Encryption at rest

[AnalogJ]

https://github.com/jackfr0st13/gorm-sqlite-cipher

[AnalogJ]

Fasten currently uses https://github.com/glebarez/sqlite which is a Go sqlite driver for Gorm (depends on glebarez/go-sqlite which is a fork of https://gitlab.com/cznic/sqlite)

neither glebarez/sqlite nor cznic/sqlite support encryption at rest.

https://github.com/jackfr0st13/gorm-sqlite-cipher is a Gorm driver based on https://github.com/mattn/go-sqlite3 (written in C) that supports encryption. We should see if we can copy/translate its code to work with glebarez/sqlite or glebarez/go-sqlite

NOTE: for completeness, https://github.com/sqlcipher/sqlcipher does exist, however it's written in C, and may not have a GORM compatible driver. Worth investigation

[AnalogJ]

mattn/go-sqlite3 has an open PR mattn/go-sqlite3#1109 which adds support for sqlcipher (and https://github.com/utelle/SQLite3MultipleCiphers)

If we feel comfortable switching to mattn/go-sqlite3, we can use @jgiannuzzi 's branch/PR to enable encryption

This comes with the following considerations:

• Non-native Go, requires CGO for compilation. This is kind of painful given the numerous architectures and operating systems we'd like to support
  • Docker images should be fine -- given the Depot native Arch support
  • Desktop apps should also be ok (Windows x64, Windows ARM, Mac ARM)
  • Users building from scratch might run into weird issues.
• Performance improvements - C Driver is faster than Golang Driver (not sure by how much)
• Dev setup might be tougher

[jgiannuzzi]

For reference about building and distributing, we use my fork in https://github.com/G-Research/fasttrackml and we distribute Docker images and fully static binaries for all major platforms

[AnalogJ]

thanks for the confirmation @jgiannuzzi. I've built binaries using cross-compilation in the past, and its been pretty brutal when using CGO, but this wasn't too bad (and thankfully I don't need to do cross-compilation for Fasten)

I was able to use your branch, and get everything working pretty nicely - #284

Thanks for all your hard work @jgiannuzzi, I can't wait until your PR is merged into mattn/go-sqlite3!

[jgiannuzzi]

Could you please let the maintainers of mattn/go-sqlite3 know? They seem to be convinced that encryption is a niche case, but it does seem quite popular, and I really don't want to actually fork their library!