Tags: lemonsaurus/blackbox
Tags
Add password-based encryption for backup files (#179) * ✨ feat: add password-based encryption support for backup files This adds optional password-based encryption for backup files using GPG symmetric encryption. The feature supports global and per-storage configuration, integrates with the existing compression workflow, and includes secure cleanup of temporary encrypted files. Key changes: - Add EncryptionHandler class with GPG-based password encryption - Integrate encryption workflow into storage base class and S3 handler - Add encryption configuration options to config schema - Include comprehensive test coverage with mocked GPG calls - Update dependencies to support encryption requirements The implementation uses GPG command-line tool for reliable AES256 encryption with compression, avoiding complex PGP library dependencies while maintaining security best practices. * 🔒 security: fix critical password exposure and encryption workflow - Fix password exposure in command line by using --passphrase-fd instead of --passphrase - Fix encryption workflow to encrypt compressed files, not original files - Add proper cleanup of temporary files in S3 handler - Add test coverage for compression + encryption workflow - Ensure encrypted filenames are correctly generated (.gz.gpg) * 🚀 improvement: replace GPG dependency with Python cryptography - Remove system GPG dependency requirement - Use Python's cryptography library (Fernet) for encryption - Built-in compression + encryption in single step - Files now use .enc extension instead of .gpg - Consistent key derivation using PBKDF2 with 100k iterations - No external dependencies required - uses existing cryptography lib - Comprehensive test coverage for new implementation - Update config examples to remove GPG reference * 🔧 fix: add missing cryptography dependency This fixes CI test failures by adding the cryptography library to pyproject.toml dependencies. The library is required for the new password-based encryption functionality but was accidentally omitted from the dependency list. * 🛠️ improve: code quality improvements from review - Move tempfile import to top of s3.py for better organization - Improve exception handling in encryption.py with specific error types - Add comprehensive documentation about fixed salt security limitation - Include security warnings in configuration documentation - Enhanced class docstring with security notes and implementation details These changes address code review feedback while maintaining backward compatibility. * 🔒 improve: strengthen password validation and enhance code quality - Increase minimum password length from 8 to 14 characters - Remove symbols requirement, require 2 of 3 complexity types (upper/lower/numbers) - Replace broad exception handling with specific exception types - Add comprehensive type hints throughout encryption module - Refactor complex S3 file processing logic into helper methods - Add dedicated password validation tests with edge cases - Update all existing tests to use stronger passwords * 🐛 fix: address PR review comments from @jchristgit - Change log.error to use exc_info parameter for better logging with tracebacks - Fix S3 file handling to avoid double-close issues and use context managers - Add explicit raise for unknown encryption methods to fix type hint accuracy - Use 'raise from e' to preserve original tracebacks in exception chains - Use contextlib.suppress for cleaner cleanup operations - Clarify cleanup_temp_file docstring about encrypted file handling - Add comprehensive exception chaining tests * ♻️ refactor: consolidate exception handlers to reduce cyclomatic complexity - Merge 4 similar exception handlers into a single handler with type checking - Reduces cyclomatic complexity while maintaining specific error messages - Preserves exception chaining and cleanup behavior - Add comprehensive tests to verify all exception types are handled correctly - Addresses PR review feedback about high cyclomatic complexity * 📝 improve: clean up and streamline code comments - Made comments more concise and professional throughout codebase - Removed redundant and self-evident comments that didn't add value - Kept verbose documentation for genuinely complex or surprising behavior - Added strategic bookmarks to make code more skimmable - Reduced emoji usage to only the most helpful instances with proper spacing - All tests pass and linting is clean * 🔧 fix: address unreachable else clause in encrypt_file method Address @jchristgit's review comment about the unreachable else clause in the encrypt_file method. While the else clause was technically unreachable due to __init__ validation, it's kept for type safety and defensive programming, with a clarifying comment. The type hint remains accurate as the method can raise ValueError for unknown encryption methods (even if only reachable through direct property manipulation in tests). Addresses: #179 (comment) * 🔧 fix: remove whitespace in blank line * ✨ feat: add backup decryption functionality with CLI and manual options Add comprehensive decryption support for encrypted backup files: - Add decrypt_file method to EncryptionHandler with robust error handling - Restructure CLI to support subcommands (backup, decrypt) with backward compatibility - Add decrypt command with password prompting and custom output paths - Add comprehensive test coverage for all decryption scenarios - Update README with encryption section including CLI usage and manual Python decryption Users can now decrypt backups via 'blackbox decrypt file.enc' or using the provided Python code snippet. * 💄 style: remove trailing whitespace and improve code formatting Clean up trailing whitespace across CLI, encryption utilities, and tests. Also improve line length compliance in encryption error messages.
Default to x86_64 for mongotools A recent change made to support arm64 has broken mongodb backups for users on amd64 architecture. This is because mongotools has no file named [...]-ubuntu2004-amd64-100.6.1.deb. This file is actually called [...]-ubuntu2004-x86_64-100.6.1.deb. This change will make x86_64 the default architecture, and will only switch to arm64 (which does exist) if umode -m returns arm64 or aarch64.
PreviousNext