From ebedffb76252c513f6d25832cda4e53e75f28c9b Mon Sep 17 00:00:00 2001
From: MattJackson <1085847+MattJackson@users.noreply.github.com>
Date: Tue, 2 Jun 2026 14:09:59 -0700
Subject: [PATCH] ScanOptions: add disable_keydb to skip all keydb lookup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A caller that resolves Unit Keys out-of-band can now set disable_keydb
so the scan consults no keydb at all — neither an explicit keydb_path
nor the standard search locations. Without it, a keydb that merely sits
in a default location ('~/.config/...') silently shadows the out-of-band
path. unit_key still takes precedence over everything.
---
 src/disc/mod.rs    | 10 ++++++++++
 src/mux/resolve.rs |  1 +
 2 files changed, 11 insertions(+)

diff --git a/src/disc/mod.rs b/src/disc/mod.rs
index 69d2f53..b2b6950 100644
--- a/src/disc/mod.rs
+++ b/src/disc/mod.rs
@@ -951,11 +951,21 @@ pub struct ScanOptions {
     /// obtains the key however it likes; libfreemkv stays free of any network
     /// dependency.
     pub unit_key: Option<[u8; 16]>,
+    /// Disable KEYDB entirely: skip both the explicit `keydb_path` and the
+    /// standard-location search, so no keydb is loaded for this scan. A caller
+    /// that resolves keys out-of-band (e.g. a remote key service) sets this so
+    /// a keydb that merely happens to sit in a default location does not shadow
+    /// the out-of-band path. `unit_key` still takes precedence over everything.
+    pub disable_keydb: bool,
 }
 
 impl ScanOptions {
     /// Resolve KEYDB path: explicit path first, then standard locations.
+    /// Returns `None` when `disable_keydb` is set — no keydb is consulted.
     fn resolve_keydb(&self) -> Option<std::path::PathBuf> {
+        if self.disable_keydb {
+            return None;
+        }
         if let Some(p) = &self.keydb_path {
             if p.exists() {
                 return Some(p.clone());
diff --git a/src/mux/resolve.rs b/src/mux/resolve.rs
index b9031a6..ab67b5d 100644
--- a/src/mux/resolve.rs
+++ b/src/mux/resolve.rs
@@ -187,6 +187,7 @@ pub fn input(url: &str, opts: &InputOptions) -> io::Result<Box<dyn crate::pes::S
             let scan_opts = crate::disc::ScanOptions {
                 keydb_path: opts.keydb_path.as_ref().map(Into::into),
                 unit_key: opts.unit_key,
+                ..Default::default()
             };
             // FileSectorSource is the sole file-backed sector source.
             // It carries the platform-tuned SEQUENTIAL fadvise hint