SQLite-DB in a qrc file

[Lykurg]

Hi,

because I want to protect my SQLite-Database file, and don't whant the encryption module because it is then 50% slower, I thougt if it is possible to store my file in the executable itself.

I know, this does only make sens if:
- only reading the database
- the file size is not too big

So, storing the file (test.db alias embeddb) in the qrc makes no problem. But normaly you assign the db via set setDatabaseName( const QString & name ), but if I try so
setDatabaseName(":embeddb"); there is created a file named `:embeddb`. Is there any possibility to pass something like a path to the qrc stored file?


Thanks
Lykurg

[wysota]

I don't think so. Sqlite database is accessed by the sqlite library and not by Qt routines, so the mechanism has to be supported by sqlite and obviously embed qt resources are not.

[gfunk]

Looking at the sqlite source, I imagine you would have to implement your own os_xxxxx.c file (which handles file I/O) to hook into Qt's resource file system, and then recompile the QSQLite sql driver. Or write your own separate sql driver for this hacked up sqlite. Good luck with that. :p

Maybe you can just embed the db in the exe, then when you need it, extract the db from the .exe to an external file first, and then open it through regular channels (setDatabaseName(), etc)? And delete it when you're done. Could be pretty slow with a big db. I know, pretty bad idea. :o

[Lykurg]

Looking at the sqlite source, I imagine you would have to implement your own os_xxxxx.c file (which handles file I/O) to hook into Qt's resource file system, and then recompile the QSQLite sql driver. Or write your own separate sql driver for this hacked up sqlite. Good luck with that. :p

I also have looked in the SQLite sources, and decided that this is a job for someone who really knows what he is doing. So I am out! But if someone has time and would like to do so, I just can say: Go, go, go!

Lykurg

[gfunk]

Sounds like a nifty thing to do, but you'd have to convince people:
1) how useful is a read-only database that can only be modified when you re-compile the executable?

2) do you actually gain any security by embedding the db as a resource inside the executable? I wonder if there are any tools out there to extract the Qt resources out of an exe (and maybe add/update new resources into the exe?)?

Btw, just curious since I'm also using sqlite and still rather new to it, how do you turn on encryption in sqlite ? do you use sqlitesecure?

[Lykurg]

Well,

somtimes I want, that not all poeple can see at once my data, which I put in my apps. So simple text files one could encrypt and put them in addition in the Qt resources. As you have remebered, it is possible to extract the data out of the exe, but this needs know-how. I know, that an embedded database / file which is delivered with our application can never be 100% secure, but as above-mentioned I only want that the datafiles are not recognized as datafiles at once and that they can't be easy accessed. The advantage by embedding the file in the qt resource system is, that you do not see the files (no security gain).

I don't use sqlitesecure. Sorry. At time I just inform me, how (low) data-protection is possible. That the encrypted database is about 50% slower, you could read at http://www.hwaci.com/sw/sqlite/prosupport.html.

And if embedding the database in the qt resource system, one could write a library for that stuff, so you have just to update this, if you change anything in your data.

Where one could use it:
- You have an huge dictionary file, which users can access via Internet, where they do not the the hole file.
- Now you want to make an offline version. So you have to publish the file, and 2 days later you find a lot of sites, which have occupied your data without saying where they have the data from. Thats not nice, so you have to protect the data, that other cannot access the data easily.
- Now you can develop an GPL'd application this the library, which embed the database, but you don't deliver the database with your sourcecode. Instead you offer the precompiled library for free download. (Dont know if this is exactly possible under GPL?)
In that case the database is not very huge (about 2-3 MB), and you only need read-access. (And normal users can't see the data.)