Function prepare_snapshot_db

src/pipeline/artifact.c:487–542

Prepare a stripped DB copy for best-quality export. * VACUUM INTO → (optionally) drop indexes → VACUUM. Returns malloc'd buffer * or NULL. VACUUM INTO runs on BOTH quality levels: it is the consistent * snapshot — the store runs in WAL mode, so raw main-file bytes miss * committed transactions still in the -wal and can be mid-checkpoint torn * (#895). Only the index-stripping is BEST-only. */

 * committed transactions still in the -wal and can be mid-checkpoint torn
 * (#895). Only the index-stripping is BEST-only. */
static char *prepare_snapshot_db(const char *db_path, size_t *out_size, bool strip_indexes) {
    artifact_snapshot_tmp_t tmp;
    if (!artifact_snapshot_tmp_open(&tmp)) {
        artifact_export_fail("prepare_snapshot_dir", cbm_tmpdir(), "private_tmpdir_failed", errno);
        return NULL;
    }
    /* Fresh private directory ⇒ the destination is absent by construction, which
     * is exactly what VACUUM INTO requires. The old unlink-the-stale-file step
     * is gone with the fixed name it existed to clear. */
    const char *tmp_path = tmp.db;

    /* VACUUM INTO: clean compacted copy. Use raw sqlite3 to bypass store authorizer
     * (which blocks ATTACH, used internally by VACUUM INTO). */
    sqlite3 *raw_db = NULL;
    if (sqlite3_open_v2(db_path, &raw_db, SQLITE_OPEN_READWRITE, NULL) != SQLITE_OK) {
        const char *err = raw_db ? sqlite3_errmsg(raw_db) : "sqlite_open";
        artifact_export_fail("open_source_db", db_path, err, 0);
        sqlite3_close(raw_db);
        artifact_snapshot_tmp_close(&tmp);
        return NULL;
    }

    char vacuum_sql[CBM_SZ_4K];
    snprintf(vacuum_sql, sizeof(vacuum_sql), "VACUUM INTO '%s';", tmp_path);
    char *errmsg = NULL;
    int vrc = sqlite3_exec(raw_db, vacuum_sql, NULL, NULL, &errmsg);
    sqlite3_close(raw_db);

    if (vrc != SQLITE_OK) {
        artifact_export_fail("vacuum_into", tmp_path, errmsg ? errmsg : sqlite3_errstr(vrc), 0);
        sqlite3_free(errmsg);
        artifact_snapshot_tmp_close(&tmp);
        return NULL;
    }

    /* Strip indexes from the copy for better compression (BEST only). */
    if (strip_indexes) {
        sqlite3 *tmp_db = NULL;
        if (sqlite3_open_v2(tmp_path, &tmp_db, SQLITE_OPEN_READWRITE, NULL) == SQLITE_OK) {
            sqlite3_exec(tmp_db, DROP_INDEXES_SQL, NULL, NULL, NULL);
            sqlite3_exec(tmp_db, "VACUUM;", NULL, NULL, NULL);
            sqlite3_close(tmp_db);
        }
    }

    /* Reopened by path rather than held on a descriptor across VACUUM INTO,
     * because sqlite owns the create. The private directory is what makes that
     * safe: an attacker who cannot enter it cannot swap the file underneath. */
    char *data = read_file_alloc(tmp_path, out_size);
    if (!data || *out_size == 0) {
        artifact_export_fail("read_stripped_db", tmp_path, "empty_or_unreadable", errno);
    }
    /* Removes the copy, its WAL/SHM sidecars, and the private directory. */
    artifact_snapshot_tmp_close(&tmp);
    return data;
}

/* ── Export ───────────────────────────────────────────────────────── */