sneak/vaultik
1
0
Fork 0
Code Issues 20 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Restore: downloaded blob hash is not verified #5

New Issue
Open
opened 2026-02-08 17:16:20 +01:00 by clawbot · 0 comments
clawbot commented 2026-02-08 17:16:20 +01:00
Collaborator
Copy Link

In restore.go, downloadBlob() calls FetchAndDecryptBlob() and returns the data without verifying that the hash of the downloaded encrypted blob matches the expected blobHash.

If the storage returns corrupted data or the wrong blob, restore will silently produce corrupted output. The blob hash should be verified after download, similar to how verify.go does it with a TeeReader + sha256.

Ref: parent issue #1

In `restore.go`, `downloadBlob()` calls `FetchAndDecryptBlob()` and returns the data without verifying that the hash of the downloaded encrypted blob matches the expected `blobHash`. If the storage returns corrupted data or the wrong blob, restore will silently produce corrupted output. The blob hash should be verified after download, similar to how `verify.go` does it with a `TeeReader` + `sha256`. Ref: parent issue #1
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: sneak/vaultik#5
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?