Repository navigation
Conversation
The remote-content cache, the On This Computer tree, the exported log and the settings bundle were written with umask permissions, and the startup purge cleared /tmp while the Flatpak stages opened attachments in the runtime directory.
cache.db holds every cached message and attachment. It is now SQLCipher under a random key kept in the keyring, an existing cache is encrypted in place, and a missing, wrong or unreachable key asks the user instead of opening anything unencrypted. Settings can turn it off for a computer without a keyring.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on #600 (its first commit is that PR's).
cache.dbholds subjects, bodies, attachments, the Outbox and the search index in plain SQLite. This encrypts it at rest:rusqliteusesbundled-sqlcipher(SQLCipher 4.5.7, linking the runtime's libcrypto;Cargo.lockis unchanged and the manifest needs no edit). The key is 32 random bytes in the keyring (cache-key), passed as a raw key so opening costs no KDF; a new key is read back before anything is encrypted with it.cipher_memory_security = ON, reads once to catch a wrong key, and refuses a connection whose cipher settings differ from the pinned ones.quick_check, schema version, row counts, header), swapped in; any failure leaves the original byte for byte. Rows left in a WAL from a crash come across.Tests: wrong/missing/locked key fail closed with the file unchanged; migration from a plaintext cache with the real schema; no plaintext header or strings on disk; mismatched cipher refused; failed migration untouched; WAL rows survive; decrypt in place; reset. Checked live in a throwaway gnome-keyring under xvfb, and in a local Flatpak build. Not covered:
local_contacts.dbstays plaintext (0600).