eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add prototype encrypted CAS blobs

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 01:35:00 +02:00
commit 533ffc8c2a
8 changed files with 382 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/roadmap.md
View file

@ -306,11 +306,16 @@ authorization and durable-state boundaries clear.
- `[x]` Unpinned cached blobs can be evicted by policy.
- `[x]` Tests cover attempted eviction of pinned data.
- `[ ]` Encrypted private blobs.
- `[x]` Encrypted private blobs.
Acceptance criteria:
- Private blob payloads are encrypted before network distribution.
- Access is gated by resource secret epoch material.
- Docs explicitly avoid claiming forward secrecy or PCS.
- `[x]` `geth cas add-private <resource> <path>` stores an encrypted CAS
envelope instead of plaintext payload bytes.
- `[x]` `geth cas get-private <resource> <hash> --out <path>` decrypts with
a matching local resource secret epoch.
- `[x]` Access is gated by local resource secret epoch material.
- `[x]` Tests verify encrypted blob roundtrip and wrong resource/secret
rejection.
- `[x]` Docs explicitly avoid claiming forward secrecy or PCS.
- `[~]` Iroh-docs KV integration.
Acceptance criteria: