56 lines
2.5 KiB
Markdown
56 lines
2.5 KiB
Markdown
# M11 recovery import evidence
|
|
|
|
- Recovery bundles use the existing versioned `BTREC` Argon2id/AES-GCM codec
|
|
and now carry a version-2 authenticated catalog containing repositories,
|
|
key epochs, sources, jobs, executions, and backups required for encrypted
|
|
restore.
|
|
- `backup-tool admin recovery import` requires a migrated empty destination DB,
|
|
re-inspects every surviving repository through configured allowlists, writes
|
|
signing/data keys exclusively with mode `0600`, and rejects conflicts.
|
|
- Imported sources are `unavailable`; imported jobs are `archived` and disabled.
|
|
Imported metadata therefore supports existing restore records without silently
|
|
restarting backup schedules.
|
|
- The focused host-loss drill exports an encrypted backup, imports it into a
|
|
fresh metadata/key host, and restores the file byte-for-byte. It also proves
|
|
unsafe repository paths and non-empty destination metadata are rejected.
|
|
- Encrypted repository creation is enabled only after that drill passed and now
|
|
records its active data-key epoch atomically with repository metadata.
|
|
- Interrupted imports remove newly installed key files on handled failure; a
|
|
retry also safely adopts only exact, authenticated key files left by an
|
|
unclean process loss. Rotation writes an fsynced repository journal before
|
|
its DB transition; worker startup deterministically completes a committed
|
|
epoch transition or removes an uncommitted one while retaining old-active.
|
|
A stale rollback journal is cleared safely even when the unreferenced new key
|
|
was already deleted before the journal cleanup could run.
|
|
- Key-aware GC decrypts encrypted manifests using their declared epoch key and
|
|
remains fail-closed for absent, wrong, or corrupt keys/manifests. Restore
|
|
removes setuid, setgid, and sticky bits from captured modes. Migration 0007
|
|
refuses downgrade while key metadata is populated.
|
|
- Recovery catalog import preserves backup `created_at` and `tombstoned_at`.
|
|
- Snapshot staging roots, per-execution directories, blob directories, and
|
|
plaintext temporary blobs are created owner-only (`0700`/`0600`) independent
|
|
of umask and are rejected if their permissions are unsafe.
|
|
|
|
## Verification
|
|
|
|
```text
|
|
pytest tests/integration/test_encrypted_repository.py -q
|
|
5 passed
|
|
|
|
make test-fault
|
|
11 passed
|
|
|
|
make test-security
|
|
21 passed
|
|
|
|
make lint && make typecheck && make frontend-build
|
|
passed
|
|
|
|
make check
|
|
86 unit/contract, 53 integration, 12 fault, and 22 security tests passed;
|
|
Ruff, mypy, TypeScript, and frontend build passed.
|
|
|
|
git diff --check && git diff --cached --quiet
|
|
passed
|
|
```
|