
+cannot be run at all, `make` stops with an error instead of building an
+unversioned binary. A binary stamped with an empty version reports the version
+Go recorded in it; if Go recorded none, it is a development build.
 
 ### cutting a release
 

configs/config.example.yml

@@ -295,6 +295,7 @@ storage_url: "rclone://myremote/path/to/backups"
 
 # Path to local SQLite index database
 # This database tracks file state for incremental backups
+# It must be an absolute path; ~ is expanded
 # Default: the platform data directory, e.g.
 #   macOS: ~/Library/Application Support/vaultik/index.sqlite
 #   Linux: ~/.local/share/vaultik/index.sqlite

docs/REPOSTRUCTURE.md

@@ -265,15 +265,23 @@ so an operator can weigh them rather than discover them.
    blob holds hundreds of chunks, so individual chunk lengths are not visible in
    the blob's size; lowering the limit toward the chunk size begins to expose
    them.
-4. **Decrypted data on local disk.** Several commands stage plaintext under
+4. **Decrypted data on local disk.** These commands stage plaintext under
-   `$TMPDIR`: `snapshot restore` writes decrypted blobs under
+   `$TMPDIR`:
-   `vaultik-blobcache-*/` (no size cap) and the decrypted metadata database at
+    - `snapshot restore`: decrypted blobs under `vaultik-blobcache-*/`, with no
-   `vaultik-restore-*/snapshot.db`; `verify --deep` writes that database at
+      size cap, and the decrypted metadata database at
-   `vaultik-verify-*/snapshot.db`; `snapshot create` keeps a plaintext copy of
+      `vaultik-restore-*/snapshot.db`.
-   the index at `vaultik-snapshot-*/snapshot.db`. These files are created `0600`
+    - `snapshot files`: the decrypted metadata database at
-   and removed on success, but a `kill -9` or a power loss leaves them behind —
+      `vaultik-restore-*/snapshot.db`.
-   delete any leftover `vaultik-*` directory under `$TMPDIR` by hand. `$TMPDIR`
+    - `verify --deep`: the decrypted metadata database at
-   should be trusted to the same degree as the restore target.
+      `vaultik-verify-*/snapshot.db`.
+    - `snapshot create`: a plaintext copy of the index at
+      `vaultik-snapshot-*/snapshot.db`.
+
+    These files are created `0600` and removed on success, but a `kill -9` or a
+    power loss leaves them behind — delete any leftover `vaultik-*` directory
+    under `$TMPDIR` by hand. `$TMPDIR` should be trusted to the same degree as
+    the restore target.
+
 5. **Store permissions differ per command.** The backed-up host needs only PUT
    to run `snapshot create`: it writes blobs and metadata and neither reads nor
    deletes them. Other commands need more — `snapshot verify`,

go.mod

@@ -24,6 +24,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	go.uber.org/dig v1.19.0
 	go.uber.org/fx v1.24.0
+	golang.org/x/mod v0.29.0
 	golang.org/x/sync v0.18.0
 	golang.org/x/sys v0.38.0
 	golang.org/x/term v0.37.0

internal/cli/app.go

@@ -7,11 +7,9 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"path/filepath"
 	"sync"
 	"time"
 
-	"github.com/adrg/xdg"
 	"github.com/spf13/cobra"
 	"go.uber.org/dig"
 	"go.uber.org/fx"
@@ -40,10 +38,11 @@ const (
 	// prune, remote nuke) write the local index or the remote store. They
 	// hold the PID lock so that at most one runs at a time.
 	mutating lockMode = iota
-	// readOnly commands (info, snapshot list, snapshot verify, remote info,
+	// readOnly commands (info, snapshot list, snapshot files, snapshot
-	// snapshot restore) do not write the local index or the remote store,
+	// verify, remote info, snapshot restore) do not write the local index
-	// so they run without the lock and are never blocked by a running
+	// or the remote store, so they run without the lock and are never
-	// mutator. restore writes only to the target directory it is given.
+	// blocked by a running mutator. restore writes only to the target
+	// directory it is given.
 	readOnly
 )
 
@@ -312,7 +311,7 @@ func RunOperation(
 }
 
 // runVaultikApp runs the standard single-operation command lifecycle
-// shared by the snapshot list/purge/remove and remote nuke subcommands:
+// shared by the snapshot list/files/purge/remove and remote nuke subcommands:
 // resolve the config, then run op against the Vaultik instance through
 // RunOperation, reporting a failure prefixed with failMsg on stderr. mode
 // says whether the command takes the PID lock. jsonOutput marks a command
@@ -339,7 +338,7 @@ func runVaultikApp(
 		},
 		Mode: mode,
 	}, op, func(err error) {
-		log.Error(failMsg, "error", err)
+		log.Info(failMsg, "error", err)
 		ReportErrorf("%s: %v", failMsg, err)
 	})
 }
@@ -351,8 +350,7 @@ func runVaultikApp(
 // only one runs at a time; a read-only command runs without it and is not
 // blocked while a mutator holds the lock (opts.Mode).
 func RunWithApp(ctx context.Context, opts AppOptions) error {
-	release, err := acquireLockIfMutating(opts.Mode,
+	release, err := acquireLockIfMutating(opts.Mode, pidlock.Dir())
-		filepath.Join(xdg.DataHome, "vaultik"))
 	if err != nil {
 		return err
 	}

internal/cli/config.go

@@ -49,8 +49,14 @@ var (
 	errWouldNotLoad     = errors.New(
 		"vaultik would not load the config after this change, " +
 			"so the file was not changed")
+	errSetS3KeysFirst = errors.New(
+		"set s3.access_key_id and s3.secret_access_key first, " +
+			"then storage_url")
 )
 
+// storageURLKey is the config key that selects the storage backend.
+const storageURLKey = "storage_url"
+
 // macOS is the value of runtime.GOOS on macOS.
 const macOS = "darwin"
 
@@ -276,7 +282,8 @@ storage_url: ""
 # Hostname used in snapshot IDs. Default: system hostname.
 # hostname: myserver
 
-# Path to the local SQLite index database.
+# Path to the local SQLite index database. It must be an absolute path;
+# ~ is expanded.
 # Default: the platform data directory, e.g.
 #   macOS: ~/Library/Application Support/vaultik/index.sqlite
 #   Linux: ~/.local/share/vaultik/index.sqlite
@@ -512,7 +519,7 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 
 	err = checkConfigChange(oldData, data, settingData)
 	if err != nil {
-		return fmt.Errorf("%w: %w", errWouldNotLoad, err)
+		return wouldNotLoadError(key, err)
 	}
 
 	err = os.WriteFile(path, data, configFileMode)
@@ -536,6 +543,21 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 	return nil
 }
 
+// wouldNotLoadError returns the refusal of a change to key that vaultik
+// would not load for reason. When storage_url moves to s3:// before the S3
+// credentials are set, it says to set them first: they can be set while
+// the old storage_url is still in place.
+func wouldNotLoadError(key string, reason error) error {
+	if key == storageURLKey &&
+		(errors.Is(reason, config.ErrS3KeyIDRequired) ||
+			errors.Is(reason, config.ErrS3SecretRequired)) {
+		return fmt.Errorf("%w: %w; %w", errWouldNotLoad, reason,
+			errSetS3KeysFirst)
+	}
+
+	return fmt.Errorf("%w: %w", errWouldNotLoad, reason)
+}
+
 // checkConfigChange returns the reason vaultik would not load newData, the
 // config after a change, if the change brings that failure in. If oldData,
 // the config before it, loads, the new one must load too. A config that

internal/cli/config_test.go

@@ -2,6 +2,7 @@ package cli //nolint:testpackage // exercises unexported yamlPathGet/yamlPathSet
 
 import (
 	"bytes"
+	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -152,6 +153,21 @@ snapshots:
       - "~"
 `
 
+// testS3URL is an S3 storage_url, which needs credentials to load.
+const testS3URL = "s3://bucket/prefix?endpoint=https://s3.example.com"
+
+// configWithS3Keys loads: its storage_url is testS3URL and both S3 keys are
+// set.
+const configWithS3Keys = storageURLKey + ": " + testS3URL + `
+s3:
+  access_key_id: AKIAEXAMPLE
+  secret_access_key: example-secret
+snapshots:
+  home:
+    paths:
+      - "~"
+`
+
 // configWithUnsetReference loads only where VAULTIK_TEST_UNSET_SECRET is
 // set, as a backup job's environment might set it. No test sets it.
 const configWithUnsetReference = configWithoutRecipients + `s3:
@@ -252,12 +268,20 @@ func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
 		{configWithoutRecipients, "snapshots.home.paths", "/srv",
 			"into []string"},
 		{configWithoutRecipients, "chunk_size", "fast",
-			"invalid size format"},
+			`chunk_size: "fast" is not a size`},
 		// Values of the right type that fail validation.
 		{configWithoutRecipients, "compression_level", "99",
 			"compression_level must be between 1 and 19"},
 		{configWithoutRecipients, "chunk_size", "1KB",
 			"chunk_size must be at least 1MB"},
+		// An s3:// URL before its credentials names them.
+		{configWithoutRecipients, storageURLKey, testS3URL,
+			"s3.access_key_id is required for s3:// URLs; " +
+				"set s3.access_key_id and s3.secret_access_key first"},
+		{configWithoutRecipients + "s3:\n  access_key_id: AKIAEXAMPLE\n",
+			storageURLKey, testS3URL,
+			"s3.secret_access_key is required for s3:// URLs; " +
+				"set s3.access_key_id and s3.secret_access_key first"},
 		// With its reference filled in, the config loads.
 		{levelReference, "blob_size_limit", "1MB",
 			"blob_size_limit must be at least"},
@@ -343,6 +367,76 @@ func TestConfigSetRefusesOnlyItsOwnFailure(t *testing.T) {
 	}
 }
 
+// TestConfigSetS3KeysBeforeStorageURL checks that the order the refusal
+// gives works on a config that loads with a file:// storage_url.
+func TestConfigSetS3KeysBeforeStorageURL(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "config.yml")
+
+	err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
+	if err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	for _, set := range [][2]string{
+		{"s3.access_key_id", "AKIAEXAMPLE"},
+		{"s3.secret_access_key", "example-secret"},
+		{storageURLKey, testS3URL},
+	} {
+		err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
+			path, set[0], set[1])
+		if err != nil {
+			t.Fatalf("config set %s: %v", set[0], err)
+		}
+	}
+
+	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
+	if err != nil {
+		t.Fatalf("read config: %v", err)
+	}
+
+	if !strings.Contains(string(data), storageURLKey+": "+testS3URL) {
+		t.Errorf("config set storage_url wrote:\n%s", data)
+	}
+}
+
+// TestConfigSetRefusesClearingS3Key checks that clearing s3.access_key_id on
+// a config with an s3:// storage_url is refused without saying to set the
+// S3 keys first. That advice is only for a change to storage_url.
+func TestConfigSetRefusesClearingS3Key(t *testing.T) {
+	t.Parallel()
+
+	const key = "s3.access_key_id"
+
+	path := filepath.Join(t.TempDir(), "config.yml")
+
+	err := os.WriteFile(path, []byte(configWithS3Keys), configFileMode)
+	if err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false), path, key, "")
+	if !errors.Is(err, errWouldNotLoad) {
+		t.Errorf("clearing %s gives error %v, want one saying %q",
+			key, err, errWouldNotLoad)
+	}
+
+	if errors.Is(err, errSetS3KeysFirst) {
+		t.Errorf("clearing %s gives error %v, want one not saying %q",
+			key, err, errSetS3KeysFirst)
+	}
+
+	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
+	if err != nil {
+		t.Fatalf("read config: %v", err)
+	}
+
+	if string(data) != configWithS3Keys {
+		t.Errorf("clearing %s changed the file to:\n%s", key, data)
+	}
+}
+
 // TestConfigSetWritesEnvSection checks that config set writes a key under
 // the top-level env section, whose keys are not settings, on a config that
 // loads.

internal/cli/database.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/vaultik/internal/config"
+	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
@@ -100,18 +101,16 @@ Use --force to skip the confirmation prompt.`,
 				}
 			}
 
-			// Delete the database file
+			// Delete the database file and its side files. A side file
-			err = os.Remove(dbPath)
+			// may not exist, so only failing to delete the database file
-			if err != nil {
+			// is an error.
-				return fmt.Errorf("failed to delete database: %w", err)
+			for _, indexFile := range database.IndexFiles(dbPath) {
+				err = os.Remove(indexFile)
+				if err != nil && indexFile == dbPath {
+					return fmt.Errorf("failed to delete database: %w", err)
+				}
 			}
 
-			// Also delete WAL and SHM files if they exist
-			walPath := dbPath + "-wal"
-			shmPath := dbPath + "-shm"
-			_ = os.Remove(walPath) // Ignore errors - files may not exist
-			_ = os.Remove(shmPath)
-
 			out.Infof("Local state database deleted: %s.", dbPath)
 			log.Info("Local state database deleted", "path", dbPath)
 

internal/cli/database_test.go

@@ -5,9 +5,11 @@ import (
 	"errors"
 	"io"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
+	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
@@ -46,3 +48,28 @@ func TestDatabaseDeleteDeclinedIsError(t *testing.T) {
 			out.String())
 	}
 }
+
+// TestDatabaseDeleteRemovesSideFiles checks that the side files SQLite
+// keeps beside the database file are deleted with it.
+//
+//nolint:paralleltest // mutates the process-global rootFlags
+func TestDatabaseDeleteRemovesSideFiles(t *testing.T) {
+	dir := t.TempDir()
+	dbPath, cfgPath := seedDatabaseDeleteConfig(t, dir)
+
+	indexFiles := database.IndexFiles(dbPath)
+	for _, indexFile := range indexFiles {
+		seedFile(t, dir, filepath.Base(indexFile), "data")
+	}
+
+	setRootFlags(t, RootFlags{ConfigPath: cfgPath})
+
+	mustExecute(t, newDatabaseDeleteCommand(), "--force")
+
+	for _, indexFile := range indexFiles {
+		_, err := os.Stat(indexFile)
+		if !os.IsNotExist(err) {
+			t.Errorf("database delete left %s: stat err = %v", indexFile, err)
+		}
+	}
+}

internal/cli/entry.go

@@ -21,6 +21,8 @@ const shortCommitLen = 12
 const exitCodeInterrupted = 130
 
 // Entry is the main entry point for the CLI application.
+// It first calls globals.FillUnsetFromBuildInfo, which fills in the
+// version, commit and commit date that the linker flags did not set.
 // It prints the startup banner to stderr (unless a banner-suppressing
 // flag is present in os.Args — see bannerSuppressedInArgs), executes the
 // root cobra command, and routes any returned error through the
@@ -33,6 +35,7 @@ const exitCodeInterrupted = 130
 // deferred profile writers run before the process ends. See run in
 // cmd/vaultik/main.go.
 func Entry() int {
+	globals.FillUnsetFromBuildInfo()
 	emitStartupBanner(os.Args[1:], os.Stderr)
 
 	rootCmd := NewRootCommand()
@@ -82,6 +85,10 @@ func emitStartupBanner(args []string, w io.Writer) {
 // 🛑 ERROR: format. Use it from goroutine error paths (where returning
 // an error to cobra isn't an option) and anywhere else a CLI command
 // must surface a failure outside the normal RunE return path.
+//
+// This line is the one report of the failure. A caller that also logs
+// the failure logs it at info level, so the record appears only under
+// --verbose or --debug and the error is not printed twice.
 func ReportErrorf(format string, args ...any) {
 	ui.New(os.Stderr).Errorf(format, args...)
 }

internal/cli/entry_failure_once_test.go

@@ -0,0 +1,205 @@
+package cli //nolint:testpackage // shares the fixtures and capture helpers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"filippo.io/age"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/ui"
+)
+
+const (
+	// errorLinePrefix starts the final line that reports a failed command.
+	errorLinePrefix = "ERROR: "
+
+	flagVerbose = "--verbose"
+	cmdRestore  = "restore"
+
+	// blobsDir is the directory of a destination store that holds the
+	// blobs.
+	blobsDir = "blobs"
+)
+
+// TestEntryFailureIsPrintedOnce runs commands that fail after startup
+// against a destination they cannot use. `info` is not among them: it
+// cannot fail after startup.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntryFailureIsPrintedOnce(t *testing.T) {
+	for _, command := range [][]string{
+		{cmdSnapshot, cmdCreate},
+		{cmdSnapshot, cmdRemove, someSnapshotID},
+		{cmdSnapshot, cmdVerify, someSnapshotID},
+		{cmdRemote, cmdInfo},
+		{cmdPrune, flagJSON},
+	} {
+		for _, verbose := range []bool{false, true} {
+			name := fmt.Sprintf("%s verbose=%t", strings.Join(command, " "), verbose)
+
+			t.Run(name, func(t *testing.T) {
+				requireErrorPrintedOnce(t, verbose, append([]string{flagConfig,
+					writeUnusableDestinationConfig(t)}, command...)...)
+			})
+		}
+	}
+}
+
+// TestEntryBlobUploadFailureIsPrintedOnce backs up to a destination
+// whose blobs directory is a file, so the blob upload fails.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntryBlobUploadFailureIsPrintedOnce(t *testing.T) {
+	for _, verbose := range []bool{false, true} {
+		t.Run(fmt.Sprintf("verbose=%t", verbose), func(t *testing.T) {
+			configPath, storeDir := writeBackupConfig(t)
+
+			require.NoError(t, os.WriteFile(
+				filepath.Join(storeDir, blobsDir), nil, 0o600))
+
+			requireErrorPrintedOnce(t, verbose,
+				flagConfig, configPath, cmdSnapshot, cmdCreate)
+		})
+	}
+}
+
+// TestEntryBlobDownloadFailureIsPrintedOnce backs up, deletes the blobs
+// from the destination, and restores, so the blob download fails.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntryBlobDownloadFailureIsPrintedOnce(t *testing.T) {
+	for _, verbose := range []bool{false, true} {
+		t.Run(fmt.Sprintf("verbose=%t", verbose), func(t *testing.T) {
+			configPath, storeDir := writeBackupConfigWithPrivateKey(t)
+
+			code, _, _ := runEntry(t,
+				flagConfig, configPath, cmdSnapshot, cmdCreate)
+			require.Equal(t, 0, code)
+
+			require.NoError(t, os.RemoveAll(filepath.Join(storeDir, blobsDir)))
+
+			requireErrorPrintedOnce(t, verbose, flagConfig, configPath,
+				cmdSnapshot, cmdRestore, onlySnapshotID(t, configPath), t.TempDir())
+		})
+	}
+}
+
+// requireErrorPrintedOnce runs Entry with args, adding --verbose when
+// verbose is set. The command must fail, and stderr must carry its error
+// once, as the final ERROR: line. A log record carrying the same error
+// appears only under --verbose.
+func requireErrorPrintedOnce(t *testing.T, verbose bool, args ...string) {
+	t.Helper()
+
+	if verbose {
+		args = append(args, flagVerbose)
+	}
+
+	code, _, stderr := runEntry(t, args...)
+	require.Equal(t, 1, code)
+
+	errorLine, records := failureOutput(t, stderr)
+
+	if !verbose {
+		assert.Zero(t, records,
+			"without --verbose no log record repeats the error:\n%s", stderr)
+
+		return
+	}
+
+	assert.NotZero(t, records,
+		"--verbose must keep the log record of %q", errorLine)
+}
+
+// failureOutput requires stderr to hold exactly one ERROR: line and
+// returns it, with the number of log records whose error attribute is
+// the error that line reports. stderr is a pipe here, so every log
+// record is a JSON object on its own line.
+func failureOutput(t *testing.T, stderr string) (string, int) {
+	t.Helper()
+
+	var (
+		errorLines []string
+		records    []map[string]any
+	)
+
+	for line := range strings.Lines(stderr) {
+		var record map[string]any
+		if json.Unmarshal([]byte(line), &record) == nil {
+			records = append(records, record)
+
+			continue
+		}
+
+		if strings.Contains(line, errorLinePrefix) {
+			errorLines = append(errorLines, strings.TrimSpace(line))
+		}
+	}
+
+	require.Len(t, errorLines, 1,
+		"the error must be printed once as an ERROR: line:\n%s", stderr)
+
+	// An error can run over several lines; the ERROR: line holds the
+	// first of them.
+	repeats := 0
+
+	for _, record := range records {
+		failure, ok := record["error"].(string)
+		firstLine, _, _ := strings.Cut(failure, "\n")
+
+		if ok && strings.Contains(errorLines[0], firstLine) {
+			repeats++
+		}
+	}
+
+	return errorLines[0], repeats
+}
+
+// writeBackupConfigWithPrivateKey builds what writeBackupConfig builds,
+// with a generated key pair in place of its recipient. The config also
+// holds the private key, so that restore can decrypt the backup. Returns
+// the config path and the store directory.
+func writeBackupConfigWithPrivateKey(t *testing.T) (string, string) {
+	t.Helper()
+
+	configPath, storeDir := writeBackupConfig(t)
+
+	identity, err := age.GenerateX25519Identity()
+	require.NoError(t, err)
+
+	out := ui.NewWithColor(io.Discard, false)
+
+	require.NoError(t, writeConfigSet(out, configPath,
+		"age_recipients.0", identity.Recipient().String()))
+	require.NoError(t, writeConfigSet(out, configPath,
+		"age_secret_key", identity.String()))
+
+	return configPath, storeDir
+}
+
+// onlySnapshotID returns the ID of the one snapshot in the local index
+// that writeBackupConfig puts beside the config file.
+func onlySnapshotID(t *testing.T, configPath string) string {
+	t.Helper()
+
+	ctx := context.Background()
+
+	db, err := database.New(ctx,
+		filepath.Join(filepath.Dir(configPath), "index.sqlite"))
+	require.NoError(t, err)
+
+	defer func() { require.NoError(t, db.Close()) }()
+
+	backedUp, err := database.NewRepositories(db).Snapshots.GetOnlySnapshot(ctx)
+	require.NoError(t, err)
+
+	return backedUp.ID.String()
+}

internal/cli/entry_snapshot_create_index_and_lock_files_test.go

@@ -0,0 +1,69 @@
+package cli //nolint:testpackage // shares runEntry and the hermetic config helpers
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/adrg/xdg"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestEntrySnapshotCreateSkipsIndexAndLockFiles backs up a directory
+// that holds vaultik's index and PID file beside one other file, with no
+// exclude pattern set. The summary counts only the other file. See
+// https://git.eeqj.de/sneak/vaultik/issues/421.
+//
+// Not parallel: it replaces os.Args, os.Stdout, os.Stderr and the xdg
+// globals.
+func TestEntrySnapshotCreateSkipsIndexAndLockFiles(t *testing.T) {
+	for _, testCase := range []struct {
+		name string
+		// linked sets index_path to a symlink outside the backed-up
+		// directory that points to the index inside it.
+		linked bool
+	}{
+		{name: "index in the backed-up directory"},
+		{name: "index_path links into the backed-up directory", linked: true},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			dir := t.TempDir()
+			configPath := filepath.Join(dir, "config.yml")
+			sourceDir := filepath.Join(dir, "source")
+			storeDir := filepath.Join(dir, "store")
+
+			indexPath := filepath.Join(sourceDir, "index.sqlite")
+
+			if testCase.linked {
+				link := filepath.Join(dir, "index.sqlite")
+				require.NoError(t, os.Symlink(indexPath, link))
+
+				indexPath = link
+			}
+
+			contents := fmt.Sprintf(hermeticConfig,
+				sourceDir, storeDir, indexPath)
+			require.NoError(t,
+				os.WriteFile(configPath, []byte(contents), configFileMode))
+			require.NoError(t, os.Mkdir(storeDir, 0o750))
+			require.NoError(t, os.Mkdir(sourceDir, 0o750))
+			require.NoError(t, os.WriteFile(
+				filepath.Join(sourceDir, "file.txt"), []byte("hello"), 0o600))
+
+			// The PID file goes in a directory under XDG_DATA_HOME, which
+			// xdg reads at package init.
+			t.Setenv("XDG_DATA_HOME", filepath.Join(sourceDir, "data"))
+			xdg.Reload()
+			t.Cleanup(xdg.Reload)
+
+			code, stdout, _ := runEntry(t,
+				flagConfig, configPath, cmdSnapshot, cmdCreate)
+
+			require.Equal(t, 0, code)
+			assert.Contains(t, stdout,
+				"Files: 1 examined, 1 backed up, 0 unchanged.")
+		})
+	}
+}

internal/cli/entry_snapshot_create_prune_test.go

@@ -61,8 +61,8 @@ func TestEntrySnapshotCreateRejectsKeepNewerThanBeforeBackup(t *testing.T) {
 
 // TestEntrySnapshotCreateReportsPostBackupPruneFailure makes the
 // post-backup prune fail after a good backup, by planting a manifest
-// that cannot be decoded, and checks that the failure is reported as the
+// that cannot be decoded, and checks that the failure is reported once,
-// prune's and not as a failed snapshot creation.
+// as the prune's and not as a failed snapshot creation.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
@@ -83,6 +83,9 @@ func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
 	assert.Contains(t, stderr, "Backup completed, but post-backup prune failed")
 	assert.NotContains(t, stderr, "Snapshot creation failed")
 
+	_, repeats := failureOutput(t, stderr)
+	assert.Zero(t, repeats, "no log record may repeat the error:\n%s", stderr)
+
 	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 2,
@@ -93,7 +96,8 @@ func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
 // empties the source directory, as a volume that is not mounted leaves
 // its mount point, and runs `snapshot create --prune`. The command exits
 // non-zero and reports the backup as completed, not as a failed snapshot
-// creation. See https://git.eeqj.de/sneak/vaultik/issues/388.
+// creation. The error is printed once. See
+// https://git.eeqj.de/sneak/vaultik/issues/388.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotCreatePruneExitsNonZeroWhenSourceIsEmpty(t *testing.T) {
@@ -114,6 +118,9 @@ func TestEntrySnapshotCreatePruneExitsNonZeroWhenSourceIsEmpty(t *testing.T) {
 		"Backup completed, but 1 source path(s) were empty")
 	assert.NotContains(t, stderr, "Snapshot creation failed")
 
+	_, repeats := failureOutput(t, stderr)
+	assert.Zero(t, repeats, "no log record may repeat the error:\n%s", stderr)
+
 	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 2, "the older snapshot is kept")
@@ -124,7 +131,8 @@ func TestEntrySnapshotCreatePruneExitsNonZeroWhenSourceIsEmpty(t *testing.T) {
 // directory as a mount point, and runs `snapshot create --prune`, which
 // does not find it as one. The command exits non-zero, reports the
 // backup as completed, not as a failed snapshot creation, and keeps the
-// older snapshot. See https://git.eeqj.de/sneak/vaultik/issues/395.
+// older snapshot. The error is printed once. See
+// https://git.eeqj.de/sneak/vaultik/issues/395.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotCreatePruneExitsNonZeroWhenMountPointIsMissing(
@@ -159,6 +167,9 @@ func TestEntrySnapshotCreatePruneExitsNonZeroWhenMountPointIsMissing(
 		"an earlier snapshot recorded were not found")
 	assert.NotContains(t, stderr, "Snapshot creation failed")
 
+	_, repeats := failureOutput(t, stderr)
+	assert.Zero(t, repeats, "no log record may repeat the error:\n%s", stderr)
+
 	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 2, "the older snapshot is kept")

internal/cli/entry_snapshot_files_test.go

@@ -0,0 +1,47 @@
+package cli //nolint:testpackage // shares runEntry and the backup config helpers
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// cmdFiles is the word of `snapshot files`, used to build argument
+// vectors below.
+const cmdFiles = "files"
+
+// TestEntrySnapshotFilesListsOnlyThePath backs up two files and runs
+// `snapshot files` with the snapshot ID and the path of one of them,
+// which must be the only file listed.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntrySnapshotFilesListsOnlyThePath(t *testing.T) {
+	configPath, _ := writeBackupConfigWithPrivateKey(t)
+
+	// writeBackupConfig puts file.txt in the source directory beside the
+	// config file.
+	sourceDir := filepath.Join(filepath.Dir(configPath), "source")
+	listed := filepath.Join(sourceDir, "file.txt")
+
+	require.NoError(t, os.WriteFile(
+		filepath.Join(sourceDir, "other.txt"), []byte("other"), 0o600))
+
+	code, _, stderr := runEntry(t,
+		flagConfig, configPath, cmdSnapshot, cmdCreate)
+	require.Equal(t, 0, code, stderr)
+
+	code, stdout, stderr := runEntry(t, flagConfig, configPath, cmdSnapshot,
+		cmdFiles, onlySnapshotID(t, configPath), listed, flagJSON)
+	require.Equal(t, 0, code, stderr)
+
+	var entries []vaultik.ListedFile
+
+	require.NoError(t, json.Unmarshal([]byte(stdout), &entries))
+	require.Len(t, entries, 1, "only the path given may be listed")
+	assert.Equal(t, listed, entries[0].Path)
+}

internal/cli/entry_test.go

@@ -48,7 +48,7 @@ func TestCLIEntry(t *testing.T) {
 	} else {
 		// Check snapshot subcommands
 		expectedSubCommands := []string{
-			"create", "list", "purge", "verify", "remove", "restore",
+			"create", "list", "files", "purge", "verify", "remove", "restore",
 		}
 		for _, expected := range expectedSubCommands {
 			found := false

internal/cli/info.go

@@ -39,7 +39,7 @@ func NewInfoCommand() *cobra.Command {
 			}, func(v *vaultik.Vaultik) error {
 				return v.ShowInfo()
 			}, func(err error) {
-				log.Error("Failed to show info", "error", err)
+				log.Info("Failed to show info", "error", err)
 				ReportErrorf("Failed to show info: %v", err)
 			})
 		},

internal/cli/prune.go

@@ -60,7 +60,7 @@ referenced.`,
 			}, func(v *vaultik.Vaultik) error {
 				return v.Prune(opts)
 			}, func(err error) {
-				log.Error("Prune operation failed", "error", err)
+				log.Info("Prune operation failed", "error", err)
 				ReportErrorf("Prune failed: %v", err)
 			})
 		},

internal/cli/remote.go

@@ -98,7 +98,7 @@ func newRemoteInfoCommand() *cobra.Command {
 			}, func(v *vaultik.Vaultik) error {
 				return v.RemoteInfo(jsonOutput)
 			}, func(err error) {
-				log.Error("Failed to get remote info", "error", err)
+				log.Info("Failed to get remote info", "error", err)
 				ReportErrorf("Failed to get remote info: %v", err)
 			})
 		},

internal/cli/snapshot.go

@@ -9,6 +9,10 @@ import (
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
+// filesMaxArgs is the maximum positional argument count of
+// `snapshot files <snapshot-id> [path]`.
+const filesMaxArgs = 2
+
 var (
 	errSnapshotIDRequired  = errors.New("snapshot ID required")
 	errWrongArgCount       = errors.New("wrong argument count")
@@ -52,6 +56,7 @@ func NewSnapshotCommand() *cobra.Command {
 	// Add subcommands
 	cmd.AddCommand(newSnapshotCreateCommand())
 	cmd.AddCommand(newSnapshotListCommand())
+	cmd.AddCommand(newSnapshotFilesCommand())
 	cmd.AddCommand(newSnapshotPurgeCommand())
 	cmd.AddCommand(newSnapshotVerifyCommand())
 	cmd.AddCommand(newSnapshotRemoveCommand())
@@ -109,7 +114,7 @@ on Linux), then /etc/vaultik/config.yml.`,
 				return v.CreateSnapshot(opts)
 			}, func(err error) {
 				if errors.Is(err, vaultik.ErrPostBackupPruneFailed) {
-					log.Error("Post-backup prune failed", "error", err)
+					log.Info("Post-backup prune failed", "error", err)
 					ReportErrorf("Backup completed, but %v", err)
 
 					return
@@ -118,13 +123,13 @@ on Linux), then /etc/vaultik/config.yml.`,
 				if errors.Is(err, vaultik.ErrFilesUnreadable) ||
 					errors.Is(err, vaultik.ErrSourcePathEmpty) ||
 					errors.Is(err, vaultik.ErrVolumeNotMounted) {
-					log.Error("Backup completed with an error", "error", err)
+					log.Info("Backup completed with an error", "error", err)
 					ReportErrorf("Backup completed, but %v", err)
 
 					return
 				}
 
-				log.Error("Snapshot creation failed", "error", err)
+				log.Info("Snapshot creation failed", "error", err)
 				ReportErrorf("Snapshot creation failed: %v", err)
 			})
 		},
@@ -172,6 +177,44 @@ func newSnapshotListCommand() *cobra.Command {
 	return cmd
 }
 
+// newSnapshotFilesCommand creates the 'snapshot files' subcommand
+func newSnapshotFilesCommand() *cobra.Command {
+	var jsonOutput bool
+
+	cmd := &cobra.Command{
+		Use:   "files <snapshot-id> [path]",
+		Short: "List the files in a snapshot",
+		Long: `Lists the path, size, mode and modification time of every file in a
+snapshot, without restoring it. With a path, lists only that path and
+what is under it; a path that matches nothing is an error.
+
+The snapshot may be named by its ID or, on a host with no local index,
+by the remote key that 'snapshot list' prints for a remote-only snapshot
+(an unambiguous leading part is enough).
+
+The file list is only in the snapshot's encrypted database, so this
+downloads and decrypts it, and requires the age private key in the
+VAULTIK_AGE_SECRET_KEY environment variable, as 'snapshot restore' does.`,
+		Args: cobra.RangeArgs(1, filesMaxArgs),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			path := ""
+			if len(args) == filesMaxArgs {
+				path = args[1]
+			}
+
+			return runVaultikApp(cmd, readOnly, jsonOutput,
+				"Failed to list snapshot files",
+				func(v *vaultik.Vaultik) error {
+					return v.ListSnapshotFiles(args[0], path, jsonOutput)
+				})
+		},
+	}
+
+	cmd.Flags().BoolVar(&jsonOutput, "json", false, "Output in JSON format")
+
+	return cmd
+}
+
 // newSnapshotPurgeCommand creates the 'snapshot purge' subcommand
 func newSnapshotPurgeCommand() *cobra.Command {
 	opts := &vaultik.SnapshotPurgeOptions{}
@@ -258,7 +301,7 @@ func newSnapshotVerifyCommand() *cobra.Command {
 					return
 				}
 
-				log.Error("Verification failed", "error", err)
+				log.Info("Verification failed", "error", err)
 				ReportErrorf("Verification failed: %v", err)
 			})
 		},

internal/cli/snapshot_restore.go

@@ -104,7 +104,7 @@ func runRestore(cmd *cobra.Command, args []string, opts *RestoreOptions) error {
 			SkipErrors: rootFlags.SkipErrors,
 		})
 	}, func(err error) {
-		log.Error("Restore operation failed", "error", err)
+		log.Info("Restore operation failed", "error", err)
 		ReportErrorf("Restore failed: %v", err)
 	})
 }

internal/config/config.go

@@ -70,14 +70,22 @@ var (
 	errFileURLNotAbsolute = errors.New(
 		"a file:// storage_url needs an absolute path, " +
 			"as in file:///path/to/backup")
+	errIndexPathNotAbsolute = errors.New(
+		"index_path and VAULTIK_INDEX_PATH need an absolute path, " +
+			"as in ~/.local/share/vaultik/index.sqlite")
 	errNegativePruneGracePeriod = errors.New(
 		"prune_grace_period must not be negative")
 	errStorageNotConfigured = errors.New(
 		"storage not configured; set storage_url or provide s3.endpoint + " +
 			"s3.bucket + credentials")
 	errS3BucketRequired = errors.New("s3.bucket is required (or set storage_url)")
-	errS3KeyIDRequired  = errors.New("s3.access_key_id is required")
+)
-	errS3SecretRequired = errors.New("s3.secret_access_key is required")
+
+// Validate returns these when S3 storage is configured without its
+// credentials.
+var (
+	ErrS3KeyIDRequired  = errors.New("s3.access_key_id is required")
+	ErrS3SecretRequired = errors.New("s3.secret_access_key is required")
 )
 
 // expandTilde expands ~ at the start of a path to the user's home directory.
@@ -287,7 +295,8 @@ func Load(path string) (*Config, error) {
 }
 
 // Parse reads YAML config data as Load does, without validating it. It
-// refuses a key that no setting has, applies default values for optional
+// refuses a key that no setting has and a size setting whose value is not a
+// size, naming the setting. It applies default values for optional
 // fields, fills in ${...} references using smartconfig, and expands ~ in
 // paths.
 func Parse(data []byte) (*Config, error) {
@@ -312,8 +321,9 @@ func Parse(data []byte) (*Config, error) {
 		return nil, fmt.Errorf("failed to load config file: %w", err)
 	}
 
-	// A ${...} reference can bring in keys that are not in the file.
+	// A ${...} reference can bring in keys that are not in the file, and
-	err = checkFilledKeys(sc.Data())
+	// is the value of a size setting only once it is filled in.
+	err = checkFilledConfig(sc.Data())
 	if err != nil {
 		return nil, err
 	}
@@ -386,7 +396,11 @@ func Parse(data []byte) (*Config, error) {
 //     never the value. An empty list is accepted, because only snapshot
 //     create needs a recipient and it checks for one itself
 //   - At least one snapshot must be configured with at least one path
+//   - Every exclude pattern, global or in a snapshot, must compile; errors
+//     name the setting and quote the pattern
 //   - Storage must be configured (either storage_url or s3.* fields)
+//   - The index path must be absolute: a relative one would resolve against
+//     the working directory, so each directory would get its own index
 //   - Chunk size must be at least 1MB
 //   - Blob size limit must be at least the largest chunk the chunker can emit
 //     (chunk_size times chunker.ChunkSizeSpread), so a single-chunk blob never
@@ -404,22 +418,26 @@ func (c *Config) Validate() error {
 		}
 	}
 
-	if len(c.Snapshots) == 0 {
+	err := c.validateSnapshots()
-		return errNoSnapshots
+	if err != nil {
+		return err
 	}
 
-	for name, snap := range c.Snapshots {
+	err = c.validateExcludes()
-		if len(snap.Paths) == 0 {
+	if err != nil {
-			return fmt.Errorf("%w: %q", errSnapshotNoPaths, name)
+		return err
-		}
 	}
 
 	// Validate storage configuration
-	err := c.validateStorage()
+	err = c.validateStorage()
 	if err != nil {
 		return err
 	}
 
+	if !filepath.IsAbs(c.IndexPath) {
+		return fmt.Errorf("%w: %q", errIndexPathNotAbsolute, c.IndexPath)
+	}
+
 	if c.ChunkSize.Int64() < minChunkSize {
 		return errChunkSizeTooSmall
 	}
@@ -450,6 +468,22 @@ func (c *Config) Validate() error {
 	return nil
 }
 
+// validateSnapshots refuses a config with no snapshot or with a snapshot
+// that has no path.
+func (c *Config) validateSnapshots() error {
+	if len(c.Snapshots) == 0 {
+		return errNoSnapshots
+	}
+
+	for name, snap := range c.Snapshots {
+		if len(snap.Paths) == 0 {
+			return fmt.Errorf("%w: %q", errSnapshotNoPaths, name)
+		}
+	}
+
+	return nil
+}
+
 // validateAgeRecipient parses one age_recipients entry with the age library
 // and returns a value-free error on failure. A recipient string can be
 // sensitive (an operator may paste a secret key by mistake), so neither the
@@ -513,11 +547,11 @@ func (c *Config) validateStorage() error {
 	}
 
 	if c.S3.AccessKeyID == "" {
-		return errS3KeyIDRequired
+		return ErrS3KeyIDRequired
 	}
 
 	if c.S3.SecretAccessKey == "" {
-		return errS3SecretRequired
+		return ErrS3SecretRequired
 	}
 
 	return nil
@@ -544,11 +578,11 @@ func (c *Config) validateStorageURL() error {
 	case strings.HasPrefix(c.StorageURL, "s3://"):
 		// S3 storage needs credentials
 		if c.S3.AccessKeyID == "" {
-			return fmt.Errorf("%w for s3:// URLs", errS3KeyIDRequired)
+			return fmt.Errorf("%w for s3:// URLs", ErrS3KeyIDRequired)
 		}
 
 		if c.S3.SecretAccessKey == "" {
-			return fmt.Errorf("%w for s3:// URLs", errS3SecretRequired)
+			return fmt.Errorf("%w for s3:// URLs", ErrS3SecretRequired)
 		}
 
 		return nil

internal/config/config_test.go

@@ -165,6 +165,7 @@ func TestValidateBlobSizeLimit(t *testing.T) {
 			AgeRecipients:    []string{testSneakAgePublicKey},
 			Snapshots:        map[string]SnapshotConfig{"test": {Paths: []string{"/tmp/src"}}},
 			StorageURL:       "file:///tmp/vaultik-test-store",
+			IndexPath:        "/tmp/vaultik-test-index.sqlite",
 			ChunkSize:        chunkSize,
 			BlobSizeLimit:    blobLimit,
 			CompressionLevel: 3,
@@ -510,6 +511,65 @@ func TestLoadRejectsRelativeFileURL(t *testing.T) {
 	}
 }
 
+// TestLoadIndexPath checks that a relative index_path fails at load, naming
+// the value. Accepted, it would resolve against the working directory, so a
+// backup run from another directory would start from an empty index. A path
+// starting with ~ is expanded and loads.
+func TestLoadIndexPath(t *testing.T) {
+	t.Parallel()
+
+	home, err := os.UserHomeDir()
+	if err != nil {
+		t.Fatalf("home directory: %v", err)
+	}
+
+	load := func(t *testing.T, indexPath string) (*Config, error) {
+		t.Helper()
+
+		data := "snapshots:\n" +
+			"  test:\n" +
+			"    paths: [/tmp/vaultik-test-source]\n" +
+			"storage_url: file:///tmp/vaultik-test-storage\n" +
+			"index_path: " + indexPath + "\n"
+
+		path := filepath.Join(t.TempDir(), "config.yml")
+
+		err := os.WriteFile(path, []byte(data), 0o600)
+		if err != nil {
+			t.Fatalf("write config: %v", err)
+		}
+
+		return Load(path)
+	}
+
+	t.Run("relative path is rejected", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := load(t, "relative/index.sqlite")
+		if !errors.Is(err, errIndexPathNotAbsolute) {
+			t.Fatalf("Load() error = %v, want errIndexPathNotAbsolute", err)
+		}
+
+		if !strings.Contains(err.Error(), `"relative/index.sqlite"`) {
+			t.Errorf("error %q does not name the value", err.Error())
+		}
+	})
+
+	t.Run("path starting with ~ is expanded", func(t *testing.T) {
+		t.Parallel()
+
+		cfg, err := load(t, "~/vaultik/index.sqlite")
+		if err != nil {
+			t.Fatalf("Load() unexpected error: %v", err)
+		}
+
+		want := filepath.Join(home, "vaultik", "index.sqlite")
+		if cfg.IndexPath != want {
+			t.Errorf("IndexPath = %q, want %q", cfg.IndexPath, want)
+		}
+	})
+}
+
 // TestValidateAgeRecipients checks that recipients are parsed at config load
 // (a bad entry fails immediately, not mid-backup) and that no invalid entry —
 // least of all a pasted secret key — is echoed in the error. An empty list
@@ -522,6 +582,7 @@ func TestValidateAgeRecipients(t *testing.T) {
 			AgeRecipients:    recipients,
 			Snapshots:        map[string]SnapshotConfig{"test": {Paths: []string{"/tmp/src"}}},
 			StorageURL:       "file:///tmp/vaultik-test-store",
+			IndexPath:        "/tmp/vaultik-test-index.sqlite",
 			ChunkSize:        Size(10 * 1024 * 1024),
 			BlobSizeLimit:    Size(10 * 1024 * 1024 * 1024),
 			CompressionLevel: 3,

internal/config/exclude.go

@@ -0,0 +1,39 @@
+package config
+
+import (
+	"fmt"
+
+	"sneak.berlin/go/vaultik/internal/exclude"
+)
+
+// validateExcludes refuses an exclude pattern, global or in a snapshot,
+// that does not compile, naming the setting and quoting the pattern.
+func (c *Config) validateExcludes() error {
+	err := validateExcludeList("exclude", c.Exclude)
+	if err != nil {
+		return err
+	}
+
+	for _, name := range c.SnapshotNames() {
+		err = validateExcludeList("snapshots."+name+".exclude",
+			c.Snapshots[name].Exclude)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// validateExcludeList refuses the first pattern in patterns that does not
+// compile. setting is the name of the list, as in "exclude".
+func validateExcludeList(setting string, patterns []string) error {
+	for i, pattern := range patterns {
+		_, _, err := exclude.Compile(pattern)
+		if err != nil {
+			return fmt.Errorf("%s[%d]: %w", setting, i, err)
+		}
+	}
+
+	return nil
+}

internal/config/exclude_test.go

@@ -0,0 +1,65 @@
+package config_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/vaultik/internal/config"
+)
+
+// TestLoadRefusesBadExcludePattern checks that an exclude pattern that does
+// not compile, global or in a snapshot, fails at load with the setting and
+// the pattern named, rather than the backup storing what it meant to leave
+// out.
+func TestLoadRefusesBadExcludePattern(t *testing.T) {
+	t.Parallel()
+
+	const storage = "storage_url: file:///tmp/vaultik-test-storage\n"
+
+	tests := []struct {
+		name    string
+		config  string
+		wantErr string
+	}{
+		{
+			name: "global",
+			config: "exclude: ['*.tmp', '.cache', 'build[']\n" +
+				"snapshots:\n" +
+				"  home:\n" +
+				"    paths: [/tmp/vaultik-test-source]\n" + storage,
+			wantErr: `exclude[2]: "build[" is not a valid exclude pattern`,
+		},
+		{
+			name: "snapshot",
+			config: "snapshots:\n" +
+				"  home:\n" +
+				"    paths: [/tmp/vaultik-test-source]\n" +
+				"    exclude: ['/a/**/x[']\n" + storage,
+			wantErr: `snapshots.home.exclude[0]: "/a/**/x[" is not a valid exclude pattern`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			path := filepath.Join(t.TempDir(), "config.yml")
+
+			err := os.WriteFile(path, []byte(tt.config), 0o600)
+			if err != nil {
+				t.Fatalf("write config: %v", err)
+			}
+
+			_, err = config.Load(path)
+			if err == nil {
+				t.Fatalf("Load() returned nil, want an error containing %q", tt.wantErr)
+			}
+
+			if !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("Load() error = %q, want it to contain %q", err, tt.wantErr)
+			}
+		})
+	}
+}

internal/config/keys.go

@@ -129,10 +129,11 @@ func checkKeys(node *yaml.Node, typ reflect.Type, path string,
 	return nil
 }
 
-// checkFilledKeys is checkKeys for data, the config after smartconfig has
+// checkFilledConfig checks data, the config after smartconfig has filled in
-// filled in its ${...} references. A key that a reference brings in is not
+// its ${...} references: its keys with checkKeys, then its size settings
-// in the file, and the copy that Encode makes has no line numbers.
+// with checkSizes. A key that a reference brings in is not in the file, and
-func checkFilledKeys(data map[string]any) error {
+// the copy that Encode makes has no line numbers.
+func checkFilledConfig(data map[string]any) error {
 	var filled yaml.Node
 
 	err := filled.Encode(data)
@@ -140,8 +141,13 @@ func checkFilledKeys(data map[string]any) error {
 		return fmt.Errorf("failed to marshal config data: %w", err)
 	}
 
-	return checkKeys(&filled, reflect.TypeFor[Config](), "",
+	err = checkKeys(&filled, reflect.TypeFor[Config](), "",
 		map[*yaml.Node]bool{}, map[nodeAndType]bool{})
+	if err != nil {
+		return err
+	}
+
+	return checkSizes(&filled, nil)
 }
 
 // checkMappingKeys is checkKeys for a map.

internal/config/size.go

@@ -4,13 +4,20 @@ import (
 	"errors"
 	"fmt"
 	"math"
+	"reflect"
+	"slices"
+	"strconv"
+	"strings"
 
 	"github.com/dustin/go-humanize"
+	"gopkg.in/yaml.v3"
 )
 
 var (
 	errSizeType     = errors.New("size must be a number or string")
 	errSizeTooLarge = errors.New("size exceeds maximum supported value")
+	errNotASize     = errors.New(
+		"is not a size; use a number of bytes or a unit such as 10MB")
 )
 
 // Size represents a byte size that can be specified in configuration files.
@@ -32,6 +39,15 @@ func (s *Size) UnmarshalYAML(unmarshal func(any) error) error {
 		return nil
 	}
 
+	// A number too large for an int64 decodes as a float64. Its text can be
+	// 1e+20, which is not a size string.
+	var floatVal float64
+
+	err = unmarshal(&floatVal)
+	if err == nil && floatVal > math.MaxInt64 {
+		return errSizeTooLarge
+	}
+
 	// Try to unmarshal as string
 	var strVal string
 
@@ -40,17 +56,66 @@ func (s *Size) UnmarshalYAML(unmarshal func(any) error) error {
 		return errSizeType
 	}
 
-	// Parse the string using go-humanize
+	size, err := ParseSize(strVal)
-	bytes, err := humanize.ParseBytes(strVal)
 	if err != nil {
-		return fmt.Errorf("invalid size format: %w", err)
+		return err
 	}
 
-	if bytes > math.MaxInt64 {
+	*s = size
-		return fmt.Errorf("%w: %s", errSizeTooLarge, strVal)
+
+	return nil
+}
+
+// checkSizes returns an error naming the first size setting in node whose
+// value is not a size. node is the config, or the part of it at the dotted
+// keys, after smartconfig has filled in its ${...} references.
+func checkSizes(node *yaml.Node, keys []string) error {
+	typ, err := SettingType(keys)
+	if err != nil {
+		// Unknown keys are refused before this check, so keys is in one of
+		// two places. The env section holds no settings. A value of the
+		// wrong shape, such as a map given for hostname or inside exclude,
+		// is reported later by the YAML decoder.
+		return nil //nolint:nilerr // not an error here
 	}
 
-	*s = Size(bytes)
+	if typ == reflect.TypeFor[Size]() {
+		var size Size
+
+		err = node.Decode(&size)
+		if err != nil {
+			return fmt.Errorf("%s: %w", strings.Join(keys, "."), err)
+		}
+
+		return nil
+	}
+
+	switch node.Kind {
+	case yaml.DocumentNode:
+		for _, child := range node.Content {
+			err = checkSizes(child, keys)
+			if err != nil {
+				return err
+			}
+		}
+	case yaml.MappingNode:
+		for i := 0; i+1 < len(node.Content); i += 2 {
+			err = checkSizes(node.Content[i+1],
+				slices.Concat(keys, []string{node.Content[i].Value}))
+			if err != nil {
+				return err
+			}
+		}
+	case yaml.SequenceNode:
+		for i, child := range node.Content {
+			err = checkSizes(child, slices.Concat(keys, []string{strconv.Itoa(i)}))
+			if err != nil {
+				return err
+			}
+		}
+	case yaml.ScalarNode, yaml.AliasNode:
+		// A scalar holds no settings, and the filled config has no aliases.
+	}
 
 	return nil
 }
@@ -70,16 +135,17 @@ func (s Size) String() string {
 	return humanize.Bytes(uint64(s))
 }
 
-// ParseSize parses a size string into a Size value
+// ParseSize parses a size string, such as "10MB", into a Size value. An
+// error quotes s.
 func ParseSize(s string) (Size, error) {
-	bytes, err := humanize.ParseBytes(s)
+	bytes, err := humanize.ParseBigBytes(s)
 	if err != nil {
-		return 0, fmt.Errorf("invalid size format: %w", err)
+		return 0, fmt.Errorf("%q %w", s, errNotASize)
 	}
 
-	if bytes > math.MaxInt64 {
+	if !bytes.IsInt64() {
 		return 0, fmt.Errorf("%w: %s", errSizeTooLarge, s)
 	}
 
-	return Size(bytes), nil
+	return Size(bytes.Int64()), nil
 }

internal/config/size_test.go

@@ -0,0 +1,120 @@
+package config //nolint:testpackage // checks errNotASize and errSizeTooLarge
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// TestParseRefusesValueThatIsNotASize checks that a size setting whose
+// value is not a size fails the parse with an error naming the setting and
+// quoting the value, also when a ${...} reference fills the value in.
+func TestParseRefusesValueThatIsNotASize(t *testing.T) {
+	t.Parallel()
+
+	sizePath := filepath.Join(t.TempDir(), "size")
+
+	err := os.WriteFile(sizePath, []byte("lots"), 0o600)
+	if err != nil {
+		t.Fatalf("write size: %v", err)
+	}
+
+	tests := []struct {
+		name string
+		yaml string
+		want string
+	}{
+		{"chunk_size", keysTestConfig + "chunk_size: banana\n",
+			`chunk_size: "banana" is not a size; ` +
+				"use a number of bytes or a unit such as 10MB"},
+		{"blob_size_limit", keysTestConfig + "blob_size_limit: 10XB\n",
+			`blob_size_limit: "10XB" is not a size; ` +
+				"use a number of bytes or a unit such as 10MB"},
+		{"s3.part_size", strings.Replace(keysTestConfig, "  region:",
+			"  part_size: big\n  region:", 1),
+			`s3.part_size: "big" is not a size; ` +
+				"use a number of bytes or a unit such as 10MB"},
+		{"from a reference",
+			keysTestConfig + "chunk_size: ${FILE:" + sizePath + "}\n",
+			`chunk_size: "lots" is not a size; ` +
+				"use a number of bytes or a unit such as 10MB"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := Parse([]byte(tt.yaml))
+			if !errors.Is(err, errNotASize) {
+				t.Fatalf("Parse() error = %v, want errNotASize", err)
+			}
+
+			if err.Error() != tt.want {
+				t.Errorf("Parse() error = %q, want %q", err.Error(), tt.want)
+			}
+		})
+	}
+}
+
+// TestParseRefusesSizeTooLarge checks that a size setting whose value is
+// too large for a size fails the parse with an error naming the setting.
+// YAML reads the second value as a float.
+func TestParseRefusesSizeTooLarge(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		value string
+		want  string
+	}{
+		{"100EB", "chunk_size: size exceeds maximum supported value: 100EB"},
+		{"99999999999999999999",
+			"chunk_size: size exceeds maximum supported value"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.value, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := Parse([]byte(keysTestConfig + "chunk_size: " + tt.value + "\n"))
+			if !errors.Is(err, errSizeTooLarge) {
+				t.Fatalf("Parse() error = %v, want errSizeTooLarge", err)
+			}
+
+			if err.Error() != tt.want {
+				t.Errorf("Parse() error = %q, want %q", err.Error(), tt.want)
+			}
+		})
+	}
+}
+
+// TestParseAcceptsSizes checks that size settings given as a number of
+// bytes, as a unit, and through a ${...} reference still parse.
+func TestParseAcceptsSizes(t *testing.T) {
+	t.Parallel()
+
+	sizePath := filepath.Join(t.TempDir(), "size")
+
+	err := os.WriteFile(sizePath, []byte("20MB"), 0o600)
+	if err != nil {
+		t.Fatalf("write size: %v", err)
+	}
+
+	data := strings.Replace(keysTestConfig, "  region:",
+		"  part_size: 6000000\n  region:", 1) +
+		"chunk_size: ${FILE:" + sizePath + "}\n" +
+		"blob_size_limit: 1GB\n"
+
+	cfg, err := Parse([]byte(data))
+	if err != nil {
+		t.Fatalf("Parse() unexpected error: %v", err)
+	}
+
+	if cfg.ChunkSize != 20_000_000 || cfg.BlobSizeLimit != 1_000_000_000 ||
+		cfg.S3.PartSize != 6_000_000 {
+		t.Errorf("chunk_size, blob_size_limit, s3.part_size = %d, %d, %d, "+
+			"want 20000000, 1000000000, 6000000",
+			cfg.ChunkSize, cfg.BlobSizeLimit, cfg.S3.PartSize)
+	}
+}

internal/database/database.go

@@ -219,7 +219,8 @@ func retryOpen(ctx context.Context, path string) (*DB, error) {
 
 // errUntrustedSnapshotSchema is returned when a downloaded snapshot
 // database carries schema objects the real schema never defines, or is
-// missing a table the restore and deep-verify queries read.
+// missing a table the restore, deep-verify and `snapshot files` queries
+// read.
 var errUntrustedSnapshotSchema = errors.New(
 	"downloaded snapshot database has an untrusted schema")
 
@@ -241,12 +242,12 @@ func snapshotReadOnlyDSN(path string) string {
 
 // OpenReadOnly opens an already-materialized SQLite file for read-only
 // querying of a snapshot database downloaded from the store, used by
-// restore and deep verify. Unlike New it never applies schema migrations
+// restore, deep verify and `snapshot files`. Unlike New it never applies
-// and never writes: the connection is opened read-only with query_only
+// schema migrations and never writes: the connection is opened read-only
-// and trusted_schema=OFF. It refuses any file whose schema carries a
+// with query_only and trusted_schema=OFF. It refuses any file whose schema
-// trigger, view or virtual table, or lacks an expected table, so a forged
+// carries a trigger, view or virtual table, or lacks an expected table, so
-// file cannot redefine what the restore queries return. The caller owns
+// a forged file cannot redefine what the restore queries return. The
-// the file and must remove it.
+// caller owns the file and must remove it.
 func OpenReadOnly(ctx context.Context, path string) (*DB, error) {
 	conn, err := sql.Open("sqlite", snapshotReadOnlyDSN(path))
 	if err != nil {
@@ -276,9 +277,9 @@ func OpenReadOnly(ctx context.Context, path string) (*DB, error) {
 // the plain table set the real schema defines. Any trigger, view or
 // virtual table, or a missing expected table, fails the open.
 func verifySnapshotSchema(ctx context.Context, conn *sql.DB) error {
-	// expectedSnapshotTables are the tables the restore and deep-verify
+	// expectedSnapshotTables are the tables the restore, deep-verify and
-	// queries read. A downloaded database missing any of them is not a
+	// `snapshot files` queries read. A downloaded database missing any of
-	// genuine snapshot database and is refused.
+	// them is not a genuine snapshot database and is refused.
 	expectedSnapshotTables := []string{
 		"blob_chunks",
 		"blobs",

internal/database/module.go

@@ -20,6 +20,17 @@ const indexDirPerm = 0o700
 // backed-up path and chunk hash and must stay private.
 const indexFilePerm = 0o600
 
+// IndexFiles returns the path of the index at indexPath and the paths of
+// the side files SQLite keeps beside it while it writes.
+func IndexFiles(indexPath string) []string {
+	return []string{
+		indexPath,
+		indexPath + "-wal",
+		indexPath + "-shm",
+		indexPath + "-journal",
+	}
+}
+
 // ensureIndexFileMode makes the index file owner-only before the SQLite
 // driver opens it: it creates the file 0600 if absent, or chmods an existing
 // one to 0600. Doing this first matters because SQLite creates its -wal and

internal/database/snapshots.go

@@ -238,10 +238,11 @@ func (r *SnapshotRepository) GetByID(
 
 // GetOnlySnapshot returns the sole snapshot in an exported per-snapshot
 // metadata database. The backup path writes each snapshot's database with
-// exactly one snapshot row (see cleanSnapshotDB), so restore and deep
+// exactly one snapshot row (see cleanSnapshotDB), so restore, deep verify
-// verify expect exactly one. Zero rows return ErrNoSnapshotInDatabase and
+// and `snapshot files` expect exactly one. Zero rows return
-// more than one returns ErrMultipleSnapshotsInDatabase; callers treat
+// ErrNoSnapshotInDatabase and more than one returns
-// either as a failed identity check on the downloaded database.
+// ErrMultipleSnapshotsInDatabase; callers treat either as a failed
+// identity check on the downloaded database.
 func (r *SnapshotRepository) GetOnlySnapshot(ctx context.Context) (*Snapshot, error) {
 	query := `
 		SELECT id, hostname, vaultik_version, vaultik_git_revision,

internal/exclude/exclude.go

@@ -0,0 +1,77 @@
+// Package exclude compiles exclude patterns into globs.
+package exclude
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/gobwas/glob"
+)
+
+var errBadExcludePattern = errors.New("is not a valid exclude pattern")
+
+// Compile compiles one exclude pattern into the globs that match it.
+// anchored reports whether the pattern matches only from the root of the
+// source directory. An empty pattern yields no globs. Config.Validate and
+// the scanner both compile patterns with it, so a pattern that loads is one
+// the scanner can use.
+func Compile(pattern string) ([]glob.Glob, bool, error) {
+	if pattern == "" {
+		return nil, false, nil
+	}
+
+	// A leading "/" anchors the pattern to the source directory.
+	trimmed, anchored := strings.CutPrefix(pattern, "/")
+
+	// A trailing "/" marks a directory and is not matched.
+	trimmed = strings.TrimSuffix(trimmed, "/")
+
+	// A leading "**/" demands a "/" before the name and so misses an
+	// entry directly under the source path. It means "at every depth",
+	// which is what an unanchored pattern already does, so drop the
+	// prefix and match unanchored: as in gitignore, "**/x" and
+	// "/**/x" then also match a top-level "x".
+	if rest, found := strings.CutPrefix(trimmed, "**/"); found {
+		trimmed = rest
+		anchored = false
+	}
+
+	// Likewise "/**/" inside a pattern demands two slashes, so
+	// "a/**/*.log" misses "a/x.log". As in gitignore it stands for
+	// zero or more directories, so also compile the pattern with it
+	// made a single "/". The glob library's {a,b} is no help: with a
+	// "**" inside it in mid-pattern, it misses paths it should match.
+	var globs []glob.Glob
+
+	for _, variant := range doubleStarVariants(trimmed) {
+		g, err := glob.Compile(variant, '/')
+		if err != nil {
+			return nil, false, fmt.Errorf("%q %w: %w",
+				pattern, errBadExcludePattern, err)
+		}
+
+		globs = append(globs, g)
+	}
+
+	return globs, anchored, nil
+}
+
+// doubleStarVariants returns pattern once for every way of keeping each
+// "/**/" in it or making it a single "/".
+func doubleStarVariants(pattern string) []string {
+	const doubleStar = "/**/"
+
+	before, after, found := strings.Cut(pattern, doubleStar)
+	if !found {
+		return []string{pattern}
+	}
+
+	var variants []string
+
+	for _, rest := range doubleStarVariants(after) {
+		variants = append(variants, before+doubleStar+rest, before+"/"+rest)
+	}
+
+	return variants
+}

internal/exclude/exclude_test.go

@@ -0,0 +1,73 @@
+package exclude_test
+
+import (
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/gobwas/glob"
+	"sneak.berlin/go/vaultik/internal/exclude"
+)
+
+// TestCompile checks the error, the anchoring and the globs that Compile
+// returns for one exclude pattern.
+func TestCompile(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name         string
+		pattern      string
+		wantErr      string
+		wantAnchored bool
+		// wantMatches lists paths that one of the globs must match. When
+		// it is empty, Compile must return no globs.
+		wantMatches []string
+	}{
+		{name: "does not compile", pattern: "build[",
+			wantErr: `"build[" is not a valid exclude pattern`},
+		{name: "empty", pattern: ""},
+		{name: "leading slash anchors", pattern: "/build",
+			wantAnchored: true, wantMatches: []string{"build"}},
+		{name: "double star after the slash clears anchoring",
+			pattern: "/**/build", wantMatches: []string{"build"}},
+		{name: "double star in the middle", pattern: "a/**/*.log",
+			wantMatches: []string{"a/x.log", "a/b/x.log"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			globs, anchored, err := exclude.Compile(tt.pattern)
+			if tt.wantErr == "" && err != nil {
+				t.Fatalf("Compile(%q) error = %v, want none", tt.pattern, err)
+			}
+
+			if tt.wantErr != "" &&
+				(err == nil || !strings.HasPrefix(err.Error(), tt.wantErr)) {
+				t.Fatalf("Compile(%q) error = %v, want one starting with %q",
+					tt.pattern, err, tt.wantErr)
+			}
+
+			if anchored != tt.wantAnchored {
+				t.Errorf("Compile(%q) anchored = %t, want %t",
+					tt.pattern, anchored, tt.wantAnchored)
+			}
+
+			if len(tt.wantMatches) == 0 && len(globs) != 0 {
+				t.Errorf("Compile(%q) returned %d globs, want none",
+					tt.pattern, len(globs))
+			}
+
+			for _, path := range tt.wantMatches {
+				matched := slices.ContainsFunc(globs, func(g glob.Glob) bool {
+					return g.Match(path)
+				})
+				if !matched {
+					t.Errorf("Compile(%q) globs do not match %q",
+						tt.pattern, path)
+				}
+			}
+		})
+	}
+}

internal/globals/globals.go

@@ -1,19 +1,24 @@
 // Package globals holds application-wide metadata (name, version,
-// commit) that is populated at build time via linker flags.
+// commit) that is populated at build time via linker flags, or from the
+// build info Go records in the binary when the linker flags set none.
 package globals
 
 import (
 	"regexp"
+	"runtime/debug"
 	"strings"
 	"time"
+
+	"golang.org/x/mod/module"
 )
 
 // Appname is the application name, populated from main().
 var Appname = "vaultik" //nolint:gochecknoglobals // set via -ldflags at build time
 
 // DevVersion is the version a binary reports when it was built without
-// git metadata: script/version emits it outside a git checkout, and an
+// git metadata: script/version emits it outside a git checkout, and a
-// unstamped `go build` keeps it. goreleaser's snapshot template stamps
+// binary keeps it when neither its linker flags nor its Go build info
+// name a version. goreleaser's snapshot template stamps
 // it followed by "-" and the commit it was built from. It is
 // deliberately not a number.
 const DevVersion = "dev"
@@ -32,6 +37,54 @@ var Commit = Unknown //nolint:gochecknoglobals // set via -ldflags at build time
 // CommitDate is the ISO-8601 date of the commit, populated from main().
 var CommitDate = Unknown //nolint:gochecknoglobals // set via -ldflags at build time
 
+// develVersion is the main module version Go records when it cannot
+// tell which version it built.
+const develVersion = "(devel)"
+
+// FillUnsetFromBuildInfo applies FillUnset to Version, Commit and
+// CommitDate, with the build info of the running binary.
+func FillUnsetFromBuildInfo() {
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return
+	}
+
+	Version, Commit, CommitDate = FillUnset(
+		info, Version, Commit, CommitDate)
+}
+
+// FillUnset returns version, commit and commitDate. Each one that
+// still holds its default ("dev" or empty for the version, "unknown"
+// for the others) is replaced by the value Go recorded in info. A
+// `go install` of a tag sets no linker flags, but Go records the tag
+// as the main module's version. Go records the commit and its time
+// only when it builds from a git checkout. The time is cut to a date,
+// as the Makefile stamps it.
+func FillUnset(
+	info *debug.BuildInfo, version, commit, commitDate string,
+) (string, string, string) {
+	if (version == "" || version == DevVersion) &&
+		info.Main.Version != "" && info.Main.Version != develVersion {
+		version = info.Main.Version
+	}
+
+	for _, s := range info.Settings {
+		switch s.Key {
+		case "vcs.revision":
+			if commit == Unknown {
+				commit = s.Value
+			}
+		case "vcs.time":
+			t, err := time.Parse(time.RFC3339, s.Value)
+			if commitDate == Unknown && err == nil {
+				commitDate = t.UTC().Format(time.DateOnly)
+			}
+		}
+	}
+
+	return version, commit, commitDate
+}
+
 // Author identifies the upstream author of vaultik.
 const Author = "Jeffrey Paul <sneak@sneak.berlin>"
 
@@ -68,8 +121,10 @@ func New() (*Globals, error) {
 // a release. "dev" and goreleaser's snapshot "dev-<sha>" count, and so
 // does what `git describe --tags --always --dirty` gives a make or
 // docker build of an untagged commit: the bare short commit, or
-// tag-N-gHASH on a commit after a tag. Any version ending in "-dirty"
+// tag-N-gHASH on a commit after a tag. A Go pseudo-version counts: Go
-// counts, a modified checkout of a tag ("v1.0.0-dirty") included.
+// records one for a build of an untagged commit without linker flags.
+// Any version ending in "-dirty" or "+dirty" counts, a modified
+// checkout of a tag ("v1.0.0-dirty", "v1.0.0+dirty") included.
 // A plain tag such as "v1.0.0" or "1.0.0" is a release.
 //
 // The empty string counts too. Nothing that knows its version reports
@@ -82,7 +137,8 @@ func New() (*Globals, error) {
 func IsDevVersion(v string) bool {
 	if v == "" || v == Unknown || v == DevVersion ||
 		strings.HasPrefix(v, DevVersion+"-") ||
-		strings.HasSuffix(v, "-dirty") {
+		strings.HasSuffix(v, "-dirty") || strings.HasSuffix(v, "+dirty") ||
+		module.IsPseudoVersion(v) {
 		return true
 	}
 

internal/globals/globals_test.go

@@ -1,6 +1,7 @@
 package globals_test
 
 import (
+	"runtime/debug"
 	"testing"
 
 	"sneak.berlin/go/vaultik/internal/globals"
@@ -59,12 +60,20 @@ func TestIsDevVersion(t *testing.T) {
 		{"1.0.0-rc.1-12-g877eb2f", true},
 		// A tagged commit with uncommitted changes is not that tag.
 		{"v1.0.0-dirty", true},
+		// What Go records for a build without linker flags: a
+		// pseudo-version for an untagged commit, "+dirty" for a
+		// modified checkout.
+		{"v1.0.0-rc3.0.20261111001226-abcdefabcdef", true},
+		{"v0.0.0-20261111001226-abcdefabcdef", true},
+		{"v1.0.1-0.20261111001226-abcdefabcdef", true},
+		{"v1.0.0+dirty", true},
 		// What a tagged build produces (goreleaser's .Version strips
 		// the leading "v"; script/version keeps it).
 		{"1.0.0", false},
 		{"0.1.0", false},
 		{"1.0.0-rc.1", false},
 		{"v1.0.0", false},
+		{"v1.0.0-rc3", false},
 		// A release must not be mistaken for a dev build just because
 		// the string happens to contain "dev".
 		{"1.0.0-dev", false},
@@ -86,10 +95,9 @@ func TestIsDevVersion(t *testing.T) {
 	}
 }
 
-// TestDefaultVersionIsDev pins the linker-flag contract: an unstamped
+// TestDefaultVersionIsDev pins the default: a binary whose linker flags
-// binary (no -ldflags at all, which is what `go build ./...` and `go
+// and build info name no version must report itself as a development
-// install` produce) must report itself as a development build rather
+// build rather than as some default release number.
-// than as some default release number.
 func TestDefaultVersionIsDev(t *testing.T) {
 	t.Parallel()
 
@@ -98,3 +106,104 @@ func TestDefaultVersionIsDev(t *testing.T) {
 			globals.DevVersion)
 	}
 }
+
+// buildInfo returns build info with the given main module version and,
+// when revision is not empty, the commit settings Go records for a
+// build from a git checkout.
+func buildInfo(version, revision string) *debug.BuildInfo {
+	info := &debug.BuildInfo{
+		Main: debug.Module{Path: "sneak.berlin/go/vaultik", Version: version},
+	}
+
+	if revision != "" {
+		info.Settings = []debug.BuildSetting{
+			{Key: "vcs.revision", Value: revision},
+			{Key: "vcs.time", Value: "2026-11-10T23:12:26Z"},
+		}
+	}
+
+	return info
+}
+
+// TestFillUnset covers a binary from `go install` of a tag, which
+// carries no linker flags: it must report the tag. Values the linker
+// flags set are kept.
+func TestFillUnset(t *testing.T) {
+	t.Parallel()
+
+	const (
+		tag = "v1.0.0-rc3"
+		rev = "0123456789abcdef0123456789abcdef01234567"
+	)
+
+	cases := []struct {
+		name                    string
+		info                    *debug.BuildInfo
+		version, commit, date   string
+		wantVersion, wantCommit string
+		wantDate                string
+	}{
+		{
+			name:        "go install of a tag",
+			info:        buildInfo(tag, ""),
+			version:     globals.DevVersion,
+			commit:      globals.Unknown,
+			date:        globals.Unknown,
+			wantVersion: tag,
+			wantCommit:  globals.Unknown,
+			wantDate:    globals.Unknown,
+		},
+		{
+			name:        "empty version",
+			info:        buildInfo(tag, ""),
+			version:     "",
+			commit:      globals.Unknown,
+			date:        globals.Unknown,
+			wantVersion: tag,
+			wantCommit:  globals.Unknown,
+			wantDate:    globals.Unknown,
+		},
+		{
+			name:        "go build in a git checkout",
+			info:        buildInfo(tag, rev),
+			version:     globals.DevVersion,
+			commit:      globals.Unknown,
+			date:        globals.Unknown,
+			wantVersion: tag,
+			wantCommit:  rev,
+			wantDate:    "2026-11-10",
+		},
+		{
+			name:        "Go could not tell the version",
+			info:        buildInfo("(devel)", ""),
+			version:     globals.DevVersion,
+			commit:      globals.Unknown,
+			date:        globals.Unknown,
+			wantVersion: globals.DevVersion,
+			wantCommit:  globals.Unknown,
+			wantDate:    globals.Unknown,
+		},
+		{
+			name:        "linker flags set",
+			info:        buildInfo(tag, rev),
+			version:     "v1.0.0-rc2-4-gabcdef1",
+			commit:      "abcdef1",
+			date:        "2026-11-01",
+			wantVersion: "v1.0.0-rc2-4-gabcdef1",
+			wantCommit:  "abcdef1",
+			wantDate:    "2026-11-01",
+		},
+	}
+
+	for _, tc := range cases {
+		version, commit, date := globals.FillUnset(
+			tc.info, tc.version, tc.commit, tc.date)
+
+		if version != tc.wantVersion || commit != tc.wantCommit ||
+			date != tc.wantDate {
+			t.Errorf("%s: got %q, %q, %q; want %q, %q, %q", tc.name,
+				version, commit, date,
+				tc.wantVersion, tc.wantCommit, tc.wantDate)
+		}
+	}
+}

internal/pidlock/pidlock.go

@@ -11,6 +11,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/adrg/xdg"
 	"golang.org/x/sys/unix"
 )
 
@@ -29,8 +30,20 @@ const (
 	lockDirPerm = 0o700
 	// pidFilePerm is the mode for the PID file (owner-only).
 	pidFilePerm = 0o600
+	// pidFileName is the name of the PID file in the lock directory.
+	pidFileName = "vaultik.pid"
 )
 
+// Dir returns the directory that holds vaultik's PID file.
+func Dir() string {
+	return filepath.Join(xdg.DataHome, "vaultik")
+}
+
+// Path returns the path of the PID file that Acquire uses in lockDir.
+func Path(lockDir string) string {
+	return filepath.Join(lockDir, pidFileName)
+}
+
 // Acquire attempts to acquire a PID lock in the specified directory.
 // If another process holds the lock, it returns ErrAlreadyRunning with
 // that process's PID. On success, it writes the current PID to the lock
@@ -42,7 +55,7 @@ func Acquire(lockDir string) (*Lock, error) {
 		return nil, fmt.Errorf("creating lock directory: %w", err)
 	}
 
-	lockPath := filepath.Join(lockDir, "vaultik.pid")
+	lockPath := Path(lockDir)
 
 	// No O_TRUNC: the file may hold the PID of the process that has the
 	// lock, which the error below reports.

internal/snapshot/index_and_lock_files_test.go

@@ -0,0 +1,65 @@
+package snapshot_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/snapshot"
+)
+
+// A backup of the directory that holds vaultik's index and PID file
+// stores neither, with no exclude pattern set, and still stores the
+// files beside them. See https://git.eeqj.de/sneak/vaultik/issues/421.
+func TestScanSkipsIndexAndLockFiles(t *testing.T) {
+	t.Parallel()
+
+	const dataDir = "/home/user/.local/share/vaultik"
+
+	indexAndLockFiles := append(database.IndexFiles(dataDir+"/index.sqlite"),
+		dataDir+"/vaultik.pid")
+
+	fs := afero.NewMemMapFs()
+	for _, p := range append(indexAndLockFiles, dataDir+"/notes.txt") {
+		require.NoError(t, afero.WriteFile(fs, p, []byte("data"), 0o600))
+	}
+
+	db, err := database.NewTestDB()
+	require.NoError(t, err)
+
+	defer func() { _ = db.Close() }()
+
+	repos := database.NewRepositories(db)
+
+	scanner := snapshot.NewScanner(snapshot.ScannerConfig{
+		FS:               fs,
+		ChunkSize:        64 * 1024,
+		Repositories:     repos,
+		MaxBlobSize:      1024 * 1024,
+		CompressionLevel: 3,
+		AgeRecipients: []string{
+			"age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"},
+		IndexAndLockFiles: indexAndLockFiles,
+	})
+	require.NotNil(t, scanner)
+
+	ctx := context.Background()
+	createSnapshotRecord(ctx, t, repos, "test-snapshot")
+
+	result, err := scanner.Scan(ctx, "/home/user", "test-snapshot")
+	require.NoError(t, err)
+
+	require.Equal(t, 1, result.FilesScanned)
+
+	stored, err := repos.Files.GetByPath(ctx, dataDir+"/notes.txt")
+	require.NoError(t, err)
+	require.NotNil(t, stored, "a file beside the index is stored")
+
+	for _, p := range indexAndLockFiles {
+		f, err := repos.Files.GetByPath(ctx, p)
+		require.NoError(t, err)
+		require.Nil(t, f, "%s is not stored", p)
+	}
+}

internal/snapshot/module.go

@@ -2,11 +2,13 @@ package snapshot
 
 import (
 	"os"
+	"path/filepath"
 
 	"github.com/spf13/afero"
 	"go.uber.org/fx"
 	"sneak.berlin/go/vaultik/internal/config"
 	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/pidlock"
 	"sneak.berlin/go/vaultik/internal/storage"
 	"sneak.berlin/go/vaultik/internal/ui"
 )
@@ -62,9 +64,52 @@ func provideScannerFactory(
 			EnableProgress:     params.EnableProgress,
 			UI:                 params.UI,
 			Exclude:            excludes,
+			IndexAndLockFiles:  indexAndLockFiles(cfg.IndexPath, pidlock.Dir()),
 			SkipErrors:         params.SkipErrors,
 			PreviousSnapshotID: params.PreviousSnapshotID,
 			DeviceNumber:       params.DeviceNumber,
 		})
 	}
 }
+
+// indexAndLockFiles returns the paths of the index at indexPath, its side
+// files and the PID file in lockDir. Symlinks in their directories are
+// resolved, as they are in the snapshot's source paths, so the scan finds
+// them under the same names. If indexPath is a symlink, the file it points
+// to and that file's side files are returned too.
+func indexAndLockFiles(indexPath, lockDir string) []string {
+	paths := append(database.IndexFiles(indexPath), pidlock.Path(lockDir))
+	for i, p := range paths {
+		paths[i] = resolveParentDir(p)
+	}
+
+	// SQLite writes the file a symlinked index points to and keeps the
+	// side files beside that file. The database package creates the index
+	// before the scanner is built, so the link resolves.
+	index := resolveParentDir(indexPath)
+
+	target, err := filepath.EvalSymlinks(index)
+	if err == nil && target != index {
+		paths = append(paths, database.IndexFiles(target)...)
+	}
+
+	return paths
+}
+
+// resolveParentDir returns the absolute form of path with the symlinks in
+// its parent directory resolved. If the parent directory cannot be
+// resolved, it returns the absolute form unresolved. If path has no
+// absolute form, it returns path.
+func resolveParentDir(path string) string {
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return path
+	}
+
+	dir, err := filepath.EvalSymlinks(filepath.Dir(abs))
+	if err != nil {
+		return abs
+	}
+
+	return filepath.Join(dir, filepath.Base(abs))
+}

internal/snapshot/module_test.go

@@ -0,0 +1,32 @@
+//nolint:testpackage // exercises the unexported indexAndLockFiles helper
+package snapshot
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// The scan walks source paths with symlinks resolved, so vaultik's own
+// files are named the same way, or a symlinked home would back them up.
+func TestIndexAndLockFilesResolvesSymlinkedDirectory(t *testing.T) {
+	t.Parallel()
+
+	realDir, err := filepath.EvalSymlinks(t.TempDir())
+	require.NoError(t, err)
+
+	link := filepath.Join(t.TempDir(), "link")
+	require.NoError(t, os.Symlink(realDir, link))
+
+	paths := indexAndLockFiles(filepath.Join(link, "index.sqlite"), link)
+
+	require.Equal(t, []string{
+		filepath.Join(realDir, "index.sqlite"),
+		filepath.Join(realDir, "index.sqlite-wal"),
+		filepath.Join(realDir, "index.sqlite-shm"),
+		filepath.Join(realDir, "index.sqlite-journal"),
+		filepath.Join(realDir, "vaultik.pid"),
+	}, paths)
+}

internal/snapshot/scanner.go

@@ -20,6 +20,7 @@ import (
 	"sneak.berlin/go/vaultik/internal/blob"
 	"sneak.berlin/go/vaultik/internal/chunker"
 	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/exclude"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/storage"
 	"sneak.berlin/go/vaultik/internal/types"
@@ -67,6 +68,9 @@ type Scanner struct {
 	currentSourcePath string
 	exclude           []string          // Glob patterns for files/directories to exclude
 	compiledExclude   []compiledPattern // Compiled glob patterns
+	// indexAndLockFiles holds the paths of vaultik's own working files,
+	// which the scan treats as excluded (ScannerConfig.IndexAndLockFiles).
+	indexAndLockFiles map[string]struct{}
 	progress          *ProgressReporter
 	// skipErrors skips files that cannot be opened or read (logged loudly);
 	// packer, database, encryption, and upload errors still abort the run.
@@ -133,6 +137,11 @@ type ScannerConfig struct {
 	EnableProgress   bool       // Enable the live progress reporter (ETAs, throughput)
 	UI               *ui.Writer // Where user-facing scanner messages go; nil = discard
 	Exclude          []string   // Glob patterns for files/directories to exclude
+	// IndexAndLockFiles are the absolute paths of vaultik's own working
+	// files: the index, its side files and the PID file. The scan treats
+	// them as excluded, whatever Exclude says, since a copy taken while
+	// they are being written is torn.
+	IndexAndLockFiles []string
 	// SkipErrors skips files that cannot be opened or read (log loudly but
 	// continue); packer, database, encryption, and upload errors still abort.
 	SkipErrors bool
@@ -213,8 +222,12 @@ func NewScanner(cfg ScannerConfig) *Scanner {
 		progress = NewProgressReporter()
 	}
 
-	// Compile exclude patterns
+	compiledExclude, err := compileExcludePatterns(cfg.Exclude)
-	compiledExclude := compileExcludePatterns(cfg.Exclude)
+	if err != nil {
+		log.Error("Failed to compile exclude patterns", "error", err)
+
+		return nil
+	}
 
 	uiw := cfg.UI
 	if uiw == nil {
@@ -226,6 +239,11 @@ func NewScanner(cfg ScannerConfig) *Scanner {
 		deviceNumber = deviceNumberFromStat
 	}
 
+	indexAndLockFiles := make(map[string]struct{}, len(cfg.IndexAndLockFiles))
+	for _, p := range cfg.IndexAndLockFiles {
+		indexAndLockFiles[filepath.Clean(p)] = struct{}{}
+	}
+
 	return &Scanner{
 		fs:                 cfg.FS,
 		chunker:            chunker.NewChunker(cfg.ChunkSize),
@@ -237,6 +255,7 @@ func NewScanner(cfg ScannerConfig) *Scanner {
 		ageRecipient:       strings.Join(cfg.AgeRecipients, ","),
 		exclude:            cfg.Exclude,
 		compiledExclude:    compiledExclude,
+		indexAndLockFiles:  indexAndLockFiles,
 		progress:           progress,
 		skipErrors:         cfg.SkipErrors,
 		previousSnapshotID: cfg.PreviousSnapshotID,
@@ -1861,7 +1880,13 @@ func (s *Scanner) uploadBlobIfNeeded(
 	err = s.storage.PutWithProgress(ctx, blobPath, blobWithReader.Reader,
 		finishedBlob.Compressed, progressCallback)
 	if err != nil {
-		log.Error("Failed to upload blob", "hash", finishedBlob.Hash, "error", err)
+		// The record is at info level: the returned error ends the backup
+		// and is printed as its ERROR: line. Only an interrupt cancels
+		// ctx, and the user is told about it, so an upload it stopped is
+		// not logged as a storage failure.
+		if ctx.Err() == nil {
+			log.Info("Failed to upload blob", "hash", finishedBlob.Hash, "error", err)
+		}
 
 		return 0, false, fmt.Errorf("uploading blob to storage: %w", err)
 	}
@@ -2248,8 +2273,9 @@ func (s *Scanner) detectDeletedFiles(
 
 // excludedOrInExcludedDir reports whether filePath, which is at or
 // beneath rootPath, or any directory between rootPath and it, matches an
-// exclude pattern. A pattern such as */.local/share/Trash matches the
+// exclude pattern or is one of vaultik's own files. A pattern such as
-// directory but not the files inside it, which the walk skips too.
+// */.local/share/Trash matches the directory but not the files inside it,
+// which the walk skips too.
 func (s *Scanner) excludedOrInExcludedDir(filePath, rootPath string) bool {
 	for p := filePath; len(p) > len(rootPath); p = filepath.Dir(p) {
 		if s.shouldExclude(p, rootPath) {
@@ -2297,51 +2323,18 @@ func wrapPermissionError(path string, err error) error {
 		"with --skip-errors to continue past unreadable files)", path, err)
 }
 
-// compileExcludePatterns compiles the exclude patterns into glob matchers
+// compileExcludePatterns compiles the exclude patterns into glob matchers.
-func compileExcludePatterns(patterns []string) []compiledPattern {
+// Config.Validate has already refused a pattern that does not compile.
+func compileExcludePatterns(patterns []string) ([]compiledPattern, error) {
 	var compiled []compiledPattern
 
 	for _, p := range patterns {
-		if p == "" {
+		globs, anchored, err := exclude.Compile(p)
-			continue
+		if err != nil {
+			return nil, err
 		}
 
-		// Check if pattern is anchored (starts with /)
+		for _, g := range globs {
-		anchored := strings.HasPrefix(p, "/")
-
-		pattern := p
-		if anchored {
-			pattern = p[1:] // Remove leading /
-		}
-
-		// Remove trailing slash if present (directory indicator)
-		pattern = strings.TrimSuffix(pattern, "/")
-
-		// A leading "**/" demands a "/" before the name and so misses an
-		// entry directly under the source path. It means "at every depth",
-		// which is what an unanchored pattern already does, so drop the
-		// prefix and match unanchored: as in gitignore, "**/x" and
-		// "/**/x" then also match a top-level "x".
-		if rest, found := strings.CutPrefix(pattern, "**/"); found {
-			pattern = rest
-			anchored = false
-		}
-
-		// Likewise "/**/" inside a pattern demands two slashes, so
-		// "a/**/*.log" misses "a/x.log". As in gitignore it stands for
-		// zero or more directories, so also compile the pattern with it
-		// made a single "/". The glob library's {a,b} is no help: with a
-		// "**" inside it in mid-pattern, it misses paths it should match.
-		for _, variant := range doubleStarVariants(pattern) {
-			// For patterns without path separators, we need to match them as components
-			// e.g., ".git" should match ".git" anywhere in the path
-			g, err := glob.Compile(variant, '/')
-			if err != nil {
-				log.Warn("Invalid exclude pattern, skipping", "pattern", p, "error", err)
-
-				break
-			}
-
 			compiled = append(compiled, compiledPattern{
 				pattern:  g,
 				anchored: anchored,
@@ -2350,32 +2343,18 @@ func compileExcludePatterns(patterns []string) []compiledPattern {
 		}
 	}
 
-	return compiled
+	return compiled, nil
-}
-
-// doubleStarVariants returns pattern once for every way of keeping each
-// "/**/" in it or making it a single "/".
-func doubleStarVariants(pattern string) []string {
-	const doubleStar = "/**/"
-
-	before, after, found := strings.Cut(pattern, doubleStar)
-	if !found {
-		return []string{pattern}
-	}
-
-	var variants []string
-
-	for _, rest := range doubleStarVariants(after) {
-		variants = append(variants, before+doubleStar+rest, before+"/"+rest)
-	}
-
-	return variants
 }
 
 // shouldExclude checks if a path should be excluded based on exclude patterns
+// or because it is one of vaultik's own working files.
 // filePath is the full path to the file
 // rootPath is the root of the backup source directory
 func (s *Scanner) shouldExclude(filePath, rootPath string) bool {
+	if _, ok := s.indexAndLockFiles[filePath]; ok {
+		return true
+	}
+
 	if len(s.compiledExclude) == 0 {
 		return false
 	}

internal/snapshot/upload_cancel_log_test.go

@@ -0,0 +1,135 @@
+//nolint:testpackage // exercises the unexported uploadBlobIfNeeded
+package snapshot
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/vaultik/internal/blob"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/storage"
+	"sneak.berlin/go/vaultik/internal/storage/faultstore"
+	"sneak.berlin/go/vaultik/internal/ui"
+)
+
+const uploadFailedLogMessage = "Failed to upload blob"
+
+// uploadTestBlob uploads a small blob through store.
+func uploadTestBlob(ctx context.Context, store storage.Storer) error {
+	data := []byte("blob data")
+	s := &Scanner{storage: store, ui: ui.NewWithColor(io.Discard, false)}
+
+	_, _, err := s.uploadBlobIfNeeded(ctx, "blobs/test", &blob.WithReader{
+		FinishedBlob: &blob.FinishedBlob{
+			Hash:       "test",
+			Compressed: int64(len(data)),
+		},
+		Reader: bytes.NewReader(data),
+	}, time.Now(), &ScanResult{})
+
+	return err
+}
+
+// captureLog runs fn and returns what the logger wrote to stderr
+// meanwhile, at the --verbose level. The logger writes to the os.Stderr
+// it finds when it is initialized, so os.Stderr is pointed at a file
+// first. Not parallel-safe: os.Stderr and the logger are process-global.
+func captureLog(t *testing.T, fn func()) string {
+	t.Helper()
+
+	stderrPath := filepath.Join(t.TempDir(), "stderr")
+
+	stderrFile, err := os.Create(stderrPath) //nolint:gosec // G304: test temp path
+	if err != nil {
+		t.Fatalf("creating stderr file: %v", err)
+	}
+
+	previous := os.Stderr
+	os.Stderr = stderrFile
+
+	log.Initialize(log.Config{Verbose: true})
+
+	fn()
+
+	os.Stderr = previous
+
+	log.Initialize(log.Config{})
+
+	_ = stderrFile.Close()
+
+	captured, err := os.ReadFile(stderrPath) //nolint:gosec // G304: test temp path
+	if err != nil {
+		t.Fatalf("reading stderr file: %v", err)
+	}
+
+	return string(captured)
+}
+
+// An upload stopped by Ctrl-C or SIGTERM is not logged as an error; the
+// interrupted message is all the user sees. See
+// https://git.eeqj.de/sneak/vaultik/issues/434.
+//
+//nolint:paralleltest // captureLog replaces os.Stderr
+func TestInterruptedUploadIsNotLoggedAsError(t *testing.T) {
+	inner, err := storage.NewFileStorer(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	// The user interrupts mid-upload. The injected error does not wrap
+	// context.Canceled, so only ctx shows why the upload failed.
+	store := faultstore.New(inner)
+	store.OnPut = func(string) faultstore.PutAction {
+		cancel()
+
+		return faultstore.PutFail
+	}
+
+	var uploadErr error
+
+	stderr := captureLog(t, func() { uploadErr = uploadTestBlob(ctx, store) })
+
+	if uploadErr == nil {
+		t.Fatal("expected the upload to fail")
+	}
+
+	if strings.Contains(stderr, uploadFailedLogMessage) {
+		t.Errorf("interrupted upload logged as a failure: %q", stderr)
+	}
+}
+
+// An upload that fails for any other reason is still logged.
+//
+//nolint:paralleltest // captureLog replaces os.Stderr
+func TestFailedUploadIsLogged(t *testing.T) {
+	inner, err := storage.NewFileStorer(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	store := faultstore.New(inner)
+	store.OnPut = func(string) faultstore.PutAction { return faultstore.PutFail }
+
+	var uploadErr error
+
+	stderr := captureLog(t, func() {
+		uploadErr = uploadTestBlob(context.Background(), store)
+	})
+
+	if uploadErr == nil {
+		t.Fatal("expected the upload to fail")
+	}
+
+	if !strings.Contains(stderr, uploadFailedLogMessage) {
+		t.Errorf("failed upload not logged: %q", stderr)
+	}
+}

internal/ui/ui.go

@@ -17,6 +17,9 @@
 // Count, Percent) return ANSI-colored strings the caller composes into
 // the message body. When color is disabled (non-TTY output or NO_COLOR
 // set) all formatters return plain text.
+//
+// QuoteUnprintable is the same escaping without colour, for plain tables
+// that print paths from the snapshot database.
 package ui
 
 import (
@@ -227,17 +230,17 @@ func (w *Writer) Hex(s string) string {
 		short = s[:hexAbbrevLen] + "..."
 	}
 
-	return w.paint(ansiCyan, sanitize(short))
+	return w.paint(ansiCyan, QuoteUnprintable(short))
 }
 
 // Snapshot colorizes a snapshot ID (full, no abbreviation).
 func (w *Writer) Snapshot(id string) string {
-	return w.paint(ansiCyan+ansiBold, sanitize(id))
+	return w.paint(ansiCyan+ansiBold, QuoteUnprintable(id))
 }
 
 // Path colorizes a filesystem path.
 func (w *Writer) Path(p string) string {
-	return w.paint(ansiBlue, sanitize(p))
+	return w.paint(ansiBlue, QuoteUnprintable(p))
 }
 
 // Size colorizes a byte count using humanize.Bytes.
@@ -312,14 +315,15 @@ func (w *Writer) paint(color, s string) string {
 	return color + s + ansiReset
 }
 
-// sanitize returns s unchanged when every rune in it is printable, and a
+// QuoteUnprintable returns s unchanged when every rune in it is printable,
-// double-quoted, backslash-escaped form (\n, \x1b, …) otherwise. The
+// and a double-quoted, backslash-escaped form (\n, \x1b, …) otherwise. The
 // string value formatters escape their argument through this before
 // painting: identifiers, paths and symlink targets they render come from
 // the snapshot database, which is not trusted, and escaping must happen
 // before colour is applied — the painted result already contains the
 // escape codes the raw text would otherwise be indistinguishable from.
-func sanitize(s string) string {
+// Plain tables call it directly.
+func QuoteUnprintable(s string) string {
 	for _, r := range s {
 		if !unicode.IsPrint(r) {
 			return strconv.Quote(s)

internal/vaultik/blob_fetch.go

@@ -160,7 +160,8 @@ func (v *Vaultik) FetchBlob(
 // Not every backend's reader stops on cancel by itself (the file
 // backend's does not), and a read stalled on a slow or hung source would
 // otherwise outlast the shutdown timeout, so the process would exit
-// before restore or deep verify removed its decrypted temporary files.
+// before restore, deep verify or `snapshot files` removed its decrypted
+// temporary files.
 type closeOnCancelReader struct {
 	io.ReadCloser
 

internal/vaultik/restore.go

@@ -31,7 +31,7 @@ var (
 	errPathsNotInSnapshot    = errors.New("requested path(s) not in the snapshot")
 	errFilesFailedVerify     = errors.New("files failed verification")
 	errDecryptionKeyRequired = errors.New(
-		"decryption key required for restore\n\n" +
+		"decryption key required\n\n" +
 			"Set the VAULTIK_AGE_SECRET_KEY environment variable to your " +
 			"age private key file:\n" +
 			"  export VAULTIK_AGE_SECRET_KEY=\"$(cat vaultik_backup_private_key.txt)\"")
@@ -153,18 +153,7 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		return fmt.Errorf("downloading snapshot database: %w", err)
 	}
 
-	defer func() {
+	defer v.closeSnapshotDB(tempDB, tempDir)
-		err := tempDB.Close()
-		if err != nil {
-			log.Debug("Failed to close temp database", "error", err)
-		}
-		// Remove the whole private directory, so the decrypted database
-		// and any SQLite side files it produced are gone on every path.
-		err = v.Fs.RemoveAll(tempDir)
-		if err != nil {
-			log.Debug("Failed to remove temp database directory", "error", err)
-		}
-	}()
 
 	repos := database.NewRepositories(tempDB)
 
@@ -325,9 +314,10 @@ func (v *Vaultik) reportUnmatchedPaths(unmatched []string) error {
 // identity it contains. The value may be a single key line or a whole
 // age-keygen file with several identities; all of them are returned so
 // blobgen (via age.Decrypt) can read a blob encrypted to any of their
-// recipients. This is the first step of both restore and deep verify, so
+// recipients. This is the first step of restore, deep verify and
-// a missing or unparseable key fails before anything is downloaded. The
+// `snapshot files`, so a missing or unparseable key fails before anything
-// error names the configuration source but never the key value.
+// is downloaded. The error names the configuration source but never the
+// key value.
 func (v *Vaultik) restoreIdentities() ([]age.Identity, error) {
 	if v.Config.AgeSecretKey == "" {
 		return nil, errDecryptionKeyRequired
@@ -667,19 +657,19 @@ func (v *Vaultik) restoreProgressTick(
 
 // handleRestoreFileError records a per-file restore failure: fatal unless
 // --skip-errors is set, in which case the file is counted as failed and
-// dropped from the plan.
+// dropped from the plan. A fatal failure is not logged here: the returned
+// error is printed as the command's ERROR: line.
 func (v *Vaultik) handleRestoreFileError(
 	plan *restorePlan, opts *RestoreOptions, result *RestoreResult,
 	file *database.File, fileID types.FileID, err error,
 ) error {
-	log.Error("Failed to restore file", "path", file.Path, "error", err)
-
 	if !opts.SkipErrors {
 		return fmt.Errorf(
 			"restoring %s: %w (pass --skip-errors to continue past "+
 				"restore failures)", file.Path, err)
 	}
 
+	log.Error("Failed to restore file", "path", file.Path, "error", err)
 	v.UI.Errorf("Failed to restore %s: %v. Skipping (--skip-errors).",
 		v.UI.Path(file.Path.String()), err)
 
@@ -880,18 +870,34 @@ func (v *Vaultik) downloadSnapshotDB(
 	return db, tempDir, nil
 }
 
+// closeSnapshotDB closes a database returned by downloadSnapshotDB and
+// removes its private directory, so the decrypted database and any SQLite
+// side files it produced are gone.
+func (v *Vaultik) closeSnapshotDB(db *database.DB, tempDir string) {
+	err := db.Close()
+	if err != nil {
+		log.Debug("Failed to close temp database", "error", err)
+	}
+
+	err = v.Fs.RemoveAll(tempDir)
+	if err != nil {
+		log.Debug("Failed to remove temp database directory", "error", err)
+	}
+}
+
 // verifySnapshotDBIdentity confirms the decrypted metadata database really
 // is the snapshot named by remoteKey. age decryption proves the database
 // is readable, not that the object served at
 // metadata/<remoteKey>/db.zst.age is the snapshot that was requested: an
 // attacker who swaps in another valid db.zst.age (which needs no key
-// material) would otherwise redirect restore and deep verify to a
+// material) would otherwise redirect restore, deep verify and
-// different snapshot's contents. The exported per-snapshot database holds
+// `snapshot files` to a different snapshot's contents. The exported
-// exactly one snapshot row, and a snapshot's remote key is derived from
+// per-snapshot database holds exactly one snapshot row, and a snapshot's
-// that row's ID, so the database is the requested one exactly when its
+// remote key is derived from that row's ID, so the database is the
-// sole snapshot hashes back to remoteKey. Comparing the requested
+// requested one exactly when its sole snapshot hashes back to remoteKey.
-// identifier directly would not do: it may be a remote-key prefix a
+// Comparing the requested identifier directly would not do: it may be a
-// recovery host uses in place of a human snapshot ID it cannot know.
+// remote-key prefix a recovery host uses in place of a human snapshot ID
+// it cannot know.
 func (v *Vaultik) verifySnapshotDBIdentity(
 	db *database.DB, requested, remoteKey string,
 ) error {

internal/vaultik/snapshot_files.go

@@ -0,0 +1,115 @@
+package vaultik
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"text/tabwriter"
+	"time"
+
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/ui"
+)
+
+// ListedFile is one entry printed by `snapshot files`. Mode is the Go
+// file mode string, which shows the entry type and the permission bits
+// (for example -rw-r--r-- or drwxr-xr-x).
+type ListedFile struct {
+	Path  string    `json:"path"`
+	Size  int64     `json:"size"`
+	Mode  string    `json:"mode"`
+	MTime time.Time `json:"mtime"`
+}
+
+// ListSnapshotFiles prints the path, size, mode and modification time of
+// every file the snapshot holds at or under path, or of every file when
+// path is empty. The file list is only in the snapshot's encrypted
+// database, so this downloads and decrypts it as restore does, and needs
+// the private key.
+func (v *Vaultik) ListSnapshotFiles(snapshotID, path string, jsonOutput bool) error {
+	identities, err := v.restoreIdentities()
+	if err != nil {
+		return err
+	}
+
+	remoteKey, err := v.resolveSnapshotRemoteKey(snapshotID)
+	if err != nil {
+		return err
+	}
+
+	db, tempDir, err := v.downloadSnapshotDB(snapshotID, remoteKey, identities)
+	if errors.Is(err, errWrongPrivateKey) {
+		return err
+	}
+
+	if err != nil {
+		return fmt.Errorf("downloading snapshot database: %w", err)
+	}
+
+	defer v.closeSnapshotDB(db, tempDir)
+
+	repos := database.NewRepositories(db)
+
+	var files []*database.File
+
+	if path == "" {
+		files, err = repos.Files.ListAll(v.ctx)
+	} else {
+		files, err = repos.Files.ListUnderPath(v.ctx, filepath.Clean(path))
+	}
+
+	if err != nil {
+		return fmt.Errorf("listing files: %w", err)
+	}
+
+	if path != "" && len(files) == 0 {
+		return fmt.Errorf("%w: %s", errPathsNotInSnapshot, path)
+	}
+
+	entries := make([]ListedFile, 0, len(files))
+
+	for _, file := range files {
+		entries = append(entries, ListedFile{
+			Path:  file.Path.String(),
+			Size:  file.Size,
+			Mode:  os.FileMode(file.Mode).String(),
+			MTime: file.MTime,
+		})
+	}
+
+	if jsonOutput {
+		encoder := json.NewEncoder(v.Stdout)
+		encoder.SetIndent("", "  ")
+
+		return encoder.Encode(entries)
+	}
+
+	if v.UI.Quiet() {
+		return nil
+	}
+
+	return v.printListedFileTable(entries)
+}
+
+// printListedFileTable writes the entries as a plain table to stdout.
+func (v *Vaultik) printListedFileTable(entries []ListedFile) error {
+	w := tabwriter.NewWriter(v.Stdout, 0, 0, tabPadding, ' ', 0)
+
+	_, err := fmt.Fprintln(w, "MODE\tSIZE\tMODIFIED\tPATH")
+	if err != nil {
+		return err
+	}
+
+	for _, entry := range entries {
+		_, err = fmt.Fprintf(w, "%s\t%d\t%s\t%s\n",
+			entry.Mode, entry.Size,
+			entry.MTime.Format(time.RFC3339), ui.QuoteUnprintable(entry.Path))
+		if err != nil {
+			return err
+		}
+	}
+
+	return w.Flush()
+}

internal/vaultik/snapshot_files_test.go

@@ -0,0 +1,197 @@
+package vaultik_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/storage"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// These tests cover https://git.eeqj.de/sneak/vaultik/issues/435:
+// `snapshot files` lists what a snapshot holds without restoring it.
+
+// unprintableFileName is a file name holding a newline and an escape
+// sequence, which the table must not print raw.
+const unprintableFileName = "odd\nname\x1b[31m"
+
+// backUpForFileListing backs up the fault source tree, plus a file named
+// unprintableFileName at its top, and returns a reader whose stdout is
+// out, the snapshot ID, and the source directory.
+func backUpForFileListing(
+	t *testing.T, out *bytes.Buffer,
+) (*vaultik.Vaultik, string, string) {
+	t.Helper()
+
+	fs := afero.NewOsFs()
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "src")
+	dbPath := filepath.Join(tempDir, "index.sqlite")
+
+	ctx := context.Background()
+	cfg := faultTestConfig()
+
+	writeFaultSourceTree(t, fs, dataDir)
+	require.NoError(t, afero.WriteFile(fs,
+		filepath.Join(dataDir, unprintableFileName), []byte("odd"), 0o644))
+
+	store, err := storage.NewFileStorer(t.TempDir())
+	require.NoError(t, err)
+
+	db, err := database.New(ctx, dbPath)
+	require.NoError(t, err)
+
+	id := fullFaultBackup(ctx, t, fs, store, cfg,
+		database.NewRepositories(db), dataDir, dbPath, "files")
+	require.NoError(t, db.Close())
+
+	v := newReaderVaultik(ctx, cfg, store, nil, fs)
+	v.Stdout = out
+
+	return v, id, dataDir
+}
+
+func TestSnapshotFilesJSONListsEveryFileWithItsMetadata(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	v, id, dataDir := backUpForFileListing(t, &out)
+
+	require.NoError(t, v.ListSnapshotFiles(id, "", true))
+
+	var entries []vaultik.ListedFile
+
+	require.NoError(t, json.Unmarshal(out.Bytes(), &entries))
+
+	byPath := make(map[string]vaultik.ListedFile, len(entries))
+	for _, entry := range entries {
+		byPath[entry.Path] = entry
+	}
+
+	for _, rel := range []string{"small.txt", "a.bin", "sub", "sub/b.bin", "sub/c.bin"} {
+		path := filepath.Join(dataDir, rel)
+
+		entry, ok := byPath[path]
+		require.True(t, ok, "%s must be listed", path)
+
+		info, err := afero.NewOsFs().Stat(path)
+		require.NoError(t, err)
+
+		assert.Equal(t, info.Mode().String(), entry.Mode, path)
+		assert.True(t, info.ModTime().Equal(entry.MTime),
+			"%s: mtime %v, listed %v", path, info.ModTime(), entry.MTime)
+
+		if !info.IsDir() {
+			assert.Equal(t, info.Size(), entry.Size, path)
+		}
+	}
+}
+
+func TestSnapshotFilesListsOnlyWhatIsUnderThePath(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	v, id, dataDir := backUpForFileListing(t, &out)
+
+	require.NoError(t, v.ListSnapshotFiles(id, filepath.Join(dataDir, "sub"), false))
+
+	text := out.String()
+	assert.Contains(t, text, filepath.Join(dataDir, "sub", "b.bin"))
+	assert.Contains(t, text, filepath.Join(dataDir, "sub", "c.bin"))
+	assert.NotContains(t, text, filepath.Join(dataDir, "small.txt"))
+	assert.True(t, strings.HasPrefix(text, "MODE"), "the table must have a header")
+}
+
+// TestSnapshotFilesTableEscapesAnUnprintablePath checks that the table
+// prints a path holding a newline and an escape sequence quoted and
+// escaped on one row: the newline must not start a forged row, and the
+// escape sequence must not reach the terminal.
+func TestSnapshotFilesTableEscapesAnUnprintablePath(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	v, id, dataDir := backUpForFileListing(t, &out)
+
+	require.NoError(t, v.ListSnapshotFiles(id, "", false))
+
+	text := out.String()
+	assert.Contains(t, text,
+		strconv.Quote(filepath.Join(dataDir, unprintableFileName)))
+	assert.NotContains(t, text, "\x1b", "no escape byte may reach the output")
+
+	for line := range strings.SplitSeq(text, "\n") {
+		assert.False(t, strings.HasPrefix(line, "name"),
+			"the newline in the name must not start a row: %q", line)
+	}
+}
+
+// TestSnapshotFilesQuietSuppressesTableNotJSON is the --quiet contract
+// for `snapshot files`: the table is silenced, but the --json document a
+// script depends on is still written.
+func TestSnapshotFilesQuietSuppressesTableNotJSON(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	v, id, _ := backUpForFileListing(t, &out)
+	v.UI.SetQuiet(true)
+
+	require.NoError(t, v.ListSnapshotFiles(id, "", false))
+	require.Empty(t, out.String(), "the table must be silenced under --quiet")
+
+	require.NoError(t, v.ListSnapshotFiles(id, "", true))
+
+	var entries []vaultik.ListedFile
+
+	require.NoError(t, json.Unmarshal(out.Bytes(), &entries))
+	assert.NotEmpty(t, entries,
+		"the --json document must still be written under --quiet")
+}
+
+func TestSnapshotFilesFailsOnAPathThatMatchesNothing(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	v, id, dataDir := backUpForFileListing(t, &out)
+	missing := filepath.Join(dataDir, "typo.txt")
+
+	err := v.ListSnapshotFiles(id, missing, false)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), missing, "the error must name the path")
+	assert.Empty(t, out.String(), "nothing must be printed")
+}
+
+func TestSnapshotFilesRequiresThePrivateKey(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	v, id, _ := backUpForFileListing(t, &out)
+	v.Config.AgeSecretKey = ""
+
+	err := v.ListSnapshotFiles(id, "", false)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "VAULTIK_AGE_SECRET_KEY")
+}

internal/vaultik/snapshot_list.go

@@ -39,7 +39,8 @@ const maxRemoteOnlyRows = 1000
 // manifest reads need throttling.
 const remoteManifestFetchConcurrency = 8
 
-// tabPadding is the tabwriter cell padding for the snapshot table.
+// tabPadding is the tabwriter cell padding for the `snapshot list` and
+// `snapshot files` tables.
 const tabPadding = 3
 
 // ListSnapshots prints the table of snapshots known to this host: the

script/version

@@ -11,8 +11,8 @@
 # when no tag is reachable, each with a "-dirty" suffix when tracked
 # files have uncommitted changes. Untracked files are ignored: a stray
 # scratch file does not change what was compiled. Outside a git checkout
-# (release tarball, `go install`), or in one with no commits, it is
+# (such as an unpacked release tarball), or in one with no commits, it
-# "dev".
+# is "dev".
 #
 # Nothing here ever invents a version number.
 set -eu