Add SQLite3MultipleCiphers 2.3.3 support (SQLite 3.53.0)

.github/workflows/cifuzz.yaml

@@ -22,7 +22,7 @@ jobs:
        dry-run: false
        sanitizer: ${{ matrix.sanitizer }}
    - name: Upload Crash
-     uses: actions/upload-artifact@v1
+     uses: actions/upload-artifact@v4
      if: failure()
      with:
        name: ${{ matrix.sanitizer }}-artifacts

.github/workflows/docker.yaml

@@ -13,10 +13,9 @@ jobs:
     name: Run Dockerfiles in examples
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: Run example - simple
         run: |
-          cd ./_example/simple
-          docker build -t simple .
+          docker build -t simple -f ./_example/simple/Dockerfile .
           docker run simple | grep 99\ こんにちは世界099

.github/workflows/go.yaml

@@ -14,7 +14,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
-        go: ['1.18', '1.19', '1.20']
+        go: ['1.24', '1.25', '1.26']
       fail-fast: false
     env:
       OS: ${{ matrix.os }}
@@ -23,7 +23,7 @@ jobs:
       - if: startsWith(matrix.os, 'macos')
         run: brew update
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go }}
 
@@ -35,7 +35,7 @@ jobs:
         run: |
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: 'Tags: default'
         run: go-acc . -- -race -v -tags ""
@@ -44,13 +44,13 @@ jobs:
         run: go-acc . -- -race -v -tags "libsqlite3"
 
       - name: 'Tags: full'
-        run: go-acc . -- -race -v -tags "sqlite_allow_uri_authority sqlite_app_armor sqlite_column_metadata sqlite_foreign_keys sqlite_fts5 sqlite_icu sqlite_introspect sqlite_json sqlite_math_functions sqlite_os_trace sqlite_preupdate_hook sqlite_secure_delete sqlite_see sqlite_stat4 sqlite_trace sqlite_unlock_notify sqlite_userauth sqlite_vacuum_incr sqlite_vtable"
+        run: go-acc . -- -race -v -tags "sqlite_allow_uri_authority sqlite_app_armor sqlite_column_metadata sqlite_foreign_keys sqlite_fts5 sqlite_icu sqlite_introspect sqlite_json sqlite_math_functions sqlite_os_trace sqlite_preupdate_hook sqlite_secure_delete sqlite_see sqlite_stat4 sqlite_trace sqlite_unlock_notify sqlite_vacuum_incr sqlite_vtable"
 
       - name: 'Tags: vacuum'
         run: go-acc . -- -race -v -tags "sqlite_vacuum_full"
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@v5
         with:
           env_vars: OS,GO
           file: coverage.txt
@@ -64,7 +64,7 @@ jobs:
 
     strategy:
       matrix:
-        go: ['1.18', '1.19', '1.20']
+        go: ['1.24', '1.25', '1.26']
       fail-fast: false
     env:
       OS: windows-latest
@@ -77,7 +77,7 @@ jobs:
           msystem: MINGW64
           path-type: inherit
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go }}
 
@@ -86,7 +86,7 @@ jobs:
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
         shell: msys2 {0}
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: 'Tags: default'
         run: go build -race -v -tags ""
@@ -99,15 +99,15 @@ jobs:
       - name: 'Tags: full'
         run: |
           echo 'skip this test'
-          echo go build -race -v -tags "sqlite_allow_uri_authority sqlite_app_armor sqlite_column_metadata sqlite_foreign_keys sqlite_fts5 sqlite_icu sqlite_introspect sqlite_json sqlite_math_functions sqlite_preupdate_hook sqlite_secure_delete sqlite_see sqlite_stat4 sqlite_trace sqlite_unlock_notify sqlite_userauth sqlite_vacuum_incr sqlite_vtable"
+          echo go build -race -v -tags "sqlite_allow_uri_authority sqlite_app_armor sqlite_column_metadata sqlite_foreign_keys sqlite_fts5 sqlite_icu sqlite_introspect sqlite_json sqlite_math_functions sqlite_preupdate_hook sqlite_secure_delete sqlite_see sqlite_stat4 sqlite_trace sqlite_unlock_notify sqlite_vacuum_incr sqlite_vtable"
         shell: msys2 {0}
 
       - name: 'Tags: vacuum'
         run: go build -race -v -tags "sqlite_vacuum_full"
         shell: msys2 {0}
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@v5
         with:
           env_vars: OS,GO
           file: coverage.txt

README.md

@@ -35,17 +35,19 @@ This package follows the official [Golang Release Policy](https://golang.org/doc
   - [Android](#android)
 - [ARM](#arm)
 - [Cross Compile](#cross-compile)
-- [Google Cloud Platform](#google-cloud-platform)
+- [Compiling](#compiling)
   - [Linux](#linux)
     - [Alpine](#alpine)
     - [Fedora](#fedora)
     - [Ubuntu](#ubuntu)
   - [macOS](#mac-osx)
   - [Windows](#windows)
   - [Errors](#errors)
-- [User Authentication](#user-authentication)
-  - [Compile](#compile)
+- [Encryption](#encryption)
   - [Usage](#usage-1)
+- [User Authentication](#user-authentication)
+  - [Compile](#compile-1)
+  - [Usage](#usage-2)
     - [Create protected database](#create-protected-database)
     - [Password Encoding](#password-encoding)
       - [Available Encoders](#available-encoders)
@@ -70,9 +72,8 @@ This package can be installed with the `go get` command:
 
 _go-sqlite3_ is *cgo* package.
 If you want to build your app using go-sqlite3, you need gcc.
-However, after you have built and installed _go-sqlite3_ with `go install github.com/mattn/go-sqlite3` (which requires gcc), you can build your app without relying on gcc in future.
 
-***Important: because this is a `CGO` enabled package, you are required to set the environment variable `CGO_ENABLED=1` and have a `gcc` compile present within your path.***
+***Important: because this is a `CGO` enabled package, you are required to set the environment variable `CGO_ENABLED=1` and have a `gcc` compiler present within your path.***
 
 # API Reference
 
@@ -109,12 +110,21 @@ Boolean values can be one of:
 | Auto Vacuum | `_auto_vacuum` \| `_vacuum` | <ul><li>`0` \| `none`</li><li>`1` \| `full`</li><li>`2` \| `incremental`</li></ul> | For more information see [PRAGMA auto_vacuum](https://www.sqlite.org/pragma.html#pragma_auto_vacuum) |
 | Busy Timeout | `_busy_timeout` \| `_timeout` | `int` | Specify value for sqlite3_busy_timeout. For more information see [PRAGMA busy_timeout](https://www.sqlite.org/pragma.html#pragma_busy_timeout) |
 | Case Sensitive LIKE | `_case_sensitive_like` \| `_cslike` | `boolean` | For more information see [PRAGMA case_sensitive_like](https://www.sqlite.org/pragma.html#pragma_case_sensitive_like) |
+| Cipher | `_cipher` | `string` | Selects the cipher to be used for encrypting the database, for more information see [PRAGMA cipher](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-cipher) |
 | Defer Foreign Keys | `_defer_foreign_keys` \| `_defer_fk` | `boolean` | For more information see [PRAGMA defer_foreign_keys](https://www.sqlite.org/pragma.html#pragma_defer_foreign_keys) |
 | Foreign Keys | `_foreign_keys` \| `_fk` | `boolean` | For more information see [PRAGMA foreign_keys](https://www.sqlite.org/pragma.html#pragma_foreign_keys) |
+| Check HMAC | `_hmac_check` | `boolean` | Selects whether the HMAC should be validated on read operations for encryption schemes using HMACs, for more information see [PRAGMA hmac_check](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-hmac_check) |
+| Use HMAC | `_hmac_use` | `boolean` | Enable or disable the use of per-page HMACs for the cipher scheme SQLCipher, for more information see [PRAGMA hmac_use](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-hmac_use) |
 | Ignore CHECK Constraints | `_ignore_check_constraints` | `boolean` | For more information see [PRAGMA ignore_check_constraints](https://www.sqlite.org/pragma.html#pragma_ignore_check_constraints) |
 | Immutable | `immutable` | `boolean` | For more information see [Immutable](https://www.sqlite.org/c3ref/open.html) |
 | Journal Mode | `_journal_mode` \| `_journal` | <ul><li>DELETE</li><li>TRUNCATE</li><li>PERSIST</li><li>MEMORY</li><li>WAL</li><li>OFF</li></ul> | For more information see [PRAGMA journal_mode](https://www.sqlite.org/pragma.html#pragma_journal_mode) |
+| KDF iterations | `_kdf_iter` | `int` | Specifies the number of iterations used for key derivation, for more information see [PRAGMA kdf_iter](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-kdf_iter) |
+| Encryption key | `_key` | `string` | Sets the database encryption key, for more information see [PRAGMA key](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-key) |
+| Legacy | `_legacy` | `int` | Defines the legacy mode for a cipher scheme, for more information see [PRAGMA legacy](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-legacy) |
+| Legacy page size | `_legacy_page_size` | `int` | Specifies the database page size to be used in legacy mode for a cipher scheme, for more information see [PRAGMA legacy_page_size](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-legacy_page_size) |
 | Locking Mode | `_locking_mode` \| `_locking` | <ul><li>NORMAL</li><li>EXCLUSIVE</li></ul> | For more information see [PRAGMA locking_mode](https://www.sqlite.org/pragma.html#pragma_locking_mode) |
+| MC Legacy WAL | `_mc_legacy_wal` | `boolean` | Selects whether the legacy mode for the WAL journal encryption should be used, for more information see [PRAGMA mc_legacy_wal](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-mc_legacy_wal) |
+| Plaintext header size | `_plaintext_header_size` | `int` | Allocates a portion of the database header which will not be encrypted to allow identification as an SQLite database, for more information see [PRAGMA plaintext_header_size](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-plaintext_header_size) |
 | Mode | `mode` | <ul><li>ro</li><li>rw</li><li>rwc</li><li>memory</li></ul> | Access Mode of the database. For more information see [SQLite Open](https://www.sqlite.org/c3ref/open.html) |
 | Mutex Locking | `_mutex` | <ul><li>no</li><li>full</li></ul> | Specify mutex mode. |
 | Query Only | `_query_only` | `boolean` | For more information see [PRAGMA query_only](https://www.sqlite.org/pragma.html#pragma_query_only) |
@@ -126,6 +136,7 @@ Boolean values can be one of:
 | Transaction Lock | `_txlock` | <ul><li>immediate</li><li>deferred</li><li>exclusive</li></ul> | Specify locking behavior for transactions. |
 | Writable Schema | `_writable_schema` | `Boolean` | When this pragma is on, the SQLITE_MASTER tables in which database can be changed using ordinary UPDATE, INSERT, and DELETE statements. Warning: misuse of this pragma can easily result in a corrupt database file. |
 | Cache Size | `_cache_size` | `int` | Maximum cache size; default is 2000K (2M). See [PRAGMA cache_size](https://sqlite.org/pragma.html#pragma_cache_size) |
+| Statement Cache Size | `_stmt_cache_size` | `int` | Maximum number of prepared statements cached per connection; default is 0 (disabled). Note that `sql.DB` is a connection pool, so each connection maintains its own independent cache. |
 
 
 ## DSN Examples
@@ -175,6 +186,7 @@ go build -tags "icu json1 fts5 secure_delete"
 | JSON SQL Functions | sqlite_json | When this option is defined in the amalgamation, the JSON SQL functions are added to the build automatically |
 | Math Functions | sqlite_math_functions | This compile-time option enables built-in scalar math functions. For more information see [Built-In Mathematical SQL Functions](https://www.sqlite.org/lang_mathfunc.html) |
 | OS Trace | sqlite_os_trace | This option enables OSTRACE() debug logging. This can be verbose and should not be used in production. |
+| Percentile | sqlite_percentile | This option enables [The Percentile Extension](sqlite.org/percentile.html). |
 | Pre Update Hook | sqlite_preupdate_hook | Registers a callback function that is invoked prior to each INSERT, UPDATE, and DELETE operation on a database table. |
 | Secure Delete | sqlite_secure_delete | This compile-time option changes the default setting of the secure_delete pragma.<br><br>When this option is not used, secure_delete defaults to off. When this option is present, secure_delete defaults to on.<br><br>The secure_delete setting causes deleted content to be overwritten with zeros. There is a small performance penalty since additional I/O must occur.<br><br>On the other hand, secure_delete can prevent fragments of sensitive information from lingering in unused parts of the database file after it has been deleted. See the documentation on the secure_delete pragma for additional information |
 | Secure Delete (FAST) | sqlite_secure_delete_fast | For more information see [PRAGMA secure_delete](https://www.sqlite.org/pragma.html#pragma_secure_delete) |
@@ -228,11 +240,7 @@ Steps:
 
 Please refer to the project's [README](https://github.com/FiloSottile/homebrew-musl-cross#readme) for further information.
 
-# Google Cloud Platform
-
-Building on GCP is not possible because Google Cloud Platform does not allow `gcc` to be executed.
-
-Please work only with compiled final binaries.
+# Compiling
 
 ## Linux
 
@@ -354,8 +362,17 @@ For example the TDM-GCC Toolchain can be found [here](https://jmeubank.github.io
     go install github.com/mattn/go-sqlite3
     ```
 
+# Encryption
+
+## Usage
+
+Pass your encryption key via the `_key` argument in the connection string.
+See the [SQLite3MultipleCiphers documentation](https://utelle.github.io/SQLite3MultipleCiphers/docs/configuration/config_sql_pragmas/#pragma-key) for more details.
+
 # User Authentication
 
+***This is deprecated***
+
 This package supports the SQLite User Authentication module.
 
 ## Compile
@@ -594,7 +611,7 @@ sqlite3-binding.c, sqlite3-binding.h, sqlite3ext.h
 
 The -binding suffix was added to avoid build failures under gccgo.
 
-In this repository, those files are an amalgamation of code that was copied from SQLite3. The license of that code is the same as the license of SQLite3.
+In this repository, those files are an amalgamation of code that was copied from SQLite3 and SQLite3MultipleCiphers. The license of that code is the same as the licenses of SQLite3 and SQLite3MultipleCiphers.
 
 # Author
 

SECURITY.md

@@ -0,0 +1,33 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release on the `v1.14.x` line receives security fixes.
+
+| Version  | Supported          |
+| -------- | ------------------ |
+| 1.14.x   | :white_check_mark: |
+| < 1.14   | :x:                |
+
+## Scope
+
+`go-sqlite3` is a CGo binding that bundles the SQLite amalgamation
+(`sqlite3-binding.c` / `sqlite3-binding.h`). Please report issues to the
+appropriate project:
+
+- Bugs in the Go binding layer, CGo glue, build tags, or this repository's
+  own code: report here.
+- Vulnerabilities in SQLite itself: please report them upstream to the
+  SQLite developers at <https://www.sqlite.org/>. Once a fix is released
+  upstream, this repository will update the bundled amalgamation.
+
+## Reporting a Vulnerability
+
+Please **do not** open a public GitHub issue for security problems.
+
+Use GitHub's private vulnerability reporting:
+<https://github.com/mattn/go-sqlite3/security/advisories/new>
+
+This project is maintained on a best-effort basis by volunteers, so please
+allow reasonable time for investigation and a fix before any public
+d

_example/json/json.go

@@ -0,0 +1,129 @@
+package main
+
+import (
+	"database/sql"
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+	_ "github.com/mattn/go-sqlite3"
+	"log"
+	"os"
+)
+
+type Tag struct {
+	Name    string `json:"name"`
+	Country string `json:"country"`
+}
+
+func (t *Tag) Scan(value interface{}) error {
+	return json.Unmarshal([]byte(value.(string)), t)
+}
+
+func (t *Tag) Value() (driver.Value, error) {
+	b, err := json.Marshal(t)
+	return string(b), err
+}
+
+func main() {
+	os.Remove("./foo.db")
+
+	db, err := sql.Open("sqlite3", "./foo.db")
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer db.Close()
+
+	// Using a json-typed column
+	// Verify type: `create table foo (tag text) strict`
+	_, err = db.Exec(`create table foo (tag json)`)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	stmt, err := db.Prepare("insert into foo(tag) values(?)")
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer stmt.Close()
+	_, err = stmt.Exec(`{"name": "mattn", "country": "japan"}`)
+	if err != nil {
+		log.Fatal(err)
+	}
+	_, err = stmt.Exec(`{"name": "michael", "country": "usa"}`)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	var country string
+	err = db.QueryRow("select tag->>'country' from foo where tag->>'name' = 'mattn'").Scan(&country)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(country)
+
+	var tag Tag
+	err = db.QueryRow("select tag from foo where tag->>'name' = 'mattn'").Scan(&tag)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	fmt.Println(tag.Name)
+
+	tag.Country = "日本"
+	_, err = db.Exec(`update foo set tag = ? where tag->>'name' == 'mattn'`, &tag)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	err = db.QueryRow("select tag->>'country' from foo where tag->>'name' = 'mattn'").Scan(&country)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(country)
+
+	// Using a jsonb-typed column
+	// Verify type: `create table bar (tag blob) strict`
+	_, err = db.Exec(`create table bar (tag jsonb)`)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	stmt, err = db.Prepare("insert into bar(tag) values(jsonb(?))")
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer stmt.Close()
+	_, err = stmt.Exec(`{"name": "mattn", "country": "japan"}`)
+	if err != nil {
+		log.Fatal(err)
+	}
+	_, err = stmt.Exec(`{"name": "michael", "country": "usa"}`)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	err = db.QueryRow("select tag->>'country' from bar where tag->>'name' = 'mattn'").Scan(&country)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(country)
+
+	err = db.QueryRow("select json(tag) from bar where tag->>'name' = 'mattn'").Scan(&tag)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	fmt.Println(tag.Name)
+
+	tag.Country = "日本"
+	_, err = db.Exec(`update bar set tag = jsonb(?) where tag->>'name' == 'mattn'`, &tag)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	err = db.QueryRow("select tag->>'country' from bar where tag->>'name' = 'mattn'").Scan(&country)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(country)
+}