- Pack signature accepts optional salt, writes 16-byte salt between header and TOC
- Set flags bit 4 and adjust toc_offset to 56 when salt present
- read_archive_metadata returns salt alongside header and TOC entries
- Add read_archive_salt() public helper for pre-unpack salt reading
- main.rs uses resolve_key_for_pack/resolve_key_for_unpack for two-phase password flow
- Add 5 new integration tests: password roundtrip, wrong password rejection,
salt flag presence, no-salt flag for key archives, directory password roundtrip
- All 52 tests pass (25 unit + 7 golden + 20 integration)
- test_roundtrip_directory: full directory tree with permissions verification
- test_roundtrip_mixed_files_and_dirs: mixed file + directory pack/unpack
- test_inspect_shows_directory_info: inspect output contains dir/file types and permissions
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- 7 deterministic tests: AES-256-CBC encrypt/decrypt, empty, HMAC-SHA256, HMAC verify, SHA-256 x2
- Fixed IV vectors for reproducible results (no randomness)
- HMAC golden value cross-verified with openssl (file input) and Python hmac module
- SHA-256 values match FORMAT.md Section 12.3 known vectors
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>