4 ms·
You could possibly use ZFS with sha256 checksums for that purpose? You would have to somehow sign the merkle root each time you write it, not sure how easy that
by mkj 5y ago
You could possibly use ZFS with sha256 checksums for that purpose? You would have to somehow sign the merkle root each time you write it, not sure how easy that would be. Perhaps write it to another partition and hope it's atomic enough? Or ZFS encryption would probably do it already if you don't need the system in cleartext.
https://blogs.oracle.com/bonwick/zfs-end-to-end-data-integrity https://blogs.oracle.com/bonwick/zfs-end-to-end-data-integri...
- strstr 5y agoYou then have write amplification from the merkle tree. Ignoring performance, something like this should be possible though. For atomicity, there’s going to be some clever journaling based solution.
- t0mas88 5y agoThe tricky part with modifications is described in the article: You would have to have the signing key available on the system which usually means it could be extracted from that system and then looses all protections.