SQLite.Encrypted raw .NET console journal

This sample is a minimal encrypted journal built directly on SQLitePCLRaw. It does not use Microsoft.Data.Sqlite, Entity Framework, sqlite-net, or another managed database layer. Provider selection, open, activation, keying, preparation, binding, stepping, column reads, finalization, and close all use the SQLitePCL.raw API.

Requirements

• .NET 8 SDK or later
• a SQLite.Encrypted activation key valid for the current platform and SQLite 3.54

Free fully-featured demo keys are available from sqlite.sourcegear.com.

Configure keys

In PowerShell:

$env:SQLITE_ENCRYPTED_ACTIVATION_KEY = '<activation key without the see- prefix>'
$env:SQLITE_ENCRYPTED_DATABASE_KEY = '<database key>'

The activation key licenses SEE for this process. The database key encrypts journal.db. Keep both out of source control and command-line arguments.

To put the database somewhere else:

$env:SQLITE_ENCRYPTED_DATABASE_PATH = 'C:\data\private-journal.db'

Restore and run

cd sqlite-encrypted-dotnet-console-journal
dotnet restore
dotnet run -- add "Release notes" "Finished the encrypted console sample"
dotnet run -- list
dotnet run -- show 1
dotnet run -- search encrypted
dotnet run -- update 1 "Release notes" "Reviewed and ready"
dotnet run -- delete 1

Arguments containing spaces must be quoted.

What the sample checks

EncryptedDatabase.Open performs this sequence before the repository runs any schema or application SQL:

1. Select and freeze SQLite3Provider_e_sqlite3 during application startup.
2. Open the database with raw.sqlite3_open.
3. Activate SEE with PRAGMA activate_extensions = 'see-…'.
4. Execute PRAGMA key and require its first result to be ok.
5. Read sqlite_master so a wrong key for an existing database fails before schema creation or migration.

After that, all CRUD uses prepared statements, bound parameters, explicit sqlite3_step result checks, and deterministic statement disposal.

Publish

Publish for the target platform so .NET selects the corresponding native e_sqlite3 asset:

dotnet publish -c Release -r win-x64 --self-contained false
dotnet publish -c Release -r linux-x64 --self-contained false
dotnet publish -c Release -r osx-arm64 --self-contained false