feat: pure-Go SQLCipher encryption (zero modernc dep) - #2
Open
zeekay wants to merge 2 commits into
Open
Conversation
The !cgo backend now ENCRYPTS at rest, byte-compatible with C SQLCipher, via a
vendored pure-Go SQLite engine + the hanzoai/sqlcipher codec VFS. Both backends
encrypt in the same SQLCipher-4 format; a DB written by one opens under the other.
- internal/: fork of modernc.org/{sqlite,libc,memory,mathutil} (v1.53.0, SQLite
3.53.2), arch-trimmed to {linux,darwin}x{amd64,arm64}, imports rewritten into
the hanzo namespace. go list -m all shows ZERO modernc.org/*.
- internal/engine/vfs/codec.go: read-write, os-backed codec VFS applying the
hanzoai/sqlcipher page format. Zeros the reserve on decrypt (WAL checksum
invariant), in-process heap wal-index (shm), single-writer. Fail-closed on
wrong key / tampered page; refuses rollback journals (WAL-only).
- driver_nocgo.go: EncryptionAvailable()=true; keyed OpenDB opens through the
codec VFS, creates via an in-memory journal then converts to WAL, unregisters
the VFS (and wipes the DEK) on sql.DB.Close.
- driver_cgo.go: migrated mattn/go-sqlite3 -> hanzoai/csqlite (no mattn dep).
- Engine patches: _reserve_bytes fcntl, Connector accessor.
- Tests (CGO=0): keyed encrypt+WAL round-trip+reopen, opens a C-written fixture,
byte-compat both ways, wrong-key fail-closed.
v0.3.0 -> v0.3.1
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Restores the named API removed on the self-containment branch so replicate,
Base, and base-ha migrate off modernc.org/sqlite with zero code churn — each is
one tag-neutral file + engine(!cgo)/csqlite(cgo) halves, so the same calls run
under both backends:
- OpenPragma / Pragma / PragmaDSN — per-connection pragmas (the only
backend-neutral way to set wal_autocheckpoint=0; csqlite drops it from the DSN)
- SetPersistWAL — SQLITE_FCNTL_PERSIST_WAL, WAL-shipping replication needs the
-wal retained across close
- HookRegisterer / CommitHookFn / CommitHookRegisterer — CommitHookFn ALIASES the
engine's under !cgo, so a raw-conn driverConn.(sqlite.HookRegisterer) assertion
(Hanzo Base) works with no bridge
- Driver / ConnectionHookFn / ExecQuerierContext / RegisterConnectionHook —
re-exports of the pure-Go engine's connection-hook feature so litesql/go-sqlite-ha
(base-ha) migrates without importing internal packages
- IsConstraint{Unique,PrimaryKey,ForeignKey}
Adds TestConcurrentCheckpointUnderLoad as the verification bar for concurrent
checkpoint locking. The vendored engine (SQLite 3.53.2) blocks correctly on
busy_timeout (a checkpoint waits out a 700ms-held writer lock then truncates).
replicate's flaky TestDB_CheckpointPageGapWithConcurrentWrites is a harness race
(its writer has no busy_timeout and hammers), NOT a version regression: clean
serial pass rate is fork 9/12 == modernc v1.44.3 9/12, > v1.48.0 7/12. Basing on
v1.44.3 does not fix it and would downgrade the SQLite.
Zero modernc.org/* in the module graph. Both backends build; full suite green.
Member
Author
Update: restored drop-in named API + concurrent-checkpoint bar (v0.3.2, commit f2b15d9)The self-containment branch had removed the named API that downstream consumers depend on. Restored it (backend-neutral: one tag-neutral file + engine(!cgo)/csqlite(cgo) halves) so replicate, Base, and base-ha migrate off
Concurrent-checkpoint regression — root-caused, evidence-backedAdded Finding: replicate's flaky
Recommend replicate set |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pure-Go (CGO_ENABLED=0) backend now ENCRYPTS at rest, byte-compatible with C SQLCipher, via a vendored pure-Go SQLite engine (fork of modernc v1.53.0 in internal/, zero modernc.org/* modules) + the hanzoai/sqlcipher codec VFS. Both backends encrypt the same SQLCipher-4 format; a DB written by one opens under the other. CGO backend migrated mattn/go-sqlite3 -> hanzoai/csqlite. Tests (CGO=0): keyed encrypt+WAL round-trip+reopen, opens a C-written fixture, byte-compat both ways, wrong-key fail-closed. Caveats: keyed DBs are single-writer single-process (in-process wal-index); WAL cross-engine hot-recovery with C not byte-compatible (checkpointed main DBs are). Tag v0.3.1.