From 7022e710e10a5f650dfa3f9c88518a7de15b0919 Mon Sep 17 00:00:00 2001 From: Sergei Vasilev Date: Wed, 20 May 2026 23:29:33 +0300 Subject: [PATCH] chore: record iqon encrypted db archive --- ...db-archive-encrypted-storage-2026-05-20.md | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 reports/db-archive-encrypted-storage-2026-05-20.md diff --git a/reports/db-archive-encrypted-storage-2026-05-20.md b/reports/db-archive-encrypted-storage-2026-05-20.md new file mode 100644 index 0000000..fb525fb --- /dev/null +++ b/reports/db-archive-encrypted-storage-2026-05-20.md @@ -0,0 +1,49 @@ +# IQON DB archive encrypted storage + +Purpose: record durable encrypted storage of the verified IQON database archive without storing raw credentials or SQL dumps in git. + +Created: 2026-05-20 +Updated: 2026-05-20 + +## Status + +`VERIFIED`: the database archive was encrypted, decryption was tested through `gzip -t`, the encryption key was stored in Vaultwarden, and plaintext temporary files were removed. + +## Encrypted artifact + +| Field | Value | +|---|---| +| Path | `/Users/svmac/.codex/memories/secure-artifacts/iqon/iqon-u0012812_iqon-20260520-231601.sql.gz.enc` | +| Mode | `600` | +| Size | approximately `468K` | +| Algorithm | `openssl enc -aes-256-cbc -salt -pbkdf2 -iter 200000` | +| Source DB | `u0012812_iqon` | + +## Vaultwarden key item + +| Field | Value | +|---|---| +| Item name | `IQON DB archive encryption key - 20260520-231601` | +| Folder | `Client Infrastructure` | +| Stored secret | encryption passphrase | + +## Checksums + +| Artifact | SHA-256 | +|---|---| +| Source gzip before plaintext cleanup | `65625e331661df6fc1cff220f10e634b0afd8967aba2387764c0e9ea0698be56` | +| Encrypted artifact | `8f1244a5f9b4e9fb2c5d0491c6f92affbf12125437a67560af6ab774efd61083` | + +## Verification + +1. Source gzip passed `gzip -t` before encryption. +2. Encrypted artifact was created with PBKDF2 and AES-256-CBC. +3. Decryption was piped directly to `gzip -t` without writing plaintext SQL. +4. Vaultwarden key item was created successfully. +5. Temporary plaintext passphrase file was removed. +6. Temporary plaintext DB dump in `/private/tmp` was removed. +7. Encrypted artifact remains present at the durable local path. + +## Safety + +No database dump or password is stored in the git repository. This report contains only paths, metadata, and checksums.