Commands / kosa8 snapshot encrypt

kosa8 snapshot encrypt

Encrypt a snapshot at rest and wipe its plaintext

Usage

kosa8 encrypt SNAPSHOT

Encrypts every artifact of the snapshot — saved memory and disk clones — with AES-256-GCM under a data key of its own, wrapped by this machine's key-encryption key (kosa8 key status), then overwrites and deletes the plaintext. Restoring it decrypts transparently. Deleting it destroys the data key, which makes every copy of it unreadable (crypto-shred).

Encrypting is not sealing. A sealed snapshot carries a signature over its files (kosa8 snapshot seal), and encrypting it would change every one of them, so it is refused: encrypt first, then seal.