Merge pull request #4685 from konidev20/fix-gh-4676-sub-commands-for-key-management

Move key add, list, remove and passwd as separate sub-commands and improve key sub-command documentation

.gitattributes

@@ -0,0 +1,2 @@
+# Workaround for https://github.com/golang/go/issues/52268.
+**/testdata/fuzz/*/* eol=lf

.github/ISSUE_TEMPLATE/Bug.md

@@ -32,23 +32,30 @@ Output of `restic version`
 --------------------------
 
 
-How did you run restic exactly?
--------------------------------
+
+What backend/service did you use to store the repository?
+---------------------------------------------------------
+
+
+
+Problem description / Steps to reproduce
+----------------------------------------
 
 <!--
 This section should include at least:
 
+ * A description of the problem you are having with restic.
+
  * The complete command line and any environment variables you used to
    configure restic's backend access. Make sure to replace sensitive values!
 
  * The output of the commands, what restic prints gives may give us much
    information to diagnose the problem!
+
+ * The more time you spend describing an easy way to reproduce the behavior (if
+   this is possible), the easier it is for the project developers to fix it!
 -->
 
-What backend/server/service did you use to store the repository?
-----------------------------------------------------------------
-
-
 
 Expected behavior
 -----------------
@@ -65,22 +72,12 @@ In this section, please try to concentrate on observations, so only describe
 what you observed directly.
 -->
 
-Steps to reproduce the behavior
--------------------------------
-
-<!--
-The more time you spend describing an easy way to reproduce the behavior (if
-this is possible), the easier it is for the project developers to fix it!
--->
-
 Do you have any idea what may have caused this?
 -----------------------------------------------
 
-
-
-Do you have an idea how to solve the issue?
--------------------------------------------
-
+<!--
+Did something noteworthy happen on your system, Internet connection, backend services, etc?
+-->
 
 
 Did restic help you today? Did it make you happy in any way?

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  # Dependencies listed in go.mod
+  - package-ecosystem: "gomod"
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "monthly"
+
+  # Dependencies listed in .github/workflows/*.yml
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"

.github/workflows/docker.yml

@@ -0,0 +1,66 @@
+
+name: Create and publish a Docker image
+
+on:
+  push:
+    tags:
+      - 'v*'
+    branches:
+      - 'master'
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    if: github.repository == 'restic/restic'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@3d58c274f17dffee475a5520cbe67f0a882c4dbb
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226
+
+      - name: Ensure consistent binaries
+        run: |
+          echo "removing git directory for consistency with release binaries"
+          rm -rf .git
+        # remove VCS information from release builds, keep VCS for nightly builds on master
+        if: github.ref != 'refs/heads/master'
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          push: true
+          context: .
+          file: docker/Dockerfile.release
+          platforms: linux/386,linux/amd64,linux/arm,linux/arm64
+          pull: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/tests.yml

@@ -7,6 +7,14 @@ on:
 
   # run tests for all pull requests
   pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+env:
+  latest_go: "1.21.x"
+  GO111MODULE: on
 
 jobs:
   test:
@@ -15,33 +23,34 @@ jobs:
         # list of jobs to run:
         include:
           - job_name: Windows
-            go: 1.16.x
+            go: 1.21.x
             os: windows-latest
 
           - job_name: macOS
-            go: 1.16.x
+            go: 1.21.x
             os: macOS-latest
             test_fuse: false
 
           - job_name: Linux
-            go: 1.16.x
+            go: 1.21.x
             os: ubuntu-latest
             test_cloud_backends: true
             test_fuse: true
             check_changelog: true
 
+          - job_name: Linux (race)
+            go: 1.21.x
+            os: ubuntu-latest
+            test_fuse: true
+            test_opts: "-race"
+
           - job_name: Linux
-            go: 1.15.x
+            go: 1.20.x
             os: ubuntu-latest
             test_fuse: true
 
           - job_name: Linux
-            go: 1.14.x
-            os: ubuntu-latest
-            test_fuse: true
-
-          - job_name: Linux
-            go: 1.13.x
+            go: 1.19.x
             os: ubuntu-latest
             test_fuse: true
 
@@ -53,14 +62,14 @@ jobs:
 
     steps:
       - name: Set up Go ${{ matrix.go }}
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.go }}
 
       - name: Get programs (Linux/macOS)
         run: |
           echo "build Go tools"
-          go get github.com/restic/rest-server/...
+          go install github.com/restic/rest-server/cmd/rest-server@latest
 
           echo "install minio server"
           mkdir $HOME/bin
@@ -82,7 +91,7 @@ jobs:
           chmod 755 $HOME/bin/rclone
           rm -rf rclone*
 
-          # add $HOME/bin to path ($GOBIN was already added to the path by setup-go@v2)
+          # add $HOME/bin to path ($GOBIN was already added to the path by setup-go@v3)
           echo $HOME/bin >> $GITHUB_PATH
         if: matrix.os == 'ubuntu-latest' || matrix.os == 'macOS-latest'
 
@@ -92,7 +101,7 @@ jobs:
           $ProgressPreference = 'SilentlyContinue'
 
           echo "build Go tools"
-          go get github.com/restic/rest-server/...
+          go install github.com/restic/rest-server/...
 
           echo "install minio server"
           mkdir $Env:USERPROFILE/bin
@@ -104,7 +113,7 @@ jobs:
           unzip rclone.zip
           copy rclone*/rclone.exe $Env:USERPROFILE/bin
 
-          # add $USERPROFILE/bin to path ($GOBIN was already added to the path by setup-go@v2)
+          # add $USERPROFILE/bin to path ($GOBIN was already added to the path by setup-go@v3)
           echo $Env:USERPROFILE\bin >> $Env:GITHUB_PATH
 
           echo "install tar"
@@ -126,17 +135,25 @@ jobs:
         if: matrix.os == 'windows-latest'
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Build with build.go
         run: |
           go run build.go
 
+      - name: Minimal test
+        run: |
+          ./restic init
+          ./restic backup .
+        env:
+          RESTIC_REPOSITORY: ../testrepo
+          RESTIC_PASSWORD: password
+
       - name: Run local Tests
         env:
           RESTIC_TEST_FUSE: ${{ matrix.test_fuse }}
         run: |
-          go test -cover ./...
+          go test -cover ${{matrix.test_opts}} ./...
 
       - name: Test cloud backends
         env:
@@ -177,12 +194,14 @@ jobs:
 
         # only run cloud backend tests for pull requests from and pushes to our
         # own repo, otherwise the secrets are not available
-        if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && matrix.test_cloud_backends
+        # Skip for Dependabot pull requests as these are run without secrets
+        # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#responding-to-events
+        if: ((github.repository == 'restic/restic' && github.event_name == 'push') || github.event.pull_request.head.repo.full_name == github.repository) && (github.actor != 'dependabot[bot]') && matrix.test_cloud_backends
 
       - name: Check changelog files with calens
         run: |
           echo "install calens"
-          go get github.com/restic/calens
+          go install github.com/restic/calens@latest
 
           echo "check changelog files"
           calens
@@ -191,73 +210,53 @@ jobs:
   cross_compile:
     strategy:
 
-      # ATTENTION: the list of architectures must be in sync with helpers/build-release-binaries/main.go!
       matrix:
-        # run cross-compile in two batches parallel so the overall tests run faster
-        targets:
-          - "linux/386 linux/amd64 linux/arm linux/arm64 linux/ppc64le linux/mips linux/mipsle linux/mips64 linux/mips64le linux/s390x \
-            openbsd/386 openbsd/amd64"
-
-          - "freebsd/386 freebsd/amd64 freebsd/arm \
-            aix/ppc64 \
-            darwin/amd64 darwin/arm64 \
-            netbsd/386 netbsd/amd64 \
-            windows/386 windows/amd64 \
-            solaris/amd64"
+        # run cross-compile in three batches parallel so the overall tests run faster
+        subset:
+          - "0/3"
+          - "1/3"
+          - "2/3"
 
     env:
-      go: 1.16.x
       GOPROXY: https://proxy.golang.org
 
     runs-on: ubuntu-latest
 
-    name: Cross Compile for ${{ matrix.targets }}
+    name: Cross Compile for subset ${{ matrix.subset }}
 
     steps:
-      - name: Set up Go ${{ env.go }}
-        uses: actions/setup-go@v2
+      - name: Set up Go ${{ env.latest_go }}
+        uses: actions/setup-go@v5
         with:
-          go-version: ${{ env.go }}
+          go-version: ${{ env.latest_go }}
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
-      - name: Install gox
+      - name: Cross-compile for subset ${{ matrix.subset }}
         run: |
-          go get github.com/mitchellh/gox
-
-      - name: Cross-compile with gox for ${{ matrix.targets }}
-        env:
-          GOFLAGS: "-trimpath"
-          GOX_ARCHS: "${{ matrix.targets }}"
-        run: |
-          mkdir build-output
-          gox -parallel 2 -verbose -osarch "$GOX_ARCHS" -output "build-output/{{.Dir}}_{{.OS}}_{{.Arch}}" ./cmd/restic
-          gox -parallel 2 -verbose -osarch "$GOX_ARCHS" -tags debug -output "build-output/{{.Dir}}_{{.OS}}_{{.Arch}}_debug" ./cmd/restic
+          mkdir build-output build-output-debug
+          go run ./helpers/build-release-binaries/main.go -o build-output -s . --platform-subset ${{ matrix.subset }}
+          go run ./helpers/build-release-binaries/main.go -o build-output-debug -s . --platform-subset ${{ matrix.subset }} --tags debug
 
   lint:
     name: lint
     runs-on: ubuntu-latest
-    env:
-      go: 1.16.x
     steps:
-      - name: Set up Go ${{ env.go }}
-        uses: actions/setup-go@v2
+      - name: Set up Go ${{ env.latest_go }}
+        uses: actions/setup-go@v5
         with:
-          go-version: ${{ env.go }}
+          go-version: ${{ env.latest_go }}
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v2
+        uses: golangci/golangci-lint-action@v3
         with:
           # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
-          version: v1.36
-          # Optional: show only new issues if it's a pull request. The default value is `false`.
-          only-new-issues: true
+          version: v1.55.2
           args: --verbose --timeout 5m
-          skip-go-installation: true
 
         # only run golangci-lint for pull requests, otherwise ALL hints get
         # reported. We need to slowly address all issues until we can enable
@@ -269,3 +268,59 @@ jobs:
           echo "check if go.mod and go.sum are up to date"
           go mod tidy
           git diff --exit-code go.mod go.sum
+
+  analyze:
+    name: Analyze results
+    needs: [test, cross_compile, lint]
+    if: always()
+
+    permissions: # no need to access code
+      contents: none
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Decide whether the needed jobs succeeded or failed
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
+        with:
+          jobs: ${{ toJSON(needs) }}
+
+  docker:
+    name: docker
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          # list of Docker images to use as base name for tags
+          images: |
+            restic/restic
+          # generate Docker tags based on the following events/attributes
+          tags: |
+            type=schedule
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=sha
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push
+        id: docker_build
+        uses: docker/build-push-action@v4
+        with:
+          push: false
+          context: .
+          file: docker/Dockerfile
+          pull: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -1,3 +1,5 @@
+/.idea
 /restic
+/restic.exe
 /.vagrant
 /.vscode

.golangci.yml

@@ -10,13 +10,10 @@ linters:
     # make sure all errors returned by functions are handled
     - errcheck
 
-    # find unused code
-    - deadcode
-
     # show how code can be simplified
     - gosimple
 
-    # # make sure code is formatted
+    # make sure code is formatted
     - gofmt
 
     # examine code and report suspicious constructs, such as Printf calls whose
@@ -24,7 +21,7 @@ linters:
     - govet
 
     # make sure names and comments are used according to the conventions
-    - golint
+    - revive
 
     # detect when assignments to existing variables are not used
     - ineffassign
@@ -35,15 +32,12 @@ linters:
     # find unused variables, functions, structs, types, etc.
     - unused
 
-    # find unused struct fields
-    - structcheck
-
-    # find unused global variables
-    - varcheck
-
     # parse and typecheck code
     - typecheck
 
+    # ensure that http response bodies are closed
+    - bodyclose
+
 issues:
   # don't use the default exclude rules, this hides (among others) ignored
   # errors from Close() calls
@@ -51,7 +45,12 @@ issues:
 
   # list of things to not warn about
   exclude:
-    # golint: do not warn about missing comments for exported stuff
-    - exported (function|method|var|type|const) `.*` should have comment or be unexported
-    # golint: ignore constants in all caps
+    # revive: do not warn about missing comments for exported stuff
+    - exported (function|method|var|type|const) .* should have comment or be unexported
+    # revive: ignore constants in all caps
     - don't use ALL_CAPS in Go names; use CamelCase
+    # revive: lots of packages don't have such a comment
+    - "package-comments: should have a package comment"
+    # staticcheck: there's no easy way to replace these packages
+    - "SA1019: \"golang.org/x/crypto/poly1305\" is deprecated"
+    - "SA1019: \"golang.org/x/crypto/openpgp\" is deprecated"

.readthedocs.yaml

@@ -0,0 +1,22 @@
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+version: 2
+
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "3.11"
+
+# Build HTMLZip
+formats:
+  - htmlzip
+
+# Build documentation in the docs/ directory with Sphinx
+sphinx:
+  configuration: doc/conf.py
+
+# https://docs.readthedocs.io/en/stable/guides/reproducible-builds.html
+python:
+  install:
+  - requirements: doc/requirements.txt

CONTRIBUTING.md

@@ -6,7 +6,8 @@ Ways to Help Out
 Thank you for your contribution! Please **open an issue first** (or add a
 comment to an existing issue) if you plan to work on any code or add a new
 feature. This way, duplicate work is prevented and we can discuss your ideas
-and design first.
+and design first. Small bugfixes are an exception to this rule, just open a
+pull request in this case.
 
 There are several ways you can help us out. First of all code contributions and
 bug fixes are most welcome. However even "minor" details as fixing spelling
@@ -48,9 +49,8 @@ environment was used and so on. Please tell us at least the following things:
 Remember, the easier it is for us to reproduce the bug, the earlier it will be
 corrected!
 
-In addition, you can compile restic with debug support by running
-`go run build.go -tags debug` and instructing it to create a debug
-log by setting the environment variable `DEBUG_LOG` to a file, e.g. like this:
+In addition, you can instruct restic to create a debug log by setting the
+environment variable `DEBUG_LOG` to a file, e.g. like this:
 
     $ export DEBUG_LOG=/tmp/restic-debug.log
     $ restic backup ~/work
@@ -59,6 +59,19 @@ Please be aware that the debug log file will contain potentially sensitive
 things like file and directory names, so please either redact it before
 uploading it somewhere or post only the parts that are really relevant.
 
+If restic gets stuck, please also include a stacktrace in the description.
+On non-Windows systems, you can send a SIGQUIT signal to restic or press
+`Ctrl-\` to achieve the same result. This causes restic to print a stacktrace
+and then exit immediately. This will not damage your repository, however,
+it might be necessary to manually clean up stale lock files using
+`restic unlock`.
+
+On Windows, please set the environment variable `RESTIC_DEBUG_STACKTRACE_SIGINT`
+to `true` and press `Ctrl-C` to create a stacktrace.
+
+If you think restic uses too much memory or a too large cache directory, then
+please include the output of `restic stats --mode debug`.
+
 
 Development Environment
 =======================
@@ -66,8 +79,8 @@ Development Environment
 The repository contains the code written for restic in the directories
 `cmd/` and `internal/`.
 
-Restic requires Go version 1.13 or later for compiling. Clone the repo (without
-having `$GOPATH` set) and `cd` into the directory:
+Make sure you have the minimum required Go version installed. Clone the repo
+(without having `$GOPATH` set) and `cd` into the directory:
 
     $ unset GOPATH
     $ git clone https://github.com/restic/restic
@@ -77,12 +90,42 @@ Then use the `go` tool to build restic:
 
     $ go build ./cmd/restic
     $ ./restic version
-    restic 0.10.0-dev (compiled manually) compiled with go1.15.2 on linux/amd64
+    restic 0.14.0-dev (compiled manually) compiled with go1.19 on linux/amd64
+
+To create a debug build use:
+
+    $ go build -tags debug ./cmd/restic
 
 You can run all tests with the following command:
 
     $ go test ./...
 
+
+Performance and Memory Usage Issues
+===================================
+
+Debug builds of restic support the `--block-profile`, `--cpu-profile`,
+`--mem-profile`, and `--trace-profile` options which collect performance data
+that later on can be analyzed using the go tools:
+
+    $ restic --cpu-profile . [...]
+    $ go tool pprof -http localhost:12345 cpu.pprof
+
+To analyze a trace profile use `go tool trace -http=localhost:12345 trace.out`.
+
+As the memory usage of restic changes over time, it may be useful to capture a
+snapshot of the current heap. This is possible using then `--listen-profile`
+option. Then while restic runs you can query and afterwards analyze the heap statistics.
+
+    $ restic --listen-profile localhost:12345 [...]
+    $ curl http://localhost:12345/debug/pprof/heap -o heap.pprof
+    $ go tool pprof -http localhost:12345 heap.pprof
+
+Further useful tools are setting the environment variable `GODEBUG=gctrace=1`,
+which provides information about garbage collector runs. For a graphical variant
+combine this with gcvis.
+
+
 Providing Patches
 =================
 
@@ -123,7 +166,10 @@ down to the following steps:
     writing, ask yourself: If I were the user, what would I need to be aware
     of with this change?
 
- 8. Once your code looks good and passes all the tests, we'll merge it. Thanks
+ 8. Do not edit the man pages under `doc/man` or `doc/manual_rest.rst` -
+    these are autogenerated before new releases.
+
+ 9. Once your code looks good and passes all the tests, we'll merge it. Thanks
     a lot for your contribution!
 
 Please provide the patches for each bug or feature in a separate branch and

README.md

@@ -46,8 +46,8 @@ Therefore, restic supports the following backends for storing backups natively:
 
 - [Local directory](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#local)
 - [sftp server (via SSH)](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#sftp)
-- [HTTP REST server](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#rest-server) ([protocol](doc/100_references.rst#rest-backend), [rest-server](https://github.com/restic/rest-server))
-- [AWS S3](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#amazon-s3) (either from Amazon or using the [Minio](https://minio.io) server)
+- [HTTP REST server](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#rest-server) ([protocol](https://restic.readthedocs.io/en/latest/100_references.html#rest-backend), [rest-server](https://github.com/restic/rest-server))
+- [Amazon S3](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#amazon-s3) (either from Amazon or using the [Minio](https://minio.io) server)
 - [OpenStack Swift](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#openstack-swift)
 - [BackBlaze B2](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#backblaze-b2)
 - [Microsoft Azure Blob Storage](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#microsoft-azure-blob-storage)
@@ -95,7 +95,7 @@ release. Instructions on how to do that are contained in the
 News
 ----
 
-You can follow the restic project on Twitter [@resticbackup](https://twitter.com/resticbackup) or by subscribing to
+You can follow the restic project on Mastodon [@resticbackup](https://fosstodon.org/@restic) or by subscribing to
 the [project blog](https://restic.net/blog/).
 
 License

VERSION

@@ -1 +1 @@
-0.12.1
+0.16.4

build.go

@@ -3,8 +3,8 @@
 // This program aims to make building Go programs for end users easier by just
 // calling it with `go run`, without having to setup a GOPATH.
 //
-// This program needs Go >= 1.12. It'll use Go modules for compilation. It
-// builds the package configured as Main in the Config struct.
+// This program checks for a minimum Go version. It will use Go modules for
+// compilation. It builds the package configured as Main in the Config struct.
 
 // BSD 2-Clause License
 //
@@ -35,6 +35,7 @@
 // OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+//go:build ignore_build_go
 // +build ignore_build_go
 
 package main
@@ -42,7 +43,6 @@ package main
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -58,7 +58,7 @@ var config = Config{
 	Main:             "./cmd/restic",                           // package name for the main package
 	DefaultBuildTags: []string{"selfupdate"},                   // specify build tags which are always used
 	Tests:            []string{"./..."},                        // tests to run
-	MinVersion:       GoVersion{Major: 1, Minor: 11, Patch: 0}, // minimum Go version supported
+	MinVersion:       GoVersion{Major: 1, Minor: 18, Patch: 0}, // minimum Go version supported
 }
 
 // Config configures the build.
@@ -123,17 +123,8 @@ func printEnv(env []string) {
 
 // build runs "go build args..." with GOPATH set to gopath.
 func build(cwd string, env map[string]string, args ...string) error {
-	a := []string{"build"}
-
-	// try to remove all absolute paths from resulting binary
-	if goVersion.AtLeast(GoVersion{1, 13, 0}) {
-		// use the new flag introduced by Go 1.13
-		a = append(a, "-trimpath")
-	} else {
-		// otherwise try to trim as many paths as possible
-		a = append(a, "-asmflags", fmt.Sprintf("all=-trimpath=%s", cwd))
-		a = append(a, "-gcflags", fmt.Sprintf("all=-trimpath=%s", cwd))
-	}
+	// -trimpath removes all absolute paths from the binary.
+	a := []string{"build", "-trimpath"}
 
 	if enablePIE {
 		a = append(a, "-buildmode=pie")
@@ -187,7 +178,7 @@ func test(cwd string, env map[string]string, args ...string) error {
 // getVersion returns the version string from the file VERSION in the current
 // directory.
 func getVersionFromFile() string {
-	buf, err := ioutil.ReadFile("VERSION")
+	buf, err := os.ReadFile("VERSION")
 	if err != nil {
 		verbosePrintf("error reading file VERSION: %v\n", err)
 		return ""
@@ -327,12 +318,8 @@ func (v GoVersion) String() string {
 }
 
 func main() {
-	if !goVersion.AtLeast(GoVersion{1, 12, 0}) {
-		die("Go version (%v) is too old, restic requires Go >= 1.12\n", goVersion)
-	}
-
 	if !goVersion.AtLeast(config.MinVersion) {
-		fmt.Fprintf(os.Stderr, "%s detected, this program requires at least %s\n", goVersion, config.MinVersion)
+		fmt.Fprintf(os.Stderr, "Detected version %s is too old, restic requires at least %s\n", goVersion, config.MinVersion)
 		os.Exit(1)
 	}
 
@@ -393,6 +380,12 @@ func main() {
 		}
 	}
 
+	solarisMinVersion := GoVersion{Major: 1, Minor: 20, Patch: 0}
+	if env["GOARCH"] == "solaris" && !goVersion.AtLeast(solarisMinVersion) {
+		fmt.Fprintf(os.Stderr, "Detected version %s is too old, restic requires at least %s for Solaris\n", goVersion, solarisMinVersion)
+		os.Exit(1)
+	}
+
 	verbosePrintf("detected Go version %v\n", goVersion)
 
 	preserveSymbols := false

changelog/0.10.0_2020-09-19/pull-2668

@@ -1,6 +1,6 @@
 Bugfix: Don't abort the stats command when data blobs are missing
 
-Runing the stats command in the blobs-per-file mode on a repository with
+Running the stats command in the blobs-per-file mode on a repository with
 missing data blobs previously resulted in a crash.
 
 https://github.com/restic/restic/pull/2668

changelog/0.11.0_2020-11-05/issue-1756

@@ -1,6 +1,6 @@
 Bugfix: Mark repository files as read-only when using the local backend
 
-Files stored in a local repository were marked as writeable on the
+Files stored in a local repository were marked as writable on the
 filesystem for non-Windows systems, which did not prevent accidental file
 modifications outside of restic. In addition, the local backend did not work
 with certain filesystems and network mounts which do not permit modifications

changelog/0.11.0_2020-11-05/issue-340

@@ -5,7 +5,7 @@ another process using an exclusive lock through a filesystem snapshot. Restic
 was unable to backup those files before. This update enables backing up these
 files.
 
-This needs to be enabled explicitely using the --use-fs-snapshot option of the
+This needs to be enabled explicitly using the --use-fs-snapshot option of the
 backup command.
 
 https://github.com/restic/restic/issues/340

changelog/0.12.0_2021-02-14/pull-3106

@@ -2,7 +2,7 @@ Enhancement: Parallelize scan of snapshot content in `copy` and `prune`
 
 The `copy` and `prune` commands used to traverse the directories of
 snapshots one by one to find used data. This snapshot traversal is
-now parallized which can speed up this step several times.
+now parallelized which can speed up this step several times.
 
 In addition the `check` command now reports how many snapshots have
 already been processed.

changelog/0.13.0_2022-03-26/issue-1106

@@ -0,0 +1,10 @@
+Bugfix: Never lock repository for `list locks`
+
+The `list locks` command previously locked to the repository by default. This
+had the problem that it wouldn't work for an exclusively locked repository and
+that the command would also display its own lock file which can be confusing.
+
+Now, the `list locks` command never locks the repository.
+
+https://github.com/restic/restic/issues/1106
+https://github.com/restic/restic/pull/3665

changelog/0.13.0_2022-03-26/issue-1542

@@ -0,0 +1,16 @@
+Enhancement: Add `--dry-run`/`-n` option to `backup` command
+
+Testing exclude filters and other configuration options was error prone as
+wrong filters could cause files to be uploaded unintentionally. It was also
+not possible to estimate beforehand how much data would be uploaded.
+
+The `backup` command now has a `--dry-run`/`-n` option, which performs all the
+normal steps of a backup without actually writing anything to the repository.
+
+Passing -vv will log information about files that would be added, allowing for
+verification of source and exclusion options before running the real backup.
+
+https://github.com/restic/restic/issues/1542
+https://github.com/restic/restic/pull/2308
+https://github.com/restic/restic/pull/3210
+https://github.com/restic/restic/pull/3300

changelog/0.13.0_2022-03-26/issue-2202

@@ -0,0 +1,15 @@
+Enhancement: Add upload checksum for Azure, GS, S3 and Swift backends
+
+Previously only the B2 and partially the Swift backends verified the integrity
+of uploaded (encrypted) files. The verification works by informing the backend
+about the expected hash of the uploaded file. The backend then verifies the
+upload and thereby rules out any data corruption during upload.
+
+We have now added upload checksums for the Azure, GS, S3 and Swift backends,
+which besides integrity checking for uploads also means that restic can now be
+used to store backups in S3 buckets which have Object Lock enabled.
+
+https://github.com/restic/restic/issues/2202
+https://github.com/restic/restic/issues/2700
+https://github.com/restic/restic/issues/3023
+https://github.com/restic/restic/pull/3246

changelog/0.13.0_2022-03-26/issue-233

@@ -0,0 +1,29 @@
+Enhancement: Support negative include/exclude patterns
+
+If a pattern starts with an exclamation mark and it matches a file that was
+previously matched by a regular pattern, the match is cancelled. Notably,
+this can be used with `--exclude-file` to cancel the exclusion of some files.
+
+It works similarly to `.gitignore`, with the same limitation; Once a directory
+is excluded, it is not possible to include files inside the directory.
+
+Example of use as an exclude pattern for the `backup` command:
+
+    $HOME/**/*
+    !$HOME/Documents
+    !$HOME/code
+    !$HOME/.emacs.d
+    !$HOME/games
+    # [...]
+    node_modules
+    *~
+    *.o
+    *.lo
+    *.pyc
+    # [...]
+    $HOME/code/linux/*
+    !$HOME/code/linux/.git
+    # [...]
+
+https://github.com/restic/restic/issues/233
+https://github.com/restic/restic/pull/2311

changelog/0.13.0_2022-03-26/issue-2345

@@ -0,0 +1,13 @@
+Bugfix: Make cache crash-resistant and usable by multiple concurrent processes
+
+The restic cache directory (`RESTIC_CACHE_DIR`) could end up in a broken state
+in the event of restic (or the OS) crashing. This is now less likely to occur
+as files are downloaded to a temporary location before being moved to their
+proper location.
+
+This also allows multiple concurrent restic processes to operate on a single
+repository without conflicts. Previously, concurrent operations could cause
+segfaults because the processes saw each other's partially downloaded files.
+
+https://github.com/restic/restic/issues/2345
+https://github.com/restic/restic/pull/2838

changelog/0.13.0_2022-03-26/issue-2388

@@ -0,0 +1,10 @@
+Enhancement: Add warning for S3 if partial credentials are provided
+
+Previously restic did not notify about incomplete credentials when using the
+S3 backend, instead just reporting access denied.
+
+Restic now checks that both the AWS key ID and secret environment variables are
+set before connecting to the remote server, and reports an error if not.
+
+https://github.com/restic/restic/issues/2388
+https://github.com/restic/restic/pull/3532

changelog/0.13.0_2022-03-26/issue-2452

@@ -0,0 +1,11 @@
+Bugfix: Improve error handling of repository locking
+
+Previously, when the lock refresh failed to delete the old lock file, it forgot
+about the newly created one. Instead it continued trying to delete the old
+(usually no longer existing) lock file and thus over time lots of lock files
+accumulated. This has now been fixed.
+
+https://github.com/restic/restic/issues/2452
+https://github.com/restic/restic/issues/2473
+https://github.com/restic/restic/issues/2562
+https://github.com/restic/restic/pull/3512

changelog/0.13.0_2022-03-26/issue-2508

@@ -0,0 +1,8 @@
+Enhancement: Support JSON output and quiet mode for the `diff` command
+
+The `diff` command now supports outputting machine-readable output in JSON
+format. To enable this, pass the `--json` option to the command. To only print
+the summary and suppress detailed output, pass the `--quiet` option.
+
+https://github.com/restic/restic/issues/2508
+https://github.com/restic/restic/pull/3592

changelog/0.13.0_2022-03-26/issue-2656

@@ -0,0 +1,8 @@
+Enhancement: Add flag to disable TLS verification for self-signed certificates
+
+There is now an `--insecure-tls` global option in restic, which disables TLS
+verification for self-signed certificates in order to support some development
+workflows.
+
+https://github.com/restic/restic/issues/2656
+https://github.com/restic/restic/pull/2657

changelog/0.13.0_2022-03-26/issue-2738

@@ -0,0 +1,8 @@
+Bugfix: Don't print progress for `backup --json --quiet`
+
+Unlike the text output, the `--json` output format still printed progress
+information even in `--quiet` mode. This has now been fixed by always
+disabling the progress output in quiet mode.
+
+https://github.com/restic/restic/issues/2738
+https://github.com/restic/restic/pull/3264

changelog/0.13.0_2022-03-26/issue-3003

@@ -0,0 +1,9 @@
+Enhancement: Atomic uploads for the SFTP backend
+
+The SFTP backend did not upload files atomically. An interrupted upload could
+leave an incomplete file behind which could prevent restic from accessing the
+repository. This has now been fixed and uploads in the SFTP backend are done
+atomically.
+
+https://github.com/restic/restic/issues/3003
+https://github.com/restic/restic/pull/3524

changelog/0.13.0_2022-03-26/issue-3127

@@ -0,0 +1,6 @@
+Enhancement: Add xattr (extended attributes) support for Solaris
+
+Restic now supports xattr for the Solaris operating system.
+
+https://github.com/restic/restic/issues/3127
+https://github.com/restic/restic/pull/3628

changelog/0.13.0_2022-03-26/issue-3382

@@ -0,0 +1,8 @@
+Bugfix: Make `check` command honor `RESTIC_CACHE_DIR` environment variable
+
+Previously, the `check` command didn't honor the `RESTIC_CACHE_DIR` environment
+variable, which caused problems in certain system/usage configurations. This
+has now been fixed.
+
+https://github.com/restic/restic/issues/3382
+https://github.com/restic/restic/pull/3474

changelog/0.13.0_2022-03-26/issue-3464

@@ -0,0 +1,10 @@
+Enhancement: Skip lock creation on `forget` if `--no-lock` and `--dry-run`
+
+Restic used to silently ignore the `--no-lock` option of the `forget` command.
+
+It now skips creation of lock file in case both `--dry-run` and `--no-lock`
+are specified. If `--no-lock` option is specified without `--dry-run`, restic
+prints a warning message to stderr.
+
+https://github.com/restic/restic/issues/3464
+https://github.com/restic/restic/pull/3623

changelog/0.13.0_2022-03-26/issue-3490

@@ -0,0 +1,8 @@
+Enhancement: Support random subset by size in `check --read-data-subset`
+
+The `--read-data-subset` option of the `check` command now supports a third way
+of specifying the subset to check, namely `nS` where `n` is a size in bytes with
+suffix `S` as k/K, m/M, g/G or t/T.
+
+https://github.com/restic/restic/issues/3490
+https://github.com/restic/restic/pull/3548

changelog/0.13.0_2022-03-26/issue-3518

@@ -0,0 +1,8 @@
+Bugfix: Make `copy` command honor `--no-lock` for source repository
+
+The `copy` command previously did not respect the `--no-lock` option for the
+source repository, causing failures with read-only storage backends. This has
+now been fixed such that the option is now respected.
+
+https://github.com/restic/restic/issues/3518
+https://github.com/restic/restic/pull/3589

changelog/0.13.0_2022-03-26/issue-3541

@@ -0,0 +1,9 @@
+Enhancement: Improve handling of temporary B2 delete errors
+
+Deleting files on B2 could sometimes fail temporarily, which required restic to
+retry the delete operation. In some cases the file was deleted nevertheless,
+causing the retries and ultimately the restic command to fail. This has now been
+fixed.
+
+https://github.com/restic/restic/issues/3541
+https://github.com/restic/restic/pull/3544

changelog/0.13.0_2022-03-26/issue-3542

@@ -0,0 +1,8 @@
+Enhancement: Add file mode in symbolic notation to `ls --json`
+
+The `ls --json` command now provides the file mode in symbolic notation (using
+the `permissions` key), aligned with `find --json`.
+
+https://github.com/restic/restic/issues/3542
+https://github.com/restic/restic/pull/3573
+https://forum.restic.net/t/restic-ls-understanding-file-mode-with-json/4371

changelog/0.13.0_2022-03-26/issue-3556

@@ -0,0 +1,10 @@
+Bugfix: Fix hang with Backblaze B2 on SSL certificate authority error
+
+Previously, if a request failed with an SSL unknown certificate authority
+error, the B2 backend retried indefinitely and restic would appear to hang.
+
+This has now been fixed and restic instead fails with an error message.
+
+https://github.com/restic/restic/issues/3556
+https://github.com/restic/restic/issues/2355
+https://github.com/restic/restic/pull/3571

changelog/0.13.0_2022-03-26/issue-3601

@@ -0,0 +1,15 @@
+Bugfix: Fix rclone backend prematurely exiting when receiving SIGINT on Windows
+
+Previously, pressing Ctrl+C in a Windows console where restic was running with
+rclone as the backend would cause rclone to exit prematurely due to getting a
+`SIGINT` signal at the same time as restic. Restic would then wait for a long
+time for time with "unexpected EOF" and "rclone stdio connection already closed"
+errors.
+
+This has now been fixed by restic starting the rclone process detached from the
+console restic runs in (similar to starting processes in a new process group on
+Linux), which enables restic to gracefully clean up rclone (which now never gets
+the `SIGINT`).
+
+https://github.com/restic/restic/issues/3601
+https://github.com/restic/restic/pull/3602

changelog/0.13.0_2022-03-26/issue-3641

@@ -0,0 +1,14 @@
+Change: Ignore parent snapshot for `backup --stdin`
+
+Restic uses a parent snapshot to speed up directory scanning when performing
+backups, but this only wasted time and memory when the backup source is stdin
+(using the `--stdin` option of the `backup` command), since no directory scanning
+is performed in this case.
+
+Snapshots made with `backup --stdin` no longer have a parent snapshot, which allows
+restic to skip some startup operations and saves a bit of resources.
+
+The `--parent` option is still available for `backup --stdin`, but is now ignored.
+
+https://github.com/restic/restic/issues/3641
+https://github.com/restic/restic/pull/3645

changelog/0.13.0_2022-03-26/issue-3667

@@ -0,0 +1,8 @@
+Bugfix: The `mount` command now reports symlinks sizes
+
+Symlinks used to have size zero in restic mountpoints, confusing some
+third-party tools. They now have a size equal to the byte length of their
+target path, as required by POSIX.
+
+https://github.com/restic/restic/issues/3667
+https://github.com/restic/restic/pull/3668

changelog/0.13.0_2022-03-26/pull-2594

@@ -0,0 +1,7 @@
+Enhancement: Speed up the `restore --verify` command
+
+The `--verify` option lets the `restore` command verify the file content
+after it has restored a snapshot. The performance of this operation has
+now been improved by up to a factor of two.
+
+https://github.com/restic/restic/pull/2594

changelog/0.13.0_2022-03-26/pull-2816

@@ -0,0 +1,10 @@
+Enhancement: The `backup` command no longer updates file access times on Linux
+
+When reading files during backup, restic used to cause the operating system to
+update the files' access times. Note that this did not apply to filesystems with
+disabled file access times.
+
+Restic now instructs the operating system not to update the file access time,
+if the user running restic is the file owner or has root permissions.
+
+https://github.com/restic/restic/pull/2816

changelog/0.13.0_2022-03-26/pull-2880

@@ -0,0 +1,9 @@
+Enhancement: Make `recover` collect only unreferenced trees
+
+Previously, the `recover` command used to generate a snapshot containing *all*
+root trees, even those which were already referenced by a snapshot.
+
+This has been improved such that it now only processes trees not already
+referenced by any snapshot.
+
+https://github.com/restic/restic/pull/2880

changelog/0.13.0_2022-03-26/pull-3429

@@ -0,0 +1,12 @@
+Enhancement: Verify that new or modified keys are stored correctly
+
+When adding a new key or changing the password of a key, restic used to just
+create the new key (and remove the old one, when changing the password). There
+was no verification that the new key was stored correctly and works properly.
+As the repository cannot be decrypted without a valid key file, this could in
+rare cases cause the repository to become inaccessible.
+
+Restic now checks that new key files actually work before continuing. This
+can protect against some (rare) cases of hardware or storage problems.
+
+https://github.com/restic/restic/pull/3429

changelog/0.13.0_2022-03-26/pull-3436

@@ -0,0 +1,12 @@
+Enhancement: Improve local backend's resilience to (system) crashes
+
+Restic now ensures that files stored using the `local` backend are created
+atomically (that is, files are either stored completely or not at all). This
+ensures that no incomplete files are left behind even if restic is terminated
+while writing a file.
+
+In addition, restic now tries to ensure that the directory in the repository
+which contains a newly uploaded file is also written to disk. This can prevent
+missing files if the system crashes or the disk is not properly unmounted.
+
+https://github.com/restic/restic/pull/3436

changelog/0.13.0_2022-03-26/pull-3488

@@ -0,0 +1,9 @@
+Bugfix: `rebuild-index` failed if an index file was damaged
+
+Previously, the `rebuild-index` command would fail with an error if an index
+file was damaged or truncated. This has now been fixed.
+
+On older restic versions, a (slow) workaround is to use
+`rebuild-index --read-all-packs` or to manually delete the damaged index.
+
+https://github.com/restic/restic/pull/3488

changelog/0.13.0_2022-03-26/pull-3508

@@ -0,0 +1,10 @@
+Enhancement: Cache blobs read by the `dump` command
+
+When dumping a file using the `dump` command, restic did not cache blobs in any
+way, so even consecutive runs of the same blob were loaded from the repository
+again and again, slowing down the dump.
+
+Now, the caching mechanism already used by the `fuse` command is also used by
+the `dump` command. This makes dumping much faster, especially for sparse files.
+
+https://github.com/restic/restic/pull/3508

changelog/0.13.0_2022-03-26/pull-3514

@@ -0,0 +1,8 @@
+Enhancement: Support configurable timeout for the rclone backend
+
+A slow rclone backend could cause restic to time out while waiting for the
+repository to open. Restic now offers an `-o rclone.timeout` option to make
+this timeout configurable.
+
+https://github.com/restic/restic/issues/3511
+https://github.com/restic/restic/pull/3514

changelog/0.13.0_2022-03-26/pull-3519

@@ -0,0 +1,6 @@
+Change: Require Go 1.14 or newer
+
+Restic now requires Go 1.14 to build. This allows it to use new
+standard library features instead of an external dependency.
+
+https://github.com/restic/restic/issues/3519

changelog/0.13.0_2022-03-26/pull-3591

@@ -0,0 +1,8 @@
+Bugfix: Fix handling of `prune --max-repack-size=0`
+
+Restic ignored the `--max-repack-size` option when passing a value of 0. This
+has now been fixed.
+
+As a workaround, `--max-repack-size=1` can be used with older versions of restic.
+
+https://github.com/restic/restic/pull/3591

changelog/0.13.0_2022-03-26/pull-3593

@@ -0,0 +1,10 @@
+Enhancement: Improve `copy` performance by parallelizing IO
+
+Restic copy previously only used a single thread for copying blobs between
+repositories, which resulted in limited performance when copying small blobs
+to/from a high latency backend (i.e. any remote backend, especially b2).
+
+Copying will now use 8 parallel threads to increase the throughput of the copy
+operation.
+
+https://github.com/restic/restic/pull/3593

changelog/0.13.0_2022-03-26/pull-3619

@@ -0,0 +1,11 @@
+Bugfix: Avoid choosing parent snapshots newer than time of new snapshot
+
+The `backup` command, when a `--parent` was not provided, previously chose the
+most recent matching snapshot as the parent snapshot. However, this didn't make
+sense when the user passed `--time` to create a new snapshot older than the most
+recent snapshot.
+
+Instead, `backup` now chooses the most recent snapshot which is not newer than
+the snapshot-being-created's timestamp, to avoid any time travel.
+
+https://github.com/restic/restic/pull/3619

changelog/0.14.0_2022-08-25/issue-1153

@@ -0,0 +1,9 @@
+Enhancement: Support pruning even when the disk is full
+
+When running out of disk space it was no longer possible to add or remove
+data from a repository. To help with recovering from such a deadlock, the
+prune command now supports an `--unsafe-recover-no-free-space` option to
+recover from these situations. Make sure to read the documentation first!
+
+https://github.com/restic/restic/issues/1153
+https://github.com/restic/restic/pull/3481

changelog/0.14.0_2022-08-25/issue-1842

@@ -0,0 +1,8 @@
+Change: Support debug log creation in release builds
+
+Creating a debug log was only possible in debug builds which required users to
+manually build restic. We changed the release builds to allow creating debug
+logs by simply setting the environment variable `DEBUG_LOG=logname.log`.
+
+https://github.com/restic/restic/issues/1842
+https://github.com/restic/restic/pull/3826

changelog/0.14.0_2022-08-25/issue-21

@@ -0,0 +1,28 @@
+Enhancement: Add compression support
+
+We've added compression support to the restic repository format. To create a
+repository using the new format run `init --repository-version 2`. Please note
+that the repository cannot be read by restic versions prior to 0.14.0.
+
+You can configure whether data is compressed with the option `--compression`. It
+can be set to `auto` (the default, which will compress very fast), `max` (which
+will trade backup speed and CPU usage for better compression), or `off` (which
+disables compression). Each setting is only applied for the current run of restic
+and does *not* apply to future runs. The option can also be set via the
+environment variable `RESTIC_COMPRESSION`.
+
+To upgrade in place run `migrate upgrade_repo_v2` followed by `prune`. See the
+documentation for more details. The migration checks the repository integrity
+and upgrades the repository format, but will not change any data. Afterwards,
+prune will rewrite the metadata to make use of compression.
+
+As an alternative you can use the `copy` command to migrate snapshots; First
+create a new repository using
+`init --repository-version 2 --copy-chunker-params --repo2 path/to/old/repo`,
+and then use the `copy` command to copy all snapshots to the new repository.
+
+https://github.com/restic/restic/issues/21
+https://github.com/restic/restic/issues/3779
+https://github.com/restic/restic/pull/3666
+https://github.com/restic/restic/pull/3704
+https://github.com/restic/restic/pull/3733

changelog/0.14.0_2022-08-25/issue-2162

@@ -0,0 +1,18 @@
+Enhancement: Adaptive IO concurrency based on backend connections
+
+Many commands used hard-coded limits for the number of concurrent operations.
+This prevented speed improvements by increasing the number of connections used
+by a backend.
+
+These limits have now been replaced by using the configured number of backend
+connections instead, which can be controlled using the
+`-o <backend-name>.connections=5` option. Commands will then automatically
+scale their parallelism accordingly.
+
+To limit the number of CPU cores used by restic, you can set the environment
+variable `GOMAXPROCS` accordingly. For example to use a single CPU core, use
+`GOMAXPROCS=1`.
+
+https://github.com/restic/restic/issues/2162
+https://github.com/restic/restic/issues/1467
+https://github.com/restic/restic/pull/3611

changelog/0.14.0_2022-08-25/issue-2248

@@ -0,0 +1,8 @@
+Bugfix: Support `self-update` on Windows
+
+Restic `self-update` would fail in situations where the operating system
+locks running binaries, including Windows. The new behavior works around
+this by renaming the running file and swapping the updated file in place.
+
+https://github.com/restic/restic/issues/2248
+https://github.com/restic/restic/pull/3675

changelog/0.14.0_2022-08-25/issue-2291

@@ -0,0 +1,12 @@
+Enhancement: Allow pack size customization
+
+Restic now uses a target pack size of 16 MiB by default. This can be customized
+using the `--pack-size size` option. Supported pack sizes range between 4 and
+128 MiB.
+
+It is possible to migrate an existing repository to _larger_ pack files using
+`prune --repack-small`. This will rewrite every pack file which is
+significantly smaller than the target size.
+
+https://github.com/restic/restic/issues/2291
+https://github.com/restic/restic/pull/3731

changelog/0.14.0_2022-08-25/issue-2295

@@ -0,0 +1,14 @@
+Enhancement: Allow use of SAS token to authenticate to Azure
+
+Previously restic only supported AccountKeys to authenticate to Azure
+storage accounts, which necessitates giving a significant amount of
+access.
+
+We added support for Azure SAS tokens which are a more fine-grained
+and time-limited manner of granting access. Set the `AZURE_ACCOUNT_NAME`
+and `AZURE_ACCOUNT_SAS` environment variables to use a SAS token for
+authentication. Note that if `AZURE_ACCOUNT_KEY` is set, it will take
+precedence.
+
+https://github.com/restic/restic/issues/2295
+https://github.com/restic/restic/pull/3661

changelog/0.14.0_2022-08-25/issue-2696

@@ -0,0 +1,13 @@
+Enhancement: Improve backup speed with many small files
+
+We have restructured the backup pipeline to continue reading files while all
+upload connections are busy. This allows the backup to already prepare the next
+data file such that the upload can continue as soon as a connection becomes
+available. This can especially improve the backup performance for high latency
+backends.
+
+The upload concurrency is now controlled using the `-o <backend-name>.connections=5`
+option.
+
+https://github.com/restic/restic/issues/2696
+https://github.com/restic/restic/pull/3489

changelog/0.14.0_2022-08-25/issue-2907

@@ -0,0 +1,15 @@
+Enhancement: Make snapshot directory structure of `mount` command customizable
+
+We've added the possibility to customize the snapshot directory structure of
+the `mount` command using templates passed to the `--snapshot-template` option.
+The formatting of snapshots' timestamps is now controlled using `--time-template`
+and supports subdirectories to for example group snapshots by year. Please
+see `restic help mount` for further details.
+
+Characters in tag names which are not allowed in a filename are replaced by
+underscores `_`. For example a tag `foo/bar` will result in a directory name
+of `foo_bar`.
+
+https://github.com/restic/restic/issues/2907
+https://github.com/restic/restic/pull/2913
+https://github.com/restic/restic/pull/3691

changelog/0.14.0_2022-08-25/issue-3114

@@ -0,0 +1,12 @@
+Enhancement: Optimize handling of duplicate blobs in `prune`
+
+Restic `prune` always used to repack all data files containing duplicate
+blobs. This effectively removed all duplicates during prune. However, as a
+consequence all these data files were repacked even if the unused repository
+space threshold could be reached with less work.
+
+This is now changed and `prune` works nice and fast even when there are lots
+of duplicate blobs.
+
+https://github.com/restic/restic/issues/3114
+https://github.com/restic/restic/pull/3290

changelog/0.14.0_2022-08-25/issue-3295

@@ -0,0 +1,13 @@
+Change: Deprecate `check --check-unused` and add further checks
+
+Since restic 0.12.0, it is expected to still have unused blobs after running
+`prune`. This made the `--check-unused` option of the `check` command rather
+useless and tended to confuse users. This option has been deprecated and is
+now ignored.
+
+The `check` command now also warns if a repository is using either the legacy
+S3 layout or mixed pack files with both tree and data blobs. The latter is
+known to cause performance problems.
+
+https://github.com/restic/restic/issues/3295
+https://github.com/restic/restic/pull/3730

changelog/0.14.0_2022-08-25/issue-3428

@@ -0,0 +1,14 @@
+Bugfix: List snapshots in backend at most once to resolve snapshot IDs
+
+Many commands support specifying a list of snapshot IDs which are then used to
+determine the snapshots to be processed by the command. To resolve snapshot IDs
+or `latest`, and check that these exist, restic previously listed all snapshots
+stored in the repository. Depending on the backend this could be a slow and/or
+expensive operation.
+
+Restic now lists the snapshots only once and remembers the result in order to
+resolve all further snapshot IDs swiftly.
+
+https://github.com/restic/restic/issues/3428
+https://github.com/restic/restic/pull/3570
+https://github.com/restic/restic/pull/3395

changelog/0.14.0_2022-08-25/issue-3432

@@ -0,0 +1,14 @@
+Bugfix: Fix rare 'not found in repository' error for `copy` command
+
+In rare cases `copy` (and other commands) would report that `LoadTree(...)`
+returned an `id [...] not found in repository` error. This could be caused by
+a backup or copy command running concurrently. The error was only temporary;
+running the failed restic command a second time as a workaround did resolve the
+error.
+
+This issue has now been fixed by correcting the order in which restic reads data
+from the repository. It is now guaranteed that restic only loads snapshots for
+which all necessary data is already available.
+
+https://github.com/restic/restic/issues/3432
+https://github.com/restic/restic/pull/3570

changelog/0.14.0_2022-08-25/issue-3465

@@ -0,0 +1,10 @@
+Enhancement: Improve handling of temporary files on Windows
+
+In some cases restic failed to delete temporary files, causing the current
+command to fail. This has now been fixed by ensuring that Windows automatically
+deletes the file. In addition, temporary files are only written to disk when
+necessary, reducing disk writes.
+
+https://github.com/restic/restic/issues/3465
+https://github.com/restic/restic/issues/1551
+https://github.com/restic/restic/pull/3610

changelog/0.14.0_2022-08-25/issue-3685

@@ -0,0 +1,7 @@
+Bugfix: The `diff` command incorrectly listed some files as added
+
+There was a bug in the `diff` command, causing it to always show files in a
+removed directory as added. This has now been fixed.
+
+https://github.com/restic/restic/issues/3685
+https://github.com/restic/restic/pull/3686

changelog/0.14.0_2022-08-25/issue-3692

@@ -0,0 +1,13 @@
+Bugfix: Fix rclone (shimmed by Scoop) and sftp not working on Windows
+
+In #3602 a fix was introduced to address the problem of `rclone` prematurely
+exiting when Ctrl+C is pressed on Windows. The solution was to create the
+subprocess with its console detached from the restic console.
+
+However, this solution failed when using `rclone` installed by Scoop or using
+`sftp` with a passphrase-protected private key. We've now fixed this by using
+a different approach to prevent Ctrl-C from passing down too early.
+
+https://github.com/restic/restic/issues/3681
+https://github.com/restic/restic/issues/3692
+https://github.com/restic/restic/pull/3696

changelog/0.14.0_2022-08-25/issue-3709

@@ -0,0 +1,11 @@
+Enhancement: Validate exclude patterns before backing up
+
+Exclude patterns provided via `--exclude`, `--iexclude`, `--exclude-file` or
+`--iexclude-file` previously weren't validated. As a consequence, invalid
+patterns resulted in files that were meant to be excluded being backed up.
+
+Restic now validates all patterns before running the backup and aborts with
+a fatal error if an invalid pattern is detected.
+
+https://github.com/restic/restic/issues/3709
+https://github.com/restic/restic/pull/3734

changelog/0.14.0_2022-08-25/issue-3720

@@ -0,0 +1,13 @@
+Bugfix: Directory sync errors for repositories accessed via SMB
+
+On Linux and macOS, accessing a repository via a SMB/CIFS mount resulted in
+restic failing to save the lock file, yielding the following errors:
+
+Save(<lock/071fe833f0>) returned error, retrying after 552.330144ms: sync /repo/locks: no such file or directory
+Save(<lock/bf789d7343>) returned error, retrying after 552.330144ms: sync /repo/locks: invalid argument
+
+This has now been fixed by ignoring the relevant error codes.
+
+https://github.com/restic/restic/issues/3720
+https://github.com/restic/restic/issues/3751
+https://github.com/restic/restic/pull/3752

changelog/0.14.0_2022-08-25/issue-3736

@@ -0,0 +1,8 @@
+Bugfix: The `stats` command miscalculated restore size for multiple snapshots
+
+Since restic 0.10.0 the restore size calculated by the `stats` command for
+multiple snapshots was too low. The hardlink detection was accidentally applied
+across multiple snapshots and thus ignored many files. This has now been fixed.
+
+https://github.com/restic/restic/issues/3736
+https://github.com/restic/restic/pull/3740

changelog/0.14.0_2022-08-25/issue-3837

@@ -0,0 +1,8 @@
+Enhancement: Improve SFTP repository initialization over slow links
+
+The `init` command, when used on an SFTP backend, now sends multiple `mkdir`
+commands to the backend concurrently. This reduces the waiting times when
+creating a repository over a very slow connection.
+
+https://github.com/restic/restic/issues/3837
+https://github.com/restic/restic/pull/3840

changelog/0.14.0_2022-08-25/issue-3861

@@ -0,0 +1,9 @@
+Bugfix: Yield error on invalid policy to `forget`
+
+The `forget` command previously silently ignored invalid/unsupported
+units in the duration options, such as e.g. `--keep-within-daily 2w`.
+
+Specifying an invalid/unsupported duration unit now results in an error.
+
+https://github.com/restic/restic/issues/3861
+https://github.com/restic/restic/pull/3862

changelog/0.14.0_2022-08-25/pull-3419

@@ -0,0 +1,21 @@
+Enhancement: Use config file permissions to control file group access
+
+Previously files in a local/SFTP repository would always end up with very
+restrictive access permissions, allowing access only to the owner. This
+prevented a number of valid use-cases involving groups and ACLs.
+
+We now use the permissions of the config file in the repository to decide
+whether group access should be given to newly created repository files or
+not. We arrange for repository files to be created group readable exactly
+when the repository config file is group readable.
+
+To opt-in to group readable repositories, a simple `chmod -R g+r` or
+equivalent on the config file can be used. For repositories that should
+be writable by group members a tad more setup is required, see the docs.
+
+Posix ACLs can also be used now that the group permissions being forced to
+zero no longer masks the effect of ACL entries.
+
+https://github.com/restic/restic/issues/2351
+https://github.com/restic/restic/pull/3419
+https://forum.restic.net/t/1391

changelog/0.14.0_2022-08-25/pull-3475

@@ -0,0 +1,9 @@
+Enhancement: Allow limiting IO concurrency for local and SFTP backend
+
+Restic did not support limiting the IO concurrency / number of connections for
+accessing repositories stored using the local or SFTP backends. The number of
+connections is now limited as for other backends, and can be configured via the
+`-o local.connections=2` and `-o sftp.connections=5` options. This ensures that
+restic does not overwhelm the backend with concurrent IO operations.
+
+https://github.com/restic/restic/pull/3475

changelog/0.14.0_2022-08-25/pull-3484

@@ -0,0 +1,13 @@
+Enhancement: Stream data in `check` and `prune` commands
+
+The commands `check --read-data` and `prune` previously downloaded data files
+into temporary files which could end up being written to disk. This could cause
+a large amount of data being written to disk.
+
+The pack files are now instead streamed, which removes the need for temporary
+files. Please note that *uploads* during `backup` and `prune` still require
+temporary files.
+
+https://github.com/restic/restic/pull/3484
+https://github.com/restic/restic/issues/3710
+https://github.com/restic/restic/pull/3717

changelog/0.14.0_2022-08-25/pull-3513

@@ -0,0 +1,10 @@
+Enhancement: Improve speed of `copy` command
+
+The `copy` command could require a long time to copy snapshots for non-local
+backends. This has been improved to provide a throughput comparable to the
+`restore` command.
+
+Additionally, `copy` now displays a progress bar.
+
+https://github.com/restic/restic/issues/2923
+https://github.com/restic/restic/pull/3513

changelog/0.14.0_2022-08-25/pull-3680

@@ -0,0 +1,8 @@
+Change: Update dependencies and require Go 1.15 or newer
+
+We've updated most dependencies. Since some libraries require newer language
+features we're dropping support for Go 1.14, which means that restic now
+requires at least Go 1.15 to build.
+
+https://github.com/restic/restic/issues/3680
+https://github.com/restic/restic/issues/3883

changelog/0.14.0_2022-08-25/pull-3716

@@ -0,0 +1,7 @@
+Bugfix: Print "wrong password" to stderr instead of stdout
+
+If an invalid password was entered, the error message was printed on stdout and
+not on stderr as intended. This has now been fixed.
+
+https://github.com/restic/restic/pull/3716
+https://forum.restic.net/t/4965

changelog/0.14.0_2022-08-25/pull-3729

@@ -0,0 +1,8 @@
+Enhancement: Display full IDs in `check` warnings
+
+When running commands to inspect or repair a damaged repository, it is often
+necessary to supply the full IDs of objects stored in the repository.
+
+The output of `check` now includes full IDs instead of their shortened variant.
+
+https://github.com/restic/restic/pull/3729

changelog/0.14.0_2022-08-25/pull-3742

@@ -0,0 +1,19 @@
+Change: Replace `--repo2` option used by `init`/`copy` with `--from-repo`
+
+The `init` and `copy` commands can read data from another repository.
+However, confusingly `--repo2` referred to the repository *from* which the
+`init` command copies parameters, but for the `copy` command `--repo2`
+referred to the copy *destination*.
+
+We've introduced a new option, `--from-repo`, which always refers to the
+source repository for both commands. The old parameter names have been
+deprecated but still work. To create a new repository and copy all snapshots
+to it, the commands are now as follows:
+
+```
+restic -r /srv/restic-repo-copy init --from-repo /srv/restic-repo --copy-chunker-params
+restic -r /srv/restic-repo-copy copy --from-repo /srv/restic-repo
+```
+
+https://github.com/restic/restic/pull/3742
+https://forum.restic.net/t/5017

changelog/0.14.0_2022-08-25/pull-3772

@@ -0,0 +1,14 @@
+Bugfix: Correctly rebuild index for legacy repositories
+
+After running `rebuild-index` on a legacy repository containing mixed pack
+files (that is, pack files which store both metadata and file data), `check`
+printed warnings like `pack 12345678 contained in several indexes: ...`.
+This warning was not critical, but has now nonetheless been fixed by properly
+handling mixed pack files while rebuilding the index.
+
+Running `prune` for such legacy repositories will also fix the warning by
+reorganizing the pack files which caused it.
+
+https://github.com/restic/restic/pull/3772
+https://github.com/restic/restic/pull/3884
+https://forum.restic.net/t/5044/13

changelog/0.14.0_2022-08-25/pull-3773

@@ -0,0 +1,7 @@
+Enhancement: Optimize memory usage for directories with many files
+
+Backing up a directory with hundreds of thousands or more files caused restic
+to require large amounts of memory. We've now optimized the `backup` command
+such that it requires up to 30% less memory.
+
+https://github.com/restic/restic/pull/3773

changelog/0.14.0_2022-08-25/pull-3776

@@ -0,0 +1,11 @@
+Bugfix: Limit number of key files tested while opening a repository
+
+Previously, restic tested the password against every key in the repository
+when opening a repository. The more keys there were in the repository, the
+slower this operation became.
+
+Restic now tests the password against up to 20 key files in the repository.
+Alternatively, you can use the `--key-hint=<key ID>` option to specify a
+specific key file to use instead.
+
+https://github.com/restic/restic/pull/3776

changelog/0.14.0_2022-08-25/pull-3819

@@ -0,0 +1,11 @@
+Enhancement: Validate include/exclude patterns before restoring
+
+Patterns provided to `restore` via `--exclude`, `--iexclude`, `--include`
+and `--iinclude` weren't validated before running the restore. Invalid
+patterns would result in error messages being printed repeatedly, and
+possibly unwanted files being restored.
+
+Restic now validates all patterns before running the restore, and aborts
+with a fatal error if an invalid pattern is detected.
+
+https://github.com/restic/restic/pull/3819

changelog/0.15.0_2023-01-12/issue-14

@@ -0,0 +1,8 @@
+Enhancement: Implement `rewrite` command
+
+Restic now has a `rewrite` command which allows to rewrite existing snapshots
+to remove unwanted files.
+
+https://github.com/restic/restic/issues/14
+https://github.com/restic/restic/pull/2731
+https://github.com/restic/restic/pull/4079

changelog/0.15.0_2023-01-12/issue-1734

@@ -0,0 +1,15 @@
+Enhancement: Inform about successful retries after errors
+
+When a recoverable error is encountered, restic shows a warning message saying
+that it's retrying, e.g.:
+
+`Save(<data/956b9ced99>) returned error, retrying after 357.131936ms: ...`
+
+This message can be confusing in that it never clearly states whether the retry
+is successful or not. This has now been fixed such that restic follows up with
+a message confirming a successful retry, e.g.:
+
+`Save(<data/956b9ced99>) operation successful after 1 retries`
+
+https://github.com/restic/restic/issues/1734
+https://github.com/restic/restic/pull/2661

changelog/0.15.0_2023-01-12/issue-1866

@@ -0,0 +1,12 @@
+Enhancement: Improve handling of directories with duplicate entries
+
+If for some reason a directory contains a duplicate entry, the `backup` command
+would previously fail with a `node "path/to/file" already present` or `nodes
+are not ordered got "path/to/file", last "path/to/file"` error.
+
+The error handling has been improved to only report a warning in this case. Make
+sure to check that the filesystem in question is not damaged if you see this!
+
+https://github.com/restic/restic/issues/1866
+https://github.com/restic/restic/issues/3937
+https://github.com/restic/restic/pull/3880

changelog/0.15.0_2023-01-12/issue-2015

@@ -0,0 +1,10 @@
+Bugfix: Make `mount` return exit code 0 after receiving Ctrl-C / SIGINT
+
+To stop the `mount` command, a user has to press Ctrl-C or send a SIGINT
+signal to restic. This used to cause restic to exit with a non-zero exit code.
+
+The exit code has now been changed to zero as the above is the expected way
+to stop the `mount` command and should therefore be considered successful.
+
+https://github.com/restic/restic/issues/2015
+https://github.com/restic/restic/pull/3894

changelog/0.15.0_2023-01-12/issue-2134

@@ -0,0 +1,19 @@
+Enhancement: Support B2 API keys restricted to hiding but not deleting files
+
+When the B2 backend does not have the necessary permissions to permanently
+delete files, it now automatically falls back to hiding files. This allows
+using restic with an application key which is not allowed to delete files.
+This can prevent an attacker from deleting backups with such an API key.
+
+To use this feature create an application key without the `deleteFiles`
+capability. It is recommended to restrict the key to just one bucket.
+For example using the `b2` command line tool:
+
+`b2 create-key --bucket <bucketName> <keyName> listBuckets,readFiles,writeFiles,listFiles`
+
+Alternatively, you can use the S3 backend to access B2, as described
+in the documentation. In this mode, files are also only hidden instead
+of being deleted permanently.
+
+https://github.com/restic/restic/issues/2134
+https://github.com/restic/restic/pull/2398

changelog/0.15.0_2023-01-12/issue-2152

@@ -0,0 +1,11 @@
+Enhancement: Make `init` open only one connection for the SFTP backend
+
+The `init` command using the SFTP backend used to connect twice to the
+repository. This could be inconvenient if the user must enter a password,
+or cause `init` to fail if the server does not correctly close the first SFTP
+connection.
+
+This has now been fixed by reusing the first/initial SFTP connection opened.
+
+https://github.com/restic/restic/issues/2152
+https://github.com/restic/restic/pull/3882

changelog/0.15.0_2023-01-12/issue-2533

@@ -0,0 +1,13 @@
+Enhancement: Handle cache corruption on disk and in downloads
+
+In rare situations, like for example after a system crash, the data stored
+in the cache might be corrupted. This could cause restic to fail and required
+manually deleting the cache.
+
+Restic now automatically removes broken data from the cache, allowing it
+to recover from such a situation without user intervention. In addition,
+restic retries downloads which return corrupt data in order to also handle
+temporary download problems.
+
+https://github.com/restic/restic/issues/2533
+https://github.com/restic/restic/pull/3521

changelog/0.15.0_2023-01-12/issue-2591

@@ -0,0 +1,17 @@
+Bugfix: Don't read password from stdin for `backup --stdin`
+
+The `backup` command when used with `--stdin` previously tried to read first
+the password, then the data to be backed up from standard input. This meant
+it would often confuse part of the data for the password.
+
+From now on, it will instead exit with the message `Fatal: cannot read both
+password and data from stdin` unless the password is passed in some other
+way (such as `--restic-password-file`, `RESTIC_PASSWORD`, etc).
+
+To enter the password interactively a password command has to be used. For
+example on Linux, `mysqldump somedatabase | restic backup --stdin
+--password-command='sh -c "systemd-ask-password < /dev/tty"'` securely reads
+the password from the terminal.
+
+https://github.com/restic/restic/issues/2591
+https://github.com/restic/restic/pull/4011

changelog/0.15.0_2023-01-12/issue-2699

@@ -0,0 +1,9 @@
+Enhancement: Support restoring symbolic links on Windows
+
+The `restore` command now supports restoring symbolic links on Windows. Because
+of Windows specific restrictions this is only possible when running restic with
+the `SeCreateSymbolicLinkPrivilege` privilege or as an administrator.
+
+https://github.com/restic/restic/issues/1078
+https://github.com/restic/restic/issues/2699
+https://github.com/restic/restic/pull/2875

changelog/0.15.0_2023-01-12/issue-2715

@@ -0,0 +1,20 @@
+Enhancement: Stricter repository lock handling
+
+Previously, restic commands kept running even if they failed to refresh their
+locks in time. This could be a problem e.g. in case the client system running
+a backup entered the standby power mode while the backup was still in progress
+(which would prevent the client from refreshing its lock), and after a short
+delay another host successfully runs `unlock` and `prune` on the repository,
+which would remove all data added by the in-progress backup. If the backup
+client later continues its backup, even though its lock had expired in the
+meantime, this would lead to an incomplete snapshot.
+
+To address this, lock handling is now much stricter. Commands requiring a lock
+are canceled if the lock is not refreshed successfully in time. In addition,
+if a lock file is not readable restic will not allow starting a command. It may
+be necessary to remove invalid lock files manually or use `unlock --remove-all`.
+Please make sure that no other restic processes are running concurrently before
+doing this, however.
+
+https://github.com/restic/restic/issues/2715
+https://github.com/restic/restic/pull/3569

changelog/0.15.0_2023-01-12/issue-2724

@@ -0,0 +1,9 @@
+Change: Include full snapshot ID in JSON output of `backup`
+
+We have changed the JSON output of the backup command to include the full
+snapshot ID instead of just a shortened version, as the latter can be ambiguous
+in some rare cases. To derive the short ID, please truncate the full ID down to
+eight characters.
+
+https://github.com/restic/restic/issues/2724
+https://github.com/restic/restic/pull/3993

changelog/0.15.0_2023-01-12/issue-3029

@@ -0,0 +1,8 @@
+Enhancement: Add support for `credential_process` to S3 backend
+
+Restic now uses a newer library for the S3 backend, which adds support for the
+`credential_process` option in the AWS credential configuration.
+
+https://github.com/restic/restic/issues/3029
+https://github.com/restic/restic/issues/4034
+https://github.com/restic/restic/pull/4025

changelog/0.15.0_2023-01-12/issue-3096

@@ -0,0 +1,8 @@
+Enhancement: Make `mount` command support macOS using macFUSE 4.x
+
+Restic now uses a different FUSE library for mounting snapshots and making them
+available as a FUSE filesystem using the `mount` command. This adds support for
+macFUSE 4.x which can be used to make this work on recent macOS versions.
+
+https://github.com/restic/restic/issues/3096
+https://github.com/restic/restic/pull/4024

changelog/0.15.0_2023-01-12/issue-3124

@@ -0,0 +1,7 @@
+Enhancement: Support JSON output for the `init` command
+
+The `init` command used to ignore the `--json` option, but now outputs a JSON
+message if the repository was created successfully.
+
+https://github.com/restic/restic/issues/3124
+https://github.com/restic/restic/pull/3132

changelog/0.15.0_2023-01-12/issue-3161

@@ -0,0 +1,14 @@
+Bugfix: Delete files on Backblaze B2 more reliably
+
+Restic used to only delete the latest version of files stored in B2. In most
+cases this worked well as there was only a single version of the file. However,
+due to retries while uploading it is possible for multiple file versions to be
+stored at B2. This could lead to various problems for files that should have
+been deleted but still existed.
+
+The implementation has now been changed to delete all versions of files, which
+doubles the amount of Class B transactions necessary to delete files, but
+assures that no file versions are left behind.
+
+https://github.com/restic/restic/issues/3161
+https://github.com/restic/restic/pull/3885

changelog/0.15.0_2023-01-12/issue-3336

@@ -0,0 +1,12 @@
+Bugfix: Make SFTP backend report no space left on device
+
+Backing up to an SFTP backend would spew repeated SSH_FX_FAILURE messages when
+the remote disk was full. Restic now reports "sftp: no space left on device"
+and exits immediately when it detects this condition.
+
+A fix for this issue was implemented in restic 0.12.1, but unfortunately the
+fix itself contained a bug that prevented it from taking effect.
+
+https://github.com/restic/restic/issues/3336
+https://github.com/restic/restic/pull/3345
+https://github.com/restic/restic/pull/4075