ftp: default to FTPS, contain restores, unpredictable temp names

[poolpOrg]

Three issues in the FTP connector.

1. No transport security at all

func ConnectToFTP(host, username, password string) (*goftp.Client, error) {
	config := goftp.Config{User: username, Password: password, Timeout: 10 * time.Second}
	return goftp.DialConfig(config, host)
}

No TLSConfig, so FTPS was simply unreachable — credentials and every byte of backup data always went in the clear, with no config key to change it.

Adds a tls option (explicit / implicit / none) defaulting to explicit AUTH TLS, and tls_insecure_no_verify for certificate verification. Plain FTP now has to be asked for twice: tls=none is refused unless tls_insecure_no_verify=true acknowledges it. That's the same shape as the dav:// gate in webdav/connector.go — reusing the pattern this repo already settled on.

This changes the default, so existing plaintext configs will fail with an actionable error pointing at tls=none.

2. The exporter had no containment check

filepath.Join(p.Root(), record.Pathname) with nothing after it: a record pathname of /../../etc/x resolves above the restore root and is written there. contained() rejects it now.

It also switches filepath → path, since FTP paths are slash-separated regardless of client platform — filepath.Join was producing backslashes on Windows.

3. Predictable temp names

fmt.Sprintf("%s.tmp.%d", pathname, rand.Int()) with math/rand/v2 — neither seeded nor a CSPRNG. On a shared server the name can be precomputed and pre-created. Now crypto/rand.

Tests

common/options_test.go covers the TLS default, the double opt-in for cleartext, and rejected values. exporter/containment_test.go covers the traversal cases. go vet clean.

🤖 Generated with Claude Code

[QuentinVigand]

It be nice to add const for possible values and/or a type for this.

type TLS string

const (
	TLSExplicit TLS = "explicit"
	TLSImplicit TLS = "implicit"
	TLSNone TLS = "none"
)

[QuentinVigand]

NIT: we should rename this common package to something else. (config, ftp, conn, ...)

[QuentinVigand]

Suggested change

	if h, _, err := splitHostPort(host); err == nil {
	if h, _, err := net.SplitHostPort(host); err == nil {

So we can drop the hostport file

[QuentinVigand]

As suggested before, we can just use net.SplitHostPort(host) and delete this file