The local index lists every backed-up path and chunk hash, but its file mode was left to the SQLite driver and the umask. Under a typical 022 umask a fresh index — and the -wal/-shm files SQLite creates alongside it — landed world-readable, and the snapshot export copied the index to snapshot.db with the same permissive default.
What changed
provideDatabase now calls a new ensureIndexFileMode before opening the driver: it creates the index 0600 if missing and chmods an existing one to 0600, failing explicitly on error.
The export copy in snapshot.copyFile is now created 0600 via OpenFile instead of the umask-dependent Create.
What the diff does not show
The ordering is load-bearing: SQLite gives its -wal and -shm side files the mode of the main database file, so the mode must be set on the main file before the driver opens it — hence pre-creating the file in provideDatabase rather than chmodding after New. SQLite treats the resulting zero-byte file as an empty database, so pre-creating it is safe.
copyFile has a single production caller (the export), so tightening it there does not affect anything else.
Tests run under umask 022 and assert 0600 for a fresh index, an existing 0644 index in a 0755 directory, and the export copy. They use //nolint:paralleltest because syscall.Umask is process-global.
make check passes.
Model: opus-4-8
Closes https://git.eeqj.de/sneak/vaultik/issues/168.
The local index lists every backed-up path and chunk hash, but its file mode was left to the SQLite driver and the umask. Under a typical 022 umask a fresh index — and the `-wal`/`-shm` files SQLite creates alongside it — landed world-readable, and the snapshot export copied the index to `snapshot.db` with the same permissive default.
## What changed
- `provideDatabase` now calls a new `ensureIndexFileMode` before opening the driver: it creates the index `0600` if missing and chmods an existing one to `0600`, failing explicitly on error.
- The export copy in `snapshot.copyFile` is now created `0600` via `OpenFile` instead of the umask-dependent `Create`.
## What the diff does not show
The ordering is load-bearing: SQLite gives its `-wal` and `-shm` side files the mode of the main database file, so the mode must be set on the main file *before* the driver opens it — hence pre-creating the file in `provideDatabase` rather than chmodding after `New`. SQLite treats the resulting zero-byte file as an empty database, so pre-creating it is safe.
`copyFile` has a single production caller (the export), so tightening it there does not affect anything else.
Tests run under umask 022 and assert `0600` for a fresh index, an existing `0644` index in a `0755` directory, and the export copy. They use `//nolint:paralleltest` because `syscall.Umask` is process-global.
`make check` passes.
Model: opus-4-8
The local index lists every backed-up path and chunk hash, but its file
mode was left to the SQLite driver and the umask, so under a typical 022
umask a fresh index (and its -wal/-shm side files) landed world-readable.
The snapshot export copied the index to snapshot.db with a permissive
create as well.
provideDatabase now calls ensureIndexFileMode before opening the driver:
it creates the index 0600 if missing and chmods an existing one to 0600.
Doing this before the driver opens the file matters because SQLite gives
its -wal and -shm files the mode of the main database file. The export
copy is now created 0600 instead of via the umask-dependent default.
Tests under umask 022 cover a fresh index, an existing 0644 index in a
0755 directory, and the export copy, asserting each ends up 0600.
Model: opus-4-8
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #168.
The local index lists every backed-up path and chunk hash, but its file mode was left to the SQLite driver and the umask. Under a typical 022 umask a fresh index — and the
-wal/-shmfiles SQLite creates alongside it — landed world-readable, and the snapshot export copied the index tosnapshot.dbwith the same permissive default.What changed
provideDatabasenow calls a newensureIndexFileModebefore opening the driver: it creates the index0600if missing and chmods an existing one to0600, failing explicitly on error.snapshot.copyFileis now created0600viaOpenFileinstead of the umask-dependentCreate.What the diff does not show
The ordering is load-bearing: SQLite gives its
-waland-shmside files the mode of the main database file, so the mode must be set on the main file before the driver opens it — hence pre-creating the file inprovideDatabaserather than chmodding afterNew. SQLite treats the resulting zero-byte file as an empty database, so pre-creating it is safe.copyFilehas a single production caller (the export), so tightening it there does not affect anything else.Tests run under umask 022 and assert
0600for a fresh index, an existing0644index in a0755directory, and the export copy. They use//nolint:paralleltestbecausesyscall.Umaskis process-global.make checkpasses.Model: opus-4-8
PASS
Model: opus-4-8