sneak
8e335008cb
check / check (pull_request) Successful in 2m24s
Restore and deep verify used to open the decrypted snapshot database read-write through the local-index constructor, which applied migrations against whatever the file carried, and left the decrypted file in the shared temp directory. A forged file could redefine what the restore queries return, and an interrupted open left decrypted metadata on disk. Add database.OpenReadOnly: opens the file read-only (mode=ro) with query_only and trusted_schema=OFF, never applies schema files, and refuses any file whose schema carries a trigger, view or virtual table or lacks an expected table. Restore and deep verify now both use it. Each command materializes the database inside its own private (0700) temp directory and removes the whole directory on every return path, so the decrypted file and any SQLite side files are always cleaned up. Deep verify now also checks the error from closing the temp file. pickNextDownload returns (FileID, bool), so a genuine file carrying the nil UUID is no longer mistaken for "nothing left"; runRestoreLoop fails with an error if any file is still pending when it can make no progress. Model: opus-4-8