tursodatabase/turso

Support `VACUUM INTO` to create an encrypted db

Open

#5,852 opened on Mar 11, 2026

View on GitHub
 (2 comments) (0 reactions) (0 assignees)Rust (1,001 forks)github user discovery
encryptiongood first issue

Repository metrics

Stars
 (19,103 stars)
PR merge metrics
 (PR metrics pending)

Description

The source db can be either encrypted or non encrypted. If the destination URI mentions encryption params, then it should produce an encrypted db. The tests also should make sure that db hash matches post vacuum.

If the source is already encrypted, then we should also that we are able to vacuum into another encrypted db but with different cipher settings.

The URI params should be like existing one: ?cipher=aegis256&hexkey=b1bbfda4f589dc9daaf004fe21111e00dc00c98237102f5c7002a5669fc76327

Contributor guide

Research direction
Examine the existing VACUUM implementation and encryption parameter handling in the codebase. Start by looking at how VACUUM is currently implemented and how encryption parameters are parsed from URIs. Then implement modifications to pass encryption parameters to the destination database during VACUUM INTO. Ensure tests verify both encrypted and non encrypted source scenarios.
Tech stack
rust
Domain
databasebackend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
RustSQLite internalsEncryption concepts
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30