Follow-up fixit for #20: encryption-at-rest fix never landed - backups still plaintext at rest #44

New issue

Closed

opened 2026-08-11 03:08:57 +00:00 by Mark · 1 comment

Mark commented

2026-08-11 03:08:57 +00:00

Owner

Finding

Mark/docker_backup#20 ("No encryption for backups at rest", open since 2026-05-10) has still not been implemented. 10+ independent QA checks (kanban qa cards, 2026-05 through 2026-08) all confirm the same failure mode: no commit on any branch references #20 or encryption; main HEAD e9289d0 is unchanged; the backup pipeline still writes plaintext tar archives with no .enc path, no crypto primitives, no decrypt step in restore, and no encryption test. The only artifacts are UI/type stubs (encryptionEnabled/encryptionKey in Settings.tsx and types.ts) and an untracked plan (.kilo/plans/backup-encryption-at-rest.md) that was never implemented.

Source: kanban qa card t_d8e2e5e7 (verify encryption-at-rest, 2026-08-10). Original tracking issue: Mark/docker_backup#20.

Repro steps

cd /home/b/Projects/docker_backup && git rev-parse HEAD -> e9289d0 (unchanged).
git log --all --oneline --grep="encrypt" -i -> empty; git log --all --oneline --grep="#20" -> empty.
Full backup path in backend/src/core/backup/executor.ts: createCompressedArchive() -> tar -cf -> gzip/zstd -> full/${jobId}.tar[.gz|.zst] -> SHA256 -> provider.upload(). No encryption step, no .enc destination.
grep -rn -iE 'decrypt|aes-256|createCipher|createDecipher|DOCKER_BACKUP_ENC|gpg' backend/src agent/src src -> 0 hits.
Restore path: restoreVolume() -> download -> SHA256 verify -> tar -xf. No decrypt.

Actual

Backups are stored as plaintext tar archives. Anyone with storage access can read all volume contents; the documented decryption path does not exist.

Expected

Per .kilo/plans/backup-encryption-at-rest.md (AES-256-GCM + PBKDF2): backup artifacts are encrypted at rest (.tar.gz.enc extension, magic bytes), and restore decrypts with the correct key/passphrase before extraction. A live backup run should produce an artifact that is not plaintext, and the documented decryption path should recover the data with the correct key.

## Finding Mark/docker_backup#20 ("No encryption for backups at rest", open since 2026-05-10) has still not been implemented. 10+ independent QA checks (kanban qa cards, 2026-05 through 2026-08) all confirm the same failure mode: no commit on any branch references #20 or encryption; main HEAD `e9289d0` is unchanged; the backup pipeline still writes plaintext tar archives with no `.enc` path, no crypto primitives, no decrypt step in restore, and no encryption test. The only artifacts are UI/type stubs (`encryptionEnabled`/`encryptionKey` in Settings.tsx and types.ts) and an untracked plan (`.kilo/plans/backup-encryption-at-rest.md`) that was never implemented. Source: kanban qa card `t_d8e2e5e7` (verify encryption-at-rest, 2026-08-10). Original tracking issue: Mark/docker_backup#20. ## Repro steps 1. `cd /home/b/Projects/docker_backup && git rev-parse HEAD` -> `e9289d0` (unchanged). 2. `git log --all --oneline --grep="encrypt" -i` -> empty; `git log --all --oneline --grep="#20"` -> empty. 3. Full backup path in `backend/src/core/backup/executor.ts`: `createCompressedArchive()` -> `tar -cf` -> gzip/zstd -> `full/${jobId}.tar[.gz|.zst]` -> SHA256 -> `provider.upload()`. No encryption step, no `.enc` destination. 4. `grep -rn -iE 'decrypt|aes-256|createCipher|createDecipher|DOCKER_BACKUP_ENC|gpg' backend/src agent/src src` -> 0 hits. 5. Restore path: `restoreVolume()` -> download -> SHA256 verify -> `tar -xf`. No decrypt. ## Actual Backups are stored as plaintext tar archives. Anyone with storage access can read all volume contents; the documented decryption path does not exist. ## Expected Per `.kilo/plans/backup-encryption-at-rest.md` (AES-256-GCM + PBKDF2): backup artifacts are encrypted at rest (`.tar.gz.enc` extension, magic bytes), and restore decrypts with the correct key/passphrase before extraction. A live backup run should produce an artifact that is not plaintext, and the documented decryption path should recover the data with the correct key.

Mark added the

bug

label

2026-08-11 03:08:57 +00:00

Mark commented

2026-08-11 17:58:40 +00:00

Author

Owner

Bughunt t_f6e96892 — dispatch blocker cleared, test suite green

The worktree blocker that kept #20/#44 undispatchable for ~275h is resolved.

Stashed the interrupted kilo-gsd WIP (git stash push): the staged websocket + multi-target backup refactor (executor.ts TargetResult/targetResults, backup-queue-types.ts targetIds, schema.prisma targetIds/targetResults, src/hooks/useWebSocket.ts + websocket stores) was half-finished and broke backend type-check and frontend lint. Nothing from it was ever committed. .gsd/gates/pre-dispatch.sh 20 now passes (exit 0) — the fixit lane can dispatch #20 fresh.
Pushed f91bf0c (main, 2026-08-11): repaired the backend test suite which was red across the board (14/14 files failing → 54/54 passing):
- added missing supertest devDep (4 route/middleware test files couldn't load)
- fixed vi.mock hoisting in worker.test.ts (ReferenceError)
- wired volumeInspectMock in backup-flow.test.ts (was hitting the real docker socket, EACCES) + execFile mock now creates the tar the rename expects
- fixed compressor.ts unhandled pipeline rejection
- async Fastify preHandler hooks (sync hooks hang Fastify 5.8.2 inject)
- auth route tests use the /api prefix; stale targets assertions updated
- fixed the pre-commit hook (lint-staged tsc --noEmit with file args ignored tsconfig.json → every commit needed --no-verify)

This issue's underlying work (implement AES-256-GCM encryption-at-rest per .kilo/plans/backup-encryption-at-rest.md) remains open and is still tracked by #20/#44 — the bughunt only cleared the infra blocker and made the test suite a reliable verify signal.

## Bughunt t_f6e96892 — dispatch blocker cleared, test suite green **The worktree blocker that kept #20/#44 undispatchable for ~275h is resolved.** 1. **Stashed the interrupted kilo-gsd WIP** (`git stash push`): the staged websocket + multi-target backup refactor (executor.ts TargetResult/targetResults, backup-queue-types.ts targetIds, schema.prisma targetIds/targetResults, src/hooks/useWebSocket.ts + websocket stores) was half-finished and broke backend type-check and frontend lint. Nothing from it was ever committed. `.gsd/gates/pre-dispatch.sh 20` now passes (exit 0) — the fixit lane can dispatch #20 fresh. 2. **Pushed f91bf0c** (main, 2026-08-11): repaired the backend test suite which was red across the board (14/14 files failing → 54/54 passing): - added missing `supertest` devDep (4 route/middleware test files couldn't load) - fixed vi.mock hoisting in worker.test.ts (ReferenceError) - wired `volumeInspectMock` in backup-flow.test.ts (was hitting the real docker socket, EACCES) + execFile mock now creates the tar the rename expects - fixed compressor.ts unhandled pipeline rejection - async Fastify preHandler hooks (sync hooks hang Fastify 5.8.2 inject) - auth route tests use the `/api` prefix; stale targets assertions updated - fixed the pre-commit hook (lint-staged `tsc --noEmit` with file args ignored tsconfig.json → every commit needed --no-verify) This issue's underlying work (implement AES-256-GCM encryption-at-rest per `.kilo/plans/backup-encryption-at-rest.md`) remains open and is still tracked by #20/#44 — the bughunt only cleared the infra blocker and made the test suite a reliable verify signal.

Mark

2026-08-12 06:35:04 +00:00