Add decrypt, refactor

cmd/archive/main.go

@@ -0,0 +1,81 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/fd0/khepri"
+	"github.com/fd0/khepri/backend"
+)
+
+const pass = "foobar"
+
+func main() {
+	if len(os.Args) != 3 {
+		fmt.Fprintf(os.Stderr, "usage: archive REPO DIR\n")
+		os.Exit(1)
+	}
+	repo := os.Args[1]
+	dir := os.Args[2]
+
+	// fmt.Printf("import %s into backend %s\n", dir, repo)
+
+	var (
+		be  backend.Server
+		key *khepri.Key
+	)
+
+	be, err := backend.OpenLocal(repo)
+	if err != nil {
+		fmt.Printf("creating %s\n", repo)
+		be, err = backend.CreateLocal(repo)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "failed: %v\n", err)
+			os.Exit(2)
+		}
+
+		key, err = khepri.CreateKey(be, pass)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "failed: %v\n", err)
+			os.Exit(2)
+		}
+	}
+
+	key, err = khepri.SearchKey(be, pass)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed: %v\n", err)
+		os.Exit(2)
+	}
+
+	arch, err := khepri.NewArchiver(be, key)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "err: %v\n", err)
+	}
+	arch.Error = func(dir string, fi os.FileInfo, err error) error {
+		fmt.Fprintf(os.Stderr, "error for %s: %v\n%s\n", dir, err, fi)
+		return err
+	}
+
+	arch.Filter = func(item string, fi os.FileInfo) bool {
+		// if fi.IsDir() {
+		// 	if fi.Name() == ".svn" {
+		// 		return false
+		// 	}
+		// } else {
+		// 	if filepath.Ext(fi.Name()) == ".bz2" {
+		// 		return false
+		// 	}
+		// }
+
+		fmt.Printf("%s\n", item)
+		return true
+	}
+
+	_, blob, err := arch.Import(dir)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Import() error: %v\n", err)
+		os.Exit(2)
+	}
+
+	fmt.Printf("saved as %+v\n", blob)
+}

cmd/cat/main.go

@@ -0,0 +1,126 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"code.google.com/p/go.crypto/ssh/terminal"
+
+	"github.com/fd0/khepri"
+	"github.com/fd0/khepri/backend"
+)
+
+func read_password(prompt string) string {
+	p := os.Getenv("KHEPRI_PASSWORD")
+	if p != "" {
+		return p
+	}
+
+	fmt.Print(prompt)
+	pw, err := terminal.ReadPassword(int(os.Stdin.Fd()))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "unable to read password: %v", err)
+		os.Exit(2)
+	}
+	fmt.Println()
+
+	return string(pw)
+}
+
+func json_pp(data []byte) error {
+	var buf bytes.Buffer
+	err := json.Indent(&buf, data, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	fmt.Println(string(buf.Bytes()))
+	return nil
+}
+
+type StopWatch struct {
+	start, last time.Time
+}
+
+func NewStopWatch() *StopWatch {
+	return &StopWatch{
+		start: time.Now(),
+		last:  time.Now(),
+	}
+}
+
+func (s *StopWatch) Next(format string, data ...interface{}) {
+	t := time.Now()
+	d := t.Sub(s.last)
+	s.last = t
+	arg := make([]interface{}, len(data)+1)
+	arg[0] = d
+	copy(arg[1:], data)
+	fmt.Printf("[%s]: "+format+"\n", arg...)
+}
+
+func main() {
+	if len(os.Args) != 3 {
+		fmt.Fprintf(os.Stderr, "usage: cat REPO ID\n")
+		os.Exit(1)
+	}
+	repo := os.Args[1]
+	id, err := backend.ParseID(filepath.Base(os.Args[2]))
+	if err != nil {
+		panic(err)
+	}
+
+	s := NewStopWatch()
+
+	be, err := backend.OpenLocal(repo)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed: %v\n", err)
+		os.Exit(1)
+	}
+
+	s.Next("OpenLocal()")
+
+	key, err := khepri.SearchKey(be, read_password("Enter Password for Repository: "))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed: %v\n", err)
+		os.Exit(2)
+	}
+
+	s.Next("SearchKey()")
+
+	// try all possible types
+	for _, t := range []backend.Type{backend.Blob, backend.Snapshot, backend.Lock, backend.Tree, backend.Key} {
+		buf, err := be.Get(t, id)
+		if err != nil {
+			continue
+		}
+
+		s.Next("Get(%s, %s)", t, id)
+
+		if t == backend.Key {
+			json_pp(buf)
+		}
+
+		buf2, err := key.Decrypt(buf)
+		if err != nil {
+			panic(err)
+		}
+
+		if t == backend.Blob {
+			// directly output blob
+			fmt.Println(string(buf2))
+		} else {
+			// try to uncompress and print as idented json
+			err = json_pp(backend.Uncompress(buf2))
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "failed: %v\n", err)
+			}
+		}
+
+		break
+	}
+}

cmd/decrypt/main.go

@@ -0,0 +1,233 @@
+package main
+
+import (
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+
+	"code.google.com/p/go.crypto/scrypt"
+	"code.google.com/p/go.crypto/ssh/terminal"
+
+	"github.com/jessevdk/go-flags"
+)
+
+const (
+	scrypt_N   = 65536
+	scrypt_r   = 8
+	scrypt_p   = 1
+	aesKeySize = 32 // for AES256
+)
+
+var Opts struct {
+	Password string `short:"p" long:"password"    description:"Password for the file"`
+	Keys     string `short:"k" long:"keys"        description:"Keys for the file (encryption_key || sign_key, hex-encoded)"`
+	Salt     string `short:"s" long:"salt"        description:"Salt to use (hex-encoded)"`
+}
+
+func newIV() ([]byte, error) {
+	buf := make([]byte, aes.BlockSize)
+	_, err := io.ReadFull(rand.Reader, buf)
+	if err != nil {
+		return nil, err
+	}
+
+	return buf, nil
+}
+
+func pad(plaintext []byte) []byte {
+	l := aes.BlockSize - (len(plaintext) % aes.BlockSize)
+	if l == 0 {
+		l = aes.BlockSize
+	}
+
+	if l <= 0 || l > aes.BlockSize {
+		panic("invalid padding size")
+	}
+
+	return append(plaintext, bytes.Repeat([]byte{byte(l)}, l)...)
+}
+
+func unpad(plaintext []byte) []byte {
+	l := len(plaintext)
+	pad := plaintext[l-1]
+
+	if pad > aes.BlockSize {
+		panic(errors.New("padding > BlockSize"))
+	}
+
+	if pad == 0 {
+		panic(errors.New("invalid padding 0"))
+	}
+
+	for i := l - int(pad); i < l; i++ {
+		if plaintext[i] != pad {
+			panic(errors.New("invalid padding!"))
+		}
+	}
+
+	return plaintext[:l-int(pad)]
+}
+
+// Encrypt encrypts and signs data. Returned is IV || Ciphertext || HMAC. For
+// the hash function, SHA256 is used, so the overhead is 16+32=48 byte.
+func Encrypt(ekey, skey []byte, plaintext []byte) ([]byte, error) {
+	iv, err := newIV()
+	if err != nil {
+		panic(fmt.Sprintf("unable to generate new random iv: %v", err))
+	}
+
+	c, err := aes.NewCipher(ekey)
+	if err != nil {
+		panic(fmt.Sprintf("unable to create cipher: %v", err))
+	}
+
+	e := cipher.NewCBCEncrypter(c, iv)
+	p := pad(plaintext)
+	ciphertext := make([]byte, len(p))
+	e.CryptBlocks(ciphertext, p)
+
+	ciphertext = append(iv, ciphertext...)
+
+	hm := hmac.New(sha256.New, skey)
+
+	n, err := hm.Write(ciphertext)
+	if err != nil || n != len(ciphertext) {
+		panic(fmt.Sprintf("unable to calculate hmac of ciphertext: %v", err))
+	}
+
+	return hm.Sum(ciphertext), nil
+}
+
+// Decrypt verifes and decrypts the ciphertext. Ciphertext must be in the form
+// IV || Ciphertext || HMAC.
+func Decrypt(ekey, skey []byte, ciphertext []byte) ([]byte, error) {
+	hm := hmac.New(sha256.New, skey)
+
+	// extract hmac
+	l := len(ciphertext) - hm.Size()
+	ciphertext, mac := ciphertext[:l], ciphertext[l:]
+
+	// calculate new hmac
+	n, err := hm.Write(ciphertext)
+	if err != nil || n != len(ciphertext) {
+		panic(fmt.Sprintf("unable to calculate hmac of ciphertext, err %v", err))
+	}
+
+	// verify hmac
+	mac2 := hm.Sum(nil)
+	if !hmac.Equal(mac, mac2) {
+		panic("HMAC verification failed")
+	}
+
+	// extract iv
+	iv, ciphertext := ciphertext[:aes.BlockSize], ciphertext[aes.BlockSize:]
+
+	// decrypt data
+	c, err := aes.NewCipher(ekey)
+	if err != nil {
+		panic(fmt.Sprintf("unable to create cipher: %v", err))
+	}
+
+	// decrypt
+	e := cipher.NewCBCDecrypter(c, iv)
+	plaintext := make([]byte, len(ciphertext))
+	e.CryptBlocks(plaintext, ciphertext)
+
+	// remove padding and return
+	return unpad(plaintext), nil
+}
+
+func errx(code int, format string, data ...interface{}) {
+	if len(format) > 0 && format[len(format)-1] != '\n' {
+		format += "\n"
+	}
+	fmt.Fprintf(os.Stderr, format, data...)
+	os.Exit(code)
+}
+
+func read_password(prompt string) string {
+	p := os.Getenv("KHEPRI_PASSWORD")
+	if p != "" {
+		return p
+	}
+
+	fmt.Print(prompt)
+	pw, err := terminal.ReadPassword(int(os.Stdin.Fd()))
+	if err != nil {
+		errx(2, "unable to read password: %v", err)
+	}
+	fmt.Println()
+
+	return string(pw)
+}
+
+func main() {
+	args, err := flags.Parse(&Opts)
+	if e, ok := err.(*flags.Error); ok && e.Type == flags.ErrHelp {
+		os.Exit(0)
+	}
+
+	var keys []byte
+
+	if Opts.Password == "" && Opts.Keys == "" {
+		Opts.Password = read_password("password: ")
+
+		salt, err := hex.DecodeString(Opts.Salt)
+		if err != nil {
+			errx(1, "unable to hex-decode salt: %v", err)
+		}
+
+		keys, err = scrypt.Key([]byte(Opts.Password), salt, scrypt_N, scrypt_r, scrypt_p, 2*aesKeySize)
+		if err != nil {
+			errx(1, "scrypt: %v", err)
+		}
+	}
+
+	if Opts.Keys != "" {
+		keys, err = hex.DecodeString(Opts.Keys)
+		if err != nil {
+			errx(1, "unable to hex-decode keys: %v", err)
+		}
+	}
+
+	if len(keys) != 2*aesKeySize {
+		errx(2, "key length is not 512")
+	}
+
+	encrypt_key := keys[:aesKeySize]
+	sign_key := keys[aesKeySize:]
+
+	for _, filename := range args {
+		f, err := os.Open(filename)
+		defer f.Close()
+		if err != nil {
+			errx(3, "%v\n", err)
+		}
+
+		buf, err := ioutil.ReadAll(f)
+		if err != nil {
+			errx(3, "%v\n", err)
+		}
+
+		buf, err = Decrypt(encrypt_key, sign_key, buf)
+		if err != nil {
+			errx(3, "%v\n", err)
+		}
+
+		_, err = os.Stdout.Write(buf)
+		if err != nil {
+			errx(3, "%v\n", err)
+		}
+	}
+
+}

cmd/dirdiff/main.go

@@ -53,14 +53,17 @@ func walk(dir string) <-chan *entry {
 
 func (e *entry) equals(other *entry) bool {
 	if e.path != other.path {
+		fmt.Printf("path does not match\n")
 		return false
 	}
 
 	if e.fi.Mode() != other.fi.Mode() {
+		fmt.Printf("mode does not match\n")
 		return false
 	}
 
 	if e.fi.ModTime() != other.fi.ModTime() {
+		fmt.Printf("ModTime does not match\n")
 		return false
 	}
 

cmd/khepri/cmd_backup.go

@@ -3,37 +3,34 @@ package main
 import (
 	"errors"
 	"fmt"
-	"log"
+	"os"
 
 	"github.com/fd0/khepri"
+	"github.com/fd0/khepri/backend"
 )
 
-func commandBackup(repo *khepri.Repository, args []string) error {
+func commandBackup(be backend.Server, key *khepri.Key, args []string) error {
 	if len(args) != 1 {
-		return errors.New("usage: backup dir")
+		return errors.New("usage: backup [dir|file]")
 	}
 
 	target := args[0]
 
-	tree, err := khepri.NewTreeFromPath(repo, target)
+	arch, err := khepri.NewArchiver(be, key)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "err: %v\n", err)
+	}
+	arch.Error = func(dir string, fi os.FileInfo, err error) error {
+		fmt.Fprintf(os.Stderr, "error for %s: %v\n%s\n", dir, err, fi)
+		return err
+	}
+
+	_, blob, err := arch.Import(target)
 	if err != nil {
 		return err
 	}
 
-	id, err := tree.Save(repo)
-	if err != nil {
-		return err
-	}
-
-	sn := khepri.NewSnapshot(target)
-	sn.Content = id
-	snid, err := sn.Save(repo)
-
-	if err != nil {
-		log.Printf("error saving snapshopt: %v", err)
-	}
-
-	fmt.Printf("%q archived as %v\n", target, snid)
+	fmt.Printf("snapshot %s saved\n", blob.Storage)
 
 	return nil
 }

cmd/khepri/cmd_dump.go

@@ -1,90 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"log"
-	"os"
-
-	"github.com/fd0/khepri"
-)
-
-func dump_tree(repo *khepri.Repository, id khepri.ID) error {
-	tree, err := khepri.NewTreeFromRepo(repo, id)
-	if err != nil {
-		return err
-	}
-
-	buf, err := json.MarshalIndent(tree, "", "  ")
-	if err != nil {
-		return err
-	}
-
-	fmt.Printf("tree %s\n%s\n", id, buf)
-
-	for _, node := range tree.Nodes {
-		if node.Type == "dir" {
-			err = dump_tree(repo, node.Subtree)
-			if err != nil {
-				fmt.Fprintf(os.Stderr, "error: %v\n", err)
-			}
-		}
-	}
-
-	return nil
-}
-
-func dump_snapshot(repo *khepri.Repository, id khepri.ID) error {
-	sn, err := khepri.LoadSnapshot(repo, id)
-	if err != nil {
-		log.Fatalf("error loading snapshot %s", id)
-	}
-
-	buf, err := json.MarshalIndent(sn, "", "  ")
-	if err != nil {
-		return err
-	}
-
-	fmt.Printf("%s\n%s\n", sn, buf)
-
-	return dump_tree(repo, sn.Content)
-}
-
-func dump_file(repo *khepri.Repository, id khepri.ID) error {
-	rd, err := repo.Get(khepri.TYPE_BLOB, id)
-	if err != nil {
-		return err
-	}
-
-	io.Copy(os.Stdout, rd)
-
-	return nil
-}
-
-func commandDump(repo *khepri.Repository, args []string) error {
-	if len(args) != 2 {
-		return errors.New("usage: dump [snapshot|tree|file] ID")
-	}
-
-	tpe := args[0]
-
-	id, err := khepri.ParseID(args[1])
-	if err != nil {
-		errx(1, "invalid id %q: %v", args[0], err)
-	}
-
-	switch tpe {
-	case "snapshot":
-		return dump_snapshot(repo, id)
-	case "tree":
-		return dump_tree(repo, id)
-	case "file":
-		return dump_file(repo, id)
-	default:
-		return fmt.Errorf("invalid type %q", tpe)
-	}
-
-	return nil
-}

cmd/khepri/cmd_fsck.go

@@ -1,84 +1,76 @@
 package main
 
-import (
-	"encoding/json"
-	"io/ioutil"
-	"log"
+import "github.com/fd0/khepri/backend"
 
-	"github.com/fd0/khepri"
-)
+// func fsck_tree(be backend.Server, id backend.ID) (bool, error) {
+// 	log.Printf("  checking dir %s", id)
 
-func fsck_tree(repo *khepri.Repository, id khepri.ID) (bool, error) {
-	log.Printf("  checking dir %s", id)
+// 	buf, err := be.GetBlob(id)
+// 	if err != nil {
+// 		return false, err
+// 	}
 
-	rd, err := repo.Get(khepri.TYPE_BLOB, id)
-	if err != nil {
-		return false, err
-	}
+// 	tree := &khepri.Tree{}
+// 	err = json.Unmarshal(buf, tree)
+// 	if err != nil {
+// 		return false, err
+// 	}
 
-	buf, err := ioutil.ReadAll(rd)
+// 	if !id.Equal(backend.IDFromData(buf)) {
+// 		return false, nil
+// 	}
 
-	tree := &khepri.Tree{}
-	err = json.Unmarshal(buf, tree)
-	if err != nil {
-		return false, err
-	}
+// 	return true, nil
+// }
 
-	if !id.Equal(khepri.IDFromData(buf)) {
-		return false, nil
-	}
+// func fsck_snapshot(be backend.Server, id backend.ID) (bool, error) {
+// 	log.Printf("checking snapshot %s", id)
 
-	return true, nil
-}
+// 	sn, err := khepri.LoadSnapshot(be, id)
+// 	if err != nil {
+// 		return false, err
+// 	}
 
-func fsck_snapshot(repo *khepri.Repository, id khepri.ID) (bool, error) {
-	log.Printf("checking snapshot %s", id)
+// 	return fsck_tree(be, sn.Content)
+// }
 
-	sn, err := khepri.LoadSnapshot(repo, id)
-	if err != nil {
-		return false, err
-	}
+func commandFsck(be backend.Server, args []string) error {
+	// var snapshots backend.IDs
+	// var err error
 
-	return fsck_tree(repo, sn.Content)
-}
+	// if len(args) != 0 {
+	// 	snapshots = make(backend.IDs, 0, len(args))
 
-func commandFsck(repo *khepri.Repository, args []string) error {
-	var snapshots khepri.IDs
-	var err error
+	// 	for _, arg := range args {
+	// 		id, err := backend.ParseID(arg)
+	// 		if err != nil {
+	// 			log.Fatal(err)
+	// 		}
 
-	if len(args) != 0 {
-		snapshots = make(khepri.IDs, 0, len(args))
+	// 		snapshots = append(snapshots, id)
+	// 	}
+	// } else {
+	// 	snapshots, err = be.ListRefs()
 
-		for _, arg := range args {
-			id, err := khepri.ParseID(arg)
-			if err != nil {
-				log.Fatal(err)
-			}
+	// 	if err != nil {
+	// 		log.Fatalf("error reading list of snapshot IDs: %v", err)
+	// 	}
+	// }
 
-			snapshots = append(snapshots, id)
-		}
-	} else {
-		snapshots, err = repo.List(khepri.TYPE_REF)
+	// log.Printf("checking %d snapshots", len(snapshots))
 
-		if err != nil {
-			log.Fatalf("error reading list of snapshot IDs: %v", err)
-		}
-	}
+	// for _, id := range snapshots {
+	// 	ok, err := fsck_snapshot(be, id)
 
-	log.Printf("checking %d snapshots", len(snapshots))
+	// 	if err != nil {
+	// 		log.Printf("error checking snapshot %s: %v", id, err)
+	// 		continue
+	// 	}
 
-	for _, id := range snapshots {
-		ok, err := fsck_snapshot(repo, id)
-
-		if err != nil {
-			log.Printf("error checking snapshot %s: %v", id, err)
-			continue
-		}
-
-		if !ok {
-			log.Printf("snapshot %s failed", id)
-		}
-	}
+	// 	if !ok {
+	// 		log.Printf("snapshot %s failed", id)
+	// 	}
+	// }
 
 	return nil
 }

cmd/khepri/cmd_init.go

@@ -5,16 +5,30 @@ import (
 	"os"
 
 	"github.com/fd0/khepri"
+	"github.com/fd0/khepri/backend"
 )
 
 func commandInit(path string) error {
-	repo, err := khepri.CreateRepository(path)
+	pw := read_password("enter password for new backend: ")
+	pw2 := read_password("enter password again: ")
+
+	if pw != pw2 {
+		errx(1, "passwords do not match")
+	}
+
+	be, err := backend.CreateLocal(path)
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "creating repository at %s failed: %v\n", path, err)
+		fmt.Fprintf(os.Stderr, "creating local backend at %s failed: %v\n", path, err)
 		os.Exit(1)
 	}
 
-	fmt.Printf("created khepri repository at %s\n", repo.Path())
+	_, err = khepri.CreateKey(be, pw)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "creating key in local backend at %s failed: %v\n", path, err)
+		os.Exit(1)
+	}
+
+	fmt.Printf("created khepri backend at %s\n", be.Location())
 
 	return nil
 }

cmd/khepri/cmd_list.go

@@ -1,29 +1,21 @@
 package main
 
 import (
-	"errors"
-	"fmt"
-	"os"
-
 	"github.com/fd0/khepri"
+	"github.com/fd0/khepri/backend"
 )
 
-func commandList(repo *khepri.Repository, args []string) error {
-	if len(args) != 1 {
-		return errors.New("usage: list [blob|ref]")
-	}
+func commandList(be backend.Server, key *khepri.Key, args []string) error {
 
-	tpe := khepri.NewTypeFromString(args[0])
+	// ids, err := be.ListRefs()
+	// if err != nil {
+	// 	fmt.Fprintf(os.Stderr, "error: %v\n", err)
+	// 	return nil
+	// }
 
-	ids, err := repo.List(tpe)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "error: %v\n", err)
-		return nil
-	}
-
-	for _, id := range ids {
-		fmt.Printf("%v\n", id)
-	}
+	// for _, id := range ids {
+	// 	fmt.Printf("%v\n", id)
+	// }
 
 	return nil
 }

cmd/khepri/cmd_restore.go

@@ -2,34 +2,54 @@ package main
 
 import (
 	"errors"
-	"log"
+	"fmt"
+	"os"
 
 	"github.com/fd0/khepri"
+	"github.com/fd0/khepri/backend"
 )
 
-func commandRestore(repo *khepri.Repository, args []string) error {
+func commandRestore(be backend.Server, key *khepri.Key, args []string) error {
 	if len(args) != 2 {
 		return errors.New("usage: restore ID dir")
 	}
 
-	id, err := khepri.ParseID(args[0])
+	id, err := backend.ParseID(args[0])
 	if err != nil {
 		errx(1, "invalid id %q: %v", args[0], err)
 	}
 
 	target := args[1]
 
-	sn, err := khepri.LoadSnapshot(repo, id)
+	// create restorer
+	res, err := khepri.NewRestorer(be, key, id)
 	if err != nil {
-		log.Fatalf("error loading snapshot %s: %v", id, err)
+		fmt.Fprintf(os.Stderr, "creating restorer failed: %v\n", err)
+		os.Exit(2)
 	}
 
-	err = sn.RestoreAt(target)
-	if err != nil {
-		log.Fatalf("error restoring snapshot %s: %v", id, err)
+	res.Error = func(dir string, node *khepri.Node, err error) error {
+		fmt.Fprintf(os.Stderr, "error for %s: %+v\n", dir, err)
+
+		// if node.Type == "dir" {
+		// 	if e, ok := err.(*os.PathError); ok {
+		// 		if errn, ok := e.Err.(syscall.Errno); ok {
+		// 			if errn == syscall.EEXIST {
+		// 				fmt.Printf("ignoring already existing directory %s\n", dir)
+		// 				return nil
+		// 			}
+		// 		}
+		// 	}
+		// }
+		return err
 	}
 
-	log.Printf("%q restored to %q\n", id, target)
+	fmt.Printf("restoring %s to %s\n", res.Snapshot(), target)
+
+	err = res.RestoreTo(target)
+	if err != nil {
+		return err
+	}
 
 	return nil
 }

cmd/khepri/cmd_snapshots.go

@@ -3,39 +3,34 @@ package main
 import (
 	"errors"
 	"fmt"
-	"log"
 
 	"github.com/fd0/khepri"
+	"github.com/fd0/khepri/backend"
 )
 
 const TimeFormat = "02.01.2006 15:04:05 -0700"
 
-func commandSnapshots(repo *khepri.Repository, args []string) error {
+func commandSnapshots(be backend.Server, key *khepri.Key, args []string) error {
 	if len(args) != 0 {
 		return errors.New("usage: snapshots")
 	}
 
-	snapshot_ids, err := repo.List(khepri.TYPE_REF)
-	if err != nil {
-		log.Fatalf("error loading list of snapshot ids: %v", err)
-	}
+	// ch, err := khepri.NewContentHandler(be, key)
+	// if err != nil {
+	// 	return err
+	// }
 
-	fmt.Printf("found snapshots:\n")
-	for _, id := range snapshot_ids {
-		snapshot, err := khepri.LoadSnapshot(repo, id)
+	backend.EachID(be, backend.Snapshot, func(id backend.ID) {
+		// sn, err := ch.LoadSnapshot(id)
+		// if err != nil {
+		// 	fmt.Fprintf(os.Stderr, "error loading snapshot %s: %v\n", id, err)
+		// 	return
+		// }
 
-		if err != nil {
-			log.Printf("error loading snapshot %s: %v", id, err)
-			continue
-		}
-
-		fmt.Printf("%s %s@%s %s %s\n",
-			snapshot.Time.Format(TimeFormat),
-			snapshot.Username,
-			snapshot.Hostname,
-			snapshot.Dir,
-			id)
-	}
+		// fmt.Printf("snapshot %s\n    %s at %s by %s\n",
+		// 	id, sn.Dir, sn.Time, sn.Username)
+		fmt.Println(id)
+	})
 
 	return nil
 }

cmd/khepri/main.go

@@ -4,8 +4,13 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"sort"
+	"strings"
+
+	"code.google.com/p/go.crypto/ssh/terminal"
 
 	"github.com/fd0/khepri"
+	"github.com/fd0/khepri/backend"
 	"github.com/jessevdk/go-flags"
 )
 
@@ -21,18 +26,32 @@ func errx(code int, format string, data ...interface{}) {
 	os.Exit(code)
 }
 
-type commandFunc func(*khepri.Repository, []string) error
+type commandFunc func(backend.Server, *khepri.Key, []string) error
 
 var commands map[string]commandFunc
 
+func read_password(prompt string) string {
+	p := os.Getenv("KHEPRI_PASSWORD")
+	if p != "" {
+		return p
+	}
+
+	fmt.Print(prompt)
+	pw, err := terminal.ReadPassword(int(os.Stdin.Fd()))
+	if err != nil {
+		errx(2, "unable to read password: %v", err)
+	}
+	fmt.Println()
+
+	return string(pw)
+}
+
 func init() {
 	commands = make(map[string]commandFunc)
 	commands["backup"] = commandBackup
 	commands["restore"] = commandRestore
 	commands["list"] = commandList
 	commands["snapshots"] = commandSnapshots
-	commands["fsck"] = commandFsck
-	commands["dump"] = commandDump
 }
 
 func main() {
@@ -42,12 +61,22 @@ func main() {
 	if Opts.Repo == "" {
 		Opts.Repo = "khepri-backup"
 	}
-	args, err := flags.Parse(&Opts)
 
+	args, err := flags.Parse(&Opts)
 	if e, ok := err.(*flags.Error); ok && e.Type == flags.ErrHelp {
 		os.Exit(0)
 	}
 
+	if len(args) == 0 {
+		cmds := []string{"init"}
+		for k := range commands {
+			cmds = append(cmds, k)
+		}
+		sort.Strings(cmds)
+		fmt.Printf("nothing to do, available commands: [%v]\n", strings.Join(cmds, "|"))
+		os.Exit(0)
+	}
+
 	cmd := args[0]
 
 	if cmd == "init" {
@@ -64,13 +93,18 @@ func main() {
 		errx(1, "unknown command: %q\n", cmd)
 	}
 
-	repo, err := khepri.NewRepository(Opts.Repo)
-
+	// read_password("enter password: ")
+	repo, err := backend.OpenLocal(Opts.Repo)
 	if err != nil {
 		errx(1, "unable to open repo: %v", err)
 	}
 
-	err = f(repo, args[1:])
+	key, err := khepri.SearchKey(repo, read_password("Enter Password for Repository: "))
+	if err != nil {
+		errx(2, "unable to open repo: %v", err)
+	}
+
+	err = f(repo, key, args[1:])
 	if err != nil {
 		errx(1, "error executing command %q: %v", cmd, err)
 	}

cmd/list/main.go

@@ -0,0 +1,110 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"code.google.com/p/go.crypto/ssh/terminal"
+
+	"github.com/fd0/khepri"
+	"github.com/fd0/khepri/backend"
+)
+
+func read_password(prompt string) string {
+	p := os.Getenv("KHEPRI_PASSWORD")
+	if p != "" {
+		return p
+	}
+
+	fmt.Print(prompt)
+	pw, err := terminal.ReadPassword(int(os.Stdin.Fd()))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "unable to read password: %v", err)
+		os.Exit(2)
+	}
+	fmt.Println()
+
+	return string(pw)
+}
+
+func list(be backend.Server, key *khepri.Key, t backend.Type) {
+	ids, err := be.List(t)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed: %v\n", err)
+		os.Exit(3)
+	}
+
+	for _, id := range ids {
+		buf, err := be.Get(t, id)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "unable to get snapshot %s: %v\n", id, err)
+			continue
+		}
+
+		if t != backend.Key && t != backend.Blob {
+			buf, err = key.Decrypt(buf)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "error: %v\n", err)
+				continue
+			}
+
+		}
+
+		if t == backend.Snapshot {
+			var sn khepri.Snapshot
+			err = json.Unmarshal(backend.Uncompress(buf), &sn)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "error: %v\n", err)
+				continue
+			}
+
+			fmt.Printf("%s %s\n", id, sn.String())
+		} else if t == backend.Blob {
+			fmt.Printf("%s %d bytes (encrypted)\n", id, len(buf))
+		} else if t == backend.Tree {
+			fmt.Printf("%s\n", backend.Hash(buf))
+		} else if t == backend.Key {
+			k := &khepri.Key{}
+			err = json.Unmarshal(buf, k)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "unable to unmashal key: %v\n", err)
+				continue
+			}
+			fmt.Println(key)
+		} else if t == backend.Lock {
+			fmt.Printf("lock: %v\n", id)
+		}
+	}
+}
+
+func main() {
+	if len(os.Args) != 2 {
+		fmt.Fprintf(os.Stderr, "usage: archive REPO\n")
+		os.Exit(1)
+	}
+	repo := os.Args[1]
+
+	be, err := backend.OpenLocal(repo)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed: %v\n", err)
+		os.Exit(1)
+	}
+
+	key, err := khepri.SearchKey(be, read_password("Enter Password for Repository: "))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed: %v\n", err)
+		os.Exit(2)
+	}
+
+	fmt.Printf("keys:\n")
+	list(be, key, backend.Key)
+	fmt.Printf("---\nlocks:\n")
+	list(be, key, backend.Lock)
+	fmt.Printf("---\nsnapshots:\n")
+	list(be, key, backend.Snapshot)
+	fmt.Printf("---\ntrees:\n")
+	list(be, key, backend.Tree)
+	fmt.Printf("---\nblobs:\n")
+	list(be, key, backend.Blob)
+}