You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There are some issues I found that occur when interacting with encrypted archives:
Currently, extracting an encrypted archive has the side effect that a .tar.lz file gets created in the source directory. This is less than ideal since someone could inadvertently compromise the security of the archive. The parameter extract_at_destination on the extract_archive function flips it around so that the .tar.lz gets created at the destination. This is used for integrity checks where the destination is a temporary directory.
Suggestion: it might make sense to automatically delete the .tar.lz after the decompression / extraction concluded since the file is only required for that one step.
Also, when creating an encrypted archive the unencrypted .tar.lz file won't get deleted. Again, this file is only needed until the encrypted file has been created and stored. There is a --remove option that will delete this file, but per default that won't happen.
Suggestion: remove .tar.lz per default and instead have an option to explicitly keep the unencrypted archive.
Good points! Generally, the user handling encryption and decryption should be take the necessary care to handle the data appropriately. In practice, these operations happen on a secure enough system, so this shouldn't be a problem. What could happen though, is that somebody copies the whole folder with both the encrypted and non-encrypted archive...
On the other hand, it is helpful to keep unencrypted archives to avoid repeated work if one wants to extract files in several steps.
Handling temporary files in general maybe needs some more thinking, I'll do that,
There are some issues I found that occur when interacting with encrypted archives:
Currently, extracting an encrypted archive has the side effect that a
.tar.lz
file gets created in the source directory. This is less than ideal since someone could inadvertently compromise the security of the archive. The parameterextract_at_destination
on theextract_archive
function flips it around so that the.tar.lz
gets created at the destination. This is used for integrity checks where the destination is a temporary directory.Suggestion: it might make sense to automatically delete the
.tar.lz
after the decompression / extraction concluded since the file is only required for that one step.Also, when creating an encrypted archive the unencrypted
.tar.lz
file won't get deleted. Again, this file is only needed until the encrypted file has been created and stored. There is a--remove
option that will delete this file, but per default that won't happen.Suggestion: remove
.tar.lz
per default and instead have an option to explicitly keep the unencrypted archive.@izcram what do you think?
The text was updated successfully, but these errors were encountered: