1
80%
main: 80%

Ran 07 Jun 2026 11:22AM UTC

Files 25

Run time 0s

Badge

Embed ▾

Committed 07 Jun 2026 11:19AM UTC coverage: 79.177% (+2.8%) from 76.336%

Job # 27091041831.1

Build Type

push

github

Committed by

nbari

Commit Message

Add keyed content identifiers and sealed naming key

Harden the catalog for an untrusted-store threat model:

- Derive the X25519 content keypair from the mnemonic via HKDF-SHA256 over
  the full seed (centralized in content_keypair); wrap derived secrets in
  Zeroizing.
- Add a per-backup naming key that keys BLAKE3 content identifiers
  (blake3_keyed), so stored ids are opaque without the key.
- Seal the naming key to the public key in the catalog; cache the plaintext
  in an owner-only {name}.wkey so cron runs stay unattended. Missing cache
  prompts for the mnemonic, unseals, and rewrites it (also a recovery self-test).
- Wire create to generate+seal the naming key and write {name}.wkey; thread
  the naming key through the run scan; resolve/unlock it in the run action.
- Update README security model and tests (38 passing).

Coverage Stats

1654 of 2089 relevant lines covered (79.18%)

7.48 hits per line

nbari / backup / 27091041831 / 1
80%
main: 80%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 27091041831.1

nbari / backup / 27091041831 / 1 80% main: 80%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 27091041831.1

nbari / backup / 27091041831 / 1
80%
main: 80%

README BADGES
x