mirror of
https://github.com/borgbackup/borg.git
synced 2026-09-02 14:43:21 +02:00
5035710042This feature allows multiple repositories to share deduplication-relevant secrets (id_key and chunk_seed) while maintaining secure, independent encryption keys. `borg key export-related-secrets <REPO> <SPATH>` to export the secrets to a JSON file. `borg init --import-related-secrets <SPATH> <REPO>` to initialize a new repository using the secrets from the JSON file. Both repositories must use the same chunk id algorithm (both HMAC-SHA256 or both BLAKE2b). If you create related repositories with borg 1.4.x, you can later transfer their archives to one or multiple related new borg2 repositories without breaking deduplication. But please note that we might remove BLAKE2b support for new borg2 repos, see #8867, so this might only work for HMAC-SHA256 in the end.
82 lines
No EOL
3.3 KiB
PHP
82 lines
No EOL
3.3 KiB
PHP
.. IMPORTANT: this file is auto-generated from borg's built-in help, do not edit!
|
|
|
|
.. _borg_key_export-related-secrets:
|
|
|
|
borg key export-related-secrets
|
|
-------------------------------
|
|
.. code-block:: none
|
|
|
|
borg [common options] key export-related-secrets [options] [REPOSITORY] [PATH]
|
|
|
|
.. only:: html
|
|
|
|
.. class:: borg-options-table
|
|
|
|
+-------------------------------------------------------+----------------+----------------------------+
|
|
| **positional arguments** |
|
|
+-------------------------------------------------------+----------------+----------------------------+
|
|
| | ``REPOSITORY`` | |
|
|
+-------------------------------------------------------+----------------+----------------------------+
|
|
| | ``PATH`` | where to store the secrets |
|
|
+-------------------------------------------------------+----------------+----------------------------+
|
|
| .. class:: borg-common-opt-ref |
|
|
| |
|
|
| :ref:`common_options` |
|
|
+-------------------------------------------------------+----------------+----------------------------+
|
|
|
|
.. raw:: html
|
|
|
|
<script type='text/javascript'>
|
|
$(document).ready(function () {
|
|
$('.borg-options-table colgroup').remove();
|
|
})
|
|
</script>
|
|
|
|
.. only:: latex
|
|
|
|
REPOSITORY
|
|
|
|
PATH
|
|
where to store the secrets
|
|
|
|
|
|
:ref:`common_options`
|
|
|
|
|
|
|
Description
|
|
~~~~~~~~~~~
|
|
|
|
This command exports the deduplication secrets (``id_key`` and ``chunk_seed``)
|
|
of a repository. These secrets can be used to initialize a **related repository**.
|
|
|
|
Related repositories share the same deduplication metadata but have their own
|
|
independent encryption keys. This is useful for:
|
|
|
|
1. Creating independent backup targets that still benefit from being
|
|
"compatible" for future archive transfers.
|
|
2. Preparing for a migration to Borg 2.0, where archives can be transferred
|
|
between related repositories using ``borg transfer``.
|
|
|
|
The exported secrets are stored in a JSON file. This file contains sensitive
|
|
information and should be deleted immediately after usage.
|
|
|
|
Examples::
|
|
|
|
# Export secrets from an existing repository
|
|
$ borg key export-related-secrets /path/to/repo1 secrets.json
|
|
|
|
# Initialize a new related repository using these secrets
|
|
$ borg init --import-related-secrets=secrets.json --encryption=repokey /path/to/repo2
|
|
$ rm secrets.json
|
|
|
|
.. IMPORTANT::
|
|
When initializing a related repository using ``borg init --import-related-secrets``,
|
|
the new repository must use the same ID hash algorithm (either both HMAC-SHA256
|
|
or both BLAKE2) as the original repository.
|
|
|
|
- HMAC-SHA256: ``repokey``, ``keyfile``, ``authenticated``
|
|
- BLAKE2: ``repokey-blake2``, ``keyfile-blake2``, ``authenticated-blake2``
|
|
|
|
.. WARNING::
|
|
Please note that future Borg 2.0 versions might remove support for BLAKE2
|
|
in new repositories (see :issue:`8867`). |