dillard
f75ed3aed6
Every change to the set of snapshots or trash entries writes an encrypted catalog generation bound to the repository and its position, with the hash of the previous generation. The server anchors the newest generation it has seen in its app config; on open, the location must show at least that generation and chain back to it, and every snapshot listed must exist. A rolled-back or tampered location is refused (the run fails and administrators are notified). Opening with the passphrase on a new server accepts the newest valid chain. occ backup:target:trust-current accepts a legitimately older state (e.g. restored from the provider's snapshot) after typing the location name; audited and announced to all administrators. Tests: chain advances, rollback, hidden snapshot, swapped generation, disaster recovery without anchor. Tested on NC34 by deleting the newest catalog generation on the SFTP location.
21 lines
634 B
PHP
21 lines
634 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
// SPDX-FileCopyrightText: 2026 Dillard Blom
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
namespace OCA\NgBackup\Repository;
|
|
|
|
/**
|
|
* Where the server remembers the newest catalog generation it has seen for a repository, outside
|
|
* the (untrusted) location. A location that presents an older generation, or a chain that does
|
|
* not lead back to this anchor, is rolled back or tampered with.
|
|
*/
|
|
interface ICatalogAnchor {
|
|
/** @return array{gen:int, hash:string}|null */
|
|
public function get(string $repositoryId): ?array;
|
|
|
|
public function set(string $repositoryId, int $gen, string $hash): void;
|
|
}
|