First real backup with bakelite is a success! 😀👍 A few hiccups (like blocking on trying to open fifos) led to bug fixes (unpushed as of now) in the process.
Conversation
Also found out signify(1) refuses to open its key through symlinks. 😡🤬 Which almost failed the whole thing at the end, but it turns out I made it so when just signature fails, you still get a successful commit you can do an incremental 0-difference on with the signature added.
2
3
Replying to
Main issue with signify is that they don't use pre-hashing so the memory usage scales to the size of the overall file and it has bad performance.
I don't really understand why they insisted on only using ed25519 without doing pre-hashing like pretty much any normal approach.
2
2
Replying to
I'm leaning towards dropping signify (note: it's invoked as a custom external command not baked in) and using ssh-keygen signing instead. Bonus: can use the same keys as the ssh keys for backup transport.
1
1
Replying to
There's minisign which is based on signify with -H for pre-hashing but I think it would be nicer to simply start over with a simpler format. The signify format is super trivial anyway. It's literally "Ed" + 64-bit keyid + ed25519 public key / signature which gets base64 encoded.