mirror of
https://github.com/borgbackup/borg.git
synced 2026-09-01 14:13:19 +02:00
8356838d79a6970c7e7 did this for the sdist: its provenance attestation is only
stored in the GitHub attestations API, and fetching it from there needs
a recent gh and a GitHub token, so the sigstore bundle is attached to
the release as <asset>.sigstore.jsonl for offline verification.
Do the same for the standalone binaries: the jobs that build them attest
them, so they are also the ones that have the bundle. Each of them stores
it under the name of every asset it attested (one attestation covers both
the single-file binary and the .tgz) and uploads it in the artifact that
carries the binaries, so the release job attaches it to the release along
with them - it uploads whatever is in the artifacts.
vm_tests attested after uploading its artifact, so the attestation is now
made before the upload, like in the other two jobs.
Also document the offline verification in the binaries README (which is a
release asset itself) and in the release checklist.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
132 lines
5 KiB
Text
132 lines
5 KiB
Text
Binary BorgBackup builds
|
|
========================
|
|
|
|
General notes
|
|
-------------
|
|
|
|
The binaries are supposed to work on the specified platform without installing anything else.
|
|
|
|
There are some limitations, though:
|
|
- for Linux, your system must have the same or newer glibc version as the one used for building
|
|
- for macOS, you need to have the same or newer macOS version as the one used for building
|
|
- for other OSes, there are likely similar limitations
|
|
|
|
If you don't find something working on your system, check the older borg releases.
|
|
|
|
*.asc are GnuPG signatures - only provided for locally built binaries.
|
|
*.exe (or no extension) is the single-file fat binary.
|
|
*.tgz is the single-directory fat binary (extract it once with tar -xzf).
|
|
|
|
Using the single-directory build is faster and does not require as much space
|
|
in the temporary directory as the self-extracting single-file build.
|
|
|
|
macOS: to avoid issues, download the file via the command line OR remove the
|
|
"quarantine" attribute after downloading:
|
|
$ xattr -dr com.apple.quarantine borg-macos1012.tgz
|
|
|
|
|
|
Download the correct files
|
|
--------------------------
|
|
|
|
Binaries built on GitHub servers
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
borg-linux-glibc243-x86_64-gh Linux AMD/Intel (built on Ubuntu 26.04 LTS with glibc 2.43)
|
|
borg-linux-glibc243-arm64-gh Linux ARM (built on Ubuntu 26.04 LTS with glibc 2.43)
|
|
|
|
borg-macos-15-arm64-gh macOS Apple Silicon (built on macOS 15 w/o FUSE support)
|
|
borg-macos-15-x86_64-gh macOS Intel (built on macOS 15 w/o FUSE support)
|
|
|
|
borg-freebsd-15-x86_64-gh FreeBSD AMD/Intel (built on FreeBSD 15.1)
|
|
|
|
borg-windows-x86_64-gh Windows AMD/Intel (built using MINGW/MSYS2)
|
|
|
|
Binaries built locally
|
|
~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
borg-linux-glibc231-x86_64 Linux (built on Debian 11 "Bullseye" with glibc 2.31)
|
|
|
|
Note: if you don't find a specific binary here, check release 1.4.1 or 1.2.9.
|
|
|
|
Verifying your download
|
|
-----------------------
|
|
|
|
I provide GPG signatures for files which I have built locally on my machines.
|
|
|
|
To check the GPG signature, download both the file and the corresponding
|
|
signature (*.asc file) and then (on the shell) type, for example:
|
|
|
|
gpg --recv-keys 9F88FB52FAF7B393
|
|
gpg --verify borgbackup.tar.gz.asc borgbackup.tar.gz
|
|
|
|
The files are signed by:
|
|
|
|
Thomas Waldmann <tw@waldmann-edv.de>
|
|
GPG key fingerprint: 6D5B EF9A DD20 7580 5747 B70F 9F88 FB52 FAF7 B393
|
|
|
|
My fingerprint is also in the footer of all my BorgBackup mailing list posts.
|
|
|
|
|
|
Provenance attestations for GitHub-built binaries
|
|
-------------------------------------------------
|
|
|
|
For binaries built on GitHub (files with a "-gh" suffix in the name), we publish
|
|
an artifact provenance attestation that proves the binary was built by our
|
|
GitHub Actions workflow from a specific commit or tag. You can verify this using
|
|
the GitHub CLI (gh). Install it from https://cli.github.com/ and make sure you
|
|
use a recent version that supports "gh attestation".
|
|
|
|
Practical example (Linux, 2.0.0b20 tag):
|
|
|
|
curl -LO https://github.com/borgbackup/borg/releases/download/2.0.0b20/borg-linux-glibc235-x86_64-gh
|
|
gh attestation verify --repo borgbackup/borg --source-ref refs/tags/2.0.0b20 borg-linux-glibc235-x86_64-gh
|
|
|
|
If verification succeeds, gh prints a summary stating the subject (your file),
|
|
that it was attested by GitHub Actions, and the job/workflow reference.
|
|
|
|
The command above fetches the attestation from the GitHub attestations API,
|
|
which needs a recent gh and a GitHub token. Every attestation is therefore also
|
|
attached to the release itself, as a sigstore bundle named after the file it
|
|
belongs to - "<FILE>.sigstore.jsonl", next to "<FILE>" on the release page - so
|
|
you can also verify offline and without a token:
|
|
|
|
curl -LO https://github.com/borgbackup/borg/releases/download/<TAG>/<FILE>.sigstore.jsonl
|
|
gh attestation verify --repo borgbackup/borg --bundle <FILE>.sigstore.jsonl <FILE>
|
|
|
|
Generic sigstore tooling works as well, e.g. cosign - the certificate identity
|
|
is the workflow that built the file: .github/workflows/ci.yml for the binaries,
|
|
.github/workflows/release.yml for the source distribution.
|
|
|
|
|
|
Installing
|
|
----------
|
|
|
|
It is suggested that you rename or symlink the binary to just "borg".
|
|
If you need "borgfs", just also symlink it to the same binary; it will
|
|
detect internally under which name it was invoked.
|
|
|
|
On UNIX-like platforms, /usr/local/bin/ or ~/bin/ is a nice place for it,
|
|
but you can invoke it from anywhere by providing the full path to it.
|
|
|
|
Make sure the file is readable and executable (chmod +rx borg on UNIX-like
|
|
platforms).
|
|
|
|
|
|
Reporting issues
|
|
----------------
|
|
|
|
Please first check the FAQ and whether a GitHub issue already exists.
|
|
|
|
If you find a NEW issue, please open a ticket on our issue tracker:
|
|
|
|
https://github.com/borgbackup/borg/issues/
|
|
|
|
There, please give:
|
|
- the version number (it is displayed if you invoke borg -V)
|
|
- the sha256sum of the binary
|
|
- a good description of what the issue is
|
|
- a good description of how to reproduce your issue
|
|
- a traceback with system info (if you have one)
|
|
- your precise platform (CPU, 32/64-bit?), OS, distribution, release
|
|
- your Python and (g)libc versions
|
|
|