internal/ctlog: fix SQLite LockBackend for nil values

When passing nil to Create or Replace, it was stored as NULL, but then
was fetched as []byte("") by Fetch, which then didn't compare equal to
NULL in Replace, making it always fail.

This was made harder to debug by two things:

 1. in the CLI, NULL and empty are both shown as empty by default;

 2. I tried to fix it by running

       "UPDATE checkpoints SET body = '' WHERE body IS NULL;"

    which put empty TEXT in those columns, which does not compare equal
    to empty BLOB. They were both allowed in the same column by the
    non-STRICT table.

Author: FiloSottile

README.md

@@ -52,7 +52,7 @@ This database must be global and it **must never be changed or modified** as an
 The database must already exist, to prevent misconfigurations. Create it with 
 
 ```
-sqlite3 checkpoints.db "CREATE TABLE checkpoints (logID BLOB PRIMARY KEY, body TEXT)"
+sqlite3 checkpoints.db "CREATE TABLE checkpoints (logID BLOB PRIMARY KEY, body BLOB NOT NULL) STRICT"
 ```
 
 Sunlight can alternatively use DynamoDB or S3-compatible object storage with `ETag` and `If-Match` support (such as Tigris) as global lock backends.

cmd/sunlight/sunlight.go

@@ -96,7 +96,7 @@ type Config struct {
 	// The database must already exist to protect against accidental
 	// misconfiguration. Create the table with:
 	//
-	//     $ sqlite3 checkpoints.db "CREATE TABLE checkpoints (logID BLOB PRIMARY KEY, body TEXT)"
+	//     $ sqlite3 checkpoints.db "CREATE TABLE checkpoints (logID BLOB PRIMARY KEY, body BLOB NOT NULL) STRICT"
 	//
 	Checkpoints string
 

internal/ctlog/cache.go

@@ -20,9 +20,9 @@ func initCache(path string) (readConn, writeConn *sqlite.Conn, err error) {
 	if err := sqlitex.ExecTransient(writeConn, `
 		CREATE TABLE IF NOT EXISTS cache (
 			key BLOB PRIMARY KEY,
-			timestamp INTEGER,
-			leaf_index INTEGER
-		) WITHOUT ROWID;`, nil); err != nil {
+			timestamp INTEGER NOT NULL,
+			leaf_index INTEGER NOT NULL
+		) WITHOUT ROWID, STRICT;`, nil); err != nil {
 		writeConn.Close()
 		return nil, nil, err
 	}

internal/ctlog/sqlite.go

@@ -34,7 +34,7 @@ func NewSQLiteBackend(ctx context.Context, path string, l *slog.Logger) (*SQLite
 
 	conn, err := sqlite.OpenConn(path, sqlite.OpenFlagsDefault & ^sqlite.SQLITE_OPEN_CREATE)
 	if err != nil {
-		return nil, fmt.Errorf(`failed to open SQLite lock database (hint: to avoid misconfiguration, the lock database must be created manually with "CREATE TABLE checkpoints (logID BLOB PRIMARY KEY, body TEXT)"): %w`, err)
+		return nil, fmt.Errorf(`failed to open SQLite lock database (hint: to avoid misconfiguration, the lock database must be created manually with "CREATE TABLE checkpoints (logID BLOB PRIMARY KEY, body BLOB NOT NULL) STRICT"): %w`, err)
 	}
 	if err := sqlitex.ExecTransient(conn, "PRAGMA synchronous = FULL", nil); err != nil {
 		conn.Close()
@@ -86,13 +86,18 @@ func (b *SQLiteBackend) Replace(ctx context.Context, old LockedCheckpoint, new [
 	defer prometheus.NewTimer(b.duration).ObserveDuration()
 	b.mu.Lock()
 	defer b.mu.Unlock()
+	if new == nil {
+		// NULL does *not* compare equal to an empty blob!
+		new = []byte{}
+	}
 	o := old.(*sqliteCheckpoint)
 	err := sqlitex.Exec(b.conn, "UPDATE checkpoints SET body = ? WHERE logID = ? AND body = ?",
 		nil, new, o.logID[:], o.body)
 	if err != nil {
 		return nil, fmtErrorf("failed to update SQLite checkpoint: %w", err)
 	}
 	if b.conn.Changes() == 0 {
+		// TODO: this also hits if new == old.body, and shouldn't.
 		return nil, fmtErrorf("SQLite checkpoint not found or has changed")
 	}
 	return &sqliteCheckpoint{logID: o.logID, body: new}, nil
@@ -101,6 +106,10 @@ func (b *SQLiteBackend) Replace(ctx context.Context, old LockedCheckpoint, new [
 func (b *SQLiteBackend) Create(ctx context.Context, logID [sha256.Size]byte, new []byte) error {
 	b.mu.Lock()
 	defer b.mu.Unlock()
+	if new == nil {
+		// NULL does *not* compare equal to an empty blob!
+		new = []byte{}
+	}
 	err := sqlitex.Exec(b.conn, `INSERT INTO checkpoints (logID, body) VALUES (?, ?)
 		ON CONFLICT(logID) DO NOTHING`, nil, logID[:], new)
 	if err != nil {