The release of the backup system restic 0.15 has been published, providing encrypted backup storage in a versioned repository. The system is initially designed for backups to be stored in untrusted environments, ensuring that the exposure of a backup does not compromise the system. Flexible rules for including and excluding files and directories during backup creation can be defined (the rule format is similar to rsync or gitignore). It supports operation on Linux, macOS, Windows, FreeBSD, and OpenBSD. The project code is written in Go and is distributed under the BSD license.
Backups can be stored in local file systems, on external server with access via SFTP/SSH or HTTP REST, in cloud services such as Amazon S3, OpenStack Swift, BackBlaze B2, Microsoft Azure Blob Storage, and Google Cloud Storage, as well as in any storage systems for which rclone backends are available. A special rest server can also be used to organize storage, providing higher performance compared to other backends and capable of operating in a supplement-only mode, which prevents the deletion or alteration of backups in case the original is compromised server and access to encryption keys.
Snapshots are supported, reflecting the state of a specific directory with all files and subdirectories at a given point in time. Each new backup creation generates an associated snapshot, allowing restoration of the state at that moment. Snapshots can be copied between different repositories. To save bandwidth during the backup process, only changed data is copied. For a visual assessment of the repository contents and simplified restoration, the snapshot with the backup can be mounted as a virtual partition (mounting is done using FUSE). Commands are also provided for analyzing changes and selectively extracting files.
The system manipulates not whole files, but variable-sized blocks selected using Rabin signatures. Information is stored in relation to contents, not file names (related names and objects are defined at the block metadata level). Deduplication and unnecessary data copying are performed based on the SHA-256 hash of the content. On external servers, information is stored in an encrypted form (SHA-256 is used for checksums, AES-256-CTR for encryption, and Poly1305-AES-based authentication codes for integrity assurance). There is an option to verify backups using checksums and authentication codes to confirm that file integrity has not been compromised.
In the new version:
- A new rewrite command has been implemented, allowing unnecessary data to be removed from the snapshot when files that were not originally intended for backup (such as those containing confidential information or extremely large logs that have no value) are accidentally included in the backup.
- The backup command has been enhanced with the `--read-concurrency` option to set the level of parallelism when reading files, allowing for faster copying on high-speed storage devices such as NVMe.
- The backup command now includes the `--no-scan` option to disable the file tree scanning stage.
- The prune command has significantly reduced memory consumption by up to 30%.
- The restore command has added the `--sparse` option for effectively restoring files with large empty areas.
- Support for restoring symbolic links has been implemented for the Windows platform.
- In macOS, the ability to mount the backup repository using macFUSE has been added.
Source: opennet.ru
