List a file:// destination through a symlinked directory (closes #296)

List and ListStream walked the destination with afero.Walk, which uses
Lstat and so reported a symlinked metadata/ or blobs/ directory as one
file, while Put, Get and Stat follow the link. The store then listed as
empty, and prune removed the local snapshot records and deleted every
blob. The listings, and DeletePartialUploads, which remote nuke uses,
now walk a view of the filesystem without its Lstat method, so afero
falls back to Stat and enters the link. A prefix lists as empty only
when it is truly missing: when it or a directory above it is a symlink
whose target is missing, such as a link to an unmounted volume, the
listing fails.

Judgement call: a symlink loop is not detected; it is followed until the
system refuses the path, and the listing fails.

Model: opus-5-5

README.md

@@ -294,7 +294,8 @@ needed.
 of the local index and the backup destination store — with timestamps
 and three sizes per snapshot (compressed remote size; total
 uncompressed chunk size; size of the chunks that snapshot stored that
-were not stored before, recorded when its backup ran).
+were not stored before). Both chunk sizes are recorded when the
+snapshot's backup runs.
 
 Listing the destination store does **not** require the age secret key,
 so it works in vaultik's intended configuration, where the backed-up

docs/DATAMODEL.md

@@ -122,6 +122,7 @@ Tracks backup snapshots.
 - `new_chunk_size` (INTEGER) - Total size of those chunks before compression; `snapshot list` shows it as NEW CHUNK SIZE
 - `blob_count` (INTEGER) - Number of blobs this snapshot created
 - `total_size` (INTEGER) - Total size of all files
+- `uncompressed_chunk_size` (INTEGER) - Total size before compression of the distinct chunks the snapshot's files reference, recorded when its backup ran; `snapshot list` shows it as UNCOMPRESSED SIZE
 - `blob_size` (INTEGER) - Total compressed size of all referenced blobs
 - `blob_uncompressed_size` (INTEGER) - Total uncompressed size of all referenced blobs
 - `compression_ratio` (REAL) - Compression ratio achieved

internal/database/schema/001.sql

@@ -89,6 +89,7 @@ CREATE TABLE IF NOT EXISTS snapshots (
     new_chunk_size INTEGER NOT NULL DEFAULT 0,
     blob_count INTEGER NOT NULL DEFAULT 0,
     total_size INTEGER NOT NULL DEFAULT 0,
+    uncompressed_chunk_size INTEGER NOT NULL DEFAULT 0,
     blob_size INTEGER NOT NULL DEFAULT 0,
     blob_uncompressed_size INTEGER NOT NULL DEFAULT 0,
     compression_ratio REAL NOT NULL DEFAULT 1.0,

internal/database/snapshots.go

@@ -120,7 +120,11 @@ func (r *SnapshotRepository) UpdateCounts(
 	return nil
 }
 
-// UpdateExtendedStats updates extended statistics for a snapshot
+// UpdateExtendedStats updates extended statistics for a snapshot. It also
+// records the total plaintext size of the distinct chunks the snapshot's
+// files reference. Only the snapshot's own backup can take that total: a
+// file's row is shared by every snapshot that lists it, and a later
+// backup of a changed file rewrites the row with the new chunks.
 func (r *SnapshotRepository) UpdateExtendedStats(
 	ctx context.Context,
 	tx *sql.Tx,
@@ -145,7 +149,17 @@ func (r *SnapshotRepository) UpdateExtendedStats(
 		    compression_level = ?,
 		    upload_bytes = ?,
 		    upload_duration_ms = ?,
-		    new_chunk_size = ?
+		    new_chunk_size = ?,
+		    uncompressed_chunk_size = (
+		        SELECT COALESCE(SUM(c.size), 0)
+		        FROM (
+		            SELECT DISTINCT fc.chunk_hash
+		            FROM snapshot_files sf
+		            JOIN file_chunks fc ON sf.file_id = fc.file_id
+		            WHERE sf.snapshot_id = snapshots.id
+		        ) sc
+		        JOIN chunks c ON sc.chunk_hash = c.chunk_hash
+		    )
 		WHERE id = ?
 	`
 
@@ -555,30 +569,22 @@ func (r *SnapshotRepository) GetSnapshotBlobSizes(
 	return compressed, uncompressed, nil
 }
 
-// GetSnapshotUncompressedChunkSize returns the sum of plaintext sizes of all unique
-// chunks referenced by a snapshot (via snapshot_files → file_chunks → chunks).
+// GetSnapshotUncompressedChunkSize returns the total plaintext size of the
+// distinct chunks the snapshot's files reference, as the snapshot's backup
+// recorded it (see UpdateExtendedStats).
 func (r *SnapshotRepository) GetSnapshotUncompressedChunkSize(
 	ctx context.Context, snapshotID string,
 ) (int64, error) {
-	query := `
-		SELECT COALESCE(SUM(c.size), 0)
-		FROM (
-			SELECT DISTINCT fc.chunk_hash
-			FROM snapshot_files sf
-			JOIN file_chunks fc ON sf.file_id = fc.file_id
-			WHERE sf.snapshot_id = ?
-		) sc
-		JOIN chunks c ON sc.chunk_hash = c.chunk_hash
-	`
+	query := `SELECT uncompressed_chunk_size FROM snapshots WHERE id = ?`
 
-	var totalSize int64
+	var uncompressedChunkSize int64
 
-	err := r.db.conn.QueryRowContext(ctx, query, snapshotID).Scan(&totalSize)
+	err := r.db.conn.QueryRowContext(ctx, query, snapshotID).Scan(&uncompressedChunkSize)
 	if err != nil {
 		return 0, fmt.Errorf("querying uncompressed chunk size: %w", err)
 	}
 
-	return totalSize, nil
+	return uncompressedChunkSize, nil
 }
 
 // GetSnapshotNewChunkSize returns the total plaintext size of the chunks the

internal/storage/file.go

@@ -120,9 +120,10 @@ func (f *FileStorer) Delete(_ context.Context, key string) error {
 	return nil
 }
 
-// List returns all keys with the given prefix. It fails when the
-// destination directory is missing; a missing prefix under it is an
-// empty listing.
+// List returns all keys with the given prefix, reading through symlinked
+// directories. It fails when the destination directory is missing, or
+// when the prefix or a directory above it is a symlink whose target is
+// missing; a prefix that is truly missing is an empty listing.
 func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error) {
 	var keys []string
 
@@ -133,8 +134,7 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 
 	basePath := f.fullPath(prefix)
 
-	// Check if the prefix exists
-	exists, err := afero.Exists(f.fs, basePath)
+	exists, err := f.prefixExists(prefix)
 	if err != nil {
 		return nil, fmt.Errorf("checking path: %w", err)
 	}
@@ -143,7 +143,7 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 		return keys, nil // Empty list for non-existent prefix
 	}
 
-	err = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
+	err = f.walk(basePath, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -176,7 +176,9 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 }
 
 // ListStream returns a channel of ObjectInfo for large result sets. Like
-// List, it sends an error when the destination directory is missing.
+// List, it reads through symlinked directories and sends an error when
+// the destination directory is missing, or when the prefix or a directory
+// above it is a symlink whose target is missing.
 func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan ObjectInfo {
 	ch := make(chan ObjectInfo)
 
@@ -192,8 +194,7 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 
 		basePath := f.fullPath(prefix)
 
-		// Check if the prefix exists
-		exists, err := afero.Exists(f.fs, basePath)
+		exists, err := f.prefixExists(prefix)
 		if err != nil {
 			ch <- ObjectInfo{Err: fmt.Errorf("checking path: %w", err)}
 
@@ -204,7 +205,7 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 			return // Empty channel for non-existent prefix
 		}
 
-		_ = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
+		_ = f.walk(basePath, func(path string, info os.FileInfo, err error) error {
 			// Check context cancellation
 			select {
 			case <-ctx.Done():
@@ -243,11 +244,12 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 }
 
 // DeletePartialUploads removes every file under prefix whose name ends in
-// tempSuffix. A missing prefix has none to remove.
+// tempSuffix. Like List, it reads through symlinked directories and fails
+// on one whose target is missing. A missing prefix has none to remove.
 func (f *FileStorer) DeletePartialUploads(ctx context.Context, prefix string) error {
 	basePath := f.fullPath(prefix)
 
-	exists, err := afero.Exists(f.fs, basePath)
+	exists, err := f.prefixExists(prefix)
 	if err != nil {
 		return fmt.Errorf("checking path: %w", err)
 	}
@@ -256,7 +258,7 @@ func (f *FileStorer) DeletePartialUploads(ctx context.Context, prefix string) er
 		return nil
 	}
 
-	err = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
+	err = f.walk(basePath, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -352,6 +354,54 @@ func (f *FileStorer) writeAtomic(
 	return nil
 }
 
+// walk is afero.Walk, except that it reads through a symlinked directory
+// the way Get and Stat do, where afero.Walk reports the link as one file.
+// afero.Walk uses Lstat, which does not follow a link, whenever the
+// filesystem has one; the struct below carries only the afero.Fs methods,
+// so the walk uses Stat instead. A link back up the tree is followed until
+// the operating system refuses the path for too many levels of links, and
+// the walk then fails.
+func (f *FileStorer) walk(root string, fn filepath.WalkFunc) error {
+	return afero.Walk(struct{ afero.Fs }{f.fs}, root, fn)
+}
+
+// prefixExists reports whether prefix exists under the destination
+// directory. It checks each directory on the way down to prefix in turn,
+// and the first one Stat cannot find decides: if it is not there at all,
+// prefix is missing; if it is a symlink whose target is missing, such as
+// a link to a volume that is not mounted, prefixExists fails, since
+// listing it as empty would let prune delete every blob.
+func (f *FileStorer) prefixExists(prefix string) (bool, error) {
+	lstater, canLstat := f.fs.(afero.Lstater)
+	path := f.basePath
+
+	for name := range strings.SplitSeq(prefix, "/") {
+		path = filepath.Join(path, name)
+
+		_, err := f.fs.Stat(path)
+		if err == nil {
+			continue
+		}
+
+		if !os.IsNotExist(err) {
+			return false, err
+		}
+
+		// Lstat does not follow a symlink at path, so it finds the link
+		// that Stat could not follow.
+		if canLstat {
+			_, _, lstatErr := lstater.LstatIfPossible(path)
+			if lstatErr == nil {
+				return false, err
+			}
+		}
+
+		return false, nil
+	}
+
+	return true, nil
+}
+
 // fullPath returns the full filesystem path for a key.
 func (f *FileStorer) fullPath(key string) string {
 	return filepath.Join(f.basePath, key)

internal/storage/file_backend_test.go

@@ -4,7 +4,10 @@ import (
 	"context"
 	"errors"
 	"io/fs"
+	"os"
 	"path/filepath"
+	"reflect"
+	"strings"
 	"testing"
 
 	"sneak.berlin/go/vaultik/internal/storage"
@@ -60,3 +63,232 @@ func TestFileStorerListMissingDestination(t *testing.T) {
 		t.Errorf("ListStream error = %v, want a not-exist error", streamErr)
 	}
 }
+
+// The two directories at the top of a destination, either of which the
+// tests below replace with a symlink.
+const (
+	metadataDir = "metadata"
+	blobsDir    = "blobs"
+)
+
+// moveBehindSymlink moves base/dir to a directory elsewhere and puts a
+// symlink to it in its place.
+func moveBehindSymlink(t *testing.T, base, dir string) {
+	t.Helper()
+
+	linkPath := filepath.Join(base, dir)
+	movedPath := filepath.Join(t.TempDir(), dir)
+
+	err := os.Rename(linkPath, movedPath)
+	if err != nil {
+		t.Fatalf("moving %s away: %v", dir, err)
+	}
+
+	err = os.Symlink(movedPath, linkPath)
+	if err != nil {
+		t.Fatalf("linking %s: %v", dir, err)
+	}
+}
+
+// TestFileStorerListsThroughSymlinkedDirectory checks that List and
+// ListStream read through a symlinked metadata/ or blobs/ directory, as Get
+// and Stat do, instead of listing the link as one key. Listing the whole
+// destination meets the link part-way through the walk; listing its prefix
+// starts the walk at the link. A prefix missing behind the link lists as
+// empty.
+func TestFileStorerListsThroughSymlinkedDirectory(t *testing.T) {
+	t.Parallel()
+
+	for _, dir := range []string{metadataDir, blobsDir} {
+		t.Run(dir, func(t *testing.T) {
+			t.Parallel()
+
+			base := t.TempDir()
+			key := dir + "/aa/bb/object"
+
+			s, err := storage.NewFileStorer(base)
+			if err != nil {
+				t.Fatalf("NewFileStorer: %v", err)
+			}
+
+			err = s.Put(context.Background(), key, strings.NewReader("data"))
+			if err != nil {
+				t.Fatalf("Put: %v", err)
+			}
+
+			moveBehindSymlink(t, base, dir)
+
+			want := []string{key}
+
+			for _, prefix := range []string{"", dir + "/"} {
+				got := listSorted(t, s, prefix)
+				if !reflect.DeepEqual(got, want) {
+					t.Errorf("List(%q) = %v, want %v", prefix, got, want)
+				}
+
+				got = listStreamKeys(t, s, prefix)
+				if !reflect.DeepEqual(got, want) {
+					t.Errorf("ListStream(%q) = %v, want %v", prefix, got, want)
+				}
+			}
+
+			absent := dir + "/absent/"
+
+			if got := listSorted(t, s, absent); len(got) != 0 {
+				t.Errorf("List(%q) = %v, want empty", absent, got)
+			}
+
+			if got := listStreamKeys(t, s, absent); len(got) != 0 {
+				t.Errorf("ListStream(%q) = %v, want empty", absent, got)
+			}
+		})
+	}
+}
+
+// TestFileStorerListFailsOnSymlinkWithMissingTarget checks that List and
+// ListStream fail on a symlinked metadata/ or blobs/ directory whose target
+// is missing, such as a link to a volume that is not mounted, as they do on
+// a missing destination directory, instead of listing it as empty. That
+// holds for a prefix below the link too.
+func TestFileStorerListFailsOnSymlinkWithMissingTarget(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+
+	for _, dir := range []string{metadataDir, blobsDir} {
+		t.Run(dir, func(t *testing.T) {
+			t.Parallel()
+
+			base := t.TempDir()
+
+			s, err := storage.NewFileStorer(base)
+			if err != nil {
+				t.Fatalf("NewFileStorer: %v", err)
+			}
+
+			unmounted := filepath.Join(t.TempDir(), "unmounted")
+
+			err = os.Symlink(unmounted, filepath.Join(base, dir))
+			if err != nil {
+				t.Fatalf("Symlink: %v", err)
+			}
+
+			for _, prefix := range []string{"", dir + "/", dir + "/aa/"} {
+				keys, err := s.List(ctx, prefix)
+				if !errors.Is(err, fs.ErrNotExist) {
+					t.Errorf("List(%q) = %v, %v; want a not-exist error",
+						prefix, keys, err)
+				}
+
+				var streamErr error
+
+				for object := range s.ListStream(ctx, prefix) {
+					if object.Err != nil {
+						streamErr = object.Err
+					}
+				}
+
+				if !errors.Is(streamErr, fs.ErrNotExist) {
+					t.Errorf("ListStream(%q) error = %v, want a not-exist error",
+						prefix, streamErr)
+				}
+			}
+		})
+	}
+}
+
+// TestFileStorerListFailsOnSymlinkLoop checks that a symlink pointing back
+// at the destination makes List and ListStream fail instead of walking it
+// forever.
+func TestFileStorerListFailsOnSymlinkLoop(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	base := t.TempDir()
+
+	s, err := storage.NewFileStorer(base)
+	if err != nil {
+		t.Fatalf("NewFileStorer: %v", err)
+	}
+
+	err = s.Put(ctx, testBlobKey, strings.NewReader("data"))
+	if err != nil {
+		t.Fatalf("Put: %v", err)
+	}
+
+	err = os.Symlink(base, filepath.Join(base, "blobs", "loop"))
+	if err != nil {
+		t.Fatalf("Symlink: %v", err)
+	}
+
+	keys, err := s.List(ctx, "blobs/")
+	if err == nil {
+		t.Errorf("List = %d keys and no error, want an error", len(keys))
+	}
+
+	var streamErr error
+
+	for object := range s.ListStream(ctx, "blobs/") {
+		if object.Err != nil {
+			streamErr = object.Err
+		}
+	}
+
+	if streamErr == nil {
+		t.Error("ListStream sent no error, want one")
+	}
+}
+
+// TestFileStorerDeletePartialUploadsThroughSymlinkedDirectory checks that
+// DeletePartialUploads, which remote nuke uses, removes a leftover temp
+// file behind a symlinked metadata/ or blobs/ directory and keeps the
+// object at the real key.
+func TestFileStorerDeletePartialUploadsThroughSymlinkedDirectory(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+
+	for _, dir := range []string{metadataDir, blobsDir} {
+		t.Run(dir, func(t *testing.T) {
+			t.Parallel()
+
+			base := t.TempDir()
+			key := dir + "/aa/bb/object"
+
+			s, err := storage.NewFileStorer(base)
+			if err != nil {
+				t.Fatalf("NewFileStorer: %v", err)
+			}
+
+			err = s.Put(ctx, key, strings.NewReader("data"))
+			if err != nil {
+				t.Fatalf("Put: %v", err)
+			}
+
+			leftover := filepath.Join(base, key+"-123456.partial")
+
+			err = os.WriteFile(leftover, []byte("half"), 0o600)
+			if err != nil {
+				t.Fatalf("writing leftover temp file: %v", err)
+			}
+
+			moveBehindSymlink(t, base, dir)
+
+			err = s.DeletePartialUploads(ctx, dir+"/")
+			if err != nil {
+				t.Fatalf("DeletePartialUploads: %v", err)
+			}
+
+			// leftover runs through the link.
+			_, err = os.Stat(leftover)
+			if !os.IsNotExist(err) {
+				t.Errorf("leftover temp file was not removed: %v", err)
+			}
+
+			_, err = s.Stat(ctx, key)
+			if err != nil {
+				t.Errorf("Stat of the real key: %v", err)
+			}
+		})
+	}
+}

internal/vaultik/snapshot_list_test.go

@@ -483,13 +483,14 @@ func TestListSnapshots_UnreadableManifestDoesNotHideOthers(t *testing.T) {
 //
 //nolint:tagliatelle // snake_case is the established output format
 type listJSONRow struct {
-	ID             string `json:"id"`
-	RemoteKey      string `json:"remote_key"`
-	Timestamp      string `json:"timestamp"`
-	CompressedSize int64  `json:"compressed_size"`
-	NewChunkSize   int64  `json:"new_chunk_size"`
-	LocallyTracked bool   `json:"locally_tracked"`
-	RemotePresent  *bool  `json:"remote_present"`
+	ID               string `json:"id"`
+	RemoteKey        string `json:"remote_key"`
+	Timestamp        string `json:"timestamp"`
+	CompressedSize   int64  `json:"compressed_size"`
+	UncompressedSize int64  `json:"uncompressed_size"`
+	NewChunkSize     int64  `json:"new_chunk_size"`
+	LocallyTracked   bool   `json:"locally_tracked"`
+	RemotePresent    *bool  `json:"remote_present"`
 }
 
 // decodeListJSON parses the command's stdout, which must contain

internal/vaultik/symlinked_destination_test.go

@@ -0,0 +1,147 @@
+package vaultik_test
+
+import (
+	"context"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// TestPruneDeletesNothingThroughSymlinkedDirectory checks that prune keeps
+// every blob and the local snapshot record when the metadata/ or blobs/
+// directory of a file:// destination is a symlink to a directory elsewhere
+// (https://git.eeqj.de/sneak/vaultik/issues/296). A backup writes through
+// such a link, so prune has to list through it too.
+func TestPruneDeletesNothingThroughSymlinkedDirectory(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	for _, dir := range []string{"metadata", "blobs"} {
+		t.Run(dir, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+			storeDir := filepath.Join(t.TempDir(), "store")
+			v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
+			blobFiles := blobFilesIn(t, storeDir)
+			moveBehindSymlink(t, storeDir, dir)
+
+			require.NoError(t, v.Prune(&vaultik.PruneOptions{Force: true}))
+
+			// When blobs/ is the link, these paths run through it.
+			for _, blobFile := range blobFiles {
+				assert.FileExists(t, blobFile, "prune must delete no blob")
+			}
+
+			snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
+			require.NoError(t, err)
+			assert.Len(t, snapshots, 1, "prune must delete no local snapshot record")
+		})
+	}
+}
+
+// TestPruneFailsOnSymlinkedDirectoryWithMissingTarget checks that prune
+// fails, deleting no blob and keeping the local snapshot record, when the
+// metadata/ or blobs/ directory of a file:// destination is a symlink
+// whose target is missing, as a link to a volume that is not mounted is.
+func TestPruneFailsOnSymlinkedDirectoryWithMissingTarget(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	for _, dir := range []string{"metadata", "blobs"} {
+		t.Run(dir, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+			storeDir := filepath.Join(t.TempDir(), "store")
+			v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
+			blobFiles := blobFilesIn(t, storeDir)
+			targetPath := moveBehindSymlink(t, storeDir, dir)
+
+			// Unmount the volume the link points to, and mount it again
+			// once prune has run.
+			unmountedPath := targetPath + "-unmounted"
+			require.NoError(t, os.Rename(targetPath, unmountedPath))
+
+			err := v.Prune(&vaultik.PruneOptions{Force: true})
+			require.ErrorIs(t, err, fs.ErrNotExist)
+
+			require.NoError(t, os.Rename(unmountedPath, targetPath))
+
+			// When blobs/ is the link, these paths run through it.
+			for _, blobFile := range blobFiles {
+				assert.FileExists(t, blobFile, "prune must delete no blob")
+			}
+
+			snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
+			require.NoError(t, err)
+			assert.Len(t, snapshots, 1, "prune must delete no local snapshot record")
+		})
+	}
+}
+
+// TestRemoveSnapshotWarnsOnSymlinkedMetadataWithMissingTarget checks that
+// snapshot remove warns that the metadata could not be removed from the
+// destination when metadata/ is a symlink whose target is missing, as it
+// does when the destination directory is missing, instead of finding no
+// metadata to remove.
+func TestRemoveSnapshotWarnsOnSymlinkedMetadataWithMissingTarget(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	ctx := context.Background()
+	storeDir := filepath.Join(t.TempDir(), "store")
+	v, repos, out := backUpToFileDestination(ctx, t, storeDir)
+	targetPath := moveBehindSymlink(t, storeDir, "metadata")
+	require.NoError(t, os.Rename(targetPath, targetPath+"-unmounted"))
+
+	result, err := v.RemoveSnapshot(localSnapshotID(ctx, t, repos, "first"),
+		&vaultik.RemoveOptions{Force: true})
+	require.NoError(t, err)
+
+	assert.False(t, result.RemoteRemoved)
+	assert.Contains(t, out.String(),
+		"Could not remove snapshot metadata from remote")
+	assert.NotContains(t, out.String(),
+		"Removed snapshot metadata from remote storage")
+}
+
+// blobFilesIn returns the paths of the blob files under storeDir/blobs, and
+// fails the test when there are none.
+func blobFilesIn(t *testing.T, storeDir string) []string {
+	t.Helper()
+
+	var blobFiles []string
+
+	err := filepath.WalkDir(filepath.Join(storeDir, "blobs"),
+		func(path string, entry fs.DirEntry, err error) error {
+			if err == nil && !entry.IsDir() {
+				blobFiles = append(blobFiles, path)
+			}
+
+			return err
+		})
+	require.NoError(t, err)
+	require.NotEmpty(t, blobFiles)
+
+	return blobFiles
+}
+
+// moveBehindSymlink moves storeDir/dir to a directory elsewhere, puts a
+// symlink to it in its place, and returns where it went.
+func moveBehindSymlink(t *testing.T, storeDir, dir string) string {
+	t.Helper()
+
+	linkPath := filepath.Join(storeDir, dir)
+	targetPath := filepath.Join(t.TempDir(), dir)
+	require.NoError(t, os.Rename(linkPath, targetPath))
+	require.NoError(t, os.Symlink(targetPath, linkPath))
+
+	return targetPath
+}

internal/vaultik/uncompressed_size_test.go

@@ -0,0 +1,85 @@
+package vaultik_test
+
+import (
+	"bytes"
+	"context"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/storage"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// TestUncompressedSizeOfChangedFileStaysFixed covers
+// https://git.eeqj.de/sneak/vaultik/issues/360. A backup that changes a
+// file leaves the earlier snapshot's UNCOMPRESSED SIZE as it was when that
+// snapshot's backup completed. The file's row in the local index is shared
+// by both snapshots and rewritten by the second backup.
+func TestUncompressedSizeOfChangedFileStaysFixed(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "src")
+	dbPath := filepath.Join(tempDir, "index.sqlite")
+	changedPath := filepath.Join(dataDir, "changed.bin")
+
+	ctx := context.Background()
+	files := writeFaultSourceTree(t, fs, dataDir)
+	cfg := changedFileConfig(dataDir, dbPath)
+
+	appendRandomBytes(t, fs, files, changedPath, appendedFileSize)
+
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
+	require.NoError(t, err)
+
+	db, err := database.New(ctx, dbPath)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = db.Close() })
+
+	repos := database.NewRepositories(db)
+	v := newBackupVaultik(ctx, cfg, store, repos, db, fs)
+
+	require.NoError(t, backUp(v, "first"))
+
+	// With nothing to compare against, sizeOfNewChunks totals every
+	// distinct chunk of the files.
+	firstID := localSnapshotID(ctx, t, repos, "first")
+	firstSize := sizeOfNewChunks(t, files, nil)
+	require.Equal(t, firstSize, listedUncompressedSizes(t, v)[firstID],
+		"the first snapshot must count the chunks of every file it holds")
+
+	appendRandomBytes(t, fs, files, changedPath, faultChunkSize)
+	require.NoError(t, backUp(v, "second"))
+
+	secondID := localSnapshotID(ctx, t, repos, "second")
+	sizes := listedUncompressedSizes(t, v)
+	assert.Equal(t, firstSize, sizes[firstID],
+		"a later backup must not change the first snapshot's figure")
+	assert.Equal(t, sizeOfNewChunks(t, files, nil), sizes[secondID],
+		"the second snapshot must count the changed file's chunks")
+}
+
+// listedUncompressedSizes runs `snapshot list --json` and returns each
+// listed snapshot's uncompressed_size by snapshot ID.
+func listedUncompressedSizes(t *testing.T, v *vaultik.Vaultik) map[string]int64 {
+	t.Helper()
+
+	var out bytes.Buffer
+
+	v.Stdout = &out
+	require.NoError(t, v.ListSnapshots(true))
+
+	sizes := make(map[string]int64)
+	for _, row := range decodeListJSON(t, out.String()) {
+		sizes[row.ID] = row.UncompressedSize
+	}
+
+	return sizes
+}