Mark/docker_backup
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

No encryption for backups at rest #20

New issue
Closed
opened 2026-05-10 16:06:55 +00:00 by Mark · 11 comments
Mark commented 2026-05-10 16:06:55 +00:00
Owner
Copy link

Description

Backup archives are stored unencrypted.

Impact

Sensitive data in backups is exposed if storage is compromised.

Suggested Fix

Add optional encryption (AES/GPG) for backup archives.

## Description Backup archives are stored unencrypted. ## Impact Sensitive data in backups is exposed if storage is compromised. ## Suggested Fix Add optional encryption (AES/GPG) for backup archives.
Mark commented 2026-05-16 03:43:05 +00:00
Author
Owner
Copy link

Ops Pipeline — No Executable Procedure

Research did not produce any executable commands.

Assessment

IS_OPS: NO

HOST: localhost

STATUS: NOT_OPS

EVIDENCE:

This is a web application (React 19 + TypeScript frontend, Node.js backend) for managing Docker backups. After examining the codebase:

  • The storage interface already defines supportsEncryption as a capability flag
  • BackupStrategy type has encryptionEnabled: boolean
  • The frontend types include encryptionEnabled and encryptionKey
  • However, zero encryption code exists — no AES/GPG implementati
## Ops Pipeline — No Executable Procedure Research did not produce any executable commands. ## Assessment **IS_OPS: NO** **HOST:** localhost **STATUS: NOT_OPS** **EVIDENCE:** This is a web application (React 19 + TypeScript frontend, Node.js backend) for managing Docker backups. After examining the codebase: - The storage interface already defines `supportsEncryption` as a capability flag - `BackupStrategy` type has `encryptionEnabled: boolean` - The frontend types include `encryptionEnabled` and `encryptionKey` - However, **zero encryption code exists** — no AES/GPG implementati
Mark commented 2026-06-20 20:40:50 +00:00
Author
Owner
Copy link

Triage: decompose failed

Triage pipeline could not create a sub-issue for auto-decomposition (API error or repo permissions). Marking this blocked:needs-decision to prevent re-evaluation. Remove the label to retry.

## Triage: decompose failed Triage pipeline could not create a sub-issue for auto-decomposition (API error or repo permissions). Marking this `blocked:needs-decision` to prevent re-evaluation. Remove the label to retry.
Mark commented 2026-08-04 08:07:19 +00:00
Author
Owner
Copy link

QA Reopened — Fix Not Landed

This issue was auto-closed at 2026-08-04T04:34:58Z by a reconciliation sweep (same exact timestamp as the mesh-seed#252 false-positive close), but the underlying vulnerability is unresolved.

Verification

  • git log --all --oneline | grep -iE 'encrypt|aes|gpg|crypt' → 0 commits on any branch.
  • find backend/src agent/src src -name 'encrypt*.ts' -o -name 'encryption.ts' → 0 files. No encryption module exists in source.
  • .kilo/plans/backup-encryption-at-rest.md is an implementation plan, not implementation. It proposes creating backend/src/core/backup/encryption.ts (NEW) — that file does not exist.
  • backend/src/core/backup/executor.ts::executeFullBackup() pipeline: tar → compress (gzip|zstd|none) → SHA256 → upload. No encryption step. The BackupStrategy.encryptionEnabled flag is never consulted.
  • agent/src/backup.ts::createArchive(): tar.gz via alpine → SHA256 → upload. No encryption.
  • The supportsEncryption flags on S3/GCS/Azure providers are backend-API capability declarations (e.g., SSE-S3, CMEK), not application-level archive encryption. They do not address this issue.
  • Seed default backup.encryptionEnabled = 'false' is a dead flag — no code path honors it.

Reopen

Reopened by tasker-worker (kanban QA task t_199ad939) on 2026-08-04. The issue remains OPEN until an actual encryption implementation lands and is independently verified.

## QA Reopened — Fix Not Landed This issue was auto-closed at 2026-08-04T04:34:58Z by a reconciliation sweep (same exact timestamp as the mesh-seed#252 false-positive close), but **the underlying vulnerability is unresolved**. ### Verification - `git log --all --oneline | grep -iE 'encrypt|aes|gpg|crypt'` → 0 commits on any branch. - `find backend/src agent/src src -name 'encrypt*.ts' -o -name 'encryption.ts'` → 0 files. No encryption module exists in source. - `.kilo/plans/backup-encryption-at-rest.md` is an **implementation plan**, not implementation. It proposes creating `backend/src/core/backup/encryption.ts` (NEW) — that file does not exist. - `backend/src/core/backup/executor.ts::executeFullBackup()` pipeline: `tar → compress (gzip|zstd|none) → SHA256 → upload`. No encryption step. The `BackupStrategy.encryptionEnabled` flag is never consulted. - `agent/src/backup.ts::createArchive()`: tar.gz via alpine → SHA256 → upload. No encryption. - The `supportsEncryption` flags on S3/GCS/Azure providers are backend-API capability declarations (e.g., SSE-S3, CMEK), not application-level archive encryption. They do not address this issue. - Seed default `backup.encryptionEnabled = 'false'` is a dead flag — no code path honors it. ### Reopen Reopened by tasker-worker (kanban QA task t_199ad939) on 2026-08-04. The issue remains **OPEN** until an actual encryption implementation lands and is independently verified.
Mark commented 2026-08-04 12:22:27 +00:00
Author
Owner
Copy link

QA FAIL (2026-08-04, t_fb037969) — fixit-board false-positive close confirmed

Re-verified against Mark/docker_backup master HEAD e9289d0 ("fix(verify): make pytest and cargo test pass on this JS-only repo"). Same state as comment #50025. No encryption module exists.

Evidence

Commits: git log --all --oneline | grep -iE 'encrypt|aes|gpg|crypt' → 0 hits across all branches. Master has gained no new commits since 2026-08-04T08:00Z.

Source files: find agent backend/src -type f -name '*ncrypt*.ts' → 0 files. No encrypt*/encryption*/cipher* modules in source.

Where encryption is mentioned in code (all declarations only, never read):

  • backend/src/core/backup/types.ts:58 — encryptionEnabled: boolean (declared in BackupStrategy type, never read anywhere)
  • backend/src/core/storage/interface.ts:37 — supportsEncryption: boolean (capability flag, declared per-provider)
  • Providers set supportsEncryption = true (s3/azure/sftp/gcs/rsync) or = false (local/box/gdrive/webdav) but nothing in the executor reads the flag to actually encrypt.

Backup pipeline (backend/src/core/backup/executor.ts): tar → compress (gzip/zstd) → upload. There is no encryption step. The single crypto import in the entire repo is createHash for checksums (agent/src/backup.ts:10), not encryption.

Tests: backend/tests/core/backup/executor.test.ts:49 asserts supportsEncryption: false for the local provider fixture. No test exercises encryption.

Plan-only artifact: .kilo/plans/backup-encryption-at-rest.md is a design proposal. Not implementation. Not referenced by any build/lint gate.

Conclusion

Issue is genuinely open. The fixit-board "done" entry is a false-positive close — same pattern as Mark/mesh-seed#236 (t_5b0bb6f3), Mark/mesh-seed#252/253/256/257/244/245, Mark/org_mode#17, Mark/nodedesk#38 (already on the recorded failure-mode list). A reconciliation sweep flipped this card to done but did not land code.

Recommendation

This issue needs actual implementation via the kilo-gsd pipeline (forge a real implementation commit on a topic branch, run ruff+tests gates, open PR, then close). Marking the kanban QA card blocked until the fix is genuinely shipped and merged. Do not close the Forgejo issue from the reconciliation sweep.

## QA FAIL (2026-08-04, t_fb037969) — fixit-board false-positive close confirmed Re-verified against Mark/docker_backup master HEAD **e9289d0** ("fix(verify): make pytest and cargo test pass on this JS-only repo"). Same state as comment #50025. No encryption module exists. ### Evidence **Commits:** `git log --all --oneline | grep -iE 'encrypt|aes|gpg|crypt'` → 0 hits across all branches. Master has gained no new commits since 2026-08-04T08:00Z. **Source files:** `find agent backend/src -type f -name '*ncrypt*.ts'` → 0 files. No `encrypt*`/`encryption*`/`cipher*` modules in source. **Where encryption is mentioned in code (all declarations only, never read):** - `backend/src/core/backup/types.ts:58` — `encryptionEnabled: boolean` (declared in BackupStrategy type, **never read anywhere**) - `backend/src/core/storage/interface.ts:37` — `supportsEncryption: boolean` (capability flag, declared per-provider) - Providers set `supportsEncryption = true` (s3/azure/sftp/gcs/rsync) or `= false` (local/box/gdrive/webdav) but nothing in the executor reads the flag to actually encrypt. **Backup pipeline (`backend/src/core/backup/executor.ts`):** tar → compress (gzip/zstd) → upload. There is no encryption step. The single `crypto` import in the entire repo is `createHash` for checksums (`agent/src/backup.ts:10`), not encryption. **Tests:** `backend/tests/core/backup/executor.test.ts:49` asserts `supportsEncryption: false` for the local provider fixture. No test exercises encryption. **Plan-only artifact:** `.kilo/plans/backup-encryption-at-rest.md` is a design proposal. Not implementation. Not referenced by any build/lint gate. ### Conclusion Issue is genuinely **open**. The fixit-board "done" entry is a false-positive close — same pattern as Mark/mesh-seed#236 (t_5b0bb6f3), Mark/mesh-seed#252/253/256/257/244/245, Mark/org_mode#17, Mark/nodedesk#38 (already on the recorded failure-mode list). A reconciliation sweep flipped this card to done but did not land code. ### Recommendation This issue needs actual implementation via the kilo-gsd pipeline (forge a real implementation commit on a topic branch, run ruff+tests gates, open PR, then close). Marking the kanban QA card blocked until the fix is genuinely shipped and merged. **Do not** close the Forgejo issue from the reconciliation sweep.
Mark closed this issue 2026-08-04 14:30:25 +00:00
Mark reopened this issue 2026-08-04 16:35:29 +00:00
Mark commented 2026-08-04 16:36:04 +00:00
Author
Owner
Copy link

QA FAIL (2026-08-04, t_f043356a) — No encryption implementation exists

Reopened from false-positive close (closed by reconciliation sweep at 2026-08-04T14:30:25Z).

Evidence

Commits: git log --all --oneline | grep -iE "encrypt|aes|gpg|crypt" → 0 hits across all branches. Master HEAD is e9289d0.

Source files: No encryption module exists. find agent backend/src src -type f -name "encrypt*" -o -name "*crypt*" returns nothing.

Type definitions only: The codebase has encryptionEnabled: boolean in backend/src/core/backup/types.ts and supportsEncryption in storage interfaces — but these are type flags only. Some providers claim supportsEncryption = true (GCS, Azure, SFTP, rsync, S3) but no actual AES/GPG encryption logic exists anywhere. crypto imports are limited to SHA-256 hashing (checksums, HMAC signatures).

Conclusion

The fix was never implemented. The issue was auto-closed by a reconciliation sweep without verification. This is the same false-positive close pattern seen on mesh-seed#252, mesh-seed#255, and others.

## QA FAIL (2026-08-04, t_f043356a) — No encryption implementation exists Reopened from false-positive close (closed by reconciliation sweep at 2026-08-04T14:30:25Z). ### Evidence **Commits:** `git log --all --oneline | grep -iE "encrypt|aes|gpg|crypt"` → 0 hits across all branches. Master HEAD is e9289d0. **Source files:** No encryption module exists. `find agent backend/src src -type f -name "encrypt*" -o -name "*crypt*"` returns nothing. **Type definitions only:** The codebase has `encryptionEnabled: boolean` in `backend/src/core/backup/types.ts` and `supportsEncryption` in storage interfaces — but these are type flags only. Some providers claim `supportsEncryption = true` (GCS, Azure, SFTP, rsync, S3) but no actual AES/GPG encryption logic exists anywhere. `crypto` imports are limited to SHA-256 hashing (checksums, HMAC signatures). ### Conclusion The fix was never implemented. The issue was auto-closed by a reconciliation sweep without verification. This is the same false-positive close pattern seen on mesh-seed#252, mesh-seed#255, and others.
Mark commented 2026-08-04 18:08:13 +00:00
Author
Owner
Copy link

QA verification (t_a4cfe992): No encryption implementation has landed.

Findings:

  • Frontend has UI controls (encryptionEnabled, encryptionKey in Settings.tsx)
  • Backend type definition exists (BackupStrategy.encryptionEnabled in types.ts)
  • Agent backup module (agent/src/backup.ts) creates plain tar.gz archives with no encryption step
  • No commits on main or any branch reference encryption or this issue
  • Previous QA cards (t_4fa374e6) confirmed the same: "QA failed: no encryption implementation landed"

Issue correctly remains open. The UI/type stubs exist but the actual encryption logic (AES/GPG) is not wired into the backup pipeline.

QA verification (t_a4cfe992): **No encryption implementation has landed.** Findings: - Frontend has UI controls (`encryptionEnabled`, `encryptionKey` in Settings.tsx) - Backend type definition exists (`BackupStrategy.encryptionEnabled` in types.ts) - Agent backup module (agent/src/backup.ts) creates plain tar.gz archives with no encryption step - No commits on main or any branch reference encryption or this issue - Previous QA cards (t_4fa374e6) confirmed the same: "QA failed: no encryption implementation landed" Issue correctly remains open. The UI/type stubs exist but the actual encryption logic (AES/GPG) is not wired into the backup pipeline.
Mark commented 2026-08-04 19:12:33 +00:00
Author
Owner
Copy link

QA FAIL (t_cab453a8) — No encryption implementation exists

Verified independently against Mark/docker_backup main HEAD e9289d0. Same finding as all prior QA attempts.

Evidence

  • git log --all --oneline | grep -iE "encrypt|aes|gpg|crypt" → 0 hits
  • Only branches: main (no topic branches with encryption work)
  • No open PRs (only PR #10, closed without merge)

What exists (UI/type stubs only)

  • src/pages/Settings.tsx — toggle + text input for encryptionEnabled / encryptionKey
  • src/types/index.ts — encryptionEnabled: boolean, encryptionKey?: string
  • backend/src/core/backup/types.ts — encryptionEnabled: boolean
  • backend/src/core/storage/interface.ts — comment mentioning encryption capability

What does NOT exist

  • No AES/GPG/cipher logic anywhere
  • No encryption of backup archives at rest
  • All crypto imports are SHA256/HMAC (checksums, auth tokens) — not encryption

Conclusion

This is a 5th consecutive QA FAIL on this issue. The feature was never implemented. The fixit-board reconciliation that generated this QA card was a false-positive close (same pattern as mesh-seed#252, #253, #256, #257).

Issue remains OPEN — no fix has landed.

## QA FAIL (t_cab453a8) — No encryption implementation exists Verified independently against Mark/docker_backup main HEAD e9289d0. Same finding as all prior QA attempts. ### Evidence - `git log --all --oneline | grep -iE "encrypt|aes|gpg|crypt"` → 0 hits - Only branches: main (no topic branches with encryption work) - No open PRs (only PR #10, closed without merge) ### What exists (UI/type stubs only) - `src/pages/Settings.tsx` — toggle + text input for `encryptionEnabled` / `encryptionKey` - `src/types/index.ts` — `encryptionEnabled: boolean`, `encryptionKey?: string` - `backend/src/core/backup/types.ts` — `encryptionEnabled: boolean` - `backend/src/core/storage/interface.ts` — comment mentioning encryption capability ### What does NOT exist - No AES/GPG/cipher logic anywhere - No encryption of backup archives at rest - All `crypto` imports are SHA256/HMAC (checksums, auth tokens) — not encryption ### Conclusion This is a 5th consecutive QA FAIL on this issue. The feature was never implemented. The fixit-board reconciliation that generated this QA card was a false-positive close (same pattern as mesh-seed#252, #253, #256, #257). **Issue remains OPEN — no fix has landed.**
Mark commented 2026-08-04 20:28:21 +00:00
Author
Owner
Copy link

QA FAIL (t_df9eb737) — No encryption implementation exists

Verified independently against Mark/docker_backup main HEAD e9289d0. Same finding as all 6 prior QA attempts.

Evidence

  • No commits in the repo reference #20 or contain encrypt in a meaningful way
  • Type definitions exist (encryptionEnabled boolean, encryptionKey optional in types/index.ts:279-280 and backup/types.ts:58)
  • UI controls exist (Settings.tsx:327-348 — toggle + key input)
  • Backend does NOT implement encryption — jobs.ts:65 is a comment (may be encrypted), interface.ts:31 is a comment listing encryption as a capability. No actual cipher/AES/GPG/encrypt/decrypt calls in the backup executor or storage layer.

Conclusion

Issue correctly remains open. The fixit board false-positive close was invalid — the reconciliation sweep closed it despite no implementation landing.

## QA FAIL (t_df9eb737) — No encryption implementation exists Verified independently against Mark/docker_backup main HEAD e9289d0. Same finding as all 6 prior QA attempts. ### Evidence - No commits in the repo reference #20 or contain encrypt in a meaningful way - Type definitions exist (encryptionEnabled boolean, encryptionKey optional in types/index.ts:279-280 and backup/types.ts:58) - UI controls exist (Settings.tsx:327-348 — toggle + key input) - Backend does NOT implement encryption — jobs.ts:65 is a comment (may be encrypted), interface.ts:31 is a comment listing encryption as a capability. No actual cipher/AES/GPG/encrypt/decrypt calls in the backup executor or storage layer. ### Conclusion Issue correctly remains open. The fixit board false-positive close was invalid — the reconciliation sweep closed it despite no implementation landing.
Mark commented 2026-08-07 16:15:47 +00:00
Author
Owner
Copy link

QA FAIL (t_879d49a8) — No encryption implementation exists

Verified independently against Mark/docker_backup main HEAD e9289d0. Same finding as all 7 prior QA attempts.

Evidence

  • git log --all --oneline | grep -iE "encrypt|aes|gpg|crypt" → 0 hits across all branches
  • No open PRs related to encryption (only PR #10, closed without merge)
  • No encryption module exists in source

What exists (UI/type stubs only)

  • src/types/index.ts:279-280 — encryptionEnabled boolean, encryptionKey optional string
  • backend/src/core/backup/types.ts:58 — encryptionEnabled: boolean in BackupStrategy
  • backend/prisma/seed.ts:34 — default encryptionEnabled: false
  • backend/src/core/storage/interface.ts:37 — supportsEncryption capability flag
  • src/pages/Settings.tsx:327-348 — UI toggle + key input

What is missing

  • No encryption step in backup executor (backend/src/core/backup/executor.ts)
  • No encryption/decryption module anywhere in the codebase
  • Backup flow: tar → compress → checksum → upload (no encrypt step)
  • Restore flow: download → extract (no decrypt step)
  • Agent backup module creates plain tar.gz with no encryption

Conclusion

Issue remains valid. Encryption feature was never implemented — only type definitions and UI placeholders were added. Needs actual code work (AES/GPG encryption in the backup/restore pipeline).

## QA FAIL (t_879d49a8) — No encryption implementation exists Verified independently against Mark/docker_backup main HEAD e9289d0. Same finding as all 7 prior QA attempts. ### Evidence - `git log --all --oneline | grep -iE "encrypt|aes|gpg|crypt"` → 0 hits across all branches - No open PRs related to encryption (only PR #10, closed without merge) - No encryption module exists in source ### What exists (UI/type stubs only) - `src/types/index.ts:279-280` — `encryptionEnabled` boolean, `encryptionKey` optional string - `backend/src/core/backup/types.ts:58` — `encryptionEnabled: boolean` in BackupStrategy - `backend/prisma/seed.ts:34` — default `encryptionEnabled: false` - `backend/src/core/storage/interface.ts:37` — `supportsEncryption` capability flag - `src/pages/Settings.tsx:327-348` — UI toggle + key input ### What is missing - No encryption step in backup executor (`backend/src/core/backup/executor.ts`) - No encryption/decryption module anywhere in the codebase - Backup flow: tar → compress → checksum → upload (no encrypt step) - Restore flow: download → extract (no decrypt step) - Agent backup module creates plain tar.gz with no encryption ### Conclusion Issue remains valid. Encryption feature was never implemented — only type definitions and UI placeholders were added. Needs actual code work (AES/GPG encryption in the backup/restore pipeline).
Mark commented 2026-08-11 02:45:39 +00:00
Author
Owner
Copy link

QA re-verification (2026-08-10, kanban t_f043356a): fix still NOT landed. main HEAD e9289d0 unchanged; last 50 commits contain no encrypt/aes/gpg/#20 references; no open PRs (only #10 closed-unmerged). Proposed module backend/src/core/backup/encryption.ts does not exist. Executor pipeline remains tar -> compress -> SHA256 -> upload with no encrypt step; encryptionEnabled/supportsEncryption remain dead type flags. Fixit lane task t_16dac594 is blocked pre-dispatch on worktree-cleanliness (staged WIP in executor.ts/schema.prisma/websocket) - needs stash/commit decision before kilo-gsd can run #20. Issue stays open.

QA re-verification (2026-08-10, kanban t_f043356a): fix still NOT landed. main HEAD e9289d0 unchanged; last 50 commits contain no encrypt/aes/gpg/#20 references; no open PRs (only #10 closed-unmerged). Proposed module backend/src/core/backup/encryption.ts does not exist. Executor pipeline remains tar -> compress -> SHA256 -> upload with no encrypt step; encryptionEnabled/supportsEncryption remain dead type flags. Fixit lane task t_16dac594 is blocked pre-dispatch on worktree-cleanliness (staged WIP in executor.ts/schema.prisma/websocket) - needs stash/commit decision before kilo-gsd can run #20. Issue stays open.
Mark 2026-08-12 18:06:28 +00:00
Mark commented 2026-08-14 01:08:07 +00:00
Author
Owner
Copy link

Fix landed and verified (kanban fixup t_9b76fd60)

The encryption-at-rest fix for this issue landed on main and is closed.

  • Fix commit: a5b47ce "feat: add encryption at rest for backup archives (#20)" — on origin/main (AES-256-GCM encryption wired into full/incremental/delta backup paths; archives encrypted in the agent before upload; backend integration + agent unit tests added).
  • Verification (kilo-gsd Verify gate, 2026-08-12): 7/7 commands PASS — backend build, backend type-check, executor tests, backup-encryption integration tests, agent build, agent encryption tests, root type-check.
  • Issue closed 2026-08-12T20:36:09Z.
  • Follow-up deployment gap (running docker-backup-app still stores plaintext) tracked separately at #47.
## Fix landed and verified (kanban fixup t_9b76fd60) The encryption-at-rest fix for this issue landed on main and is closed. - Fix commit: `a5b47ce` "feat: add encryption at rest for backup archives (#20)" — on origin/main (AES-256-GCM encryption wired into full/incremental/delta backup paths; archives encrypted in the agent before upload; backend integration + agent unit tests added). - Verification (kilo-gsd Verify gate, 2026-08-12): 7/7 commands PASS — backend build, backend type-check, executor tests, backup-encryption integration tests, agent build, agent encryption tests, root type-check. - Issue closed 2026-08-12T20:36:09Z. - Follow-up deployment gap (running docker-backup-app still stores plaintext) tracked separately at #47.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:lint-failed

   
blocked:needs-decision

   
blocked:no-changes

   
blocked:no-procedure

   
blocked:verify-failed

   
bug

Something is not working correctly

  
feature-request

   
in-progress

   
needs-decompose

Ready to be decomposed into sub-issues

  
needs-triage

   
ops-task

Operations task — install, configure, deploy, API calls

  
quickfix

   
security/high

High severity security issue

  
security/low

Low severity security issue

  
security/medium

Medium severity security issue

  
test-coverage

Test coverage review / gap report

  
triage-approved

Approved by triage pipeline

No labels
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-fetch
blocked:lint-failed
blocked:needs-decision
blocked:no-changes
blocked:no-procedure
blocked:verify-failed
bug
feature-request
in-progress
needs-decompose
needs-triage
ops-task
quickfix
security/high
security/low
security/medium
test-coverage
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/docker_backup#20
No description provided.