B2 Object Lock in GOVERNANCE mode with an offline bypass key for v1
Date: 2026-06-28 Status: Accepted Decision: hl-ptnd Deciders: Sean Brandt
Context
Section titled “Context”The backup protects irreplaceable data against ransomware. B2 Object Lock makes blobs immutable for a retention window, and Kopia maintenance re-extends that retention. The mode choice (COMPLIANCE vs GOVERNANCE) trades absolute safety against reversibility, and Object Lock must be enabled at bucket creation.
Decision
Section titled “Decision”For v1, use GOVERNANCE mode with the bypass capability held in an offline B2 key (never placed on the host), and a 30-day retention period (which must exceed the full-maintenance interval). Graduate to COMPLIANCE once the system is proven.
Rationale
Section titled “Rationale”- Governance defeats a compromised-host smash-and-grab — the host’s key cannot bypass the lock — while leaving an offline escape hatch for misconfiguration.
- COMPLIANCE is irreversible: a fat-fingered retention locks storage cost with no recourse, which is too unforgiving for a first deployment.
- 30 days bounds both the locked-storage cost and the attack-recovery window.
Alternatives Considered
Section titled “Alternatives Considered”- COMPLIANCE mode (deferred): strongest protection, but nobody (including the owner) can delete before expiry; revisit once the system is proven.
- No Object Lock (rejected): leaves backups deletable by a compromised host — the threat this design exists to close.
Consequences
Section titled “Consequences”- Positive: a ransomware-resistant offsite copy from day one, while remaining reversible.
- Negative: an offline bypass key must be managed; locked blobs are not garbage-collected until expiry (bounded cost, notably during the later consolidation phase).
- Neutral: Object Lock + versioning must be enabled at bucket creation.