clawbot bd9656dbd4 Reject a decrypted snapshot database that is not the requested one (closes #156) ...

Restore and deep verify downloaded and decrypted metadata/<key>/db.zst.age by object name alone. age decryption proves the database is readable, not that it is the snapshot that was asked for: an attacker who swaps in another valid db.zst.age could redirect the operation, and deep verify with a swapped database plus an empty manifest reported success with zero blobs verified.

After the database is opened, both paths now confirm its identity: an exported per-snapshot database holds one snapshot row, and a snapshot remote key derives from that row ID, so the database is the requested one exactly when its sole snapshot hashes back to the remote key fetched. The shared check lives in verifySnapshotDBIdentity, backed by a new SnapshotRepository.GetOnlySnapshot.

Model: opus-4-8

2026-09-22 15:01:02 +02:00

..

blob_fetch_hash_test.go

Remove the unused crypto path and write the blob-ID hash step once (closes #151)

2026-09-22 13:46:02 +02:00

blob_fetch.go

Remove the unused crypto path and write the blob-ID hash step once (closes #151)

2026-09-22 13:46:02 +02:00

blobcache_test.go

Finish the lint remediation: script/cibuild exits 0 (closes #61)

2026-08-09 04:25:11 +02:00

blobcache.go

Finish the lint remediation: script/cibuild exits 0 (closes #61)

2026-08-09 04:25:11 +02:00

deep_verify_test.go

Hash the plaintext, not the encrypted bytes, in verify --deep (closes #131)

2026-09-21 20:24:37 +02:00

fault_injection_test.go

Trust only uploaded blobs for deduplication (closes #148)

2026-09-22 10:29:21 +02:00

helpers_test.go

Use one duration parser and fix the --older-than months example (closes #123)

2026-09-21 20:58:30 +02:00

helpers.go

Use one duration parser and fix the --older-than months example (closes #123)

2026-09-21 20:58:30 +02:00

info.go

List remote snapshots without requiring the private key (closes #64)

2026-08-09 07:34:15 +02:00

integration_test.go

Finish the lint remediation: script/cibuild exits 0 (closes #61)

2026-08-09 04:25:11 +02:00

prune_cleanup_test.go

Gate prune's local-cleanup output on --json, and make make build build (closes #108)

2026-08-09 19:53:46 +02:00

prune_count_test.go

Report a prune count that could not be read as unknown, not 0 (closes #96)

2026-09-21 21:41:57 +02:00

prune_manifest_safety_test.go

Fail closed on unreadable manifests instead of losing blobs (closes #157)

2026-09-22 11:45:30 +02:00

prune.go

Fail closed on unreadable manifests instead of losing blobs (closes #157)

2026-09-22 11:45:30 +02:00

purge_local_remote_consistency_test.go

Reconcile purge against remote by hashed key, not human ID (closes #160)

2026-09-22 12:11:49 +02:00

purge_per_name_test.go

Reconcile purge against remote by hashed key, not human ID (closes #160)

2026-09-22 12:11:49 +02:00

remove_snapshot_test.go

Update golangci-lint to v2.12.2 with canonical config (#62)

2026-08-07 23:22:48 +02:00

restore_another_machine_test.go

Accept a remote key for restore and verify, and document it (closes #124)

2026-09-22 01:01:25 +02:00

restore_containment_test.go

Keep restore writes inside the target directory (closes #154)

2026-09-22 11:01:01 +02:00

restore_interrupt_test.go

Wait for the interrupted operation to clean up before exit (closes #159)

2026-09-22 14:00:49 +02:00

restore_locality_test.go

Update golangci-lint to v2.12.2 with canonical config (#62)

2026-08-07 23:22:48 +02:00

restore_perms_test.go

Restore files at 0600 and make the blob hash check unskippable (closes #163)

2026-09-22 11:45:52 +02:00

restore_plan_test.go

Open the downloaded snapshot database read-only, on a private temp dir (closes #162)

2026-09-22 12:45:53 +02:00

restore_plan.go

Open the downloaded snapshot database read-only, on a private temp dir (closes #162)

2026-09-22 12:45:53 +02:00

restore_snapshot_identity_test.go

Reject a decrypted snapshot database that is not the requested one (closes #156)

2026-09-22 15:01:02 +02:00

restore_snapshotdb_test.go

Open the downloaded snapshot database read-only, on a private temp dir (closes #162)

2026-09-22 12:45:53 +02:00

restore_sweeper_integration_test.go

Update golangci-lint to v2.12.2 with canonical config (#62)

2026-08-07 23:22:48 +02:00

restore_sweeper.go

Finish the lint remediation: script/cibuild exits 0 (closes #61)

2026-08-09 04:25:11 +02:00

restore.go

Reject a decrypted snapshot database that is not the requested one (closes #156)

2026-09-22 15:01:02 +02:00

shallow_verify_test.go

Check blob sizes and the database in shallow verify (closes #169)

2026-09-22 14:28:44 +02:00

snapshot_identifier.go

Check blob sizes and the database in shallow verify (closes #169)

2026-09-22 14:28:44 +02:00

snapshot_list_test.go

Suppress the startup banner for --json (closes #106)

2026-08-09 19:18:36 +02:00

snapshot_list.go

Log to stderr and stop discarding With attributes (closes #82)

2026-08-09 18:43:55 +02:00

snapshot_prune_test.go

Update golangci-lint to v2.12.2 with canonical config (#62)

2026-08-07 23:22:48 +02:00

snapshot.go

Check blob sizes and the database in shallow verify (closes #169)

2026-09-22 14:28:44 +02:00

storage_bind_test.go

Update golangci-lint to v2.12.2 with canonical config (#62)

2026-08-07 23:22:48 +02:00

storage_bind.go

Update golangci-lint to v2.12.2 with canonical config (#62)

2026-08-07 23:22:48 +02:00

vaultik.go

Wait for the interrupted operation to clean up before exit (closes #159)

2026-09-22 14:00:49 +02:00

verify_manifest_test.go

Fail closed on unreadable manifests instead of losing blobs (closes #157)

2026-09-22 11:45:30 +02:00

verify.go

Reject a decrypted snapshot database that is not the requested one (closes #156)

2026-09-22 15:01:02 +02:00