Sergei Vasilev
50 lines
1.7 KiB
Markdown
50 lines
1.7 KiB
Markdown
# IQON DB archive encrypted storage
|
|
|
|
Purpose: record durable encrypted storage of the verified IQON database archive without storing raw credentials or SQL dumps in git.
|
|
|
|
Created: 2026-05-20
|
|
Updated: 2026-05-20
|
|
|
|
## Status
|
|
|
|
`VERIFIED`: the database archive was encrypted, decryption was tested through `gzip -t`, the encryption key was stored in Vaultwarden, and plaintext temporary files were removed.
|
|
|
|
## Encrypted artifact
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Path | `/Users/svmac/.codex/memories/secure-artifacts/iqon/iqon-u0012812_iqon-20260520-231601.sql.gz.enc` |
|
|
| Mode | `600` |
|
|
| Size | approximately `468K` |
|
|
| Algorithm | `openssl enc -aes-256-cbc -salt -pbkdf2 -iter 200000` |
|
|
| Source DB | `u0012812_iqon` |
|
|
|
|
## Vaultwarden key item
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Item name | `IQON DB archive encryption key - 20260520-231601` |
|
|
| Folder | `Client Infrastructure` |
|
|
| Stored secret | encryption passphrase |
|
|
|
|
## Checksums
|
|
|
|
| Artifact | SHA-256 |
|
|
|---|---|
|
|
| Source gzip before plaintext cleanup | `65625e331661df6fc1cff220f10e634b0afd8967aba2387764c0e9ea0698be56` |
|
|
| Encrypted artifact | `8f1244a5f9b4e9fb2c5d0491c6f92affbf12125437a67560af6ab774efd61083` |
|
|
|
|
## Verification
|
|
|
|
1. Source gzip passed `gzip -t` before encryption.
|
|
2. Encrypted artifact was created with PBKDF2 and AES-256-CBC.
|
|
3. Decryption was piped directly to `gzip -t` without writing plaintext SQL.
|
|
4. Vaultwarden key item was created successfully.
|
|
5. Temporary plaintext passphrase file was removed.
|
|
6. Temporary plaintext DB dump in `/private/tmp` was removed.
|
|
7. Encrypted artifact remains present at the durable local path.
|
|
|
|
## Safety
|
|
|
|
No database dump or password is stored in the git repository. This report contains only paths, metadata, and checksums.
|