Skip vaultik's own index and PID file in a backup (closes #421)

A backup of a directory that holds the local index stored a torn copy
of it, its -wal and -shm side files and vaultik.pid, all being written
while they were read. The scan now treats these files as excluded,
whatever the config says. Their paths come from index_path and the lock
directory, with symlinks in their directories resolved the way source
paths are. If index_path is itself a symlink, SQLite writes the file it
points to, so that file and its side files are skipped too. pidlock now
owns the lock directory and the PID file name, so the CLI and the
scanner use the same path. database delete now removes the side files
database.IndexFiles lists, the -journal file included.

Model: opus-5-5

README.md

@@ -313,10 +313,12 @@ when the next path element is a number (so
 `vaultik config set age_recipients.0 age1...` works on a file without
 `age_recipients`), otherwise as a map. If the config loads, a change after which
 it would not, such as `vaultik config set compression_level 99`, is refused and
-the file is left unchanged. A config that does not load is checked one setting
-at a time. Examples are the file `config init` writes before `storage_url` is
-set, and one with a `${ENV:...}` reference to a variable not set in this shell.
-In such a config, an unknown key or a value of the wrong type is refused.
+the file is left unchanged. A config that does not load, such as the one
+`config init` writes before `storage_url` is set or one with a `${ENV:...}`
+reference to a variable not set in this shell, is checked one setting at a time:
+only a change after which the changed setting cannot be read, such as one giving
+it the wrong type (a single value where a list belongs or a word where a number
+belongs), is refused.
 
 **`snapshot create`**: Perform incremental backup of configured snapshots.
 
@@ -1039,37 +1041,20 @@ is `git describe --tags --always --dirty`, which `script/version` runs for the
 A `docker build .` of a clone, with no build arguments, runs the same
 `git describe` (without `--dirty`) on the `.git` in its build context, so it
 stamps the same value for a clean commit; the build fails if the context carries
-`.git` and no version, commit or commit date comes out. `make` outside a git
-checkout and `docker build .` without `.git` both stamp `dev`. `script/docker`
-and `script/cibuild` stamp `unknown` when they run outside a git checkout.
-
-A binary built by plain `go install` or `go build` carries no stamped version.
-It reports the version Go recorded in it instead:
-
-- a `go install` of the tag `v1.0.0` → `v1.0.0`.
-- a `go build` of an untagged commit → a Go pseudo-version, such as
-  `v1.0.1-0.20261110231226-0123456789ab`.
-- a build where Go recorded no version → `dev`.
+`.git` and no version, commit or commit date comes out. A binary built without
+git metadata reports `dev`, or `unknown` when `script/docker` or
+`script/cibuild` built it outside a git checkout.
 
 `goreleaser` stamps a release binary with the tag minus its leading `v`, so the
 tag `v1.0.0` produces `vaultik 1.0.0`, matching the archive name
 `vaultik_1.0.0_linux_amd64.tar.gz`. `goreleaser --snapshot` stamps
 `dev-<12 chars of the commit sha>` rather than inventing the next patch number.
-
-`vaultik version` calls a build a development build when its version is one of
-these:
-
-- `dev` or `unknown`.
-- `dev-<sha>`.
-- the short commit sha.
-- `<tag>-<N>-g<short sha>`.
-- a Go pseudo-version.
-- any version with a `-dirty` or `+dirty` suffix.
-
-Only a plain tag, such as `v1.0.0` or `1.0.0`, is a release. If `script/version`
-cannot be run at all, `make` stops with an error instead of building an
-unversioned binary. A binary stamped with an empty version reports the version
-Go recorded in it; if Go recorded none, it is a development build.
+`vaultik version` calls a build a development build when its version is `dev`,
+`unknown`, `dev-<sha>`, the short commit sha or `<tag>-<N>-g<short sha>`, with
+or without `-dirty`; only a plain tag, such as `v1.0.0` or `1.0.0`, is a
+release. If `script/version` cannot be run at all, `make` stops with an error
+instead of building an unversioned binary, and a binary that somehow carries an
+empty version string still reports itself as a development build.
 
 ### cutting a release
 

configs/config.example.yml

@@ -295,7 +295,6 @@ storage_url: "rclone://myremote/path/to/backups"
 
 # Path to local SQLite index database
 # This database tracks file state for incremental backups
-# It must be an absolute path; ~ is expanded
 # Default: the platform data directory, e.g.
 #   macOS: ~/Library/Application Support/vaultik/index.sqlite
 #   Linux: ~/.local/share/vaultik/index.sqlite

go.mod

@@ -24,7 +24,6 @@ require (
 	github.com/stretchr/testify v1.11.1
 	go.uber.org/dig v1.19.0
 	go.uber.org/fx v1.24.0
-	golang.org/x/mod v0.29.0
 	golang.org/x/sync v0.18.0
 	golang.org/x/sys v0.38.0
 	golang.org/x/term v0.37.0

internal/blobgen/negative_test.go

@@ -2,10 +2,8 @@ package blobgen_test
 
 import (
 	"bytes"
-	"errors"
 	"fmt"
 	"testing"
-	"testing/iotest"
 
 	"filippo.io/age"
 	"github.com/stretchr/testify/assert"
@@ -122,38 +120,6 @@ func TestNewReaderTrailingAndGarbage(t *testing.T) {
 	})
 }
 
-// TestNewReaderGarbageErrorQuotesNoBytes checks that lines of text in
-// place of a blob fail with ErrNotAgeStream, and that the error carries
-// none of their bytes. The lines end in a newline because age's own error
-// quotes the data's first line only when it reads a whole line.
-func TestNewReaderGarbageErrorQuotesNoBytes(t *testing.T) {
-	t.Parallel()
-
-	id, _ := makeIdentity(t)
-	garbage := bytes.Repeat([]byte("garbage-bytes-\n"), 100)
-
-	_, err := blobgen.NewReader(bytes.NewReader(garbage), id)
-
-	require.ErrorIs(t, err, blobgen.ErrNotAgeStream)
-	assert.NotContains(t, err.Error(), "garbage-bytes-")
-}
-
-// errConnectionReset stands for a storage read that fails.
-var errConnectionReset = errors.New("connection reset")
-
-// TestNewReaderReadFailure checks that a failed read of the age header is
-// returned as that read error, not as ErrNotAgeStream.
-func TestNewReaderReadFailure(t *testing.T) {
-	t.Parallel()
-
-	id, _ := makeIdentity(t)
-
-	_, err := blobgen.NewReader(iotest.ErrReader(errConnectionReset), id)
-
-	require.ErrorIs(t, err, errConnectionReset)
-	assert.NotErrorIs(t, err, blobgen.ErrNotAgeStream)
-}
-
 // TestNewWriterInvalidLevel covers the rejected end of issue case 9: an
 // out-of-range compression level errors and writes nothing to the destination.
 func TestNewWriterInvalidLevel(t *testing.T) {

internal/blobgen/reader.go

@@ -11,11 +11,6 @@ import (
 	"github.com/klauspost/compress/zstd"
 )
 
-// ErrNotAgeStream is returned by NewReader when the data cannot be opened
-// as an age stream, for example because its header is malformed. It
-// replaces age's own error, which can quote the data's first bytes.
-var ErrNotAgeStream = errors.New("not a valid age stream")
-
 // Reader wraps decompression and decryption with SHA256 verification
 type Reader struct {
 	reader       io.Reader
@@ -29,25 +24,11 @@ type Reader struct {
 // NewReader creates a new Reader that decrypts, decompresses, and verifies
 // data. Every supplied identity is offered to age.Decrypt, so a blob
 // encrypted to any one of them can be read.
-//
-// A failure to read r is returned as that error, and a blob encrypted to
-// none of the identities as age.NoIdentityMatchError. Any other failure
-// to open the age stream is ErrNotAgeStream.
 func NewReader(r io.Reader, identities ...age.Identity) (*Reader, error) {
-	src := &readErrorRecorder{reader: r}
-
-	decReader, err := age.Decrypt(src, identities...)
+	// Create decryption reader
+	decReader, err := age.Decrypt(r, identities...)
 	if err != nil {
-		var noMatch *age.NoIdentityMatchError
-
-		switch {
-		case src.err != nil:
-			return nil, fmt.Errorf("reading age header: %w", src.err)
-		case errors.As(err, &noMatch):
-			return nil, fmt.Errorf("creating decryption reader: %w", err)
-		default:
-			return nil, ErrNotAgeStream
-		}
+		return nil, fmt.Errorf("creating decryption reader: %w", err)
 	}
 
 	// Create decompression reader
@@ -71,23 +52,6 @@ func NewReader(r io.Reader, identities ...age.Identity) (*Reader, error) {
 	}, nil
 }
 
-// readErrorRecorder passes reads through to reader and keeps the first
-// error other than io.EOF, so NewReader can tell a failed read from bad
-// data.
-type readErrorRecorder struct {
-	reader io.Reader
-	err    error
-}
-
-func (r *readErrorRecorder) Read(p []byte) (int, error) {
-	n, err := r.reader.Read(p)
-	if err != nil && !errors.Is(err, io.EOF) && r.err == nil {
-		r.err = err
-	}
-
-	return n, err
-}
-
 // Read implements io.Reader
 func (r *Reader) Read(p []byte) (int, error) {
 	n, err := r.teeReader.Read(p)

internal/cli/app.go

@@ -337,7 +337,7 @@ func runVaultikApp(
 		},
 		Mode: mode,
 	}, op, func(err error) {
-		log.Info(failMsg, "error", err)
+		log.Error(failMsg, "error", err)
 		ReportErrorf("%s: %v", failMsg, err)
 	})
 }

internal/cli/config.go

@@ -49,14 +49,8 @@ var (
 	errWouldNotLoad     = errors.New(
 		"vaultik would not load the config after this change, " +
 			"so the file was not changed")
-	errSetS3KeysFirst = errors.New(
-		"set s3.access_key_id and s3.secret_access_key first, " +
-			"then storage_url")
 )
 
-// storageURLKey is the config key that selects the storage backend.
-const storageURLKey = "storage_url"
-
 // macOS is the value of runtime.GOOS on macOS.
 const macOS = "darwin"
 
@@ -282,8 +276,7 @@ storage_url: ""
 # Hostname used in snapshot IDs. Default: system hostname.
 # hostname: myserver
 
-# Path to the local SQLite index database. It must be an absolute path;
-# ~ is expanded.
+# Path to the local SQLite index database.
 # Default: the platform data directory, e.g.
 #   macOS: ~/Library/Application Support/vaultik/index.sqlite
 #   Linux: ~/.local/share/vaultik/index.sqlite
@@ -450,10 +443,11 @@ number, otherwise as a map.
 
 If the config loads, a change after which it would not, such as
 compression_level 99, is refused and the file is left unchanged. A
-config that does not load is checked one setting at a time. Examples
-are the file config init writes before storage_url is set, and one
-with a ${ENV:...} reference to a variable not set in this shell. In
-such a config, an unknown key or a value of the wrong type is refused.
+config that does not load, such as the one config init writes before
+storage_url is set or one with a ${ENV:...} reference to a variable
+not set here, is checked one setting at a time: only a change after
+which the changed setting cannot be read, such as one giving it the
+wrong type, is refused.
 
 Examples:
   vaultik config set storage_url "file:///mnt/backups"
@@ -490,13 +484,6 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 
 	keys := strings.Split(key, ".")
 
-	if keys[0] != config.EnvSection {
-		_, err = config.SettingType(keys)
-		if err != nil {
-			return err
-		}
-	}
-
 	err = yamlPathSet(root, keys, value)
 	if err != nil {
 		return err
@@ -519,7 +506,7 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 
 	err = checkConfigChange(oldData, data, settingData)
 	if err != nil {
-		return wouldNotLoadError(key, err)
+		return fmt.Errorf("%w: %w", errWouldNotLoad, err)
 	}
 
 	err = os.WriteFile(path, data, configFileMode)
@@ -543,21 +530,6 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 	return nil
 }
 
-// wouldNotLoadError returns the refusal of a change to key that vaultik
-// would not load for reason. When storage_url moves to s3:// before the S3
-// credentials are set, it says to set them first: they can be set while
-// the old storage_url is still in place.
-func wouldNotLoadError(key string, reason error) error {
-	if key == storageURLKey &&
-		(errors.Is(reason, config.ErrS3KeyIDRequired) ||
-			errors.Is(reason, config.ErrS3SecretRequired)) {
-		return fmt.Errorf("%w: %w; %w", errWouldNotLoad, reason,
-			errSetS3KeysFirst)
-	}
-
-	return fmt.Errorf("%w: %w", errWouldNotLoad, reason)
-}
-
 // checkConfigChange returns the reason vaultik would not load newData, the
 // config after a change, if the change brings that failure in. If oldData,
 // the config before it, loads, the new one must load too. A config that
@@ -767,11 +739,41 @@ func yamlPathSet(root *yaml.Node, keys []string, value string) error {
 }
 
 // configKeyIsString reports whether the dotted key names a string in
-// config.Config, as s3.access_key_id and snapshots.home.exclude.0 do.
+// config.Config, following the fields' yaml tags, as s3.access_key_id and
+// snapshots.home.exclude.0 do.
 func configKeyIsString(keys []string) bool {
-	typ, err := config.SettingType(keys)
+	typ := reflect.TypeFor[config.Config]()
 
-	return err == nil && typ.Kind() == reflect.String
+	for _, key := range keys {
+		switch {
+		case typ.Kind() == reflect.Map || typ.Kind() == reflect.Slice:
+			// The key is a snapshot name or a list index.
+			typ = typ.Elem()
+		case typ.Kind() == reflect.Struct:
+			field, ok := yamlField(typ, key)
+			if !ok {
+				return false
+			}
+
+			typ = field.Type
+		default:
+			return false
+		}
+	}
+
+	return typ.Kind() == reflect.String
+}
+
+// yamlField returns the field of struct type typ whose yaml tag names key.
+func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
+	for field := range typ.Fields() {
+		name, _, _ := strings.Cut(field.Tag.Get("yaml"), ",")
+		if name == key {
+			return field, true
+		}
+	}
+
+	return reflect.StructField{}, false
 }
 
 // yamlSetInMapping resolves (creating if needed) the value node for the

internal/cli/config_test.go

@@ -2,7 +2,6 @@ package cli //nolint:testpackage // exercises unexported yamlPathGet/yamlPathSet
 
 import (
 	"bytes"
-	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -153,21 +152,6 @@ snapshots:
       - "~"
 `
 
-// testS3URL is an S3 storage_url, which needs credentials to load.
-const testS3URL = "s3://bucket/prefix?endpoint=https://s3.example.com"
-
-// configWithS3Keys loads: its storage_url is testS3URL and both S3 keys are
-// set.
-const configWithS3Keys = storageURLKey + ": " + testS3URL + `
-s3:
-  access_key_id: AKIAEXAMPLE
-  secret_access_key: example-secret
-snapshots:
-  home:
-    paths:
-      - "~"
-`
-
 // configWithUnsetReference loads only where VAULTIK_TEST_UNSET_SECRET is
 // set, as a backup job's environment might set it. No test sets it.
 const configWithUnsetReference = configWithoutRecipients + `s3:
@@ -241,7 +225,7 @@ func TestConfigSetIndexUnderMissingKey(t *testing.T) {
 // change after which the config would not load, with an error giving the
 // reason, and leaves the file as it was. On the file `config init` writes,
 // which does not load until storage_url is set, and on one that cannot be
-// read here, only an unknown key or a value of the wrong type is refused.
+// read here, only a value of the wrong type is refused.
 func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
 	t.Parallel()
 
@@ -253,14 +237,6 @@ func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
 		value  string
 		reason string
 	}{
-		// Keys that no setting has, on a config that loads and on one
-		// that does not.
-		{configWithoutRecipients, "nosuchkey", "1",
-			`unknown config key "nosuchkey"`},
-		{configWithoutRecipients, "snapshots.home.exlude", "/tmp",
-			`unknown config key "snapshots.home.exlude"`},
-		{defaultConfigText(macOS), "compression_lvl", "9",
-			`unknown config key "compression_lvl"`},
 		// Index 1 of the empty list the missing key gives.
 		{configWithoutRecipients, "age_recipients.1", testRecipient,
 			"index out of range"},
@@ -268,20 +244,12 @@ func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
 		{configWithoutRecipients, "snapshots.home.paths", "/srv",
 			"into []string"},
 		{configWithoutRecipients, "chunk_size", "fast",
-			`chunk_size: "fast" is not a size`},
+			"invalid size format"},
 		// Values of the right type that fail validation.
 		{configWithoutRecipients, "compression_level", "99",
 			"compression_level must be between 1 and 19"},
 		{configWithoutRecipients, "chunk_size", "1KB",
 			"chunk_size must be at least 1MB"},
-		// An s3:// URL before its credentials names them.
-		{configWithoutRecipients, storageURLKey, testS3URL,
-			"s3.access_key_id is required for s3:// URLs; " +
-				"set s3.access_key_id and s3.secret_access_key first"},
-		{configWithoutRecipients + "s3:\n  access_key_id: AKIAEXAMPLE\n",
-			storageURLKey, testS3URL,
-			"s3.secret_access_key is required for s3:// URLs; " +
-				"set s3.access_key_id and s3.secret_access_key first"},
 		// With its reference filled in, the config loads.
 		{levelReference, "blob_size_limit", "1MB",
 			"blob_size_limit must be at least"},
@@ -367,109 +335,6 @@ func TestConfigSetRefusesOnlyItsOwnFailure(t *testing.T) {
 	}
 }
 
-// TestConfigSetS3KeysBeforeStorageURL checks that the order the refusal
-// gives works on a config that loads with a file:// storage_url.
-func TestConfigSetS3KeysBeforeStorageURL(t *testing.T) {
-	t.Parallel()
-
-	path := filepath.Join(t.TempDir(), "config.yml")
-
-	err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
-	if err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-
-	for _, set := range [][2]string{
-		{"s3.access_key_id", "AKIAEXAMPLE"},
-		{"s3.secret_access_key", "example-secret"},
-		{storageURLKey, testS3URL},
-	} {
-		err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-			path, set[0], set[1])
-		if err != nil {
-			t.Fatalf("config set %s: %v", set[0], err)
-		}
-	}
-
-	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-	if err != nil {
-		t.Fatalf("read config: %v", err)
-	}
-
-	if !strings.Contains(string(data), storageURLKey+": "+testS3URL) {
-		t.Errorf("config set storage_url wrote:\n%s", data)
-	}
-}
-
-// TestConfigSetRefusesClearingS3Key checks that clearing s3.access_key_id on
-// a config with an s3:// storage_url is refused without saying to set the
-// S3 keys first. That advice is only for a change to storage_url.
-func TestConfigSetRefusesClearingS3Key(t *testing.T) {
-	t.Parallel()
-
-	const key = "s3.access_key_id"
-
-	path := filepath.Join(t.TempDir(), "config.yml")
-
-	err := os.WriteFile(path, []byte(configWithS3Keys), configFileMode)
-	if err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-
-	err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false), path, key, "")
-	if !errors.Is(err, errWouldNotLoad) {
-		t.Errorf("clearing %s gives error %v, want one saying %q",
-			key, err, errWouldNotLoad)
-	}
-
-	if errors.Is(err, errSetS3KeysFirst) {
-		t.Errorf("clearing %s gives error %v, want one not saying %q",
-			key, err, errSetS3KeysFirst)
-	}
-
-	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-	if err != nil {
-		t.Fatalf("read config: %v", err)
-	}
-
-	if string(data) != configWithS3Keys {
-		t.Errorf("clearing %s changed the file to:\n%s", key, data)
-	}
-}
-
-// TestConfigSetWritesEnvSection checks that config set writes a key under
-// the top-level env section, whose keys are not settings, on a config that
-// loads.
-func TestConfigSetWritesEnvSection(t *testing.T) {
-	const name = "VAULTIK_TEST_CONFIG_SET_ENV"
-
-	// Loading the changed config sets the variable; t.Setenv restores it
-	// after the test.
-	t.Setenv(name, "")
-
-	path := filepath.Join(t.TempDir(), "config.yml")
-
-	err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
-	if err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-
-	err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-		path, "env."+name, "value")
-	if err != nil {
-		t.Fatalf("config set env.%s: %v", name, err)
-	}
-
-	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-	if err != nil {
-		t.Fatalf("read config: %v", err)
-	}
-
-	if !strings.Contains(string(data), "env:\n  "+name+": value\n") {
-		t.Errorf("config set env.%s wrote:\n%s", name, data)
-	}
-}
-
 // TestConfigSetStringLooksLikeNumber sets string settings to values that
 // YAML reads as numbers or booleans when they are unquoted, and checks that
 // config.Load returns each one unchanged.

internal/cli/entry.go

@@ -21,8 +21,6 @@ const shortCommitLen = 12
 const exitCodeInterrupted = 130
 
 // Entry is the main entry point for the CLI application.
-// It first calls globals.FillUnsetFromBuildInfo, which fills in the
-// version, commit and commit date that the linker flags did not set.
 // It prints the startup banner to stderr (unless a banner-suppressing
 // flag is present in os.Args — see bannerSuppressedInArgs), executes the
 // root cobra command, and routes any returned error through the
@@ -35,7 +33,6 @@ const exitCodeInterrupted = 130
 // deferred profile writers run before the process ends. See run in
 // cmd/vaultik/main.go.
 func Entry() int {
-	globals.FillUnsetFromBuildInfo()
 	emitStartupBanner(os.Args[1:], os.Stderr)
 
 	rootCmd := NewRootCommand()
@@ -85,10 +82,6 @@ func emitStartupBanner(args []string, w io.Writer) {
 // 🛑 ERROR: format. Use it from goroutine error paths (where returning
 // an error to cobra isn't an option) and anywhere else a CLI command
 // must surface a failure outside the normal RunE return path.
-//
-// This line is the one report of the failure. A caller that also logs
-// the failure logs it at info level, so the record appears only under
-// --verbose or --debug and the error is not printed twice.
 func ReportErrorf(format string, args ...any) {
 	ui.New(os.Stderr).Errorf(format, args...)
 }

internal/cli/entry_failure_once_test.go

@@ -1,205 +0,0 @@
-package cli //nolint:testpackage // shares the fixtures and capture helpers
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"filippo.io/age"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/ui"
-)
-
-const (
-	// errorLinePrefix starts the final line that reports a failed command.
-	errorLinePrefix = "ERROR: "
-
-	flagVerbose = "--verbose"
-	cmdRestore  = "restore"
-
-	// blobsDir is the directory of a destination store that holds the
-	// blobs.
-	blobsDir = "blobs"
-)
-
-// TestEntryFailureIsPrintedOnce runs commands that fail after startup
-// against a destination they cannot use. `info` is not among them: it
-// cannot fail after startup.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntryFailureIsPrintedOnce(t *testing.T) {
-	for _, command := range [][]string{
-		{cmdSnapshot, cmdCreate},
-		{cmdSnapshot, cmdRemove, someSnapshotID},
-		{cmdSnapshot, cmdVerify, someSnapshotID},
-		{cmdRemote, cmdInfo},
-		{cmdPrune, flagJSON},
-	} {
-		for _, verbose := range []bool{false, true} {
-			name := fmt.Sprintf("%s verbose=%t", strings.Join(command, " "), verbose)
-
-			t.Run(name, func(t *testing.T) {
-				requireErrorPrintedOnce(t, verbose, append([]string{flagConfig,
-					writeUnusableDestinationConfig(t)}, command...)...)
-			})
-		}
-	}
-}
-
-// TestEntryBlobUploadFailureIsPrintedOnce backs up to a destination
-// whose blobs directory is a file, so the blob upload fails.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntryBlobUploadFailureIsPrintedOnce(t *testing.T) {
-	for _, verbose := range []bool{false, true} {
-		t.Run(fmt.Sprintf("verbose=%t", verbose), func(t *testing.T) {
-			configPath, storeDir := writeBackupConfig(t)
-
-			require.NoError(t, os.WriteFile(
-				filepath.Join(storeDir, blobsDir), nil, 0o600))
-
-			requireErrorPrintedOnce(t, verbose,
-				flagConfig, configPath, cmdSnapshot, cmdCreate)
-		})
-	}
-}
-
-// TestEntryBlobDownloadFailureIsPrintedOnce backs up, deletes the blobs
-// from the destination, and restores, so the blob download fails.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntryBlobDownloadFailureIsPrintedOnce(t *testing.T) {
-	for _, verbose := range []bool{false, true} {
-		t.Run(fmt.Sprintf("verbose=%t", verbose), func(t *testing.T) {
-			configPath, storeDir := writeBackupConfigWithPrivateKey(t)
-
-			code, _, _ := runEntry(t,
-				flagConfig, configPath, cmdSnapshot, cmdCreate)
-			require.Equal(t, 0, code)
-
-			require.NoError(t, os.RemoveAll(filepath.Join(storeDir, blobsDir)))
-
-			requireErrorPrintedOnce(t, verbose, flagConfig, configPath,
-				cmdSnapshot, cmdRestore, onlySnapshotID(t, configPath), t.TempDir())
-		})
-	}
-}
-
-// requireErrorPrintedOnce runs Entry with args, adding --verbose when
-// verbose is set. The command must fail, and stderr must carry its error
-// once, as the final ERROR: line. A log record carrying the same error
-// appears only under --verbose.
-func requireErrorPrintedOnce(t *testing.T, verbose bool, args ...string) {
-	t.Helper()
-
-	if verbose {
-		args = append(args, flagVerbose)
-	}
-
-	code, _, stderr := runEntry(t, args...)
-	require.Equal(t, 1, code)
-
-	errorLine, records := failureOutput(t, stderr)
-
-	if !verbose {
-		assert.Zero(t, records,
-			"without --verbose no log record repeats the error:\n%s", stderr)
-
-		return
-	}
-
-	assert.NotZero(t, records,
-		"--verbose must keep the log record of %q", errorLine)
-}
-
-// failureOutput requires stderr to hold exactly one ERROR: line and
-// returns it, with the number of log records whose error attribute is
-// the error that line reports. stderr is a pipe here, so every log
-// record is a JSON object on its own line.
-func failureOutput(t *testing.T, stderr string) (string, int) {
-	t.Helper()
-
-	var (
-		errorLines []string
-		records    []map[string]any
-	)
-
-	for line := range strings.Lines(stderr) {
-		var record map[string]any
-		if json.Unmarshal([]byte(line), &record) == nil {
-			records = append(records, record)
-
-			continue
-		}
-
-		if strings.Contains(line, errorLinePrefix) {
-			errorLines = append(errorLines, strings.TrimSpace(line))
-		}
-	}
-
-	require.Len(t, errorLines, 1,
-		"the error must be printed once as an ERROR: line:\n%s", stderr)
-
-	// An error can run over several lines; the ERROR: line holds the
-	// first of them.
-	repeats := 0
-
-	for _, record := range records {
-		failure, ok := record["error"].(string)
-		firstLine, _, _ := strings.Cut(failure, "\n")
-
-		if ok && strings.Contains(errorLines[0], firstLine) {
-			repeats++
-		}
-	}
-
-	return errorLines[0], repeats
-}
-
-// writeBackupConfigWithPrivateKey builds what writeBackupConfig builds,
-// with a generated key pair in place of its recipient. The config also
-// holds the private key, so that restore can decrypt the backup. Returns
-// the config path and the store directory.
-func writeBackupConfigWithPrivateKey(t *testing.T) (string, string) {
-	t.Helper()
-
-	configPath, storeDir := writeBackupConfig(t)
-
-	identity, err := age.GenerateX25519Identity()
-	require.NoError(t, err)
-
-	out := ui.NewWithColor(io.Discard, false)
-
-	require.NoError(t, writeConfigSet(out, configPath,
-		"age_recipients.0", identity.Recipient().String()))
-	require.NoError(t, writeConfigSet(out, configPath,
-		"age_secret_key", identity.String()))
-
-	return configPath, storeDir
-}
-
-// onlySnapshotID returns the ID of the one snapshot in the local index
-// that writeBackupConfig puts beside the config file.
-func onlySnapshotID(t *testing.T, configPath string) string {
-	t.Helper()
-
-	ctx := context.Background()
-
-	db, err := database.New(ctx,
-		filepath.Join(filepath.Dir(configPath), "index.sqlite"))
-	require.NoError(t, err)
-
-	defer func() { require.NoError(t, db.Close()) }()
-
-	backedUp, err := database.NewRepositories(db).Snapshots.GetOnlySnapshot(ctx)
-	require.NoError(t, err)
-
-	return backedUp.ID.String()
-}

internal/cli/entry_snapshot_create_prune_test.go

@@ -61,8 +61,8 @@ func TestEntrySnapshotCreateRejectsKeepNewerThanBeforeBackup(t *testing.T) {
 
 // TestEntrySnapshotCreateReportsPostBackupPruneFailure makes the
 // post-backup prune fail after a good backup, by planting a manifest
-// that cannot be decoded, and checks that the failure is reported once,
-// as the prune's and not as a failed snapshot creation.
+// that cannot be decoded, and checks that the failure is reported as the
+// prune's and not as a failed snapshot creation.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
@@ -83,9 +83,6 @@ func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
 	assert.Contains(t, stderr, "Backup completed, but post-backup prune failed")
 	assert.NotContains(t, stderr, "Snapshot creation failed")
 
-	_, repeats := failureOutput(t, stderr)
-	assert.Zero(t, repeats, "no log record may repeat the error:\n%s", stderr)
-
 	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 2,
@@ -96,8 +93,7 @@ func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
 // empties the source directory, as a volume that is not mounted leaves
 // its mount point, and runs `snapshot create --prune`. The command exits
 // non-zero and reports the backup as completed, not as a failed snapshot
-// creation. The error is printed once. See
-// https://git.eeqj.de/sneak/vaultik/issues/388.
+// creation. See https://git.eeqj.de/sneak/vaultik/issues/388.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotCreatePruneExitsNonZeroWhenSourceIsEmpty(t *testing.T) {
@@ -118,9 +114,6 @@ func TestEntrySnapshotCreatePruneExitsNonZeroWhenSourceIsEmpty(t *testing.T) {
 		"Backup completed, but 1 source path(s) were empty")
 	assert.NotContains(t, stderr, "Snapshot creation failed")
 
-	_, repeats := failureOutput(t, stderr)
-	assert.Zero(t, repeats, "no log record may repeat the error:\n%s", stderr)
-
 	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 2, "the older snapshot is kept")
@@ -131,8 +124,7 @@ func TestEntrySnapshotCreatePruneExitsNonZeroWhenSourceIsEmpty(t *testing.T) {
 // directory as a mount point, and runs `snapshot create --prune`, which
 // does not find it as one. The command exits non-zero, reports the
 // backup as completed, not as a failed snapshot creation, and keeps the
-// older snapshot. The error is printed once. See
-// https://git.eeqj.de/sneak/vaultik/issues/395.
+// older snapshot. See https://git.eeqj.de/sneak/vaultik/issues/395.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotCreatePruneExitsNonZeroWhenMountPointIsMissing(
@@ -167,9 +159,6 @@ func TestEntrySnapshotCreatePruneExitsNonZeroWhenMountPointIsMissing(
 		"an earlier snapshot recorded were not found")
 	assert.NotContains(t, stderr, "Snapshot creation failed")
 
-	_, repeats := failureOutput(t, stderr)
-	assert.Zero(t, repeats, "no log record may repeat the error:\n%s", stderr)
-
 	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 2, "the older snapshot is kept")

internal/cli/info.go

@@ -39,7 +39,7 @@ func NewInfoCommand() *cobra.Command {
 			}, func(v *vaultik.Vaultik) error {
 				return v.ShowInfo()
 			}, func(err error) {
-				log.Info("Failed to show info", "error", err)
+				log.Error("Failed to show info", "error", err)
 				ReportErrorf("Failed to show info: %v", err)
 			})
 		},

internal/cli/prune.go

@@ -60,7 +60,7 @@ referenced.`,
 			}, func(v *vaultik.Vaultik) error {
 				return v.Prune(opts)
 			}, func(err error) {
-				log.Info("Prune operation failed", "error", err)
+				log.Error("Prune operation failed", "error", err)
 				ReportErrorf("Prune failed: %v", err)
 			})
 		},

internal/cli/remote.go

@@ -98,7 +98,7 @@ func newRemoteInfoCommand() *cobra.Command {
 			}, func(v *vaultik.Vaultik) error {
 				return v.RemoteInfo(jsonOutput)
 			}, func(err error) {
-				log.Info("Failed to get remote info", "error", err)
+				log.Error("Failed to get remote info", "error", err)
 				ReportErrorf("Failed to get remote info: %v", err)
 			})
 		},

internal/cli/snapshot.go

@@ -109,7 +109,7 @@ on Linux), then /etc/vaultik/config.yml.`,
 				return v.CreateSnapshot(opts)
 			}, func(err error) {
 				if errors.Is(err, vaultik.ErrPostBackupPruneFailed) {
-					log.Info("Post-backup prune failed", "error", err)
+					log.Error("Post-backup prune failed", "error", err)
 					ReportErrorf("Backup completed, but %v", err)
 
 					return
@@ -118,13 +118,13 @@ on Linux), then /etc/vaultik/config.yml.`,
 				if errors.Is(err, vaultik.ErrFilesUnreadable) ||
 					errors.Is(err, vaultik.ErrSourcePathEmpty) ||
 					errors.Is(err, vaultik.ErrVolumeNotMounted) {
-					log.Info("Backup completed with an error", "error", err)
+					log.Error("Backup completed with an error", "error", err)
 					ReportErrorf("Backup completed, but %v", err)
 
 					return
 				}
 
-				log.Info("Snapshot creation failed", "error", err)
+				log.Error("Snapshot creation failed", "error", err)
 				ReportErrorf("Snapshot creation failed: %v", err)
 			})
 		},
@@ -258,7 +258,7 @@ func newSnapshotVerifyCommand() *cobra.Command {
 					return
 				}
 
-				log.Info("Verification failed", "error", err)
+				log.Error("Verification failed", "error", err)
 				ReportErrorf("Verification failed: %v", err)
 			})
 		},

internal/cli/snapshot_restore.go

@@ -104,7 +104,7 @@ func runRestore(cmd *cobra.Command, args []string, opts *RestoreOptions) error {
 			SkipErrors: rootFlags.SkipErrors,
 		})
 	}, func(err error) {
-		log.Info("Restore operation failed", "error", err)
+		log.Error("Restore operation failed", "error", err)
 		ReportErrorf("Restore failed: %v", err)
 	})
 }

internal/config/config.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"reflect"
 	"sort"
 	"strings"
 	"time"
@@ -70,22 +69,14 @@ var (
 	errFileURLNotAbsolute = errors.New(
 		"a file:// storage_url needs an absolute path, " +
 			"as in file:///path/to/backup")
-	errIndexPathNotAbsolute = errors.New(
-		"index_path and VAULTIK_INDEX_PATH need an absolute path, " +
-			"as in ~/.local/share/vaultik/index.sqlite")
 	errNegativePruneGracePeriod = errors.New(
 		"prune_grace_period must not be negative")
 	errStorageNotConfigured = errors.New(
 		"storage not configured; set storage_url or provide s3.endpoint + " +
 			"s3.bucket + credentials")
 	errS3BucketRequired = errors.New("s3.bucket is required (or set storage_url)")
-)
-
-// Validate returns these when S3 storage is configured without its
-// credentials.
-var (
-	ErrS3KeyIDRequired  = errors.New("s3.access_key_id is required")
-	ErrS3SecretRequired = errors.New("s3.secret_access_key is required")
+	errS3KeyIDRequired  = errors.New("s3.access_key_id is required")
+	errS3SecretRequired = errors.New("s3.secret_access_key is required")
 )
 
 // expandTilde expands ~ at the start of a path to the user's home directory.
@@ -295,39 +286,15 @@ func Load(path string) (*Config, error) {
 }
 
 // Parse reads YAML config data as Load does, without validating it. It
-// refuses a key that no setting has and a size setting whose value is not a
-// size, naming the setting. It applies default values for optional
-// fields, fills in ${...} references using smartconfig, and expands ~ in
-// paths.
+// applies default values for optional fields, fills in ${...} references
+// using smartconfig, and expands ~ in paths.
 func Parse(data []byte) (*Config, error) {
-	// smartconfig drops line numbers, so keys are checked in the data as
-	// written.
-	var root yaml.Node
-
-	err := yaml.Unmarshal(data, &root)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse config: %w", err)
-	}
-
-	err = checkKeys(&root, reflect.TypeFor[Config](), "",
-		map[*yaml.Node]bool{}, map[nodeAndType]bool{})
-	if err != nil {
-		return nil, err
-	}
-
 	// Load config using smartconfig for interpolation
 	sc, err := smartconfig.NewFromReader(bytes.NewReader(data))
 	if err != nil {
 		return nil, fmt.Errorf("failed to load config file: %w", err)
 	}
 
-	// A ${...} reference can bring in keys that are not in the file, and
-	// is the value of a size setting only once it is filled in.
-	err = checkFilledConfig(sc.Data())
-	if err != nil {
-		return nil, err
-	}
-
 	cfg := &Config{
 		// Set defaults
 		BlobSizeLimit:    defaultBlobSizeLimit,
@@ -396,11 +363,7 @@ func Parse(data []byte) (*Config, error) {
 //     never the value. An empty list is accepted, because only snapshot
 //     create needs a recipient and it checks for one itself
 //   - At least one snapshot must be configured with at least one path
-//   - Every exclude pattern, global or in a snapshot, must compile; errors
-//     name the setting and quote the pattern
 //   - Storage must be configured (either storage_url or s3.* fields)
-//   - The index path must be absolute: a relative one would resolve against
-//     the working directory, so each directory would get its own index
 //   - Chunk size must be at least 1MB
 //   - Blob size limit must be at least the largest chunk the chunker can emit
 //     (chunk_size times chunker.ChunkSizeSpread), so a single-chunk blob never
@@ -418,26 +381,22 @@ func (c *Config) Validate() error {
 		}
 	}
 
-	err := c.validateSnapshots()
-	if err != nil {
-		return err
+	if len(c.Snapshots) == 0 {
+		return errNoSnapshots
 	}
 
-	err = c.validateExcludes()
-	if err != nil {
-		return err
+	for name, snap := range c.Snapshots {
+		if len(snap.Paths) == 0 {
+			return fmt.Errorf("%w: %q", errSnapshotNoPaths, name)
+		}
 	}
 
 	// Validate storage configuration
-	err = c.validateStorage()
+	err := c.validateStorage()
 	if err != nil {
 		return err
 	}
 
-	if !filepath.IsAbs(c.IndexPath) {
-		return fmt.Errorf("%w: %q", errIndexPathNotAbsolute, c.IndexPath)
-	}
-
 	if c.ChunkSize.Int64() < minChunkSize {
 		return errChunkSizeTooSmall
 	}
@@ -468,22 +427,6 @@ func (c *Config) Validate() error {
 	return nil
 }
 
-// validateSnapshots refuses a config with no snapshot or with a snapshot
-// that has no path.
-func (c *Config) validateSnapshots() error {
-	if len(c.Snapshots) == 0 {
-		return errNoSnapshots
-	}
-
-	for name, snap := range c.Snapshots {
-		if len(snap.Paths) == 0 {
-			return fmt.Errorf("%w: %q", errSnapshotNoPaths, name)
-		}
-	}
-
-	return nil
-}
-
 // validateAgeRecipient parses one age_recipients entry with the age library
 // and returns a value-free error on failure. A recipient string can be
 // sensitive (an operator may paste a secret key by mistake), so neither the
@@ -547,11 +490,11 @@ func (c *Config) validateStorage() error {
 	}
 
 	if c.S3.AccessKeyID == "" {
-		return ErrS3KeyIDRequired
+		return errS3KeyIDRequired
 	}
 
 	if c.S3.SecretAccessKey == "" {
-		return ErrS3SecretRequired
+		return errS3SecretRequired
 	}
 
 	return nil
@@ -578,11 +521,11 @@ func (c *Config) validateStorageURL() error {
 	case strings.HasPrefix(c.StorageURL, "s3://"):
 		// S3 storage needs credentials
 		if c.S3.AccessKeyID == "" {
-			return fmt.Errorf("%w for s3:// URLs", ErrS3KeyIDRequired)
+			return fmt.Errorf("%w for s3:// URLs", errS3KeyIDRequired)
 		}
 
 		if c.S3.SecretAccessKey == "" {
-			return fmt.Errorf("%w for s3:// URLs", ErrS3SecretRequired)
+			return fmt.Errorf("%w for s3:// URLs", errS3SecretRequired)
 		}
 
 		return nil

internal/config/config_test.go

@@ -165,7 +165,6 @@ func TestValidateBlobSizeLimit(t *testing.T) {
 			AgeRecipients:    []string{testSneakAgePublicKey},
 			Snapshots:        map[string]SnapshotConfig{"test": {Paths: []string{"/tmp/src"}}},
 			StorageURL:       "file:///tmp/vaultik-test-store",
-			IndexPath:        "/tmp/vaultik-test-index.sqlite",
 			ChunkSize:        chunkSize,
 			BlobSizeLimit:    blobLimit,
 			CompressionLevel: 3,
@@ -511,65 +510,6 @@ func TestLoadRejectsRelativeFileURL(t *testing.T) {
 	}
 }
 
-// TestLoadIndexPath checks that a relative index_path fails at load, naming
-// the value. Accepted, it would resolve against the working directory, so a
-// backup run from another directory would start from an empty index. A path
-// starting with ~ is expanded and loads.
-func TestLoadIndexPath(t *testing.T) {
-	t.Parallel()
-
-	home, err := os.UserHomeDir()
-	if err != nil {
-		t.Fatalf("home directory: %v", err)
-	}
-
-	load := func(t *testing.T, indexPath string) (*Config, error) {
-		t.Helper()
-
-		data := "snapshots:\n" +
-			"  test:\n" +
-			"    paths: [/tmp/vaultik-test-source]\n" +
-			"storage_url: file:///tmp/vaultik-test-storage\n" +
-			"index_path: " + indexPath + "\n"
-
-		path := filepath.Join(t.TempDir(), "config.yml")
-
-		err := os.WriteFile(path, []byte(data), 0o600)
-		if err != nil {
-			t.Fatalf("write config: %v", err)
-		}
-
-		return Load(path)
-	}
-
-	t.Run("relative path is rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := load(t, "relative/index.sqlite")
-		if !errors.Is(err, errIndexPathNotAbsolute) {
-			t.Fatalf("Load() error = %v, want errIndexPathNotAbsolute", err)
-		}
-
-		if !strings.Contains(err.Error(), `"relative/index.sqlite"`) {
-			t.Errorf("error %q does not name the value", err.Error())
-		}
-	})
-
-	t.Run("path starting with ~ is expanded", func(t *testing.T) {
-		t.Parallel()
-
-		cfg, err := load(t, "~/vaultik/index.sqlite")
-		if err != nil {
-			t.Fatalf("Load() unexpected error: %v", err)
-		}
-
-		want := filepath.Join(home, "vaultik", "index.sqlite")
-		if cfg.IndexPath != want {
-			t.Errorf("IndexPath = %q, want %q", cfg.IndexPath, want)
-		}
-	})
-}
-
 // TestValidateAgeRecipients checks that recipients are parsed at config load
 // (a bad entry fails immediately, not mid-backup) and that no invalid entry —
 // least of all a pasted secret key — is echoed in the error. An empty list
@@ -582,7 +522,6 @@ func TestValidateAgeRecipients(t *testing.T) {
 			AgeRecipients:    recipients,
 			Snapshots:        map[string]SnapshotConfig{"test": {Paths: []string{"/tmp/src"}}},
 			StorageURL:       "file:///tmp/vaultik-test-store",
-			IndexPath:        "/tmp/vaultik-test-index.sqlite",
 			ChunkSize:        Size(10 * 1024 * 1024),
 			BlobSizeLimit:    Size(10 * 1024 * 1024 * 1024),
 			CompressionLevel: 3,

internal/config/exclude.go

@@ -1,39 +0,0 @@
-package config
-
-import (
-	"fmt"
-
-	"sneak.berlin/go/vaultik/internal/exclude"
-)
-
-// validateExcludes refuses an exclude pattern, global or in a snapshot,
-// that does not compile, naming the setting and quoting the pattern.
-func (c *Config) validateExcludes() error {
-	err := validateExcludeList("exclude", c.Exclude)
-	if err != nil {
-		return err
-	}
-
-	for _, name := range c.SnapshotNames() {
-		err = validateExcludeList("snapshots."+name+".exclude",
-			c.Snapshots[name].Exclude)
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// validateExcludeList refuses the first pattern in patterns that does not
-// compile. setting is the name of the list, as in "exclude".
-func validateExcludeList(setting string, patterns []string) error {
-	for i, pattern := range patterns {
-		_, _, err := exclude.Compile(pattern)
-		if err != nil {
-			return fmt.Errorf("%s[%d]: %w", setting, i, err)
-		}
-	}
-
-	return nil
-}

internal/config/exclude_test.go

@@ -1,65 +0,0 @@
-package config_test
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"sneak.berlin/go/vaultik/internal/config"
-)
-
-// TestLoadRefusesBadExcludePattern checks that an exclude pattern that does
-// not compile, global or in a snapshot, fails at load with the setting and
-// the pattern named, rather than the backup storing what it meant to leave
-// out.
-func TestLoadRefusesBadExcludePattern(t *testing.T) {
-	t.Parallel()
-
-	const storage = "storage_url: file:///tmp/vaultik-test-storage\n"
-
-	tests := []struct {
-		name    string
-		config  string
-		wantErr string
-	}{
-		{
-			name: "global",
-			config: "exclude: ['*.tmp', '.cache', 'build[']\n" +
-				"snapshots:\n" +
-				"  home:\n" +
-				"    paths: [/tmp/vaultik-test-source]\n" + storage,
-			wantErr: `exclude[2]: "build[" is not a valid exclude pattern`,
-		},
-		{
-			name: "snapshot",
-			config: "snapshots:\n" +
-				"  home:\n" +
-				"    paths: [/tmp/vaultik-test-source]\n" +
-				"    exclude: ['/a/**/x[']\n" + storage,
-			wantErr: `snapshots.home.exclude[0]: "/a/**/x[" is not a valid exclude pattern`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(tt.config), 0o600)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			_, err = config.Load(path)
-			if err == nil {
-				t.Fatalf("Load() returned nil, want an error containing %q", tt.wantErr)
-			}
-
-			if !strings.Contains(err.Error(), tt.wantErr) {
-				t.Fatalf("Load() error = %q, want it to contain %q", err, tt.wantErr)
-			}
-		})
-	}
-}

internal/config/keys.go

@@ -1,220 +0,0 @@
-package config
-
-import (
-	"errors"
-	"fmt"
-	"reflect"
-	"strconv"
-	"strings"
-
-	"gopkg.in/yaml.v3"
-)
-
-// yamlMergeTag is the tag YAML gives a merge key (<<), which adds the keys
-// of the map it names to the map it sits in.
-const yamlMergeTag = "!!merge"
-
-// EnvSection is the top-level key of a map of environment variables that
-// smartconfig sets while it loads the config. It is not a vaultik setting,
-// so its keys are not checked.
-const EnvSection = "env"
-
-var (
-	errUnknownKey           = errors.New("unknown config key")
-	errAnchorContainsItself = errors.New("anchor contains itself")
-)
-
-// nodeAndType is a node of a parsed config and the setting type it is
-// checked against.
-type nodeAndType struct {
-	node *yaml.Node
-	typ  reflect.Type
-}
-
-// SettingType returns the type of the setting that the dotted key names in
-// Config, following the fields' yaml tags, as for s3.bucket or
-// snapshots.home.exclude.0. A snapshot name or a list index may be any
-// word. It returns an unknown key error when no setting has that key.
-func SettingType(keys []string) (reflect.Type, error) {
-	typ := reflect.TypeFor[Config]()
-
-	for _, key := range keys {
-		switch {
-		case typ.Kind() == reflect.Map || typ.Kind() == reflect.Slice:
-			typ = typ.Elem()
-		case typ.Kind() == reflect.Struct:
-			field, ok := yamlField(typ, key)
-			if !ok {
-				return nil, fmt.Errorf("%w %q", errUnknownKey, strings.Join(keys, "."))
-			}
-
-			typ = field.Type
-		default:
-			return nil, fmt.Errorf("%w %q", errUnknownKey, strings.Join(keys, "."))
-		}
-	}
-
-	return typ, nil
-}
-
-// yamlField returns the field of struct type typ whose yaml tag names key.
-func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
-	for field := range typ.Fields() {
-		name, _, _ := strings.Cut(field.Tag.Get("yaml"), ",")
-		if name == key && name != "-" {
-			return field, true
-		}
-	}
-
-	return reflect.StructField{}, false
-}
-
-// checkKeys returns an error naming the first key in node, a parsed config
-// or part of one at the dotted path, that no setting in typ has. The error
-// gives the key's line in the file, when it has one. A value of the wrong
-// type is left for the YAML decoder to report. following holds the aliases
-// the walk is inside. Meeting one of them again means its anchor contains
-// itself, which is an error. checked holds each anchored node the walk has
-// checked completely, with the type it was checked against. An alias to
-// that node is not followed again for that type.
-func checkKeys(node *yaml.Node, typ reflect.Type, path string,
-	following map[*yaml.Node]bool, checked map[nodeAndType]bool,
-) error {
-	switch node.Kind {
-	case yaml.DocumentNode:
-		for _, child := range node.Content {
-			err := checkKeys(child, typ, path, following, checked)
-			if err != nil {
-				return err
-			}
-		}
-	case yaml.AliasNode:
-		if following[node] {
-			return fmt.Errorf("%w: %q on line %d",
-				errAnchorContainsItself, node.Value, node.Line)
-		}
-
-		target := nodeAndType{node.Alias, typ}
-		if checked[target] {
-			return nil
-		}
-
-		following[node] = true
-		defer delete(following, node)
-
-		err := checkKeys(node.Alias, typ, path, following, checked)
-		if err != nil {
-			return err
-		}
-
-		checked[target] = true
-	case yaml.SequenceNode:
-		if typ.Kind() != reflect.Slice {
-			return nil
-		}
-
-		for i, child := range node.Content {
-			err := checkKeys(child, typ.Elem(), joinKey(path, strconv.Itoa(i)),
-				following, checked)
-			if err != nil {
-				return err
-			}
-		}
-	case yaml.MappingNode:
-		return checkMappingKeys(node, typ, path, following, checked)
-	case yaml.ScalarNode:
-		// A scalar has no keys.
-	}
-
-	return nil
-}
-
-// checkFilledConfig checks data, the config after smartconfig has filled in
-// its ${...} references: its keys with checkKeys, then its size settings
-// with checkSizes. A key that a reference brings in is not in the file, and
-// the copy that Encode makes has no line numbers.
-func checkFilledConfig(data map[string]any) error {
-	var filled yaml.Node
-
-	err := filled.Encode(data)
-	if err != nil {
-		return fmt.Errorf("failed to marshal config data: %w", err)
-	}
-
-	err = checkKeys(&filled, reflect.TypeFor[Config](), "",
-		map[*yaml.Node]bool{}, map[nodeAndType]bool{})
-	if err != nil {
-		return err
-	}
-
-	return checkSizes(&filled, nil)
-}
-
-// checkMappingKeys is checkKeys for a map.
-func checkMappingKeys(node *yaml.Node, typ reflect.Type, path string,
-	following map[*yaml.Node]bool, checked map[nodeAndType]bool,
-) error {
-	for i := 0; i+1 < len(node.Content); i += 2 {
-		key, value := node.Content[i], node.Content[i+1]
-
-		if key.Tag == yamlMergeTag {
-			// The value is one map or a list of maps.
-			merged := []*yaml.Node{value}
-			if value.Kind == yaml.SequenceNode {
-				merged = value.Content
-			}
-
-			for _, m := range merged {
-				err := checkKeys(m, typ, path, following, checked)
-				if err != nil {
-					return err
-				}
-			}
-
-			continue
-		}
-
-		keyPath := joinKey(path, key.Value)
-		if keyPath == EnvSection {
-			continue
-		}
-
-		var valueType reflect.Type
-
-		switch {
-		case typ.Kind() == reflect.Map:
-			valueType = typ.Elem()
-		case typ.Kind() == reflect.Struct:
-			field, ok := yamlField(typ, key.Value)
-			if !ok && key.Line == 0 {
-				// A key that a ${...} reference brought in has no line.
-				return fmt.Errorf("%w %q", errUnknownKey, keyPath)
-			}
-
-			if !ok {
-				return fmt.Errorf("%w %q on line %d",
-					errUnknownKey, keyPath, key.Line)
-			}
-
-			valueType = field.Type
-		default:
-			return nil
-		}
-
-		err := checkKeys(value, valueType, keyPath, following, checked)
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// joinKey appends key to the dotted path.
-func joinKey(path, key string) string {
-	if path == "" {
-		return key
-	}
-
-	return path + "." + key
-}

internal/config/keys_test.go

@@ -1,163 +0,0 @@
-package config //nolint:testpackage // checks the unexported errUnknownKey
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"slices"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-// keysTestConfig loads; each case below adds one line to it.
-const keysTestConfig = "storage_url: file:///tmp/vaultik-test-storage\n" +
-	"s3:\n" +
-	"  region: us-east-1\n" +
-	"snapshots:\n" +
-	"  test:\n" +
-	"    paths: [/tmp/vaultik-test-source]\n"
-
-// TestParseRefusesUnknownKey checks that a key no setting has, at any
-// depth, fails the parse with an error naming the key and its line. A key
-// that a ${...} reference brings in is not in the file, so its error gives
-// no line.
-func TestParseRefusesUnknownKey(t *testing.T) {
-	t.Parallel()
-
-	snapshotPath := filepath.Join(t.TempDir(), "snapshot.yml")
-
-	err := os.WriteFile(snapshotPath, []byte("other:\n"+
-		"  paths: [/tmp/vaultik-test-source]\n"+
-		"  exlude: [/tmp/cache]\n"), 0o600)
-	if err != nil {
-		t.Fatalf("write snapshot: %v", err)
-	}
-
-	tests := []struct {
-		name string
-		yaml string
-		want string
-	}{
-		{"top level", keysTestConfig + "compression_lvl: 9\n",
-			`unknown config key "compression_lvl" on line 7`},
-		{"in a snapshot", keysTestConfig + "    exlude: [/tmp/cache]\n",
-			`unknown config key "snapshots.test.exlude" on line 7`},
-		{"in s3", strings.Replace(keysTestConfig, "  region:",
-			"  bukcet: b\n  region:", 1),
-			`unknown config key "s3.bukcet" on line 3`},
-		{"from a reference",
-			keysTestConfig + "  other: ${YAML:" + snapshotPath + ":other}\n",
-			`unknown config key "snapshots.other.exlude"`},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := Parse([]byte(tt.yaml))
-			if !errors.Is(err, errUnknownKey) {
-				t.Fatalf("Parse() error = %v, want errUnknownKey", err)
-			}
-
-			if err.Error() != tt.want {
-				t.Errorf("Parse() error = %q, want %q", err.Error(), tt.want)
-			}
-		})
-	}
-}
-
-// TestParseRefusesAnchorThatContainsItself checks that a YAML merge key (<<)
-// naming the anchor of the map it sits in fails the parse with an error.
-func TestParseRefusesAnchorThatContainsItself(t *testing.T) {
-	t.Parallel()
-
-	data := strings.Replace(keysTestConfig, "  test:", "  test: &test", 1) +
-		"    <<: *test\n"
-
-	_, err := Parse([]byte(data))
-	if !errors.Is(err, errAnchorContainsItself) {
-		t.Fatalf("Parse() error = %v, want errAnchorContainsItself", err)
-	}
-
-	want := `anchor contains itself: "test" on line 7`
-	if err.Error() != want {
-		t.Errorf("Parse() error = %q, want %q", err.Error(), want)
-	}
-}
-
-// TestParseRefusesExcessiveAliasing checks that Parse returns an error for
-// a file whose merge keys (<<) fan out. Each of eight snapshots merges the
-// one before it ten times. A key check that followed every alias would walk
-// the first snapshot over 10^8 times and run past the package's test
-// timeout.
-func TestParseRefusesExcessiveAliasing(t *testing.T) {
-	t.Parallel()
-
-	const snapshots, merges = 8, 10
-
-	var data strings.Builder
-
-	data.WriteString(strings.Replace(keysTestConfig, "  test:", "  test: &s0", 1))
-
-	for i := 1; i <= snapshots; i++ {
-		aliases := slices.Repeat([]string{"*s" + strconv.Itoa(i-1)}, merges)
-		fmt.Fprintf(&data, "  s%d: &s%d\n    <<: [%s]\n",
-			i, i, strings.Join(aliases, ", "))
-	}
-
-	_, err := Parse([]byte(data.String()))
-	if err == nil {
-		t.Fatal("Parse() returned no error")
-	}
-}
-
-// TestParseAcceptsKnownKeys checks that a config with a ${...} reference
-// and a YAML merge key (<<) still parses.
-func TestParseAcceptsKnownKeys(t *testing.T) {
-	t.Parallel()
-
-	levelPath := filepath.Join(t.TempDir(), "level")
-
-	err := os.WriteFile(levelPath, []byte("9"), 0o600)
-	if err != nil {
-		t.Fatalf("write level: %v", err)
-	}
-
-	data := strings.Replace(keysTestConfig, "  test:", "  test: &test", 1) +
-		"  other:\n" +
-		"    <<: *test\n" +
-		"    exclude: [/tmp/vaultik-test-source/cache]\n" +
-		"compression_level: ${FILE:" + levelPath + "}\n"
-
-	cfg, err := Parse([]byte(data))
-	if err != nil {
-		t.Fatalf("Parse() unexpected error: %v", err)
-	}
-
-	if cfg.CompressionLevel != 9 {
-		t.Errorf("compression_level = %d, want 9", cfg.CompressionLevel)
-	}
-
-	other := cfg.Snapshots["other"]
-	if len(other.Paths) != 1 || len(other.Exclude) != 1 {
-		t.Errorf("snapshot other = %+v, want the paths of test and one exclude",
-			other)
-	}
-}
-
-// TestParseAcceptsEnvSection checks that a config with a top-level env
-// section still parses. smartconfig sets the environment variables it
-// lists, so its keys are not settings.
-func TestParseAcceptsEnvSection(t *testing.T) {
-	const name = "VAULTIK_TEST_ENV_SECTION"
-
-	// Parse sets the variable; t.Setenv restores it after the test.
-	t.Setenv(name, "")
-
-	_, err := Parse([]byte(keysTestConfig + "env:\n  " + name + ": set\n"))
-	if err != nil {
-		t.Fatalf("Parse() unexpected error: %v", err)
-	}
-}

internal/config/size.go

@@ -4,20 +4,13 @@ import (
 	"errors"
 	"fmt"
 	"math"
-	"reflect"
-	"slices"
-	"strconv"
-	"strings"
 
 	"github.com/dustin/go-humanize"
-	"gopkg.in/yaml.v3"
 )
 
 var (
 	errSizeType     = errors.New("size must be a number or string")
 	errSizeTooLarge = errors.New("size exceeds maximum supported value")
-	errNotASize     = errors.New(
-		"is not a size; use a number of bytes or a unit such as 10MB")
 )
 
 // Size represents a byte size that can be specified in configuration files.
@@ -39,15 +32,6 @@ func (s *Size) UnmarshalYAML(unmarshal func(any) error) error {
 		return nil
 	}
 
-	// A number too large for an int64 decodes as a float64. Its text can be
-	// 1e+20, which is not a size string.
-	var floatVal float64
-
-	err = unmarshal(&floatVal)
-	if err == nil && floatVal > math.MaxInt64 {
-		return errSizeTooLarge
-	}
-
 	// Try to unmarshal as string
 	var strVal string
 
@@ -56,66 +40,17 @@ func (s *Size) UnmarshalYAML(unmarshal func(any) error) error {
 		return errSizeType
 	}
 
-	size, err := ParseSize(strVal)
+	// Parse the string using go-humanize
+	bytes, err := humanize.ParseBytes(strVal)
 	if err != nil {
-		return err
+		return fmt.Errorf("invalid size format: %w", err)
 	}
 
-	*s = size
-
-	return nil
-}
-
-// checkSizes returns an error naming the first size setting in node whose
-// value is not a size. node is the config, or the part of it at the dotted
-// keys, after smartconfig has filled in its ${...} references.
-func checkSizes(node *yaml.Node, keys []string) error {
-	typ, err := SettingType(keys)
-	if err != nil {
-		// Unknown keys are refused before this check, so keys is in one of
-		// two places. The env section holds no settings. A value of the
-		// wrong shape, such as a map given for hostname or inside exclude,
-		// is reported later by the YAML decoder.
-		return nil //nolint:nilerr // not an error here
+	if bytes > math.MaxInt64 {
+		return fmt.Errorf("%w: %s", errSizeTooLarge, strVal)
 	}
 
-	if typ == reflect.TypeFor[Size]() {
-		var size Size
-
-		err = node.Decode(&size)
-		if err != nil {
-			return fmt.Errorf("%s: %w", strings.Join(keys, "."), err)
-		}
-
-		return nil
-	}
-
-	switch node.Kind {
-	case yaml.DocumentNode:
-		for _, child := range node.Content {
-			err = checkSizes(child, keys)
-			if err != nil {
-				return err
-			}
-		}
-	case yaml.MappingNode:
-		for i := 0; i+1 < len(node.Content); i += 2 {
-			err = checkSizes(node.Content[i+1],
-				slices.Concat(keys, []string{node.Content[i].Value}))
-			if err != nil {
-				return err
-			}
-		}
-	case yaml.SequenceNode:
-		for i, child := range node.Content {
-			err = checkSizes(child, slices.Concat(keys, []string{strconv.Itoa(i)}))
-			if err != nil {
-				return err
-			}
-		}
-	case yaml.ScalarNode, yaml.AliasNode:
-		// A scalar holds no settings, and the filled config has no aliases.
-	}
+	*s = Size(bytes)
 
 	return nil
 }
@@ -135,17 +70,16 @@ func (s Size) String() string {
 	return humanize.Bytes(uint64(s))
 }
 
-// ParseSize parses a size string, such as "10MB", into a Size value. An
-// error quotes s.
+// ParseSize parses a size string into a Size value
 func ParseSize(s string) (Size, error) {
-	bytes, err := humanize.ParseBigBytes(s)
+	bytes, err := humanize.ParseBytes(s)
 	if err != nil {
-		return 0, fmt.Errorf("%q %w", s, errNotASize)
+		return 0, fmt.Errorf("invalid size format: %w", err)
 	}
 
-	if !bytes.IsInt64() {
+	if bytes > math.MaxInt64 {
 		return 0, fmt.Errorf("%w: %s", errSizeTooLarge, s)
 	}
 
-	return Size(bytes.Int64()), nil
+	return Size(bytes), nil
 }

internal/config/size_test.go

@@ -1,120 +0,0 @@
-package config //nolint:testpackage // checks errNotASize and errSizeTooLarge
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// TestParseRefusesValueThatIsNotASize checks that a size setting whose
-// value is not a size fails the parse with an error naming the setting and
-// quoting the value, also when a ${...} reference fills the value in.
-func TestParseRefusesValueThatIsNotASize(t *testing.T) {
-	t.Parallel()
-
-	sizePath := filepath.Join(t.TempDir(), "size")
-
-	err := os.WriteFile(sizePath, []byte("lots"), 0o600)
-	if err != nil {
-		t.Fatalf("write size: %v", err)
-	}
-
-	tests := []struct {
-		name string
-		yaml string
-		want string
-	}{
-		{"chunk_size", keysTestConfig + "chunk_size: banana\n",
-			`chunk_size: "banana" is not a size; ` +
-				"use a number of bytes or a unit such as 10MB"},
-		{"blob_size_limit", keysTestConfig + "blob_size_limit: 10XB\n",
-			`blob_size_limit: "10XB" is not a size; ` +
-				"use a number of bytes or a unit such as 10MB"},
-		{"s3.part_size", strings.Replace(keysTestConfig, "  region:",
-			"  part_size: big\n  region:", 1),
-			`s3.part_size: "big" is not a size; ` +
-				"use a number of bytes or a unit such as 10MB"},
-		{"from a reference",
-			keysTestConfig + "chunk_size: ${FILE:" + sizePath + "}\n",
-			`chunk_size: "lots" is not a size; ` +
-				"use a number of bytes or a unit such as 10MB"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := Parse([]byte(tt.yaml))
-			if !errors.Is(err, errNotASize) {
-				t.Fatalf("Parse() error = %v, want errNotASize", err)
-			}
-
-			if err.Error() != tt.want {
-				t.Errorf("Parse() error = %q, want %q", err.Error(), tt.want)
-			}
-		})
-	}
-}
-
-// TestParseRefusesSizeTooLarge checks that a size setting whose value is
-// too large for a size fails the parse with an error naming the setting.
-// YAML reads the second value as a float.
-func TestParseRefusesSizeTooLarge(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		value string
-		want  string
-	}{
-		{"100EB", "chunk_size: size exceeds maximum supported value: 100EB"},
-		{"99999999999999999999",
-			"chunk_size: size exceeds maximum supported value"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.value, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := Parse([]byte(keysTestConfig + "chunk_size: " + tt.value + "\n"))
-			if !errors.Is(err, errSizeTooLarge) {
-				t.Fatalf("Parse() error = %v, want errSizeTooLarge", err)
-			}
-
-			if err.Error() != tt.want {
-				t.Errorf("Parse() error = %q, want %q", err.Error(), tt.want)
-			}
-		})
-	}
-}
-
-// TestParseAcceptsSizes checks that size settings given as a number of
-// bytes, as a unit, and through a ${...} reference still parse.
-func TestParseAcceptsSizes(t *testing.T) {
-	t.Parallel()
-
-	sizePath := filepath.Join(t.TempDir(), "size")
-
-	err := os.WriteFile(sizePath, []byte("20MB"), 0o600)
-	if err != nil {
-		t.Fatalf("write size: %v", err)
-	}
-
-	data := strings.Replace(keysTestConfig, "  region:",
-		"  part_size: 6000000\n  region:", 1) +
-		"chunk_size: ${FILE:" + sizePath + "}\n" +
-		"blob_size_limit: 1GB\n"
-
-	cfg, err := Parse([]byte(data))
-	if err != nil {
-		t.Fatalf("Parse() unexpected error: %v", err)
-	}
-
-	if cfg.ChunkSize != 20_000_000 || cfg.BlobSizeLimit != 1_000_000_000 ||
-		cfg.S3.PartSize != 6_000_000 {
-		t.Errorf("chunk_size, blob_size_limit, s3.part_size = %d, %d, %d, "+
-			"want 20000000, 1000000000, 6000000",
-			cfg.ChunkSize, cfg.BlobSizeLimit, cfg.S3.PartSize)
-	}
-}

internal/exclude/exclude.go

@@ -1,77 +0,0 @@
-// Package exclude compiles exclude patterns into globs.
-package exclude
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-
-	"github.com/gobwas/glob"
-)
-
-var errBadExcludePattern = errors.New("is not a valid exclude pattern")
-
-// Compile compiles one exclude pattern into the globs that match it.
-// anchored reports whether the pattern matches only from the root of the
-// source directory. An empty pattern yields no globs. Config.Validate and
-// the scanner both compile patterns with it, so a pattern that loads is one
-// the scanner can use.
-func Compile(pattern string) ([]glob.Glob, bool, error) {
-	if pattern == "" {
-		return nil, false, nil
-	}
-
-	// A leading "/" anchors the pattern to the source directory.
-	trimmed, anchored := strings.CutPrefix(pattern, "/")
-
-	// A trailing "/" marks a directory and is not matched.
-	trimmed = strings.TrimSuffix(trimmed, "/")
-
-	// A leading "**/" demands a "/" before the name and so misses an
-	// entry directly under the source path. It means "at every depth",
-	// which is what an unanchored pattern already does, so drop the
-	// prefix and match unanchored: as in gitignore, "**/x" and
-	// "/**/x" then also match a top-level "x".
-	if rest, found := strings.CutPrefix(trimmed, "**/"); found {
-		trimmed = rest
-		anchored = false
-	}
-
-	// Likewise "/**/" inside a pattern demands two slashes, so
-	// "a/**/*.log" misses "a/x.log". As in gitignore it stands for
-	// zero or more directories, so also compile the pattern with it
-	// made a single "/". The glob library's {a,b} is no help: with a
-	// "**" inside it in mid-pattern, it misses paths it should match.
-	var globs []glob.Glob
-
-	for _, variant := range doubleStarVariants(trimmed) {
-		g, err := glob.Compile(variant, '/')
-		if err != nil {
-			return nil, false, fmt.Errorf("%q %w: %w",
-				pattern, errBadExcludePattern, err)
-		}
-
-		globs = append(globs, g)
-	}
-
-	return globs, anchored, nil
-}
-
-// doubleStarVariants returns pattern once for every way of keeping each
-// "/**/" in it or making it a single "/".
-func doubleStarVariants(pattern string) []string {
-	const doubleStar = "/**/"
-
-	before, after, found := strings.Cut(pattern, doubleStar)
-	if !found {
-		return []string{pattern}
-	}
-
-	var variants []string
-
-	for _, rest := range doubleStarVariants(after) {
-		variants = append(variants, before+doubleStar+rest, before+"/"+rest)
-	}
-
-	return variants
-}

internal/exclude/exclude_test.go

@@ -1,73 +0,0 @@
-package exclude_test
-
-import (
-	"slices"
-	"strings"
-	"testing"
-
-	"github.com/gobwas/glob"
-	"sneak.berlin/go/vaultik/internal/exclude"
-)
-
-// TestCompile checks the error, the anchoring and the globs that Compile
-// returns for one exclude pattern.
-func TestCompile(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name         string
-		pattern      string
-		wantErr      string
-		wantAnchored bool
-		// wantMatches lists paths that one of the globs must match. When
-		// it is empty, Compile must return no globs.
-		wantMatches []string
-	}{
-		{name: "does not compile", pattern: "build[",
-			wantErr: `"build[" is not a valid exclude pattern`},
-		{name: "empty", pattern: ""},
-		{name: "leading slash anchors", pattern: "/build",
-			wantAnchored: true, wantMatches: []string{"build"}},
-		{name: "double star after the slash clears anchoring",
-			pattern: "/**/build", wantMatches: []string{"build"}},
-		{name: "double star in the middle", pattern: "a/**/*.log",
-			wantMatches: []string{"a/x.log", "a/b/x.log"}},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			globs, anchored, err := exclude.Compile(tt.pattern)
-			if tt.wantErr == "" && err != nil {
-				t.Fatalf("Compile(%q) error = %v, want none", tt.pattern, err)
-			}
-
-			if tt.wantErr != "" &&
-				(err == nil || !strings.HasPrefix(err.Error(), tt.wantErr)) {
-				t.Fatalf("Compile(%q) error = %v, want one starting with %q",
-					tt.pattern, err, tt.wantErr)
-			}
-
-			if anchored != tt.wantAnchored {
-				t.Errorf("Compile(%q) anchored = %t, want %t",
-					tt.pattern, anchored, tt.wantAnchored)
-			}
-
-			if len(tt.wantMatches) == 0 && len(globs) != 0 {
-				t.Errorf("Compile(%q) returned %d globs, want none",
-					tt.pattern, len(globs))
-			}
-
-			for _, path := range tt.wantMatches {
-				matched := slices.ContainsFunc(globs, func(g glob.Glob) bool {
-					return g.Match(path)
-				})
-				if !matched {
-					t.Errorf("Compile(%q) globs do not match %q",
-						tt.pattern, path)
-				}
-			}
-		})
-	}
-}

internal/globals/globals.go

@@ -1,24 +1,19 @@
 // Package globals holds application-wide metadata (name, version,
-// commit) that is populated at build time via linker flags, or from the
-// build info Go records in the binary when the linker flags set none.
+// commit) that is populated at build time via linker flags.
 package globals
 
 import (
 	"regexp"
-	"runtime/debug"
 	"strings"
 	"time"
-
-	"golang.org/x/mod/module"
 )
 
 // Appname is the application name, populated from main().
 var Appname = "vaultik" //nolint:gochecknoglobals // set via -ldflags at build time
 
 // DevVersion is the version a binary reports when it was built without
-// git metadata: script/version emits it outside a git checkout, and a
-// binary keeps it when neither its linker flags nor its Go build info
-// name a version. goreleaser's snapshot template stamps
+// git metadata: script/version emits it outside a git checkout, and an
+// unstamped `go build` keeps it. goreleaser's snapshot template stamps
 // it followed by "-" and the commit it was built from. It is
 // deliberately not a number.
 const DevVersion = "dev"
@@ -37,54 +32,6 @@ var Commit = Unknown //nolint:gochecknoglobals // set via -ldflags at build time
 // CommitDate is the ISO-8601 date of the commit, populated from main().
 var CommitDate = Unknown //nolint:gochecknoglobals // set via -ldflags at build time
 
-// develVersion is the main module version Go records when it cannot
-// tell which version it built.
-const develVersion = "(devel)"
-
-// FillUnsetFromBuildInfo applies FillUnset to Version, Commit and
-// CommitDate, with the build info of the running binary.
-func FillUnsetFromBuildInfo() {
-	info, ok := debug.ReadBuildInfo()
-	if !ok {
-		return
-	}
-
-	Version, Commit, CommitDate = FillUnset(
-		info, Version, Commit, CommitDate)
-}
-
-// FillUnset returns version, commit and commitDate. Each one that
-// still holds its default ("dev" or empty for the version, "unknown"
-// for the others) is replaced by the value Go recorded in info. A
-// `go install` of a tag sets no linker flags, but Go records the tag
-// as the main module's version. Go records the commit and its time
-// only when it builds from a git checkout. The time is cut to a date,
-// as the Makefile stamps it.
-func FillUnset(
-	info *debug.BuildInfo, version, commit, commitDate string,
-) (string, string, string) {
-	if (version == "" || version == DevVersion) &&
-		info.Main.Version != "" && info.Main.Version != develVersion {
-		version = info.Main.Version
-	}
-
-	for _, s := range info.Settings {
-		switch s.Key {
-		case "vcs.revision":
-			if commit == Unknown {
-				commit = s.Value
-			}
-		case "vcs.time":
-			t, err := time.Parse(time.RFC3339, s.Value)
-			if commitDate == Unknown && err == nil {
-				commitDate = t.UTC().Format(time.DateOnly)
-			}
-		}
-	}
-
-	return version, commit, commitDate
-}
-
 // Author identifies the upstream author of vaultik.
 const Author = "Jeffrey Paul <sneak@sneak.berlin>"
 
@@ -121,10 +68,8 @@ func New() (*Globals, error) {
 // a release. "dev" and goreleaser's snapshot "dev-<sha>" count, and so
 // does what `git describe --tags --always --dirty` gives a make or
 // docker build of an untagged commit: the bare short commit, or
-// tag-N-gHASH on a commit after a tag. A Go pseudo-version counts: Go
-// records one for a build of an untagged commit without linker flags.
-// Any version ending in "-dirty" or "+dirty" counts, a modified
-// checkout of a tag ("v1.0.0-dirty", "v1.0.0+dirty") included.
+// tag-N-gHASH on a commit after a tag. Any version ending in "-dirty"
+// counts, a modified checkout of a tag ("v1.0.0-dirty") included.
 // A plain tag such as "v1.0.0" or "1.0.0" is a release.
 //
 // The empty string counts too. Nothing that knows its version reports
@@ -137,8 +82,7 @@ func New() (*Globals, error) {
 func IsDevVersion(v string) bool {
 	if v == "" || v == Unknown || v == DevVersion ||
 		strings.HasPrefix(v, DevVersion+"-") ||
-		strings.HasSuffix(v, "-dirty") || strings.HasSuffix(v, "+dirty") ||
-		module.IsPseudoVersion(v) {
+		strings.HasSuffix(v, "-dirty") {
 		return true
 	}
 

internal/globals/globals_test.go

@@ -1,7 +1,6 @@
 package globals_test
 
 import (
-	"runtime/debug"
 	"testing"
 
 	"sneak.berlin/go/vaultik/internal/globals"
@@ -60,20 +59,12 @@ func TestIsDevVersion(t *testing.T) {
 		{"1.0.0-rc.1-12-g877eb2f", true},
 		// A tagged commit with uncommitted changes is not that tag.
 		{"v1.0.0-dirty", true},
-		// What Go records for a build without linker flags: a
-		// pseudo-version for an untagged commit, "+dirty" for a
-		// modified checkout.
-		{"v1.0.0-rc3.0.20261111001226-abcdefabcdef", true},
-		{"v0.0.0-20261111001226-abcdefabcdef", true},
-		{"v1.0.1-0.20261111001226-abcdefabcdef", true},
-		{"v1.0.0+dirty", true},
 		// What a tagged build produces (goreleaser's .Version strips
 		// the leading "v"; script/version keeps it).
 		{"1.0.0", false},
 		{"0.1.0", false},
 		{"1.0.0-rc.1", false},
 		{"v1.0.0", false},
-		{"v1.0.0-rc3", false},
 		// A release must not be mistaken for a dev build just because
 		// the string happens to contain "dev".
 		{"1.0.0-dev", false},
@@ -95,9 +86,10 @@ func TestIsDevVersion(t *testing.T) {
 	}
 }
 
-// TestDefaultVersionIsDev pins the default: a binary whose linker flags
-// and build info name no version must report itself as a development
-// build rather than as some default release number.
+// TestDefaultVersionIsDev pins the linker-flag contract: an unstamped
+// binary (no -ldflags at all, which is what `go build ./...` and `go
+// install` produce) must report itself as a development build rather
+// than as some default release number.
 func TestDefaultVersionIsDev(t *testing.T) {
 	t.Parallel()
 
@@ -106,104 +98,3 @@ func TestDefaultVersionIsDev(t *testing.T) {
 			globals.DevVersion)
 	}
 }
-
-// buildInfo returns build info with the given main module version and,
-// when revision is not empty, the commit settings Go records for a
-// build from a git checkout.
-func buildInfo(version, revision string) *debug.BuildInfo {
-	info := &debug.BuildInfo{
-		Main: debug.Module{Path: "sneak.berlin/go/vaultik", Version: version},
-	}
-
-	if revision != "" {
-		info.Settings = []debug.BuildSetting{
-			{Key: "vcs.revision", Value: revision},
-			{Key: "vcs.time", Value: "2026-11-10T23:12:26Z"},
-		}
-	}
-
-	return info
-}
-
-// TestFillUnset covers a binary from `go install` of a tag, which
-// carries no linker flags: it must report the tag. Values the linker
-// flags set are kept.
-func TestFillUnset(t *testing.T) {
-	t.Parallel()
-
-	const (
-		tag = "v1.0.0-rc3"
-		rev = "0123456789abcdef0123456789abcdef01234567"
-	)
-
-	cases := []struct {
-		name                    string
-		info                    *debug.BuildInfo
-		version, commit, date   string
-		wantVersion, wantCommit string
-		wantDate                string
-	}{
-		{
-			name:        "go install of a tag",
-			info:        buildInfo(tag, ""),
-			version:     globals.DevVersion,
-			commit:      globals.Unknown,
-			date:        globals.Unknown,
-			wantVersion: tag,
-			wantCommit:  globals.Unknown,
-			wantDate:    globals.Unknown,
-		},
-		{
-			name:        "empty version",
-			info:        buildInfo(tag, ""),
-			version:     "",
-			commit:      globals.Unknown,
-			date:        globals.Unknown,
-			wantVersion: tag,
-			wantCommit:  globals.Unknown,
-			wantDate:    globals.Unknown,
-		},
-		{
-			name:        "go build in a git checkout",
-			info:        buildInfo(tag, rev),
-			version:     globals.DevVersion,
-			commit:      globals.Unknown,
-			date:        globals.Unknown,
-			wantVersion: tag,
-			wantCommit:  rev,
-			wantDate:    "2026-11-10",
-		},
-		{
-			name:        "Go could not tell the version",
-			info:        buildInfo("(devel)", ""),
-			version:     globals.DevVersion,
-			commit:      globals.Unknown,
-			date:        globals.Unknown,
-			wantVersion: globals.DevVersion,
-			wantCommit:  globals.Unknown,
-			wantDate:    globals.Unknown,
-		},
-		{
-			name:        "linker flags set",
-			info:        buildInfo(tag, rev),
-			version:     "v1.0.0-rc2-4-gabcdef1",
-			commit:      "abcdef1",
-			date:        "2026-11-01",
-			wantVersion: "v1.0.0-rc2-4-gabcdef1",
-			wantCommit:  "abcdef1",
-			wantDate:    "2026-11-01",
-		},
-	}
-
-	for _, tc := range cases {
-		version, commit, date := globals.FillUnset(
-			tc.info, tc.version, tc.commit, tc.date)
-
-		if version != tc.wantVersion || commit != tc.wantCommit ||
-			date != tc.wantDate {
-			t.Errorf("%s: got %q, %q, %q; want %q, %q, %q", tc.name,
-				version, commit, date,
-				tc.wantVersion, tc.wantCommit, tc.wantDate)
-		}
-	}
-}

internal/snapshot/scanner.go

@@ -20,7 +20,6 @@ import (
 	"sneak.berlin/go/vaultik/internal/blob"
 	"sneak.berlin/go/vaultik/internal/chunker"
 	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/exclude"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/storage"
 	"sneak.berlin/go/vaultik/internal/types"
@@ -222,12 +221,8 @@ func NewScanner(cfg ScannerConfig) *Scanner {
 		progress = NewProgressReporter()
 	}
 
-	compiledExclude, err := compileExcludePatterns(cfg.Exclude)
-	if err != nil {
-		log.Error("Failed to compile exclude patterns", "error", err)
-
-		return nil
-	}
+	// Compile exclude patterns
+	compiledExclude := compileExcludePatterns(cfg.Exclude)
 
 	uiw := cfg.UI
 	if uiw == nil {
@@ -1880,13 +1875,7 @@ func (s *Scanner) uploadBlobIfNeeded(
 	err = s.storage.PutWithProgress(ctx, blobPath, blobWithReader.Reader,
 		finishedBlob.Compressed, progressCallback)
 	if err != nil {
-		// The record is at info level: the returned error ends the backup
-		// and is printed as its ERROR: line. Only an interrupt cancels
-		// ctx, and the user is told about it, so an upload it stopped is
-		// not logged as a storage failure.
-		if ctx.Err() == nil {
-			log.Info("Failed to upload blob", "hash", finishedBlob.Hash, "error", err)
-		}
+		log.Error("Failed to upload blob", "hash", finishedBlob.Hash, "error", err)
 
 		return 0, false, fmt.Errorf("uploading blob to storage: %w", err)
 	}
@@ -2323,18 +2312,51 @@ func wrapPermissionError(path string, err error) error {
 		"with --skip-errors to continue past unreadable files)", path, err)
 }
 
-// compileExcludePatterns compiles the exclude patterns into glob matchers.
-// Config.Validate has already refused a pattern that does not compile.
-func compileExcludePatterns(patterns []string) ([]compiledPattern, error) {
+// compileExcludePatterns compiles the exclude patterns into glob matchers
+func compileExcludePatterns(patterns []string) []compiledPattern {
 	var compiled []compiledPattern
 
 	for _, p := range patterns {
-		globs, anchored, err := exclude.Compile(p)
-		if err != nil {
-			return nil, err
+		if p == "" {
+			continue
 		}
 
-		for _, g := range globs {
+		// Check if pattern is anchored (starts with /)
+		anchored := strings.HasPrefix(p, "/")
+
+		pattern := p
+		if anchored {
+			pattern = p[1:] // Remove leading /
+		}
+
+		// Remove trailing slash if present (directory indicator)
+		pattern = strings.TrimSuffix(pattern, "/")
+
+		// A leading "**/" demands a "/" before the name and so misses an
+		// entry directly under the source path. It means "at every depth",
+		// which is what an unanchored pattern already does, so drop the
+		// prefix and match unanchored: as in gitignore, "**/x" and
+		// "/**/x" then also match a top-level "x".
+		if rest, found := strings.CutPrefix(pattern, "**/"); found {
+			pattern = rest
+			anchored = false
+		}
+
+		// Likewise "/**/" inside a pattern demands two slashes, so
+		// "a/**/*.log" misses "a/x.log". As in gitignore it stands for
+		// zero or more directories, so also compile the pattern with it
+		// made a single "/". The glob library's {a,b} is no help: with a
+		// "**" inside it in mid-pattern, it misses paths it should match.
+		for _, variant := range doubleStarVariants(pattern) {
+			// For patterns without path separators, we need to match them as components
+			// e.g., ".git" should match ".git" anywhere in the path
+			g, err := glob.Compile(variant, '/')
+			if err != nil {
+				log.Warn("Invalid exclude pattern, skipping", "pattern", p, "error", err)
+
+				break
+			}
+
 			compiled = append(compiled, compiledPattern{
 				pattern:  g,
 				anchored: anchored,
@@ -2343,7 +2365,26 @@ func compileExcludePatterns(patterns []string) ([]compiledPattern, error) {
 		}
 	}
 
-	return compiled, nil
+	return compiled
+}
+
+// doubleStarVariants returns pattern once for every way of keeping each
+// "/**/" in it or making it a single "/".
+func doubleStarVariants(pattern string) []string {
+	const doubleStar = "/**/"
+
+	before, after, found := strings.Cut(pattern, doubleStar)
+	if !found {
+		return []string{pattern}
+	}
+
+	var variants []string
+
+	for _, rest := range doubleStarVariants(after) {
+		variants = append(variants, before+doubleStar+rest, before+"/"+rest)
+	}
+
+	return variants
 }
 
 // shouldExclude checks if a path should be excluded based on exclude patterns

internal/snapshot/upload_cancel_log_test.go

@@ -1,135 +0,0 @@
-//nolint:testpackage // exercises the unexported uploadBlobIfNeeded
-package snapshot
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/vaultik/internal/blob"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/storage"
-	"sneak.berlin/go/vaultik/internal/storage/faultstore"
-	"sneak.berlin/go/vaultik/internal/ui"
-)
-
-const uploadFailedLogMessage = "Failed to upload blob"
-
-// uploadTestBlob uploads a small blob through store.
-func uploadTestBlob(ctx context.Context, store storage.Storer) error {
-	data := []byte("blob data")
-	s := &Scanner{storage: store, ui: ui.NewWithColor(io.Discard, false)}
-
-	_, _, err := s.uploadBlobIfNeeded(ctx, "blobs/test", &blob.WithReader{
-		FinishedBlob: &blob.FinishedBlob{
-			Hash:       "test",
-			Compressed: int64(len(data)),
-		},
-		Reader: bytes.NewReader(data),
-	}, time.Now(), &ScanResult{})
-
-	return err
-}
-
-// captureLog runs fn and returns what the logger wrote to stderr
-// meanwhile, at the --verbose level. The logger writes to the os.Stderr
-// it finds when it is initialized, so os.Stderr is pointed at a file
-// first. Not parallel-safe: os.Stderr and the logger are process-global.
-func captureLog(t *testing.T, fn func()) string {
-	t.Helper()
-
-	stderrPath := filepath.Join(t.TempDir(), "stderr")
-
-	stderrFile, err := os.Create(stderrPath) //nolint:gosec // G304: test temp path
-	if err != nil {
-		t.Fatalf("creating stderr file: %v", err)
-	}
-
-	previous := os.Stderr
-	os.Stderr = stderrFile
-
-	log.Initialize(log.Config{Verbose: true})
-
-	fn()
-
-	os.Stderr = previous
-
-	log.Initialize(log.Config{})
-
-	_ = stderrFile.Close()
-
-	captured, err := os.ReadFile(stderrPath) //nolint:gosec // G304: test temp path
-	if err != nil {
-		t.Fatalf("reading stderr file: %v", err)
-	}
-
-	return string(captured)
-}
-
-// An upload stopped by Ctrl-C or SIGTERM is not logged as an error; the
-// interrupted message is all the user sees. See
-// https://git.eeqj.de/sneak/vaultik/issues/434.
-//
-//nolint:paralleltest // captureLog replaces os.Stderr
-func TestInterruptedUploadIsNotLoggedAsError(t *testing.T) {
-	inner, err := storage.NewFileStorer(t.TempDir())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	// The user interrupts mid-upload. The injected error does not wrap
-	// context.Canceled, so only ctx shows why the upload failed.
-	store := faultstore.New(inner)
-	store.OnPut = func(string) faultstore.PutAction {
-		cancel()
-
-		return faultstore.PutFail
-	}
-
-	var uploadErr error
-
-	stderr := captureLog(t, func() { uploadErr = uploadTestBlob(ctx, store) })
-
-	if uploadErr == nil {
-		t.Fatal("expected the upload to fail")
-	}
-
-	if strings.Contains(stderr, uploadFailedLogMessage) {
-		t.Errorf("interrupted upload logged as a failure: %q", stderr)
-	}
-}
-
-// An upload that fails for any other reason is still logged.
-//
-//nolint:paralleltest // captureLog replaces os.Stderr
-func TestFailedUploadIsLogged(t *testing.T) {
-	inner, err := storage.NewFileStorer(t.TempDir())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	store := faultstore.New(inner)
-	store.OnPut = func(string) faultstore.PutAction { return faultstore.PutFail }
-
-	var uploadErr error
-
-	stderr := captureLog(t, func() {
-		uploadErr = uploadTestBlob(context.Background(), store)
-	})
-
-	if uploadErr == nil {
-		t.Fatal("expected the upload to fail")
-	}
-
-	if !strings.Contains(stderr, uploadFailedLogMessage) {
-		t.Errorf("failed upload not logged: %q", stderr)
-	}
-}

internal/vaultik/blob_fetch.go

@@ -22,10 +22,6 @@ var errBlobHashMismatch = errors.New("blob hash mismatch")
 var errBlobNotFullyRead = errors.New(
 	"blob closed before fully read; hash not verified")
 
-// errWrongPrivateKeyForBlob is returned when the configured key parses
-// but is not one of the keys a blob was encrypted to.
-var errWrongPrivateKeyForBlob = errors.New("cannot decrypt this blob")
-
 // hashVerifyReader wraps a blobgen.Reader and verifies the double-SHA-256 hash
 // of decrypted plaintext when Close is called. It reuses the hash that
 // blobgen.Reader already computes internally via its TeeReader, avoiding
@@ -91,14 +87,10 @@ func (v *Vaultik) FetchAndDecryptBlob(
 		return nil, err
 	}
 
-	reader, err := v.newBlobReader(rc, identities)
+	reader, err := blobgen.NewReader(rc, identities...)
 	if err != nil {
 		_ = rc.Close()
 
-		if errors.Is(err, errWrongPrivateKeyForBlob) {
-			return nil, err
-		}
-
 		return nil, fmt.Errorf("creating blob reader: %w", err)
 	}
 
@@ -110,28 +102,6 @@ func (v *Vaultik) FetchAndDecryptBlob(
 	}, nil
 }
 
-// newBlobReader opens the decrypting reader for a blob. When none of the
-// identities can decrypt it, the error says in plain words that the
-// configured private key is not one of the keys the blob was encrypted
-// to and names where the key was configured.
-func (v *Vaultik) newBlobReader(
-	r io.Reader, identities []age.Identity,
-) (*blobgen.Reader, error) {
-	blobReader, err := blobgen.NewReader(r, identities...)
-
-	if _, ok := errors.AsType[*age.NoIdentityMatchError](err); ok {
-		return nil, fmt.Errorf(
-			"%w: the private key in %s is not one of the keys the blob was encrypted to",
-			errWrongPrivateKeyForBlob, v.Config.AgeSecretKeySourceName())
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	return blobReader, nil
-}
-
 // FetchBlob downloads a blob and returns a reader for the encrypted data.
 // The reader is closed as soon as ctx is cancelled, which ends a read
 // blocked inside it. A storage error is returned as is: restore and deep

internal/vaultik/destination_marker.go

@@ -51,7 +51,7 @@ func (v *Vaultik) checkDestinationMarker() error {
 	}
 
 	// Config is nil only in tests, which then record no binding (see
-	// checkStorageBinding).
+	// EnsureStorageBinding).
 	if v.Config != nil {
 		stored, configured, err := v.storageBinding()
 		if err != nil {
@@ -83,19 +83,11 @@ func (v *Vaultik) checkDestinationMarker() error {
 	return nil
 }
 
-// markDestination refuses a local index bound to a different
-// destination, checks the backup destination store for its marker,
-// writes the marker, and then records the binding. A first backup marks
-// its destination and a later one writes the same text again. The
-// binding is recorded last, so a first backup that cannot write to the
-// destination leaves the local index unbound.
+// markDestination checks the backup destination store with
+// checkDestinationMarker and then writes the marker, so a first backup
+// marks its destination and a later one writes the same text again.
 func (v *Vaultik) markDestination() error {
-	err := v.checkStorageBinding()
-	if err != nil {
-		return err
-	}
-
-	err = v.checkDestinationMarker()
+	err := v.checkDestinationMarker()
 	if err != nil {
 		return err
 	}
@@ -107,5 +99,5 @@ func (v *Vaultik) markDestination() error {
 			destinationMarkerKey, err)
 	}
 
-	return v.EnsureStorageBinding()
+	return nil
 }

internal/vaultik/prune.go

@@ -68,7 +68,7 @@ func (v *Vaultik) NukeRemote(force bool) error {
 	// the same way, so the advice below must not follow these errors.
 	// The listing also fails on a destination that answers that it has
 	// no marker while the local index holds snapshots.
-	err := v.checkStorageBinding()
+	err := v.EnsureStorageBinding()
 	if err != nil {
 		return err
 	}
@@ -192,7 +192,7 @@ type PruneBlobsResult struct {
 // PruneDatabase or PruneBlobs individually unless it specifically wants
 // one half.
 func (v *Vaultik) Prune(opts *PruneOptions) error {
-	err := v.checkStorageBinding()
+	err := v.EnsureStorageBinding()
 	if err != nil {
 		return err
 	}

internal/vaultik/restore.go

@@ -40,9 +40,6 @@ var (
 	// which is secret, so the message is safe to print and log.
 	errInvalidAgeSecretKey = errors.New(
 		"configured age secret key holds no usable age identity")
-	// errWrongPrivateKey is returned when the configured key parses but
-	// is not one of the keys the snapshot was encrypted to.
-	errWrongPrivateKey          = errors.New("cannot decrypt this snapshot")
 	errBlobMissingFromIndex     = errors.New("blob hash missing from blob index")
 	errChunkNotInAnyBlob        = errors.New("chunk not found in any blob")
 	errBlobIDNotInHashIndex     = errors.New("blob id missing from hash index")
@@ -109,12 +106,7 @@ type RestoreResult struct {
 	BytesDownloaded int64
 	Duration        time.Duration
 	FilesFailed     int
-	FailedFiles     []string // Paths of files that failed to restore for their own reason
-	// Blobs that could not be downloaded, and the paths of the files
-	// skipped because they need one of them. Those files are counted in
-	// FilesFailed but not listed in the summary.
-	BlobsFailed            int
-	FilesNeedingFailedBlob []string
+	FailedFiles     []string // Paths of files that failed to restore
 	// Verification results (only populated if Verify option is set)
 	FilesVerified     int
 	BytesVerified     int64
@@ -136,19 +128,10 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		"paths", opts.Paths,
 	)
 
-	remoteKey, err := v.resolveSnapshotRemoteKey(opts.SnapshotID)
-	if err != nil {
-		return err
-	}
-
 	// Step 1: Download and decrypt the snapshot metadata database
 	log.Info("Downloading snapshot metadata...")
 
-	tempDB, tempDir, err := v.downloadSnapshotDB(opts.SnapshotID, remoteKey, identities)
-	if errors.Is(err, errWrongPrivateKey) {
-		return err
-	}
-
+	tempDB, tempDir, err := v.downloadSnapshotDB(opts.SnapshotID, identities)
 	if err != nil {
 		return fmt.Errorf("downloading snapshot database: %w", err)
 	}
@@ -243,11 +226,6 @@ func (v *Vaultik) finishRestore(
 	if result.FilesFailed > 0 {
 		v.UI.Warningf("%d file(s) failed to restore:", result.FilesFailed)
 
-		if result.BlobsFailed > 0 {
-			v.UI.Detailf("%d of them need a blob that could not be read (%d blob(s) in all).",
-				len(result.FilesNeedingFailedBlob), result.BlobsFailed)
-		}
-
 		for _, path := range result.FailedFiles {
 			v.UI.Detailf("%s", v.UI.Path(path))
 		}
@@ -345,28 +323,6 @@ func (v *Vaultik) restoreIdentities() ([]age.Identity, error) {
 	return identities, nil
 }
 
-// newSnapshotDBReader opens the decrypting reader for a snapshot
-// database. When none of the identities can decrypt it, the error says
-// in plain words that the configured private key is the wrong one and
-// names where it was configured.
-func (v *Vaultik) newSnapshotDBReader(
-	r io.Reader, identities []age.Identity,
-) (*blobgen.Reader, error) {
-	blobReader, err := blobgen.NewReader(r, identities...)
-
-	if _, ok := errors.AsType[*age.NoIdentityMatchError](err); ok {
-		return nil, fmt.Errorf(
-			"%w: the private key in %s is not one of the keys the backup was encrypted to",
-			errWrongPrivateKey, v.Config.AgeSecretKeySourceName())
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	return blobReader, nil
-}
-
 // restoreAllFiles processes files in blob-locality order: drain every
 // file whose blob set is on disk, download the missing blobs for the
 // pending file with the smallest uncached count, repeat. This keeps
@@ -538,8 +494,8 @@ func (v *Vaultik) runRestoreLoop(
 // Returns false when nothing is pending download (the caller stops).
 //
 // A blob that cannot be downloaded is reported through
-// handleRestoreBlobError, so it aborts the restore unless --skip-errors
-// is set.
+// handleRestoreFileError for every pending file that references it, so
+// it aborts the restore unless --skip-errors is set.
 func (s *restoreSession) downloadNextBlobSet(
 	plan *restorePlan, filesByID map[types.FileID]*database.File,
 ) (bool, error) {
@@ -572,11 +528,12 @@ func (s *restoreSession) downloadNextBlobSet(
 				return false, err
 			}
 
-			blobErr := s.v.handleRestoreBlobError(
-				plan, s.opts, s.result, filesByID,
-				plan.filesReferencingBlob(hash), err)
-			if blobErr != nil {
-				return false, blobErr
+			for _, fileID := range plan.filesReferencingBlob(hash) {
+				fileErr := s.v.handleRestoreFileError(
+					plan, s.opts, s.result, filesByID[fileID], fileID, err)
+				if fileErr != nil {
+					return false, fileErr
+				}
 			}
 
 			// next is among the failed files, so the rest of its blob set
@@ -667,19 +624,19 @@ func (v *Vaultik) restoreProgressTick(
 
 // handleRestoreFileError records a per-file restore failure: fatal unless
 // --skip-errors is set, in which case the file is counted as failed and
-// dropped from the plan. A fatal failure is not logged here: the returned
-// error is printed as the command's ERROR: line.
+// dropped from the plan.
 func (v *Vaultik) handleRestoreFileError(
 	plan *restorePlan, opts *RestoreOptions, result *RestoreResult,
 	file *database.File, fileID types.FileID, err error,
 ) error {
+	log.Error("Failed to restore file", "path", file.Path, "error", err)
+
 	if !opts.SkipErrors {
 		return fmt.Errorf(
 			"restoring %s: %w (pass --skip-errors to continue past "+
 				"restore failures)", file.Path, err)
 	}
 
-	log.Error("Failed to restore file", "path", file.Path, "error", err)
 	v.UI.Errorf("Failed to restore %s: %v. Skipping (--skip-errors).",
 		v.UI.Path(file.Path.String()), err)
 
@@ -691,41 +648,6 @@ func (v *Vaultik) handleRestoreFileError(
 	return nil
 }
 
-// handleRestoreBlobError records a blob that could not be downloaded.
-// fileIDs are the pending files that need it, never empty. Without
-// --skip-errors the first of them fails the restore. With it, the blob is
-// reported once, and its files are counted as failed and dropped from
-// the plan without being reported one by one.
-func (v *Vaultik) handleRestoreBlobError(
-	plan *restorePlan, opts *RestoreOptions, result *RestoreResult,
-	filesByID map[types.FileID]*database.File, fileIDs []types.FileID,
-	err error,
-) error {
-	if !opts.SkipErrors {
-		return v.handleRestoreFileError(
-			plan, opts, result, filesByID[fileIDs[0]], fileIDs[0], err)
-	}
-
-	log.Error("Failed to restore files", "files", len(fileIDs), "error", err)
-	v.UI.Errorf("Failed to restore %d file(s): %v. Skipping them (--skip-errors).",
-		len(fileIDs), err)
-
-	result.BlobsFailed++
-
-	for _, fileID := range fileIDs {
-		path := filesByID[fileID].Path.String()
-
-		log.Debug("Skipped file that needs a failed blob", "path", path)
-
-		result.FilesFailed++
-		result.FilesNeedingFailedBlob = append(result.FilesNeedingFailedBlob, path)
-
-		plan.finishFile(fileID)
-	}
-
-	return nil
-}
-
 // printRestoreProgress emits a periodic restore-phase status line via
 // the UI writer, mirroring scanner.printProcessingProgress so the two
 // long-running commands have the same on-screen rhythm.
@@ -797,8 +719,8 @@ func (v *Vaultik) handleRestoreVerification(
 ) error {
 	// A file that failed to restore was not written and is already
 	// reported as such, so it is not verified.
-	failedToRestore := make(map[string]bool, result.FilesFailed)
-	for _, path := range slices.Concat(result.FailedFiles, result.FilesNeedingFailedBlob) {
+	failedToRestore := make(map[string]bool, len(result.FailedFiles))
+	for _, path := range result.FailedFiles {
 		failedToRestore[path] = true
 	}
 
@@ -832,12 +754,19 @@ func (v *Vaultik) handleRestoreVerification(
 	return nil
 }
 
-// downloadSnapshotDB downloads and decrypts the metadata database of the
-// snapshot at remoteKey, which resolveSnapshotRemoteKey returned for
-// snapshotID.
+// downloadSnapshotDB downloads and decrypts the snapshot metadata
+// database. The identifier is resolved to the snapshot's remote key: a
+// human ID is hashed, and a remote key (or its abbreviation, as printed
+// for a remote-only snapshot) is used as-is, so a host with no local
+// index can restore the snapshots it can only see on the store.
 func (v *Vaultik) downloadSnapshotDB(
-	snapshotID, remoteKey string, identities []age.Identity,
+	snapshotID string, identities []age.Identity,
 ) (*database.DB, string, error) {
+	remoteKey, err := v.resolveSnapshotRemoteKey(snapshotID)
+	if err != nil {
+		return nil, "", err
+	}
+
 	// Download encrypted database from storage
 	dbKey := fmt.Sprintf("metadata/%s/db.zst.age", remoteKey)
 
@@ -854,9 +783,9 @@ func (v *Vaultik) downloadSnapshotDB(
 	// the plaintext to a temp file. Neither the encrypted bytes nor the
 	// decrypted database is ever held whole in memory; a snapshot database
 	// can be large.
-	blobReader, err := v.newSnapshotDBReader(reader, identities)
+	blobReader, err := blobgen.NewReader(reader, identities...)
 	if err != nil {
-		return nil, "", err
+		return nil, "", fmt.Errorf("creating decryption reader: %w", err)
 	}
 
 	defer func() { _ = blobReader.Close() }()

internal/vaultik/restore_skip_errors_test.go

@@ -51,72 +51,27 @@ func TestRestoreSkipErrorsSkipsFilesOfMissingBlob(t *testing.T) {
 	t.Parallel()
 
 	ctx := context.Background()
-	backup := backupThenDeleteOneBlob(ctx, t)
-	out := assertRestoreSkipsLostFiles(ctx, t, backup)
-
-	assertLostFilesCountedNotListed(t, backup, out)
-}
-
-// TestRestoreSkipErrorsReportsUnreadableBlobOnce restores with SkipErrors
-// after one blob of a two-blob snapshot was overwritten with other bytes
-// of the same size. The blob must be reported once, by its hash, as not a
-// valid age stream, without quoting its bytes, and its files must be
-// counted, not listed.
-func TestRestoreSkipErrorsReportsUnreadableBlobOnce(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	backup, lostBlob := backupThenOverwriteOneBlob(ctx, t)
-	out := assertRestoreSkipsLostFiles(ctx, t, backup)
-
-	assert.Equal(t, 1, strings.Count(out, "not a valid age stream"), out)
-	assert.Contains(t, out, lostBlob[:16])
-	assert.NotContains(t, out, overwriteBlobPattern)
-	assertLostFilesCountedNotListed(t, backup, out)
+	assertRestoreSkipsLostFiles(ctx, t, backupThenDeleteOneBlob(ctx, t))
 }
 
 // TestRestoreSkipErrorsSkipsFilesWithChunkInNoBlob restores with
 // SkipErrors a snapshot whose metadata lists chunks that no blob holds, as
-// earlier backup defects left behind. Each such file fails for its own
-// reason, so each is listed.
+// earlier backup defects left behind.
 func TestRestoreSkipErrorsSkipsFilesWithChunkInNoBlob(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()
 
 	ctx := context.Background()
-	backup := backupThenDropOneBlobFromMetadata(ctx, t)
-	out := assertRestoreSkipsLostFiles(ctx, t, backup)
-
-	for path := range backup.lost {
-		assert.Containsf(t, out, path, "%s must be reported", path)
-	}
+	assertRestoreSkipsLostFiles(ctx, t, backupThenDropOneBlobFromMetadata(ctx, t))
 }
 
-// assertLostFilesCountedNotListed checks that the restore output out
-// counts the files of the lost blob and names none of them.
-func assertLostFilesCountedNotListed(
-	t *testing.T, backup *missingBlobBackup, out string,
-) {
-	t.Helper()
-
-	assert.Contains(t, out, fmt.Sprintf(
-		"%d of them need a blob that could not be read (1 blob(s) in all)",
-		len(backup.lost)))
-
-	for path := range backup.lost {
-		assert.NotContainsf(t, out, path,
-			"%s needs the lost blob and must be counted, not listed", path)
-	}
-}
-
-// assertRestoreSkipsLostFiles restores backup with SkipErrors and returns
-// what it printed. Every file stored in the lost blob must be left
-// absent, every other file must be restored intact, and Restore must
-// still return an error.
+// assertRestoreSkipsLostFiles restores backup with SkipErrors. Every file
+// stored in the lost blob must be reported as failed and left absent,
+// every other file must be restored intact, and Restore must still return
+// an error.
 func assertRestoreSkipsLostFiles(
 	ctx context.Context, t *testing.T, backup *missingBlobBackup,
-) string {
+) {
 	t.Helper()
 
 	var out bytes.Buffer
@@ -138,6 +93,8 @@ func assertRestoreSkipsLostFiles(
 		restored := filepath.Join(backup.restoreDir, path)
 
 		if backup.lost[path] {
+			assert.Containsf(t, out.String(), path,
+				"%s needs the lost blob and must be reported", path)
 			assert.NoFileExists(t, restored)
 
 			continue
@@ -147,8 +104,6 @@ func assertRestoreSkipsLostFiles(
 		require.NoErrorf(t, err, "%s does not need the lost blob", path)
 		assert.Equalf(t, content, got, "%s restored with wrong content", path)
 	}
-
-	return out.String()
 }
 
 // TestRestoreSkipErrorsVerifyChecksOnlyRestoredFiles restores with
@@ -189,9 +144,9 @@ func TestRestoreSkipErrorsVerifyChecksOnlyRestoredFiles(t *testing.T) {
 // TestRestoreSkipErrorsVerifyReportsFailuresApart restores with
 // SkipErrors and Verify after one blob of a two-blob snapshot was
 // deleted, while one file that does restore is written one byte too long.
-// The restore warning must count the files of the deleted blob without
-// listing them, the verification summary must list only the long file,
-// once, and Restore must return an error.
+// The restore warning must list only the files of the deleted blob, the
+// verification summary only the long file, each path once, and Restore
+// must return an error.
 func TestRestoreSkipErrorsVerifyReportsFailuresApart(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()
@@ -231,9 +186,9 @@ func TestRestoreSkipErrorsVerifyReportsFailuresApart(t *testing.T) {
 		"Verification failed: 1 files did not match")
 	require.Truef(t, found, "no verification summary in:\n%s", out.String())
 
-	assertLostFilesCountedNotListed(t, backup, warning)
-
 	for path := range backup.lost {
+		assert.Equalf(t, 1, strings.Count(warning, path),
+			"%s must be listed once as failed to restore", path)
 		assert.NotContainsf(t, summary, path,
 			"%s was not restored and must not fail verification", path)
 	}
@@ -337,35 +292,6 @@ func backupThenDeleteOneBlob(
 	return backup
 }
 
-// overwriteBlobPattern repeats, each time followed by a newline, through
-// the bytes that backupThenOverwriteOneBlob writes over a blob. age's own
-// error quotes the data's first line only when it reads a whole line.
-const overwriteBlobPattern = "overwritten-blob-bytes-"
-
-// backupThenOverwriteOneBlob backs up missingBlobFileCount single-chunk
-// files, then overwrites the blob holding the first of them with as many
-// bytes of overwriteBlobPattern lines. It also returns that blob's hash.
-func backupThenOverwriteOneBlob(
-	ctx context.Context, t *testing.T,
-) (*missingBlobBackup, string) {
-	t.Helper()
-
-	backup, db, lostBlob := backupSingleChunkFiles(ctx, t)
-	require.NoError(t, db.Close())
-
-	key := fmt.Sprintf("blobs/%s/%s/%s", lostBlob[:2], lostBlob[2:4], lostBlob)
-
-	info, err := backup.storer.Stat(ctx, key)
-	require.NoError(t, err)
-
-	line := overwriteBlobPattern + "\n"
-	pattern := bytes.Repeat([]byte(line), int(info.Size)/len(line)+1)
-	require.NoError(t, backup.storer.Put(
-		ctx, key, bytes.NewReader(pattern[:info.Size])))
-
-	return backup, lostBlob
-}
-
 // backupThenDropOneBlobFromMetadata backs up missingBlobFileCount
 // single-chunk files, then removes the blob holding the first of them from
 // the snapshot and exports the snapshot metadata again. The exported

internal/vaultik/restore_wrong_key_test.go

@@ -1,161 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"path"
-	"path/filepath"
-	"testing"
-
-	"filippo.io/age"
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/blobgen"
-	"sneak.berlin/go/vaultik/internal/config"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/snapshot"
-	"sneak.berlin/go/vaultik/internal/ui"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// TestWrongPrivateKeyError checks that restore and deep verify, given a
-// valid private key the backup was not encrypted to, fail with one plain
-// sentence that names where the key was configured.
-func TestWrongPrivateKeyError(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	store := NewMockStorer()
-
-	const snapshotID = "test-host_2026-01-01T00:00:00Z"
-
-	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)
-
-	manifest, err := snapshot.EncodeManifest(
-		&snapshot.Manifest{SnapshotID: remoteKey}, 3)
-	require.NoError(t, err)
-	require.NoError(t, store.Put(ctx,
-		"metadata/"+remoteKey+"/manifest.json.zst", bytes.NewReader(manifest)))
-
-	// The database is encrypted to the test recipient only.
-	var db bytes.Buffer
-
-	writer, err := blobgen.NewWriter(&db, 1, []string{testAgePublicKey})
-	require.NoError(t, err)
-
-	_, err = writer.Write([]byte("snapshot database"))
-	require.NoError(t, err)
-	require.NoError(t, writer.Close())
-	require.NoError(t, store.Put(ctx,
-		"metadata/"+remoteKey+"/db.zst.age", &db))
-
-	otherKey, err := age.GenerateX25519Identity()
-	require.NoError(t, err)
-
-	v := &vaultik.Vaultik{
-		Config:  &config.Config{AgeSecretKey: otherKey.String()},
-		Storage: store,
-		Fs:      afero.NewMemMapFs(),
-		Stdout:  io.Discard,
-		Stderr:  io.Discard,
-		UI:      ui.NewWithColor(io.Discard, false),
-	}
-	v.SetContext(ctx)
-
-	// A Config built directly has no recorded source, so the error names
-	// the config-file field.
-	const want = "cannot decrypt this snapshot: the private key in " +
-		"age_secret_key is not one of the keys the backup was encrypted to"
-
-	err = v.Restore(&vaultik.RestoreOptions{
-		SnapshotID: snapshotID,
-		TargetDir:  t.TempDir(),
-	})
-	require.EqualError(t, err, want)
-
-	err = v.RunDeepVerify(snapshotID, &vaultik.VerifyOptions{Deep: true})
-	require.EqualError(t, err, want)
-}
-
-// TestWrongPrivateKeyForBlobError backs up a file, then backs it up again
-// from an empty local index with a second recipient added. The second
-// snapshot reuses the stored blob, which stays encrypted to the first
-// recipient only. With only the added key configured, restore and deep
-// verify read the database but fail on the blob with one plain sentence
-// that names where the key was configured.
-func TestWrongPrivateKeyForBlobError(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	fs := afero.NewOsFs()
-	tempDir := t.TempDir()
-	dataDir := filepath.Join(tempDir, "source")
-	dataPath := filepath.Join(dataDir, "data.bin")
-	storeDir := t.TempDir()
-	secondDBPath := filepath.Join(tempDir, "second.sqlite")
-
-	chunkSize := int64(64 * 1024)
-	maxBlobSize := int64(512 * 1024)
-
-	require.NoError(t, fs.MkdirAll(dataDir, 0o755))
-	require.NoError(t, afero.WriteFile(fs, dataPath,
-		bytesPattern("key-", int(chunkSize)), 0o644))
-
-	ctx := context.Background()
-
-	runFileStorageBackup(ctx, t, fs, dataDir, storeDir,
-		filepath.Join(tempDir, "first.sqlite"), chunkSize, maxBlobSize)
-
-	env := setupDedupBackupEnv(
-		ctx, t, fs, storeDir, secondDBPath, chunkSize, maxBlobSize)
-
-	defer func() { _ = env.db.Close() }()
-
-	addedKey, err := age.GenerateX25519Identity()
-	require.NoError(t, err)
-
-	env.cfg.AgeRecipients = append(env.cfg.AgeRecipients,
-		addedKey.Recipient().String())
-
-	snapshotID, result := runDedupSnapshot(ctx, t, env.sm, env.makeScanner(),
-		env.cfg.Hostname, "second", dataDir, secondDBPath)
-	require.Zero(t, result.BlobsUploaded,
-		"the second backup should reuse the stored blob")
-
-	require.NoError(t, env.db.Close())
-
-	blobKeys, err := env.storer.List(ctx, "blobs/")
-	require.NoError(t, err)
-	require.Len(t, blobKeys, 1)
-
-	blobHash := path.Base(blobKeys[0])
-
-	env.cfg.AgeSecretKey = addedKey.String()
-
-	v := &vaultik.Vaultik{
-		Config:  env.cfg,
-		Storage: env.storer,
-		Fs:      fs,
-		Stdout:  io.Discard,
-		Stderr:  io.Discard,
-		UI:      ui.NewWithColor(io.Discard, false),
-	}
-	v.SetContext(ctx)
-
-	const sentence = "cannot decrypt this blob: the private key in " +
-		"age_secret_key is not one of the keys the blob was encrypted to"
-
-	// Restore names the blob by the first 16 characters of its hash.
-	err = v.Restore(&vaultik.RestoreOptions{
-		SnapshotID: snapshotID,
-		TargetDir:  t.TempDir(),
-	})
-	require.EqualError(t, err, "restoring "+dataPath+": downloading blob "+
-		blobHash[:16]+": "+sentence+
-		" (pass --skip-errors to continue past restore failures)")
-
-	err = v.RunDeepVerify(snapshotID, &vaultik.VerifyOptions{Deep: true})
-	require.EqualError(t, err,
-		"blob "+blobHash+" verification failed: "+sentence)
-}

internal/vaultik/snapshot.go

@@ -115,9 +115,14 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 		"index_path", v.Config.IndexPath,
 	)
 
+	err := v.EnsureStorageBinding()
+	if err != nil {
+		return err
+	}
+
 	// Before PruneDatabase: it drops incomplete snapshots, which could
 	// leave the local index without one and so skip the marker check.
-	err := v.markDestination()
+	err = v.markDestination()
 	if err != nil {
 		return err
 	}
@@ -744,7 +749,7 @@ type SnapshotPurgeOptions struct {
 // snapshot name, not the latest globally. This prevents `home` and `system`
 // snapshots from cannibalizing each other.
 func (v *Vaultik) PurgeSnapshotsWithOptions(opts *SnapshotPurgeOptions) error {
-	err := v.checkStorageBinding()
+	err := v.EnsureStorageBinding()
 	if err != nil {
 		return err
 	}
@@ -959,22 +964,25 @@ func (v *Vaultik) VerifySnapshotWithOptions(
 		Mode:       "shallow",
 	}
 
-	// The key is kept so we can also check for the snapshot's encrypted
-	// database below.
+	v.printVerifyHeader(snapshotID, opts)
+
+	// Resolve the identifier to the snapshot's remote key. A human ID is
+	// hashed; a remote key (or its abbreviation, as printed for a
+	// remote-only snapshot) is used as-is, so a host with no local index
+	// can verify a snapshot it can only see on the store. The key is kept
+	// so we can also check for the snapshot's encrypted database below.
 	remoteKey, err := v.resolveSnapshotRemoteKey(snapshotID)
 	if err != nil {
 		if opts.JSON {
 			result.Status = verifyStatusFailed
-			result.ErrorMessage = err.Error()
+			result.ErrorMessage = fmt.Sprintf("resolving snapshot identifier: %v", err)
 
 			return v.outputVerifyJSON(result)
 		}
 
-		return err
+		return fmt.Errorf("resolving snapshot identifier: %w", err)
 	}
 
-	v.printVerifyHeader(snapshotID, opts)
-
 	manifest, err := v.downloadManifestByKey(remoteKey)
 	if err != nil {
 		if opts.JSON {
@@ -1272,7 +1280,7 @@ func (v *Vaultik) outputVerifyJSON(result *VerifyResult) error {
 // jq` fail (issue #108). The narration is duplicated as log records,
 // which go to stderr and so cannot corrupt the document.
 func (v *Vaultik) CleanupLocalSnapshots(opts *PruneOptions) error {
-	err := v.checkStorageBinding()
+	err := v.EnsureStorageBinding()
 	if err != nil {
 		return err
 	}
@@ -1462,12 +1470,12 @@ func (v *Vaultik) RemoveSnapshot(
 		SnapshotID: snapshotID,
 	}
 
-	err := v.checkStorageBinding()
+	err := v.EnsureStorageBinding()
 	if err != nil {
 		return result, err
 	}
 
-	inLocalIndex, err := v.checkSnapshotExists(snapshotID, opts.LocalOnly)
+	inLocalIndex, err := v.findSnapshotToRemove(snapshotID, opts)
 	if err != nil {
 		return result, err
 	}
@@ -1530,20 +1538,17 @@ func (v *Vaultik) RemoveSnapshot(
 	return result, nil
 }
 
-// checkSnapshotExists returns errSnapshotNotFound when the local index
-// has no row for snapshotID and, unless localOnly is set, the
-// destination store has no metadata for it either. inLocalIndex reports
-// whether the local index has that row. The destination store is
-// consulted only when the local index has no row, so a snapshot in the
-// local index can still be removed from it while the destination store
-// is unreachable, and only after checkDestinationMarker passes, so an
-// unplugged volume's empty mount point is not taken for a store without
-// the snapshot.
-//
-//nolint:nonamedreturns // the result name says what the bool means
-func (v *Vaultik) checkSnapshotExists(
-	snapshotID string, localOnly bool,
-) (inLocalIndex bool, err error) {
+// findSnapshotToRemove reports whether the local index has a row for
+// snapshotID, and returns errSnapshotNotFound when there is nothing to
+// remove: no row and, unless LocalOnly is set, no metadata on the
+// destination store either. The destination store is consulted only
+// when the local index has no row, so a snapshot in the local index can
+// still be removed from it while the destination store is unreachable,
+// and only after checkDestinationMarker passes, so an unplugged volume's
+// empty mount point is not taken for a store without the snapshot.
+func (v *Vaultik) findSnapshotToRemove(
+	snapshotID string, opts *RemoveOptions,
+) (bool, error) {
 	if v.Repositories != nil {
 		snap, err := v.Repositories.Snapshots.GetByID(v.ctx, snapshotID)
 		if err != nil {
@@ -1555,12 +1560,12 @@ func (v *Vaultik) checkSnapshotExists(
 		}
 	}
 
-	if localOnly {
+	if opts.LocalOnly {
 		return false, fmt.Errorf("%w in the local index: %s",
 			errSnapshotNotFound, snapshotID)
 	}
 
-	err = v.checkDestinationMarker()
+	err := v.checkDestinationMarker()
 	if err != nil {
 		return false, err
 	}
@@ -1702,7 +1707,7 @@ func (v *Vaultik) removeSnapshotRemote(
 // before it removes anything when the destination store cannot be
 // listed or is not present by checkDestinationMarker.
 func (v *Vaultik) RemoveAllSnapshots(opts *RemoveOptions) (*RemoveResult, error) {
-	err := v.checkStorageBinding()
+	err := v.EnsureStorageBinding()
 	if err != nil {
 		return nil, err
 	}

internal/vaultik/snapshot_identifier.go

@@ -28,9 +28,8 @@ var (
 // Two forms are accepted, matching the two things a host can know:
 //
 //   - A human snapshot ID (hostname_name_timestamp), which a host holding
-//     the local index has. It is hashed to its remote key. An ID that
-//     names no snapshot in the local index or on the destination store
-//     is an error (see checkSnapshotExists).
+//     the local index has. It is hashed to its remote key; the store is
+//     not consulted.
 //   - A remote key, or the leading part of one, which is all a host with
 //     no local index can know — it is exactly what `snapshot list` prints
 //     for a remote-only snapshot (see formatRemoteOnlyID). It is resolved
@@ -42,11 +41,6 @@ var (
 // RFC3339 timestamp).
 func (v *Vaultik) resolveSnapshotRemoteKey(identifier string) (string, error) {
 	if !isRemoteKeyOrPrefix(identifier) {
-		_, err := v.checkSnapshotExists(identifier, false)
-		if err != nil {
-			return "", err
-		}
-
 		return snapshot.RemoteSnapshotKey(identifier), nil
 	}
 

internal/vaultik/storage_bind.go

@@ -13,30 +13,35 @@ import (
 var errStorageBindingMismatch = errors.New(
 	"local index is bound to a different backup destination")
 
-// checkStorageBinding refuses when the local index database is bound to
-// a different destination than the configured one, with an error that
-// tells the user how to recover (revert the config, or run `vaultik
-// database delete`). Every mutating command calls it before touching
-// either the local index or the destination store, because the two live
-// in lockstep: the local index records which chunks/blobs already exist
-// at the destination, and a mismatched pair produces silent corruption
-// (the scanner sees "known" chunks and skips uploads, then writes
-// snapshots whose manifests reference blobs that aren't on the new
-// destination).
+// EnsureStorageBinding guarantees that the local index database is
+// bound to the currently-configured storage destination. Every mutating
+// command must call this before touching either the local index or the
+// destination store, because the two live in lockstep: the local index
+// records which chunks/blobs already exist at the destination, and
+// mismatched destination + local index produces silent corruption (the
+// scanner sees "known" chunks and skips uploads, then writes snapshots
+// whose manifests reference blobs that aren't on the new destination).
 //
-// It records nothing. Only a backup binds the local index, through
-// EnsureStorageBinding, and it does so before adding anything to it. An
-// unbound local index therefore holds nothing from any destination.
+// Behaviour:
+//   - On first use (empty stored value), record the configured
+//     destination (storage_url, or the s3.* endpoint, bucket and
+//     prefix) and log the binding.
+//   - When the stored value matches the configured destination, do
+//     nothing and return nil.
+//   - When the two differ, refuse with an error that tells the user
+//     how to recover (revert the config, or run `vaultik database
+//     delete` to discard the local index and rebuild against the new
+//     destination on the next backup).
 //
 // Read-only inspection commands (remote info, snapshot list, etc.)
 // deliberately don't call this: they can be run against a bare
 // destination store without any binding state.
-func (v *Vaultik) checkStorageBinding() error {
+func (v *Vaultik) EnsureStorageBinding() error {
 	if v.Repositories == nil || v.Config == nil {
 		// NewForTesting builds a Vaultik with no DB or config;
-		// there's no binding to check. Callers exercising the bind
-		// path use a real DB and populate Config explicitly (see
-		// storage_bind_test.go).
+		// there's nothing to bind and no binding to check. Callers
+		// exercising the bind path use a real DB and populate Config
+		// explicitly (see storage_bind_test.go).
 		return nil
 	}
 
@@ -45,24 +50,6 @@ func (v *Vaultik) checkStorageBinding() error {
 		return err
 	}
 
-	if stored == "" || stored == configured {
-		return nil
-	}
-
-	return fmt.Errorf("%w\n%s",
-		errStorageBindingMismatch, buildBindingMismatchMessage(stored, configured))
-}
-
-// EnsureStorageBinding records the configured destination (storage_url,
-// or the s3.* endpoint, bucket and prefix) as the binding of an unbound
-// local index. It refuses as checkStorageBinding does when the local
-// index is bound to a different destination.
-func (v *Vaultik) EnsureStorageBinding() error {
-	stored, configured, err := v.storageBinding()
-	if err != nil {
-		return err
-	}
-
 	if stored == "" {
 		err = v.Repositories.LocalMeta.Set(
 			v.ctx, database.LocalMetaKeyStorageURL, configured)
@@ -75,12 +62,12 @@ func (v *Vaultik) EnsureStorageBinding() error {
 		return nil
 	}
 
-	if stored != configured {
-		return fmt.Errorf("%w\n%s",
-			errStorageBindingMismatch, buildBindingMismatchMessage(stored, configured))
+	if stored == configured {
+		return nil
 	}
 
-	return nil
+	return fmt.Errorf("%w\n%s",
+		errStorageBindingMismatch, buildBindingMismatchMessage(stored, configured))
 }
 
 // storageBinding returns the destination the local index is bound to

internal/vaultik/storage_bind_test.go

@@ -2,7 +2,6 @@ package vaultik_test
 
 import (
 	"context"
-	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -10,126 +9,9 @@ import (
 	"sneak.berlin/go/vaultik/internal/config"
 	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/storage"
-	"sneak.berlin/go/vaultik/internal/storage/faultstore"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
-// storageBindingOf returns the destination the local index is bound to,
-// or "" when it is not bound.
-func storageBindingOf(
-	ctx context.Context, t *testing.T, repos *database.Repositories,
-) string {
-	t.Helper()
-
-	got, err := repos.LocalMeta.Get(ctx, database.LocalMetaKeyStorageURL)
-	require.NoError(t, err)
-
-	return got
-}
-
-// TestFailedFirstBackupLeavesIndexUnbound checks that a first backup
-// the destination refuses, as a mistyped bucket would, leaves the local
-// index unbound, so a backup with the corrected destination succeeds.
-func TestFailedFirstBackupLeavesIndexUnbound(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := t.TempDir()
-	v, repos := newFileDestinationVaultik(ctx, t, storeDir)
-	working := v.Storage
-
-	refusing := faultstore.New(working)
-	refusing.OnPut = func(string) faultstore.PutAction { return faultstore.PutFail }
-	refusing.OnStat = func(string) bool { return true }
-	v.Storage = refusing
-	v.Config.StorageURL = "file://" + filepath.Join(t.TempDir(), "typo")
-
-	require.ErrorIs(t, backUp(v, "first"), faultstore.ErrInjectedUpload)
-	assert.Empty(t, storageBindingOf(ctx, t, repos))
-
-	v.Storage = working
-	v.Config.StorageURL = "file://" + storeDir
-
-	require.NoError(t, backUp(v, "first"))
-	assert.Equal(t, "file://"+storeDir, storageBindingOf(ctx, t, repos))
-}
-
-// TestBackupToOtherDestinationWritesNoMarker checks that a backup
-// refuses a local index bound to a different destination before it
-// writes the marker to the configured one.
-func TestBackupToOtherDestinationWritesNoMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	firstDir := t.TempDir()
-	v, _ := newFileDestinationVaultik(ctx, t, firstDir)
-	v.Config.StorageURL = "file://" + firstDir
-
-	require.NoError(t, backUp(v, "first"))
-
-	secondDir := t.TempDir()
-	secondStore, err := storage.NewFileStorer(secondDir)
-	require.NoError(t, err)
-
-	v.Storage = secondStore
-	v.Config.StorageURL = "file://" + secondDir
-
-	require.ErrorContains(t, backUp(v, "first"),
-		"local index is bound to a different backup destination")
-	assert.NoFileExists(t, filepath.Join(secondDir, markerFile))
-}
-
-// TestCommandsOtherThanBackupLeaveIndexUnbound checks that commands
-// other than a backup do not bind an unbound local index, whether or not
-// they fail. Each runs on a fresh local index.
-func TestCommandsOtherThanBackupLeaveIndexUnbound(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		run  func(v *vaultik.Vaultik) error
-	}{
-		{"prune", func(v *vaultik.Vaultik) error {
-			return v.Prune(&vaultik.PruneOptions{Force: true})
-		}},
-		{"snapshot purge", func(v *vaultik.Vaultik) error {
-			return v.PurgeSnapshotsWithOptions(
-				&vaultik.SnapshotPurgeOptions{KeepLatest: true, Force: true})
-		}},
-		{"snapshot remove", func(v *vaultik.Vaultik) error {
-			_, err := v.RemoveSnapshot("host_first_2026-01-02T03:04:05Z",
-				&vaultik.RemoveOptions{Force: true})
-
-			return err
-		}},
-		{"snapshot remove --all", func(v *vaultik.Vaultik) error {
-			_, err := v.RemoveAllSnapshots(&vaultik.RemoveOptions{Force: true})
-
-			return err
-		}},
-		{"remote nuke", func(v *vaultik.Vaultik) error {
-			return v.NukeRemote(true)
-		}},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			v, repos := newFileDestinationVaultik(ctx, t, t.TempDir())
-
-			_ = tt.run(v)
-
-			assert.Empty(t, storageBindingOf(ctx, t, repos))
-		})
-	}
-}
-
 // buildBindTestVaultik returns a minimal Vaultik wired with a real
 // in-memory DB and a config carrying the given StorageURL. Enough to
 // exercise EnsureStorageBinding without spinning up storage or fx.

internal/vaultik/unknown_snapshot_test.go

@@ -1,62 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/config"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// TestUnknownSnapshotID checks that restore and verify, given an ID that
-// names no snapshot in the local index or on the destination store, say
-// so in the words `snapshot remove` uses and print nothing else.
-func TestUnknownSnapshotID(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	const unknownID = "host1_home_2026-01-01T00:00:00Z"
-
-	commands := map[string]func(v *vaultik.Vaultik) error{
-		"restore": func(v *vaultik.Vaultik) error {
-			return v.Restore(&vaultik.RestoreOptions{
-				SnapshotID: unknownID,
-				TargetDir:  t.TempDir(),
-			})
-		},
-		"verify": func(v *vaultik.Vaultik) error {
-			return v.VerifySnapshotWithOptions(unknownID, &vaultik.VerifyOptions{})
-		},
-		"verify --deep": func(v *vaultik.Vaultik) error {
-			return v.VerifySnapshotWithOptions(unknownID,
-				&vaultik.VerifyOptions{Deep: true})
-		},
-	}
-
-	for name, run := range commands {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			store := newTestStorer()
-			addManifest(t, store, "snapshot-001", nil)
-
-			// A backup wrote to this destination, so it carries the marker.
-			require.NoError(t, store.Put(context.Background(), markerFile,
-				bytes.NewReader(nil)))
-
-			tv := vaultik.NewForTesting(store)
-			tv.Config = &config.Config{AgeSecretKey: testAgeSecretKey}
-			tv.Repositories = newLocalIndex(t, "snapshot-001")
-
-			err := run(tv.Vaultik)
-
-			require.EqualError(t, err, "snapshot not found in the local "+
-				"index or on the destination store: "+unknownID)
-			assert.Empty(t, tv.Stdout.String())
-		})
-	}
-}

internal/vaultik/verify.go

@@ -120,17 +120,12 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 
 	log.Info("Starting snapshot verification", "snapshot_id", snapshotID, "mode", "deep")
 
-	remoteKey, err := v.resolveSnapshotRemoteKey(snapshotID)
-	if err != nil {
-		return v.deepVerifyFailure(result, opts, err.Error(), err)
-	}
-
 	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("Deep verification of snapshot: %s\n\n", snapshotID)
 	}
 
 	manifest, tempDB, dbBlobs, err := v.loadVerificationData(
-		snapshotID, remoteKey, opts, result, identities)
+		snapshotID, opts, result, identities)
 	if err != nil {
 		return err
 	}
@@ -175,13 +170,21 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 	return nil
 }
 
-// loadVerificationData downloads manifest, database, and blob list for
-// verification of the snapshot at remoteKey, which
-// resolveSnapshotRemoteKey returned for snapshotID.
+// loadVerificationData downloads manifest, database, and blob list for verification
 func (v *Vaultik) loadVerificationData(
-	snapshotID, remoteKey string, opts *VerifyOptions, result *VerifyResult,
+	snapshotID string, opts *VerifyOptions, result *VerifyResult,
 	identities []age.Identity,
 ) (*snapshot.Manifest, *tempDB, []snapshot.BlobInfo, error) {
+	// Resolve the identifier to the snapshot's remote key. A human ID is
+	// hashed; a remote key (or its abbreviation, as printed for a
+	// remote-only snapshot) is used as-is, so a host with no local index
+	// can verify a snapshot it can only see on the store.
+	remoteKey, err := v.resolveSnapshotRemoteKey(snapshotID)
+	if err != nil {
+		return nil, nil, nil, v.deepVerifyFailure(result, opts,
+			fmt.Sprintf("resolving snapshot identifier: %v", err), err)
+	}
+
 	// Download manifest. downloadManifestByKey is the single reader for
 	// remote manifests; see its doc comment.
 	log.Info("Downloading manifest", "remote_key", remoteKey)
@@ -264,10 +267,6 @@ func (v *Vaultik) downloadVerifiedSnapshotDB(
 	defer func() { _ = dbReader.Close() }()
 
 	tdb, err := v.decryptAndLoadDatabase(dbReader, identities)
-	if errors.Is(err, errWrongPrivateKey) {
-		return nil, v.deepVerifyFailure(result, opts, err.Error(), err)
-	}
-
 	if err != nil {
 		return nil, v.deepVerifyFailure(result, opts,
 			fmt.Sprintf("failed to decrypt database: %v", err),
@@ -352,9 +351,9 @@ func (v *Vaultik) decryptAndLoadDatabase(
 	reader io.ReadCloser, identities []age.Identity,
 ) (*tempDB, error) {
 	// Decrypt and decompress through the shared blobgen reader.
-	blobReader, err := v.newSnapshotDBReader(reader, identities)
+	blobReader, err := blobgen.NewReader(reader, identities...)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to create decryption reader: %w", err)
 	}
 
 	defer func() { _ = blobReader.Close() }()
@@ -427,11 +426,7 @@ func (v *Vaultik) verifyBlob(
 	// the plaintext as it is read. A blob's hash — its remote name — is the
 	// double SHA-256 of that plaintext (see blobgen.DoubleSHA256), not of the
 	// encrypted bytes.
-	blobReader, err := v.newBlobReader(reader, identities)
-	if errors.Is(err, errWrongPrivateKeyForBlob) {
-		return err
-	}
-
+	blobReader, err := blobgen.NewReader(reader, identities...)
 	if err != nil {
 		return fmt.Errorf("failed to create blob reader: %w", err)
 	}

script/version

@@ -11,8 +11,8 @@
 # when no tag is reachable, each with a "-dirty" suffix when tracked
 # files have uncommitted changes. Untracked files are ignored: a stray
 # scratch file does not change what was compiled. Outside a git checkout
-# (such as an unpacked release tarball), or in one with no commits, it
-# is "dev".
+# (release tarball, `go install`), or in one with no commits, it is
+# "dev".
 #
 # Nothing here ever invents a version number.
 set -eu