Encrypt the library at rest, behind a passphrase - #135

Merged

vmillet-dev merged 17 commits into

mainfrom

encrypted-at-rest

Sep 16, 2026

Commits on Sep 16, 2026

Let the attachments travel with the library
vmillet-dev
committed
d2c7411
Rename a shadowed binding in the transfer scenario
vmillet-dev
committed
31dffd0
Derive a key from a passphrase, and seal a value with it
vmillet-dev
committed
33acb0b
Keep the salt, the cost and a check value beside the library
vmillet-dev
committed
eec1ba4
Carry the key with the connection, and open the library behind a passphrase
vmillet-dev
committed
7d69460
Seal what a reader would want, and nothing SQL needs
vmillet-dev
committed
88b8de6
Seal the attachment files, and migrate a library that predates the passphrase
vmillet-dev
committed
565c3b6
Put an unlock screen in front of the library
vmillet-dev
committed
b62c98a
Let an export be sealed with a phrase of its own
vmillet-dev
committed
a08165c
Sweep the decrypted copies on the way out, and write the security model down
vmillet-dev
committed
798ac05
Keep the File menu out of the titlebar until the library is open
vmillet-dev
committed
49c1a4e
Say what the encryption protects against, and what it does not
vmillet-dev
committed
d77a41d
Seal the values of a variable shared by the whole corpus
vmillet-dev
committed
a9af220
Keep the decrypted copies in the profile, not in the shared temp directory
vmillet-dev
committed
f2d2f1d
Leave the prompt on screen while the phrase is being used
vmillet-dev
committed
81ac00c
Let the passphrase be changed, by wrapping the key instead of being it
vmillet-dev
committed
4a3eda3
Answer "is this file protected?" from the recipe alone
vmillet-dev
committed
8addf9a

Navigation Menu

Encrypt the library at rest, behind a passphrase - #135

Encrypt the library at rest, behind a passphrase#135
vmillet-dev merged 17 commits into
mainfrom
encrypted-at-rest

Commits on Sep 16, 2026

Let the attachments travel with the library

Rename a shadowed binding in the transfer scenario

Derive a key from a passphrase, and seal a value with it

Keep the salt, the cost and a check value beside the library

Carry the key with the connection, and open the library behind a passphrase

Seal what a reader would want, and nothing SQL needs

Seal the attachment files, and migrate a library that predates the passphrase

Put an unlock screen in front of the library

Let an export be sealed with a phrase of its own

Sweep the decrypted copies on the way out, and write the security model down

Keep the File menu out of the titlebar until the library is open

Say what the encryption protects against, and what it does not

Seal the values of a variable shared by the whole corpus

Keep the decrypted copies in the profile, not in the shared temp directory

Leave the prompt on screen while the phrase is being used

Let the passphrase be changed, by wrapping the key instead of being it

Answer "is this file protected?" from the recipe alone