implement write support in encfsr

Author: vgough

AGENTS.md

@@ -8,7 +8,7 @@ This document provides comprehensive information for AI agents working in the En
 
 - **Language**: Rust (Edition 2024)
 - **Primary Goal**: Read/write compatibility with legacy EncFS filesystems
-- **Status**: Beta (v2.0.0-beta.4) - functional for read/write but still maturing
+- **Status**: Beta (v2.0.0-beta.5) - functional for read/write but still maturing
 
 ### Key Characteristics
 - Encrypts individual files (not block devices)
@@ -93,6 +93,12 @@ task clippy
 ./target/debug/encfsctl info /path/to/encrypted
 ./target/debug/encfsctl decode /path/to/encrypted encrypted_filename
 ./target/debug/encfsctl cat /path/to/encrypted encrypted_filename
+
+# Reverse encryption: plaintext source -> encrypted virtual view
+./target/debug/encfsr /path/to/source/.encfs7 /path/to/source /path/to/mountpoint
+
+# Opt in to writes through the encrypted reverse view
+./target/debug/encfsr --write /path/to/source/.encfs7 /path/to/source /path/to/mountpoint
 ```
 
 ### Installation
@@ -108,11 +114,13 @@ encfs/
 ├── src/                      # Rust source code
 │   ├── main.rs              # Main encfs binary (FUSE mount)
 │   ├── encfsctl.rs          # Control utility binary
+│   ├── encfsr.rs            # Reverse-mode FUSE binary
 │   ├── lib.rs               # Library entry point
 │   ├── config.rs            # Config file parsing (V4/V5/V6)
 │   ├── config_binary.rs     # Binary config format parser
 │   ├── constants.rs         # Global constants
 │   ├── fs.rs                # FUSE filesystem implementation
+│   ├── reverse_fs.rs        # Reverse-mode FUSE implementation
 │   └── crypto/              # Cryptographic operations
 │       ├── mod.rs           # Crypto module exports
 │       ├── ssl.rs           # Legacy cipher wrapper (RustCrypto)
@@ -141,7 +149,7 @@ encfs/
 
 2. **`config.rs`**: Configuration file handling
    - `EncfsConfig`: Main config struct
-   - `ConfigType`: Enum for V3/V4/V5/V6 formats
+   - `ConfigType`: Enum for V3/V4/V5/V6/V7 formats
    - `Interface`: Cipher/naming algorithm interface
    - Supports XML (V6) and binary (V4/V5) formats
    - XML uses Boost Serialization format for compatibility
@@ -172,6 +180,14 @@ encfs/
    - Subcommands: info, passwd, decode, encode, cat, ls, showkey, export
    - Standalone utility for inspecting/manipulating encrypted filesystems
 
+8. **`reverse_fs.rs` / `encfsr.rs`**: Reverse encryption
+   - Presents an encrypted V7 view of a plaintext source directory
+   - Read-only by default; `encfsr --write` enables transactional writes
+   - Requires `unique_iv = false`; create a compatible V7 config with
+     `encfsctl new --no-unique-iv <source-dir>`
+   - Stages ciphertext writes and validates authenticated blocks before applying
+     changes to the plaintext source
+
 ## Naming Conventions
 
 ### Rust Standard Conventions
@@ -304,7 +320,16 @@ Three methods (in order of precedence):
 2. `--stdinpass`: Read from stdin
 3. Default: Interactive prompt via `rpassword`
 
-### 9. Validation Requirements
+### 9. Reverse Mode Writes
+- `encfsr` only accepts V7 configs and rejects `unique_iv = true`.
+- Use `--write` explicitly; regular reverse mounts remain read-only.
+- `encfsctl new --no-unique-iv` remains compatible with V7 AES-GCM-SIV tags,
+  filename IV chaining, and external IV chaining.
+- Incomplete or invalid ciphertext is rejected during flush/close without
+  applying it to the plaintext source. Direct source changes while a write is
+  staged cause the commit to fail with a conflict.
+
+### 10. Validation Requirements
 The `EncfsConfig::validate()` method enforces:
 - `plain_data` must be false (not supported)
 - `unique_iv` may be true or false (filesystem supports both)
@@ -314,13 +339,13 @@ The `EncfsConfig::validate()` method enforces:
 - `block_mac_bytes` must be 0-8
 - Block size must be larger than MAC overhead
 
-### 10. Logging
+### 11. Logging
 - Uses `env_logger` crate
 - Controlled by `RUST_LOG` environment variable
 - `-v` flag sets debug level
 - `-d` flag sets debug + foreground mode
 
-### 11. Daemonization
+### 12. Daemonization
 - Uses `daemonize` crate
 - Automatic unless `-f` (foreground) or `-d` (debug) flag
 - Happens after password validation, before FUSE mount
@@ -530,6 +555,6 @@ task test-live           # Live mount tests
 
 ---
 
-**Last Updated**: July 22, 2026
-**EncFS Version**: 2.0.0-beta.4
+**Last Updated**: July 28, 2026
+**EncFS Version**: 2.0.0-beta.5
 **Rust Edition**: 2024

Cargo.lock

@@ -4,7 +4,7 @@ exclude = ["fuzz"]
 
 [package]
 name = "encfs"
-version = "2.0.0-beta.4"
+version = "2.0.0-beta.5"
 edition = "2024"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -42,6 +42,7 @@ sha1 = "0.11"
 sha2 = "0.11"
 zeroize = { version = "1", features = ["derive"] }
 sysinfo = { version = "0.39.6", default-features = false, features = ["system"] }
+tempfile = "3"
 
 [[bin]]
 name = "encfsctl"
@@ -54,7 +55,6 @@ path = "src/encfsr.rs"
 [dev-dependencies]
 serde_json = "1"
 tar = "0.4"
-tempfile = "3"
 
 [[bench]]
 name = "filesystem"

Cargo.toml

@@ -1,3 +1,9 @@
+v2.0.0-beta.5 / 2026-07-28
+==================
+	* Add opt-in writable reverse mounts with `encfsr --write`
+	* Stage and authenticate reverse writes before applying them to the plaintext source
+	* Support V7 reverse-write configs created with `encfsctl new --no-unique-iv`
+
 v2.0.0-beta.4 / 2026-07-22
 ==================
 	* Replace async-fuse with libfuse-sys for improved Linux and macOS performance

ChangeLog

@@ -137,7 +137,7 @@ fusermount -u ~/mount   # Linux
 ## Reverse encryption mode (encfsr)
 
 The **encfsr** binary provides *reverse* encryption: your **plaintext** files
-live on disk in a source directory, and encfsr mounts a **read-only** virtual
+live on disk in a source directory, and encfsr mounts a **read-only by default** virtual
 filesystem that exposes the **encrypted** view of that directory. Use this when
 you want to back up or sync an encrypted representation of local data (e.g. to
 an untrusted or cloud storage) without storing plaintext there.
@@ -149,8 +149,9 @@ an untrusted or cloud storage) without storing plaintext there.
 
 - A **V7** EncFS config (e.g. `.encfs7`). Older configs are not supported.
 - Config should be created **without** per-file IV headers: use
-  `encfsctl new --no-unique-iv ...` so the content is deterministic and suitable
-  for reverse mode.
+  `encfsctl new --no-unique-iv ...`.  This is required by encfsr, including
+  writable reverse mounts; authenticated V7 block encryption and IV chaining
+  remain supported.
 
 ### Usage
 
@@ -164,6 +165,15 @@ Example: plaintext in `~/Documents`, encrypted view at `/mnt/enc`:
 encfsr ~/Documents/.encfs7 ~/Documents /mnt/enc
 ```
 
+To restore through the encrypted view, opt in explicitly to writable reverse
+mode.  Writes are staged and authenticated before they are applied to the
+plaintext source, so a malformed or incomplete encrypted write fails at flush
+or close rather than corrupting the source:
+
+```bash
+encfsr --write ~/Documents/.encfs7 ~/Documents /mnt/enc
+```
+
 Then copy or sync from `/mnt/enc` to your backup/cloud target; the content and filenames there are encrypted.
 
 Options (same as encfs where applicable):

README.md

@@ -218,9 +218,9 @@ help.encfsctl.speed:
   de: "Versionsinformationen anzeigen und unterstützte Verschlüsselungsalgorithmen benchmarken"
 
 help.encfsr.about:
-  en: "EncFS Reverse - Virtual Encrypted Read-Only Filesystem"
-  fr: "EncFS Reverse - Système de fichiers chiffré virtuel en lecture seule"
-  de: "EncFS Reverse - Virtuelles verschlüsseltes schreibgeschütztes Dateisystem"
+  en: "EncFS Reverse - Virtual Encrypted Filesystem"
+  fr: "EncFS Reverse - Système de fichiers chiffré virtuel"
+  de: "EncFS Reverse - Virtuelles verschlüsseltes Dateisystem"
 help.encfsr.config:
   en: "EncFS config file (e.g. .encfs6.xml or .encfs7)"
   fr: "Fichier de configuration EncFS (par ex. .encfs6.xml ou .encfs7)"
@@ -229,6 +229,10 @@ help.encfsr.source:
   en: "Source directory (plaintext)"
   fr: "Répertoire source (texte en clair)"
   de: "Quellverzeichnis (Klartext)"
+help.encfsr.write:
+  en: "Allow transactional writes through the encrypted reverse view"
+  fr: "Autoriser les écritures transactionnelles via la vue chiffrée inversée"
+  de: "Transaktionale Schreibvorgänge über die verschlüsselte Reverse-Ansicht erlauben"
 help.encfsr.fuse_opts:
   en: "FUSE options (e.g. -o allow_other)"
   fr: "Options FUSE (ex : -o allow_other)"

locales/help.yml

@@ -37,6 +37,10 @@ fn help_encfsr_foreground() -> String {
     t!("help.encfs.foreground").to_string()
 }
 
+fn help_encfsr_write() -> String {
+    t!("help.encfsr.write").to_string()
+}
+
 fn help_encfsr_fuse_opts() -> String {
     t!("help.encfsr.fuse_opts").to_string()
 }
@@ -68,6 +72,10 @@ struct Args {
     #[arg(short = 'f', long, help = help_encfsr_foreground())]
     foreground: bool,
 
+    /// Allow writes to the plaintext source through the encrypted view.
+    #[arg(short = 'w', long, help = help_encfsr_write())]
+    write: bool,
+
     /// FUSE options passed directly to the FUSE layer (e.g. -o allow_other).
     /// Place these after -- or use trailing arguments directly.
     #[arg(trailing_var_arg = true, allow_hyphen_values = true, help = help_encfsr_fuse_opts())]
@@ -224,12 +232,15 @@ fn main() -> Result<()> {
         config,
         config_bytes,
         config_metadata,
+        encfs::reverse_fs::ReverseFsOptions {
+            writable: args.write,
+        },
     );
 
-    // Build FUSE options: always mount read-only at kernel level (FUSE-01)
-    // plus default_permissions, then pass through any user-provided fuse_opts.
+    // The encrypted view is read-only unless the user explicitly opted into
+    // reverse writes.  A supplied `-o ro` may still tighten a writable mount.
     let mut mount_config = typed_fuse::mount::MountConfig {
-        read_only: true,
+        read_only: !args.write,
         default_permissions: true,
         ..typed_fuse::mount::MountConfig::new("encfsr")
     };
@@ -255,6 +266,10 @@ fn main() -> Result<()> {
         };
         mount_config.parse_option_words(words);
     }
+    if !args.write {
+        // Do not let `-o rw` turn the safe default into a writable mount.
+        mount_config.read_only = true;
+    }
 
     // Pre-check the mount point so a bad one is reported in the user's
     // locale; `Session::mount` repeats the check (and works around the macOS