* fix: compile SQLite 3.53.0 from source to fix WAL-reset corruption bug
The python:3.12-slim base ships SQLite 3.46.1 (Debian Trixie), which is
vulnerable to the WAL-reset corruption bug discovered March 2026.
Debian has not backported the fix.
Compiles SQLite 3.53.0 from the official amalgamation tarball during the
Docker build. Installs to /usr/local/lib (takes ldconfig priority over
/usr/lib). Build tools (gcc, make, libc6-dev) are purged in the same
layer. A build-time Python assertion fails the image build if the linked
library is still vulnerable.
Version and year are build args for easy bumps.
https://sqlite.org/wal.html#walresetbug
* fix: enable FTS5/FTS4/R-Tree and pin tarball SHA-256
Address review feedback (nesquena-hermes):
1. Add --enable-fts5 --enable-fts4 --enable-rtree to ./configure so the
compiled SQLite matches the distro package's feature set. Without
FTS5, state.db session/message full-text search breaks silently.
2. Pin the amalgamation tarball SHA-256 as a build arg and verify with
sha256sum -c before extraction.
3. Extend the build-time assertion to create and drop an FTS5 virtual
table, proving the module is available - not just the version number.
4. Add regression tests for checksum verification, FTS5 configure flag,
and FTS5 build-time vtable assertion.
* docker(sqlite): compile with SQLITE_SECURE_DELETE to preserve deleted-row erasure
Codex gate found a SILENT data-privacy regression: the Debian base image's SQLite is
built with SQLITE_SECURE_DELETE (PRAGMA secure_delete=1, deleted content overwritten),
but compiling 3.53.0 from the amalgamation without the flag drops it to 0 -> deleting a
session removes its rows but leaves transcript bytes recoverable in state.db. Reproduced
end-to-end via api/models.py delete path. Add CPPFLAGS=-DSQLITE_SECURE_DELETE and a
build-time assertion that PRAGMA secure_delete==1 (fails the image build if not).
Co-authored-by: qxxaa <qxxaa@users.noreply.github.com>
---------
Co-authored-by: qxxaa <qxxaa@users.noreply.github.com>
Co-authored-by: nesquena-hermes <agent@nesquena-hermes>
