Add crypto debug benchmark

Add code to debug wrong hash issue
Add version for 0.11.0
2026-02-22 08:46:23 +00:00 · 2020-12-23 10:46:53 +01:00 · 2020-12-20 14:51:15 +01:00 · 2020-11-05 09:41:35 +01:00 · 2020-11-05 09:41:35 +01:00 · 2020-11-05 09:41:22 +01:00
97 changed files with 2257 additions and 1288 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /restic
 /.vagrant
+/.vscode
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,178 @@
+Changelog for restic 0.11.0 (2020-11-05)
+=======================================
+
+The following sections list the changes in restic 0.11.0 relevant to
+restic users. The changes are ordered by importance.
+
+Summary
+-------
+
+ * Fix #1212: Restore timestamps and permissions on intermediate directories
+ * Fix #1756: Mark repository files as read-only when using the local backend
+ * Fix #2241: Hide password in REST backend repository URLs
+ * Fix #2319: Correctly dump directories into tar files
+ * Fix #2491: Don't require `self-update --output` placeholder file
+ * Fix #2834: Fix rare cases of backup command hanging forever
+ * Fix #2938: Fix manpage formatting
+ * Fix #2942: Make --exclude-larger-than handle disappearing files
+ * Fix #2951: Restic generate, help and self-update no longer check passwords
+ * Fix #2979: Make snapshots --json output [] instead of null when no snapshots
+ * Enh #2969: Optimize check for unchanged files during backup
+ * Enh #340: Add support for Volume Shadow Copy Service (VSS) on Windows
+ * Enh #2849: Authenticate to Google Cloud Storage with access token
+ * Enh #1458: New option --repository-file
+ * Enh #2978: Warn if parent snapshot cannot be loaded during backup
+
+Details
+-------
+
+ * Bugfix #1212: Restore timestamps and permissions on intermediate directories
+
+   When using the `--include` option of the restore command, restic restored timestamps and
+   permissions only on directories selected by the include pattern. Intermediate directories,
+   which are necessary to restore files located in sub- directories, were created with default
+   permissions. We've fixed the restore command to restore timestamps and permissions for these
+   directories as well.
+
+   https://github.com/restic/restic/issues/1212
+   https://github.com/restic/restic/issues/1402
+   https://github.com/restic/restic/pull/2906
+
+ * Bugfix #1756: Mark repository files as read-only when using the local backend
+
+   Files stored in a local repository were marked as writeable on the filesystem for non-Windows
+   systems, which did not prevent accidental file modifications outside of restic. In addition,
+   the local backend did not work with certain filesystems and network mounts which do not permit
+   modifications of file permissions.
+
+   Restic now marks files stored in a local repository as read-only on the filesystem on
+   non-Windows systems. The error handling is improved to support more filesystems.
+
+   https://github.com/restic/restic/issues/1756
+   https://github.com/restic/restic/issues/2157
+   https://github.com/restic/restic/pull/2989
+
+ * Bugfix #2241: Hide password in REST backend repository URLs
+
+   When using a password in the REST backend repository URL, the password could in some cases be
+   included in the output from restic, e.g. when initializing a repo or during an error.
+
+   The password is now replaced with "***" where applicable.
+
+   https://github.com/restic/restic/issues/2241
+   https://github.com/restic/restic/pull/2658
+
+ * Bugfix #2319: Correctly dump directories into tar files
+
+   The dump command previously wrote directories in a tar file in a way which can cause
+   compatibility problems. This caused, for example, 7zip on Windows to not open tar files
+   containing directories. In addition it was not possible to dump directories with extended
+   attributes. These compatibility problems are now corrected.
+
+   In addition, a tar file now includes the name of the owner and group of a file.
+
+   https://github.com/restic/restic/issues/2319
+   https://github.com/restic/restic/pull/3039
+
+ * Bugfix #2491: Don't require `self-update --output` placeholder file
+
+   `restic self-update --output /path/to/new-restic` used to require that new-restic was an
+   existing file, to be overwritten. Now it's possible to download an updated restic binary to a
+   new path, without first having to create a placeholder file.
+
+   https://github.com/restic/restic/issues/2491
+   https://github.com/restic/restic/pull/2937
+
+ * Bugfix #2834: Fix rare cases of backup command hanging forever
+
+   We've fixed an issue with the backup progress reporting which could cause restic to hang
+   forever right before finishing a backup.
+
+   https://github.com/restic/restic/issues/2834
+   https://github.com/restic/restic/pull/2963
+
+ * Bugfix #2938: Fix manpage formatting
+
+   The manpage formatting in restic v0.10.0 was garbled, which is fixed now.
+
+   https://github.com/restic/restic/issues/2938
+   https://github.com/restic/restic/pull/2977
+
+ * Bugfix #2942: Make --exclude-larger-than handle disappearing files
+
+   There was a small bug in the backup command's --exclude-larger-than option where files that
+   disappeared between scanning and actually backing them up to the repository caused a panic.
+   This is now fixed.
+
+   https://github.com/restic/restic/issues/2942
+
+ * Bugfix #2951: Restic generate, help and self-update no longer check passwords
+
+   The commands `restic cache`, `generate`, `help` and `self-update` don't need passwords, but
+   they previously did run the RESTIC_PASSWORD_COMMAND (if set in the environment), prompting
+   users to authenticate for no reason. They now skip running the password command.
+
+   https://github.com/restic/restic/issues/2951
+   https://github.com/restic/restic/pull/2987
+
+ * Bugfix #2979: Make snapshots --json output [] instead of null when no snapshots
+
+   Restic previously output `null` instead of `[]` for the `--json snapshots` command, when
+   there were no snapshots in the repository. This caused some minor problems when parsing the
+   output, but is now fixed such that `[]` is output when the list of snapshots is empty.
+
+   https://github.com/restic/restic/issues/2979
+   https://github.com/restic/restic/pull/2984
+
+ * Enhancement #2969: Optimize check for unchanged files during backup
+
+   During a backup restic skips processing files which have not changed since the last backup run.
+   Previously this required opening each file once which can be slow on network filesystems. The
+   backup command now checks for file changes before opening a file. This considerably reduces
+   the time to create a backup on network filesystems.
+
+   https://github.com/restic/restic/issues/2969
+   https://github.com/restic/restic/pull/2970
+
+ * Enhancement #340: Add support for Volume Shadow Copy Service (VSS) on Windows
+
+   Volume Shadow Copy Service allows read access to files that are locked by another process using
+   an exclusive lock through a filesystem snapshot. Restic was unable to backup those files
+   before. This update enables backing up these files.
+
+   This needs to be enabled explicitely using the --use-fs-snapshot option of the backup
+   command.
+
+   https://github.com/restic/restic/issues/340
+   https://github.com/restic/restic/pull/2274
+
+ * Enhancement #2849: Authenticate to Google Cloud Storage with access token
+
+   When using the GCS backend, it is now possible to authenticate with OAuth2 access tokens
+   instead of a credentials file by setting the GOOGLE_ACCESS_TOKEN environment variable.
+
+   https://github.com/restic/restic/pull/2849
+
+ * Enhancement #1458: New option --repository-file
+
+   We've added a new command-line option --repository-file as an alternative to -r. This allows
+   to read the repository URL from a file in order to prevent certain types of information leaks,
+   especially for URLs containing credentials.
+
+   https://github.com/restic/restic/issues/1458
+   https://github.com/restic/restic/issues/2900
+   https://github.com/restic/restic/pull/2910
+
+ * Enhancement #2978: Warn if parent snapshot cannot be loaded during backup
+
+   During a backup restic uses the parent snapshot to check whether a file was changed and has to be
+   backed up again. For this check the backup has to read the directories contained in the old
+   snapshot. If a tree blob cannot be loaded, restic now warns about this problem with the backup
+   repository.
+
+   https://github.com/restic/restic/pull/2978
+
+
 Changelog for restic 0.10.0 (2020-09-19)
 =======================================

--- a/README.md
+++ b/README.md
@@ -0,0 +1,114 @@
+[![Documentation](https://readthedocs.org/projects/restic/badge/?version=latest)](https://restic.readthedocs.io/en/latest/?badge=latest)
+[![Build Status Travis](https://travis-ci.com/restic/restic.svg?branch=master)](https://travis-ci.com/restic/restic)
+[![Build Status AppVeyor](https://ci.appveyor.com/api/projects/status/nuy4lfbgfbytw92q/branch/master?svg=true)](https://ci.appveyor.com/project/fd0/restic/branch/master)
+[![Go Report Card](https://goreportcard.com/badge/github.com/restic/restic)](https://goreportcard.com/report/github.com/restic/restic)
+
+# Introduction
+
+restic is a backup program that is fast, efficient and secure. It supports the three major operating systems (Linux, macOS, Windows) and a few smaller ones (FreeBSD, OpenBSD).
+
+For detailed usage and installation instructions check out the [documentation](https://restic.readthedocs.io/en/latest).
+
+You can ask questions in our [Discourse forum](https://forum.restic.net).
+
+Quick start
+-----------
+
+Once you've [installed](https://restic.readthedocs.io/en/latest/020_installation.html) restic, start
+off with creating a repository for your backups:
+
+    $ restic init --repo /tmp/backup
+    enter password for new backend:
+    enter password again:
+    created restic backend 085b3c76b9 at /tmp/backup
+    Please note that knowledge of your password is required to access the repository.
+    Losing your password means that your data is irrecoverably lost.
+
+and add some data:
+
+    $ restic --repo /tmp/backup backup ~/work
+    enter password for repository:
+    scan [/home/user/work]
+    scanned 764 directories, 1816 files in 0:00
+    [0:29] 100.00%  54.732 MiB/s  1.582 GiB / 1.582 GiB  2580 / 2580 items  0 errors  ETA 0:00
+    duration: 0:29, 54.47MiB/s
+    snapshot 40dc1520 saved
+
+Next you can either use `restic restore` to restore files or use `restic
+mount` to mount the repository via fuse and browse the files from previous
+snapshots.
+
+For more options check out the [online documentation](https://restic.readthedocs.io/en/latest/).
+
+# Backends
+
+Saving a backup on the same machine is nice but not a real backup strategy.
+Therefore, restic supports the following backends for storing backups natively:
+
+- [Local directory](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#local)
+- [sftp server (via SSH)](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#sftp)
+- [HTTP REST server](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#rest-server) ([protocol](doc/100_references.rst#rest-backend), [rest-server](https://github.com/restic/rest-server))
+- [AWS S3](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#amazon-s3) (either from Amazon or using the [Minio](https://minio.io) server)
+- [OpenStack Swift](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#openstack-swift)
+- [BackBlaze B2](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#backblaze-b2)
+- [Microsoft Azure Blob Storage](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#microsoft-azure-blob-storage)
+- [Google Cloud Storage](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#google-cloud-storage)
+- And many other services via the [rclone](https://rclone.org) [Backend](https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#other-services-via-rclone)
+
+# Design Principles
+
+Restic is a program that does backups right and was designed with the
+following principles in mind:
+
+-  **Easy:** Doing backups should be a frictionless process, otherwise
+   you might be tempted to skip it. Restic should be easy to configure
+   and use, so that, in the event of a data loss, you can just restore
+   it. Likewise, restoring data should not be complicated.
+
+-  **Fast**: Backing up your data with restic should only be limited by
+   your network or hard disk bandwidth so that you can backup your files
+   every day. Nobody does backups if it takes too much time. Restoring
+   backups should only transfer data that is needed for the files that
+   are to be restored, so that this process is also fast.
+
+-  **Verifiable**: Much more important than backup is restore, so restic
+   enables you to easily verify that all data can be restored.
+
+-  **Secure**: Restic uses cryptography to guarantee confidentiality and
+   integrity of your data. The location the backup data is stored is
+   assumed not to be a trusted environment (e.g. a shared space where
+   others like system administrators are able to access your backups).
+   Restic is built to secure your data against such attackers.
+
+-  **Efficient**: With the growth of data, additional snapshots should
+   only take the storage of the actual increment. Even more, duplicate
+   data should be de-duplicated before it is actually written to the
+   storage back end to save precious backup space.
+
+# Reproducible Builds
+
+The binaries released with each restic version starting at 0.6.1 are
+[reproducible](https://reproducible-builds.org/), which means that you can
+reproduce a byte identical version from the source code for that
+release. Instructions on how to do that are contained in the
+[builder repository](https://github.com/restic/builder).
+
+News
+----
+
+You can follow the restic project on Twitter [@resticbackup](https://twitter.com/resticbackup) or by subscribing to
+the [project blog](https://restic.net/blog/).
+
+License
+-------
+
+Restic is licensed under [BSD 2-Clause License](https://opensource.org/licenses/BSD-2-Clause). You can find the
+complete text in [``LICENSE``](LICENSE).
+
+Sponsorship
+-----------
+
+Backend integration tests for Google Cloud Storage and Microsoft Azure Blob
+Storage are sponsored by [AppsCode](https://appscode.com)!
+
+[![Sponsored by AppsCode](https://cdn.appscode.com/images/logo/appscode/ac-logo-color.png)](https://appscode.com)
--- a/README.rst
+++ b/README.rst
@@ -1,133 +0,0 @@
-|Documentation| |Build Status| |Build status| |Report Card| |Reviewed by Hound|
-
-Introduction
------------
-
-restic is a backup program that is fast, efficient and secure. It supports the three major operating systems (Linux, macOS, Windows) and a few smaller ones (FreeBSD, OpenBSD).
-
-For detailed usage and installation instructions check out the `documentation <https://restic.readthedocs.io/en/latest>`__.
-
-You can ask questions in our `Discourse forum <https://forum.restic.net>`__.
-
-Quick start
-----------
-
-Once you've `installed
-<https://restic.readthedocs.io/en/latest/020_installation.html>`__ restic, start
-off with creating a repository for your backups:
-
-.. code-block:: console
-
-    $ restic init --repo /tmp/backup
-    enter password for new backend:
-    enter password again:
-    created restic backend 085b3c76b9 at /tmp/backup
-    Please note that knowledge of your password is required to access the repository.
-    Losing your password means that your data is irrecoverably lost.
-
-and add some data:
-
-.. code-block:: console
-
-    $ restic --repo /tmp/backup backup ~/work
-    enter password for repository:
-    scan [/home/user/work]
-    scanned 764 directories, 1816 files in 0:00
-    [0:29] 100.00%  54.732 MiB/s  1.582 GiB / 1.582 GiB  2580 / 2580 items  0 errors  ETA 0:00
-    duration: 0:29, 54.47MiB/s
-    snapshot 40dc1520 saved
-
-Next you can either use ``restic restore`` to restore files or use ``restic
-mount`` to mount the repository via fuse and browse the files from previous
-snapshots.
-
-For more options check out the `online documentation <https://restic.readthedocs.io/en/latest/>`__.
-
-Backends
--------
-
-Saving a backup on the same machine is nice but not a real backup strategy.
-Therefore, restic supports the following backends for storing backups natively:
-
- `Local directory <https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#local>`__
- `sftp server (via SSH) <https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#sftp>`__
- `HTTP REST server <https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#rest-server>`__ (`protocol <doc/100_references.rst#rest-backend>`__ `rest-server <https://github.com/restic/rest-server>`__)
- `AWS S3 <https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#amazon-s3>`__ (either from Amazon or using the `Minio <https://minio.io>`__ server)
- `OpenStack Swift <https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#openstack-swift>`__
- `BackBlaze B2 <https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#backblaze-b2>`__
- `Microsoft Azure Blob Storage <https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#microsoft-azure-blob-storage>`__
- `Google Cloud Storage <https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#google-cloud-storage>`__
- And many other services via the `rclone <https://rclone.org>`__ `Backend <https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#other-services-via-rclone>`__
-
-Design Principles
-----------------
-
-Restic is a program that does backups right and was designed with the
-following principles in mind:
-
-  **Easy:** Doing backups should be a frictionless process, otherwise
-   you might be tempted to skip it. Restic should be easy to configure
-   and use, so that, in the event of a data loss, you can just restore
-   it. Likewise, restoring data should not be complicated.
-
-  **Fast**: Backing up your data with restic should only be limited by
-   your network or hard disk bandwidth so that you can backup your files
-   every day. Nobody does backups if it takes too much time. Restoring
-   backups should only transfer data that is needed for the files that
-   are to be restored, so that this process is also fast.
-
-  **Verifiable**: Much more important than backup is restore, so restic
-   enables you to easily verify that all data can be restored.
-
-  **Secure**: Restic uses cryptography to guarantee confidentiality and
-   integrity of your data. The location the backup data is stored is
-   assumed not to be a trusted environment (e.g. a shared space where
-   others like system administrators are able to access your backups).
-   Restic is built to secure your data against such attackers.
-
-  **Efficient**: With the growth of data, additional snapshots should
-   only take the storage of the actual increment. Even more, duplicate
-   data should be de-duplicated before it is actually written to the
-   storage back end to save precious backup space.
-
-Reproducible Builds
-------------------
-
-The binaries released with each restic version starting at 0.6.1 are
-`reproducible <https://reproducible-builds.org/>`__, which means that you can
-easily reproduce a byte identical version from the source code for that
-release. Instructions on how to do that are contained in the
-`builder repository <https://github.com/restic/builder>`__.
-
-News
----
-
-You can follow the restic project on Twitter `@resticbackup <https://twitter.com/resticbackup>`__ or by subscribing to
-the `development blog <https://restic.net/blog/>`__.
-
-License
-------
-
-Restic is licensed under `BSD 2-Clause License <https://opensource.org/licenses/BSD-2-Clause>`__. You can find the
-complete text in ``LICENSE``.
-
-Sponsorship
-----------
-
-Backend integration tests for Google Cloud Storage and Microsoft Azure Blob
-Storage are sponsored by `AppsCode <https://appscode.com>`__!
-
-|AppsCode|
-
-.. |Documentation| image:: https://readthedocs.org/projects/restic/badge/?version=latest
-   :target: https://restic.readthedocs.io/en/latest/?badge=latest
-.. |Build Status| image:: https://travis-ci.com/restic/restic.svg?branch=master
-   :target: https://travis-ci.com/restic/restic
-.. |Build status| image:: https://ci.appveyor.com/api/projects/status/nuy4lfbgfbytw92q/branch/master?svg=true
-   :target: https://ci.appveyor.com/project/fd0/restic/branch/master
-.. |Report Card| image:: https://goreportcard.com/badge/github.com/restic/restic
-   :target: https://goreportcard.com/report/github.com/restic/restic
-.. |AppsCode| image:: https://cdn.appscode.com/images/logo/appscode/ac-logo-color.png
-   :target: https://appscode.com
-.. |Reviewed by Hound| image:: https://img.shields.io/badge/Reviewed_by-Hound-8E64B0.svg
-   :target: https://houndci.com
--- a/2
+++ b/2
@@ -1 +1 @@
-0.10.0
+0.11.0
--- a/changelog/0.10.0_2020-09-19/.gitkeep
+++ b/changelog/0.10.0_2020-09-19/.gitkeep
--- a/changelog/0.11.0_2020-11-05/issue-1212
+++ b/changelog/0.11.0_2020-11-05/issue-1212
@@ -0,0 +1,11 @@
+Bugfix: Restore timestamps and permissions on intermediate directories
+
+When using the `--include` option of the restore command, restic restored
+timestamps and permissions only on directories selected by the include pattern.
+Intermediate directories, which are necessary to restore files located in sub-
+directories, were created with default permissions. We've fixed the restore
+command to restore timestamps and permissions for these directories as well.
+
+https://github.com/restic/restic/issues/1212
+https://github.com/restic/restic/issues/1402
+https://github.com/restic/restic/pull/2906
--- a/changelog/0.11.0_2020-11-05/issue-1756
+++ b/changelog/0.11.0_2020-11-05/issue-1756
@@ -0,0 +1,15 @@
+Bugfix: Mark repository files as read-only when using the local backend
+
+Files stored in a local repository were marked as writeable on the
+filesystem for non-Windows systems, which did not prevent accidental file
+modifications outside of restic. In addition, the local backend did not work
+with certain filesystems and network mounts which do not permit modifications
+of file permissions.
+
+restic now marks files stored in a local repository as read-only on the
+filesystem on non-Windows systems. The error handling is improved to support
+more filesystems.
+
+https://github.com/restic/restic/issues/1756
+https://github.com/restic/restic/issues/2157
+https://github.com/restic/restic/pull/2989
--- a/changelog/0.11.0_2020-11-05/issue-2241
+++ b/changelog/0.11.0_2020-11-05/issue-2241
@@ -0,0 +1,10 @@
+Bugfix: Hide password in REST backend repository URLs
+
+When using a password in the REST backend repository URL,
+the password could in some cases be included in the output
+from restic, e.g. when initializing a repo or during an error.
+
+The password is now replaced with "***" where applicable.
+
+https://github.com/restic/restic/issues/2241
+https://github.com/restic/restic/pull/2658
--- a/changelog/0.11.0_2020-11-05/issue-2319
+++ b/changelog/0.11.0_2020-11-05/issue-2319
@@ -0,0 +1,12 @@
+Bugfix: Correctly dump directories into tar files
+
+The dump command previously wrote directories in a tar file in a way which
+can cause compatibility problems. This caused, for example, 7zip on Windows
+to not open tar files containing directories. In addition it was not possible
+to dump directories with extended attributes. These compatibility problems
+are now corrected.
+
+In addition, a tar file now includes the name of the owner and group of a file.
+
+https://github.com/restic/restic/issues/2319
+https://github.com/restic/restic/pull/3039
--- a/changelog/0.11.0_2020-11-05/issue-2491
+++ b/changelog/0.11.0_2020-11-05/issue-2491
@@ -0,0 +1,9 @@
+Bugfix: Don't require `self-update --output` placeholder file
+
+`restic self-update --output /path/to/new-restic` used to require that
+new-restic was an existing file, to be overwritten. Now it's possible
+to download an updated restic binary to a new path, without first
+having to create a placeholder file.
+
+https://github.com/restic/restic/issues/2491
+https://github.com/restic/restic/pull/2937
--- a/changelog/0.11.0_2020-11-05/issue-2834
+++ b/changelog/0.11.0_2020-11-05/issue-2834
@@ -0,0 +1,7 @@
+Bugfix: Fix rare cases of backup command hanging forever
+
+We've fixed an issue with the backup progress reporting which could cause
+restic to hang forever right before finishing a backup.
+
+https://github.com/restic/restic/issues/2834
+https://github.com/restic/restic/pull/2963
--- a/changelog/0.11.0_2020-11-05/issue-2938
+++ b/changelog/0.11.0_2020-11-05/issue-2938
@@ -0,0 +1,6 @@
+Bugfix: Fix manpage formatting
+
+The manpage formatting in restic v0.10.0 was garbled, which is fixed now.
+
+https://github.com/restic/restic/issues/2938
+https://github.com/restic/restic/pull/2977
--- a/changelog/0.11.0_2020-11-05/issue-2942
+++ b/changelog/0.11.0_2020-11-05/issue-2942
@@ -0,0 +1,7 @@
+Bugfix: Make --exclude-larger-than handle disappearing files
+
+There was a small bug in the backup command's --exclude-larger-than
+option where files that disappeared between scanning and actually
+backing them up to the repository caused a panic. This is now fixed.
+
+https://github.com/restic/restic/issues/2942
--- a/changelog/0.11.0_2020-11-05/issue-2951
+++ b/changelog/0.11.0_2020-11-05/issue-2951
@@ -0,0 +1,9 @@
+Bugfix: restic generate, help and self-update no longer check passwords
+
+The commands `restic cache`, `generate`, `help` and `self-update` don't need
+passwords, but they previously did run the RESTIC_PASSWORD_COMMAND (if set in
+the environment), prompting users to authenticate for no reason. They now skip
+running the password command.
+
+https://github.com/restic/restic/issues/2951
+https://github.com/restic/restic/pull/2987
--- a/changelog/0.11.0_2020-11-05/issue-2969
+++ b/changelog/0.11.0_2020-11-05/issue-2969
@@ -0,0 +1,9 @@
+Enhancement: Optimize check for unchanged files during backup
+
+During a backup restic skips processing files which have not changed since the last backup run.
+Previously this required opening each file once which can be slow on network filesystems. The
+backup command now checks for file changes before opening a file. This considerably reduces
+the time to create a backup on network filesystems.
+
+https://github.com/restic/restic/issues/2969
+https://github.com/restic/restic/pull/2970
--- a/changelog/0.11.0_2020-11-05/issue-2979
+++ b/changelog/0.11.0_2020-11-05/issue-2979
@@ -0,0 +1,9 @@
+Bugfix: Make snapshots --json output [] instead of null when no snapshots
+
+Restic previously output `null` instead of `[]` for the `--json snapshots`
+command, when there were no snapshots in the repository. This caused some
+minor problems when parsing the output, but is now fixed such that `[]` is
+output when the list of snapshots is empty.
+
+https://github.com/restic/restic/issues/2979
+https://github.com/restic/restic/pull/2984
--- a/changelog/0.11.0_2020-11-05/issue-340
+++ b/changelog/0.11.0_2020-11-05/issue-340
@@ -0,0 +1,12 @@
+Enhancement: Add support for Volume Shadow Copy Service (VSS) on Windows
+
+Volume Shadow Copy Service allows read access to files that are locked by
+another process using an exclusive lock through a filesystem snapshot. Restic
+was unable to backup those files before. This update enables backing up these
+files.
+
+This needs to be enabled explicitely using the --use-fs-snapshot option of the
+backup command.
+
+https://github.com/restic/restic/issues/340
+https://github.com/restic/restic/pull/2274
--- a/changelog/0.11.0_2020-11-05/pull-2849
+++ b/changelog/0.11.0_2020-11-05/pull-2849
@@ -0,0 +1,7 @@
+Enhancement: Authenticate to Google Cloud Storage with access token
+
+When using the GCS backend, it is now possible to authenticate with OAuth2
+access tokens instead of a credentials file by setting the GOOGLE_ACCESS_TOKEN
+environment variable.
+
+https://github.com/restic/restic/pull/2849
--- a/changelog/0.11.0_2020-11-05/pull-2910
+++ b/changelog/0.11.0_2020-11-05/pull-2910
@@ -0,0 +1,10 @@
+Enhancement: New option --repository-file
+
+We've added a new command-line option --repository-file as an alternative
+to -r. This allows to read the repository URL from a file in order to
+prevent certain types of information leaks, especially for URLs containing
+credentials.
+
+https://github.com/restic/restic/issues/1458
+https://github.com/restic/restic/issues/2900
+https://github.com/restic/restic/pull/2910
--- a/changelog/0.11.0_2020-11-05/pull-2978
+++ b/changelog/0.11.0_2020-11-05/pull-2978
@@ -0,0 +1,8 @@
+Enhancement: Warn if parent snapshot cannot be loaded during backup
+
+During a backup restic uses the parent snapshot to check whether a file was
+changed and has to be backed up again. For this check the backup has to read
+the directories contained in the old snapshot. If a tree blob cannot be
+loaded, restic now warns about this problem with the backup repository.
+
+https://github.com/restic/restic/pull/2978
--- a/changelog/unreleased/.gitignore
+++ b/changelog/unreleased/.gitignore
@@ -0,0 +1,2 @@
+# this file is here so the unreleased/ directory is tracked within git, even if
+# no other changelog files are present.
--- a/changelog/unreleased/issue-2319
+++ b/changelog/unreleased/issue-2319
@@ -0,0 +1,12 @@
+Bugfix: Correctly dump directories into tar files
+
+The dump command previously wrote directories in a tar file in a way which
+can cause compatibility problems. This caused, for example, 7zip on Windows
+to not open tar files containing directories. In addition it was not possible
+to dump directories with extended attributes. These compatibility problems
+are now corrected.
+
+In addition, a tar file now includes the name of the owner and group of a file.
+
+https://github.com/restic/restic/issues/2319
+https://github.com/restic/restic/pull/3039
--- a/changelog/unreleased/pull-2978
+++ b/changelog/unreleased/pull-2978
@@ -0,0 +1,8 @@
+Enhancement: Warn if parent snapshot cannot be loaded during backup
+
+During a backup restic uses the parent snapshot to check whether a file was
+changed and has to be backed up again. For this check the backup has to read
+the directories contained in the old snapshot. If a tree blob cannot be
+loaded, restic now warns about this problem with the backup repository.
+
+https://github.com/restic/restic/pull/2978
--- a/cmd/restic/cmd_backup.go
+++ b/cmd/restic/cmd_backup.go
@@ -556,8 +556,8 @@ func runBackup(opts BackupOptions, gopts GlobalOptions, term *termstatus.Termina

 	var targetFS fs.FS = fs.Local{}
 	if runtime.GOOS == "windows" && opts.UseFsSnapshot {
-		if !fs.HasSufficientPrivilegesForVSS() {
-			return errors.Fatal("user doesn't have sufficient privileges to use VSS snapshots\n")
+		if err = fs.HasSufficientPrivilegesForVSS(); err != nil {
+			return err
 		}

 		errorHandler := func(item string, err error) error {
--- a/cmd/restic/cmd_restore.go
+++ b/cmd/restic/cmd_restore.go
@@ -140,13 +140,15 @@ func runRestore(opts RestoreOptions, gopts GlobalOptions, args []string) error {
 		return nil
 	}

+	excludePatterns := filter.ParsePatterns(opts.Exclude)
+	insensitiveExcludePatterns := filter.ParsePatterns(opts.InsensitiveExclude)
 	selectExcludeFilter := func(item string, dstpath string, node *restic.Node) (selectedForRestore bool, childMayBeSelected bool) {
-		matched, _, err := filter.List(opts.Exclude, item)
+		matched, err := filter.List(excludePatterns, item)
 		if err != nil {
 			Warnf("error for exclude pattern: %v", err)
 		}

-		matchedInsensitive, _, err := filter.List(opts.InsensitiveExclude, strings.ToLower(item))
+		matchedInsensitive, err := filter.List(insensitiveExcludePatterns, strings.ToLower(item))
 		if err != nil {
 			Warnf("error for iexclude pattern: %v", err)
 		}
@@ -161,13 +163,15 @@ func runRestore(opts RestoreOptions, gopts GlobalOptions, args []string) error {
 		return selectedForRestore, childMayBeSelected
 	}

+	includePatterns := filter.ParsePatterns(opts.Include)
+	insensitiveIncludePatterns := filter.ParsePatterns(opts.InsensitiveInclude)
 	selectIncludeFilter := func(item string, dstpath string, node *restic.Node) (selectedForRestore bool, childMayBeSelected bool) {
-		matched, childMayMatch, err := filter.List(opts.Include, item)
+		matched, childMayMatch, err := filter.ListWithChild(includePatterns, item)
 		if err != nil {
 			Warnf("error for include pattern: %v", err)
 		}

-		matchedInsensitive, childMayMatchInsensitive, err := filter.List(opts.InsensitiveInclude, strings.ToLower(item))
+		matchedInsensitive, childMayMatchInsensitive, err := filter.ListWithChild(insensitiveIncludePatterns, strings.ToLower(item))
 		if err != nil {
 			Warnf("error for iexclude pattern: %v", err)
 		}
--- a/cmd/restic/exclude.go
+++ b/cmd/restic/exclude.go
@@ -74,8 +74,9 @@ type RejectFunc func(path string, fi os.FileInfo) bool
 // rejectByPattern returns a RejectByNameFunc which rejects files that match
 // one of the patterns.
 func rejectByPattern(patterns []string) RejectByNameFunc {
+	parsedPatterns := filter.ParsePatterns(patterns)
 	return func(item string) bool {
-		matched, _, err := filter.List(patterns, item)
+		matched, err := filter.List(parsedPatterns, item)
 		if err != nil {
 			Warnf("error for exclude pattern: %v", err)
 		}
@@ -313,6 +314,10 @@ func rejectBySize(maxSizeStr string) (RejectFunc, error) {
 }

 func parseSizeStr(sizeStr string) (int64, error) {
+	if sizeStr == "" {
+		return 0, errors.New("expected size, got empty string")
+	}
+
 	numStr := sizeStr[:len(sizeStr)-1]
 	var unit int64 = 1

@@ -332,7 +337,7 @@ func parseSizeStr(sizeStr string) (int64, error) {
 	}
 	value, err := strconv.ParseInt(numStr, 10, 64)
 	if err != nil {
-		return 0, nil
+		return 0, err
 	}
 	return value * unit, nil
 }
--- a/cmd/restic/exclude_test.go
+++ b/cmd/restic/exclude_test.go
@@ -219,6 +219,25 @@ func TestParseSizeStr(t *testing.T) {
 	}
 }

+func TestParseInvalidSizeStr(t *testing.T) {
+	invalidSizes := []string{
+		"",
+		" ",
+		"foobar",
+		"zzz",
+	}
+
+	for _, s := range invalidSizes {
+		v, err := parseSizeStr(s)
+		if err == nil {
+			t.Errorf("wanted error for invalid value %q, got nil", s)
+		}
+		if v != 0 {
+			t.Errorf("wanted zero for invalid value %q, got: %v", s, v)
+		}
+	}
+}
+
 // TestIsExcludedByFileSize is for testing the instance of
 // --exclude-larger-than parameters
 func TestIsExcludedByFileSize(t *testing.T) {
--- a/cmd/restic/global.go
+++ b/cmd/restic/global.go
@@ -39,7 +39,7 @@ import (
 	"golang.org/x/crypto/ssh/terminal"
 )

-var version = "0.10.0-dev (compiled manually)"
+var version = "0.11.0"

 // TimeFormat is the format used for all timestamps printed by restic.
 const TimeFormat = "2006-01-02 15:04:05"
@@ -687,15 +687,15 @@ func open(s string, gopts GlobalOptions, opts options.Options) (restic.Backend,

 	switch loc.Scheme {
 	case "local":
-		be, err = local.Open(cfg.(local.Config))
+		be, err = local.Open(globalOptions.ctx, cfg.(local.Config))
 		// wrap the backend in a LimitBackend so that the throughput is limited
 		be = limiter.LimitBackend(be, lim)
 	case "sftp":
-		be, err = sftp.Open(cfg.(sftp.Config))
+		be, err = sftp.Open(globalOptions.ctx, cfg.(sftp.Config))
 		// wrap the backend in a LimitBackend so that the throughput is limited
 		be = limiter.LimitBackend(be, lim)
 	case "s3":
-		be, err = s3.Open(cfg.(s3.Config), rt)
+		be, err = s3.Open(globalOptions.ctx, cfg.(s3.Config), rt)
 	case "gs":
 		be, err = gs.Open(cfg.(gs.Config), rt)
 	case "azure":
@@ -754,11 +754,11 @@ func create(s string, opts options.Options) (restic.Backend, error) {

 	switch loc.Scheme {
 	case "local":
-		return local.Create(cfg.(local.Config))
+		return local.Create(globalOptions.ctx, cfg.(local.Config))
 	case "sftp":
-		return sftp.Create(cfg.(sftp.Config))
+		return sftp.Create(globalOptions.ctx, cfg.(sftp.Config))
 	case "s3":
-		return s3.Create(cfg.(s3.Config), rt)
+		return s3.Create(globalOptions.ctx, cfg.(s3.Config), rt)
 	case "gs":
 		return gs.Create(cfg.(gs.Config), rt)
 	case "azure":
--- a/cmd/restic/integration_test.go
+++ b/cmd/restic/integration_test.go
@@ -286,7 +286,7 @@ func TestBackup(t *testing.T) {
 }

 func TestBackupWithFilesystemSnapshots(t *testing.T) {
-	if runtime.GOOS == "windows" && fs.HasSufficientPrivilegesForVSS() {
+	if runtime.GOOS == "windows" && fs.HasSufficientPrivilegesForVSS() == nil {
 		testBackup(t, true)
 	}
 }
@@ -368,7 +368,7 @@ func TestBackupNonExistingFile(t *testing.T) {
 	testRunBackup(t, "", dirs, opts, env.gopts)
 }

-func removeDataPacksExcept(gopts GlobalOptions, t *testing.T, keep restic.IDSet) {
+func removePacksExcept(gopts GlobalOptions, t *testing.T, keep restic.IDSet, removeTreePacks bool) {
 	r, err := OpenRepository(gopts)
 	rtest.OK(t, err)

@@ -383,7 +383,7 @@ func removeDataPacksExcept(gopts GlobalOptions, t *testing.T, keep restic.IDSet)

 	// remove all packs containing data blobs
 	rtest.OK(t, r.List(gopts.ctx, restic.PackFile, func(id restic.ID, size int64) error {
-		if treePacks.Has(id) || keep.Has(id) {
+		if treePacks.Has(id) != removeTreePacks || keep.Has(id) {
 			return nil
 		}
 		return r.Backend().Remove(gopts.ctx, restic.Handle{Type: restic.PackFile, Name: id.String()})
@@ -406,7 +406,7 @@ func TestBackupSelfHealing(t *testing.T) {
 	testRunCheck(t, env.gopts)

 	// remove all data packs
-	removeDataPacksExcept(env.gopts, t, restic.NewIDSet())
+	removePacksExcept(env.gopts, t, restic.NewIDSet(), false)

 	testRunRebuildIndex(t, env.gopts)
 	// now the repo is also missing the data blob in the index; check should report this
@@ -420,6 +420,56 @@ func TestBackupSelfHealing(t *testing.T) {
 	testRunCheck(t, env.gopts)
 }

+func TestBackupTreeLoadError(t *testing.T) {
+	env, cleanup := withTestEnvironment(t)
+	defer cleanup()
+
+	testRunInit(t, env.gopts)
+	p := filepath.Join(env.testdata, "test/test")
+	rtest.OK(t, os.MkdirAll(filepath.Dir(p), 0755))
+	rtest.OK(t, appendRandomData(p, 5))
+
+	opts := BackupOptions{}
+	// Backup a subdirectory first, such that we can remove the tree pack for the subdirectory
+	testRunBackup(t, env.testdata, []string{"test"}, opts, env.gopts)
+
+	r, err := OpenRepository(env.gopts)
+	rtest.OK(t, err)
+	rtest.OK(t, r.LoadIndex(env.gopts.ctx))
+	// collect tree packs of subdirectory
+	subTreePacks := restic.NewIDSet()
+	for _, idx := range r.Index().(*repository.MasterIndex).All() {
+		for _, id := range idx.TreePacks() {
+			subTreePacks.Insert(id)
+		}
+	}
+
+	testRunBackup(t, filepath.Dir(env.testdata), []string{filepath.Base(env.testdata)}, opts, env.gopts)
+	testRunCheck(t, env.gopts)
+
+	// delete the subdirectory pack first
+	for id := range subTreePacks {
+		rtest.OK(t, r.Backend().Remove(env.gopts.ctx, restic.Handle{Type: restic.PackFile, Name: id.String()}))
+	}
+	testRunRebuildIndex(t, env.gopts)
+	// now the repo is missing the tree blob in the index; check should report this
+	rtest.Assert(t, runCheck(CheckOptions{}, env.gopts, nil) != nil, "check should have reported an error")
+	// second backup should report an error but "heal" this situation
+	err = testRunBackupAssumeFailure(t, filepath.Dir(env.testdata), []string{filepath.Base(env.testdata)}, opts, env.gopts)
+	rtest.Assert(t, err != nil, "backup should have reported an error for the subdirectory")
+	testRunCheck(t, env.gopts)
+
+	// remove all tree packs
+	removePacksExcept(env.gopts, t, restic.NewIDSet(), true)
+	testRunRebuildIndex(t, env.gopts)
+	// now the repo is also missing the data blob in the index; check should report this
+	rtest.Assert(t, runCheck(CheckOptions{}, env.gopts, nil) != nil, "check should have reported an error")
+	// second backup should report an error but "heal" this situation
+	err = testRunBackupAssumeFailure(t, filepath.Dir(env.testdata), []string{filepath.Base(env.testdata)}, opts, env.gopts)
+	rtest.Assert(t, err != nil, "backup should have reported an error")
+	testRunCheck(t, env.gopts)
+}
+
 func includes(haystack []string, needle string) bool {
 	for _, s := range haystack {
 		if s == needle {
@@ -1396,7 +1446,7 @@ func TestPruneWithDamagedRepository(t *testing.T) {
 	testRunBackup(t, "", []string{filepath.Join(env.testdata, "0", "0", "9", "3")}, opts, env.gopts)
 	snapshotIDs := testRunList(t, "snapshots", env.gopts)

-	removeDataPacksExcept(env.gopts, t, oldPacks)
+	removePacksExcept(env.gopts, t, oldPacks, false)

 	rtest.Assert(t, len(snapshotIDs) == 1,
 		"expected one snapshot, got %v", snapshotIDs)
--- a/doc/bash-completion.sh
+++ b/doc/bash-completion.sh
@@ -36,71 +36,9 @@ __restic_contains_word()
    return 1
 }

-__restic_handle_go_custom_completion()
-{
-    __restic_debug "${FUNCNAME[0]}: cur is ${cur}, words[*] is ${words[*]}, #words[@] is ${#words[@]}"
-
-    local out requestComp lastParam lastChar comp directive args
-
-    # Prepare the command to request completions for the program.
-    # Calling ${words[0]} instead of directly restic allows to handle aliases
-    args=("${words[@]:1}")
-    requestComp="${words[0]} __completeNoDesc ${args[*]}"
-
-    lastParam=${words[$((${#words[@]}-1))]}
-    lastChar=${lastParam:$((${#lastParam}-1)):1}
-    __restic_debug "${FUNCNAME[0]}: lastParam ${lastParam}, lastChar ${lastChar}"
-
-    if [ -z "${cur}" ] && [ "${lastChar}" != "=" ]; then
-        # If the last parameter is complete (there is a space following it)
-        # We add an extra empty parameter so we can indicate this to the go method.
-        __restic_debug "${FUNCNAME[0]}: Adding extra empty parameter"
-        requestComp="${requestComp} \"\""
-    fi
-
-    __restic_debug "${FUNCNAME[0]}: calling ${requestComp}"
-    # Use eval to handle any environment variables and such
-    out=$(eval "${requestComp}" 2>/dev/null)
-
-    # Extract the directive integer at the very end of the output following a colon (:)
-    directive=${out##*:}
-    # Remove the directive
-    out=${out%:*}
-    if [ "${directive}" = "${out}" ]; then
-        # There is not directive specified
-        directive=0
-    fi
-    __restic_debug "${FUNCNAME[0]}: the completion directive is: ${directive}"
-    __restic_debug "${FUNCNAME[0]}: the completions are: ${out[*]}"
-
-    if [ $((directive & 1)) -ne 0 ]; then
-        # Error code.  No completion.
-        __restic_debug "${FUNCNAME[0]}: received error from custom completion go code"
-        return
-    else
-        if [ $((directive & 2)) -ne 0 ]; then
-            if [[ $(type -t compopt) = "builtin" ]]; then
-                __restic_debug "${FUNCNAME[0]}: activating no space"
-                compopt -o nospace
-            fi
-        fi
-        if [ $((directive & 4)) -ne 0 ]; then
-            if [[ $(type -t compopt) = "builtin" ]]; then
-                __restic_debug "${FUNCNAME[0]}: activating no file completion"
-                compopt +o default
-            fi
-        fi
-
-        while IFS='' read -r comp; do
-            COMPREPLY+=("$comp")
-        done < <(compgen -W "${out[*]}" -- "$cur")
-    fi
-}
-
 __restic_handle_reply()
 {
    __restic_debug "${FUNCNAME[0]}"
-    local comp
    case $cur in
        -*)
            if [[ $(type -t compopt) = "builtin" ]]; then
@@ -112,9 +50,7 @@ __restic_handle_reply()
            else
                allflags=("${flags[*]} ${two_word_flags[*]}")
            fi
-            while IFS='' read -r comp; do
-                COMPREPLY+=("$comp")
-            done < <(compgen -W "${allflags[*]}" -- "$cur")
+            COMPREPLY=( $(compgen -W "${allflags[*]}" -- "$cur") )
            if [[ $(type -t compopt) = "builtin" ]]; then
                [[ "${COMPREPLY[0]}" == *= ]] || compopt +o nospace
            fi
@@ -160,22 +96,14 @@ __restic_handle_reply()
    completions=("${commands[@]}")
    if [[ ${#must_have_one_noun[@]} -ne 0 ]]; then
        completions=("${must_have_one_noun[@]}")
-    elif [[ -n "${has_completion_function}" ]]; then
-        # if a go completion function is provided, defer to that function
-        completions=()
-        __restic_handle_go_custom_completion
    fi
    if [[ ${#must_have_one_flag[@]} -ne 0 ]]; then
        completions+=("${must_have_one_flag[@]}")
    fi
-    while IFS='' read -r comp; do
-        COMPREPLY+=("$comp")
-    done < <(compgen -W "${completions[*]}" -- "$cur")
+    COMPREPLY=( $(compgen -W "${completions[*]}" -- "$cur") )

    if [[ ${#COMPREPLY[@]} -eq 0 && ${#noun_aliases[@]} -gt 0 && ${#must_have_one_noun[@]} -ne 0 ]]; then
-        while IFS='' read -r comp; do
-            COMPREPLY+=("$comp")
-        done < <(compgen -W "${noun_aliases[*]}" -- "$cur")
+        COMPREPLY=( $(compgen -W "${noun_aliases[*]}" -- "$cur") )
    fi

    if [[ ${#COMPREPLY[@]} -eq 0 ]]; then
@@ -210,7 +138,7 @@ __restic_handle_filename_extension_flag()
 __restic_handle_subdirs_in_dir_flag()
 {
    local dir="$1"
-    pushd "${dir}" >/dev/null 2>&1 && _filedir -d && popd >/dev/null 2>&1 || return
+    pushd "${dir}" >/dev/null 2>&1 && _filedir -d && popd >/dev/null 2>&1
 }

 __restic_handle_flag()
@@ -418,6 +346,8 @@ _restic_backup()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -479,6 +409,8 @@ _restic_cache()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -533,6 +465,8 @@ _restic_cat()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -596,6 +530,8 @@ _restic_check()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -672,6 +608,8 @@ _restic_copy()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -728,6 +666,8 @@ _restic_diff()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -792,6 +732,8 @@ _restic_dump()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -882,6 +824,8 @@ _restic_find()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -987,6 +931,8 @@ _restic_forget()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1050,6 +996,8 @@ _restic_generate()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1118,6 +1066,8 @@ _restic_init()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1181,6 +1131,8 @@ _restic_key()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1235,6 +1187,8 @@ _restic_list()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1304,6 +1258,8 @@ _restic_ls()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1361,6 +1317,8 @@ _restic_migrate()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1434,6 +1392,8 @@ _restic_mount()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1488,6 +1448,8 @@ _restic_prune()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1542,6 +1504,8 @@ _restic_rebuild-index()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1596,6 +1560,8 @@ _restic_recover()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1680,6 +1646,8 @@ _restic_restore()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1737,6 +1705,8 @@ _restic_self-update()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1810,6 +1780,8 @@ _restic_snapshots()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1877,6 +1849,8 @@ _restic_stats()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -1950,6 +1924,8 @@ _restic_tag()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -2006,6 +1982,8 @@ _restic_unlock()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -2060,6 +2038,8 @@ _restic_version()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -2140,6 +2120,8 @@ _restic_root_command()
    flags+=("--repo=")
    two_word_flags+=("--repo")
    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
    flags+=("--tls-client-cert=")
    two_word_flags+=("--tls-client-cert")
    flags+=("--verbose")
@@ -2170,7 +2152,6 @@ __start_restic()
    local commands=("restic")
    local must_have_one_flag=()
    local must_have_one_noun=()
-    local has_completion_function
    local last_command
    local nouns=()

--- a/doc/man/restic-backup.1
+++ b/doc/man/restic-backup.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -28,145 +29,150 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 .SH OPTIONS
 .PP
 \fB\-e\fP, \fB\-\-exclude\fP=[]
-	exclude a \fB\fCpattern\fR (can be specified multiple times)
+    exclude a \fB\fCpattern\fR (can be specified multiple times)

 .PP
 \fB\-\-exclude\-caches\fP[=false]
-	excludes cache directories that are marked with a CACHEDIR.TAG file. See https://bford.info/cachedir/ for the Cache Directory Tagging Standard
+    excludes cache directories that are marked with a CACHEDIR.TAG file. See 
+\[la]https://bford.info/cachedir/\[ra] for the Cache Directory Tagging Standard

 .PP
 \fB\-\-exclude\-file\fP=[]
-	read exclude patterns from a \fB\fCfile\fR (can be specified multiple times)
+    read exclude patterns from a \fB\fCfile\fR (can be specified multiple times)

 .PP
 \fB\-\-exclude\-if\-present\fP=[]
-	takes \fB\fCfilename[:header]\fR, exclude contents of directories containing filename (except filename itself) if header of that file is as provided (can be specified multiple times)
+    takes \fB\fCfilename[:header]\fR, exclude contents of directories containing filename (except filename itself) if header of that file is as provided (can be specified multiple times)

 .PP
 \fB\-\-exclude\-larger\-than\fP=""
-	max \fB\fCsize\fR of the files to be backed up (allowed suffixes: k/K, m/M, g/G, t/T)
+    max \fB\fCsize\fR of the files to be backed up (allowed suffixes: k/K, m/M, g/G, t/T)

 .PP
 \fB\-\-files\-from\fP=[]
-	read the files to backup from \fB\fCfile\fR (can be combined with file args/can be specified multiple times)
+    read the files to backup from \fB\fCfile\fR (can be combined with file args/can be specified multiple times)

 .PP
 \fB\-f\fP, \fB\-\-force\fP[=false]
-	force re\-reading the target files/directories (overrides the "parent" flag)
+    force re\-reading the target files/directories (overrides the "parent" flag)

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for backup
+    help for backup

 .PP
 \fB\-H\fP, \fB\-\-host\fP=""
-	set the \fB\fChostname\fR for the snapshot manually. To prevent an expensive rescan use the "parent" flag
+    set the \fB\fChostname\fR for the snapshot manually. To prevent an expensive rescan use the "parent" flag

 .PP
 \fB\-\-iexclude\fP=[]
-	same as \-\-exclude \fB\fCpattern\fR but ignores the casing of filenames
+    same as \-\-exclude \fB\fCpattern\fR but ignores the casing of filenames

 .PP
 \fB\-\-iexclude\-file\fP=[]
-	same as \-\-exclude\-file but ignores casing of \fB\fCfile\fRnames in patterns
+    same as \-\-exclude\-file but ignores casing of \fB\fCfile\fRnames in patterns

 .PP
 \fB\-\-ignore\-inode\fP[=false]
-	ignore inode number changes when checking for modified files
+    ignore inode number changes when checking for modified files

 .PP
 \fB\-x\fP, \fB\-\-one\-file\-system\fP[=false]
-	exclude other file systems
+    exclude other file systems

 .PP
 \fB\-\-parent\fP=""
-	use this parent \fB\fCsnapshot\fR (default: last snapshot in the repo that has the same target files/directories)
+    use this parent \fB\fCsnapshot\fR (default: last snapshot in the repo that has the same target files/directories)

 .PP
 \fB\-\-stdin\fP[=false]
-	read backup from stdin
+    read backup from stdin

 .PP
 \fB\-\-stdin\-filename\fP="stdin"
-	\fB\fCfilename\fR to use when reading from stdin
+    \fB\fCfilename\fR to use when reading from stdin

 .PP
 \fB\-\-tag\fP=[]
-	add a \fB\fCtag\fR for the new snapshot (can be specified multiple times)
+    add a \fB\fCtag\fR for the new snapshot (can be specified multiple times)

 .PP
 \fB\-\-time\fP=""
-	\fB\fCtime\fR of the backup (ex. '2012\-11\-01 22:08:41') (default: now)
+    \fB\fCtime\fR of the backup (ex. '2012\-11\-01 22:08:41') (default: now)

 .PP
 \fB\-\-with\-atime\fP[=false]
-	store the atime for all files and directories
+    store the atime for all files and directories


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-cache.1
+++ b/doc/man/restic-cache.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -25,85 +26,89 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-\-cleanup\fP[=false]
-	remove old cache directories
+    remove old cache directories

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for cache
+    help for cache

 .PP
 \fB\-\-max\-age\fP=30
-	max age in \fB\fCdays\fR for cache directories to be considered old
+    max age in \fB\fCdays\fR for cache directories to be considered old

 .PP
 \fB\-\-no\-size\fP[=false]
-	do not output the size of the cache directories
+    do not output the size of the cache directories


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-cat.1
+++ b/doc/man/restic-cat.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -25,73 +26,77 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for cat
+    help for cat


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-check.1
+++ b/doc/man/restic-check.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -30,89 +31,93 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-\-check\-unused\fP[=false]
-	find unused blobs
+    find unused blobs

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for check
+    help for check

 .PP
 \fB\-\-read\-data\fP[=false]
-	read all data blobs
+    read all data blobs

 .PP
 \fB\-\-read\-data\-subset\fP=""
-	read subset n of m data packs (format: \fB\fCn/m\fR)
+    read subset n of m data packs (format: \fB\fCn/m\fR)

 .PP
 \fB\-\-with\-cache\fP[=false]
-	use the cache
+    use the cache


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-copy.1
+++ b/doc/man/restic-copy.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -25,101 +26,105 @@ option when initializing a new destination repository using the "init" command.
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for copy
+    help for copy

 .PP
 \fB\-H\fP, \fB\-\-host\fP=[]
-	only consider snapshots for this \fB\fChost\fR, when no snapshot ID is given (can be specified multiple times)
+    only consider snapshots for this \fB\fChost\fR, when no snapshot ID is given (can be specified multiple times)

 .PP
 \fB\-\-key\-hint2\fP=""
-	key ID of key to try decrypting the destination repository first (default: $RESTIC\_KEY\_HINT2)
+    key ID of key to try decrypting the destination repository first (default: $RESTIC\_KEY\_HINT2)

 .PP
 \fB\-\-password\-command2\fP=""
-	shell \fB\fCcommand\fR to obtain the destination repository password from (default: $RESTIC\_PASSWORD\_COMMAND2)
+    shell \fB\fCcommand\fR to obtain the destination repository password from (default: $RESTIC\_PASSWORD\_COMMAND2)

 .PP
 \fB\-\-password\-file2\fP=""
-	\fB\fCfile\fR to read the destination repository password from (default: $RESTIC\_PASSWORD\_FILE2)
+    \fB\fCfile\fR to read the destination repository password from (default: $RESTIC\_PASSWORD\_FILE2)

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots which include this (absolute) \fB\fCpath\fR, when no snapshot ID is given
+    only consider snapshots which include this (absolute) \fB\fCpath\fR, when no snapshot ID is given

 .PP
 \fB\-\-repo2\fP=""
-	destination repository to copy snapshots to (default: $RESTIC\_REPOSITORY2)
+    destination \fB\fCrepository\fR to copy snapshots to (default: $RESTIC\_REPOSITORY2)

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR, when no snapshot ID is given
+    only consider snapshots which include this \fB\fCtaglist\fR, when no snapshot ID is given


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-diff.1
+++ b/doc/man/restic-diff.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -41,77 +42,81 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for diff
+    help for diff

 .PP
 \fB\-\-metadata\fP[=false]
-	print changes in metadata
+    print changes in metadata


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-dump.1
+++ b/doc/man/restic-dump.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -32,85 +33,89 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for dump
+    help for dump

 .PP
 \fB\-H\fP, \fB\-\-host\fP=[]
-	only consider snapshots for this host when the snapshot ID is "latest" (can be specified multiple times)
+    only consider snapshots for this host when the snapshot ID is "latest" (can be specified multiple times)

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots which include this (absolute) \fB\fCpath\fR for snapshot ID "latest"
+    only consider snapshots which include this (absolute) \fB\fCpath\fR for snapshot ID "latest"

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR for snapshot ID "latest"
+    only consider snapshots which include this \fB\fCtaglist\fR for snapshot ID "latest"


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-find.1
+++ b/doc/man/restic-find.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -22,121 +23,125 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 .SH OPTIONS
 .PP
 \fB\-\-blob\fP[=false]
-	pattern is a blob\-ID
+    pattern is a blob\-ID

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for find
+    help for find

 .PP
 \fB\-H\fP, \fB\-\-host\fP=[]
-	only consider snapshots for this \fB\fChost\fR, when no snapshot ID is given (can be specified multiple times)
+    only consider snapshots for this \fB\fChost\fR, when no snapshot ID is given (can be specified multiple times)

 .PP
 \fB\-i\fP, \fB\-\-ignore\-case\fP[=false]
-	ignore case for pattern
+    ignore case for pattern

 .PP
 \fB\-l\fP, \fB\-\-long\fP[=false]
-	use a long listing format showing size and mode
+    use a long listing format showing size and mode

 .PP
 \fB\-N\fP, \fB\-\-newest\fP=""
-	newest modification date/time
+    newest modification date/time

 .PP
 \fB\-O\fP, \fB\-\-oldest\fP=""
-	oldest modification date/time
+    oldest modification date/time

 .PP
 \fB\-\-pack\fP[=false]
-	pattern is a pack\-ID
+    pattern is a pack\-ID

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots which include this (absolute) \fB\fCpath\fR, when no snapshot\-ID is given
+    only consider snapshots which include this (absolute) \fB\fCpath\fR, when no snapshot\-ID is given

 .PP
 \fB\-\-show\-pack\-id\fP[=false]
-	display the pack\-ID the blobs belong to (with \-\-blob or \-\-tree)
+    display the pack\-ID the blobs belong to (with \-\-blob or \-\-tree)

 .PP
 \fB\-s\fP, \fB\-\-snapshot\fP=[]
-	snapshot \fB\fCid\fR to search in (can be given multiple times)
+    snapshot \fB\fCid\fR to search in (can be given multiple times)

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR, when no snapshot\-ID is given
+    only consider snapshots which include this \fB\fCtaglist\fR, when no snapshot\-ID is given

 .PP
 \fB\-\-tree\fP[=false]
-	pattern is a tree\-ID
+    pattern is a tree\-ID


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH EXAMPLE
--- a/doc/man/restic-forget.1
+++ b/doc/man/restic-forget.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -28,133 +29,137 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-l\fP, \fB\-\-keep\-last\fP=0
-	keep the last \fB\fCn\fR snapshots
+    keep the last \fB\fCn\fR snapshots

 .PP
 \fB\-H\fP, \fB\-\-keep\-hourly\fP=0
-	keep the last \fB\fCn\fR hourly snapshots
+    keep the last \fB\fCn\fR hourly snapshots

 .PP
 \fB\-d\fP, \fB\-\-keep\-daily\fP=0
-	keep the last \fB\fCn\fR daily snapshots
+    keep the last \fB\fCn\fR daily snapshots

 .PP
 \fB\-w\fP, \fB\-\-keep\-weekly\fP=0
-	keep the last \fB\fCn\fR weekly snapshots
+    keep the last \fB\fCn\fR weekly snapshots

 .PP
 \fB\-m\fP, \fB\-\-keep\-monthly\fP=0
-	keep the last \fB\fCn\fR monthly snapshots
+    keep the last \fB\fCn\fR monthly snapshots

 .PP
 \fB\-y\fP, \fB\-\-keep\-yearly\fP=0
-	keep the last \fB\fCn\fR yearly snapshots
+    keep the last \fB\fCn\fR yearly snapshots

 .PP
 \fB\-\-keep\-within\fP=
-	keep snapshots that are newer than \fB\fCduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
+    keep snapshots that are newer than \fB\fCduration\fR (eg. 1y5m7d2h) relative to the latest snapshot

 .PP
 \fB\-\-keep\-tag\fP=[]
-	keep snapshots with this \fB\fCtaglist\fR (can be specified multiple times)
+    keep snapshots with this \fB\fCtaglist\fR (can be specified multiple times)

 .PP
 \fB\-\-host\fP=[]
-	only consider snapshots with the given \fB\fChost\fR (can be specified multiple times)
+    only consider snapshots with the given \fB\fChost\fR (can be specified multiple times)

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR in the format \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+    only consider snapshots which include this \fB\fCtaglist\fR in the format \fB\fCtag[,tag,...]\fR (can be specified multiple times)

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots which include this (absolute) \fB\fCpath\fR (can be specified multiple times)
+    only consider snapshots which include this (absolute) \fB\fCpath\fR (can be specified multiple times)

 .PP
 \fB\-c\fP, \fB\-\-compact\fP[=false]
-	use compact format
+    use compact output format

 .PP
 \fB\-g\fP, \fB\-\-group\-by\fP="host,paths"
-	string for grouping snapshots by host,paths,tags
+    string for grouping snapshots by host,paths,tags

 .PP
 \fB\-n\fP, \fB\-\-dry\-run\fP[=false]
-	do not delete anything, just print what would be done
+    do not delete anything, just print what would be done

 .PP
 \fB\-\-prune\fP[=false]
-	automatically run the 'prune' command if snapshots have been removed
+    automatically run the 'prune' command if snapshots have been removed

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for forget
+    help for forget


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-generate.1
+++ b/doc/man/restic-generate.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -26,85 +27,89 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-\-bash\-completion\fP=""
-	write bash completion \fB\fCfile\fR
+    write bash completion \fB\fCfile\fR

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for generate
+    help for generate

 .PP
 \fB\-\-man\fP=""
-	write man pages to \fB\fCdirectory\fR
+    write man pages to \fB\fCdirectory\fR

 .PP
 \fB\-\-zsh\-completion\fP=""
-	write zsh completion \fB\fCfile\fR
+    write zsh completion \fB\fCfile\fR


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-init.1
+++ b/doc/man/restic-init.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -25,93 +26,97 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-\-copy\-chunker\-params\fP[=false]
-	copy chunker parameters from the secondary repository (useful with the copy command)
+    copy chunker parameters from the secondary repository (useful with the copy command)

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for init
+    help for init

 .PP
 \fB\-\-key\-hint2\fP=""
-	key ID of key to try decrypting the secondary repository first (default: $RESTIC\_KEY\_HINT2)
+    key ID of key to try decrypting the secondary repository first (default: $RESTIC\_KEY\_HINT2)

 .PP
 \fB\-\-password\-command2\fP=""
-	shell \fB\fCcommand\fR to obtain the secondary repository password from (default: $RESTIC\_PASSWORD\_COMMAND2)
+    shell \fB\fCcommand\fR to obtain the secondary repository password from (default: $RESTIC\_PASSWORD\_COMMAND2)

 .PP
 \fB\-\-password\-file2\fP=""
-	\fB\fCfile\fR to read the secondary repository password from (default: $RESTIC\_PASSWORD\_FILE2)
+    \fB\fCfile\fR to read the secondary repository password from (default: $RESTIC\_PASSWORD\_FILE2)

 .PP
 \fB\-\-repo2\fP=""
-	secondary repository to copy chunker parameters from (default: $RESTIC\_REPOSITORY2)
+    secondary \fB\fCrepository\fR to copy chunker parameters from (default: $RESTIC\_REPOSITORY2)


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-key.1
+++ b/doc/man/restic-key.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -25,85 +26,89 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for key
+    help for key

 .PP
 \fB\-\-host\fP=""
-	the hostname for new keys
+    the hostname for new keys

 .PP
 \fB\-\-new\-password\-file\fP=""
-	\fB\fCfile\fR from which to read the new password
+    \fB\fCfile\fR from which to read the new password

 .PP
 \fB\-\-user\fP=""
-	the username for new keys
+    the username for new keys


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-list.1
+++ b/doc/man/restic-list.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -25,73 +26,77 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for list
+    help for list


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-ls.1
+++ b/doc/man/restic-ls.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -40,93 +41,97 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for ls
+    help for ls

 .PP
 \fB\-H\fP, \fB\-\-host\fP=[]
-	only consider snapshots for this \fB\fChost\fR, when no snapshot ID is given (can be specified multiple times)
+    only consider snapshots for this \fB\fChost\fR, when no snapshot ID is given (can be specified multiple times)

 .PP
 \fB\-l\fP, \fB\-\-long\fP[=false]
-	use a long listing format showing size and mode
+    use a long listing format showing size and mode

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots which include this (absolute) \fB\fCpath\fR, when no snapshot ID is given
+    only consider snapshots which include this (absolute) \fB\fCpath\fR, when no snapshot ID is given

 .PP
 \fB\-\-recursive\fP[=false]
-	include files in subfolders of the listed directories
+    include files in subfolders of the listed directories

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR, when no snapshot ID is given
+    only consider snapshots which include this \fB\fCtaglist\fR, when no snapshot ID is given


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-migrate.1
+++ b/doc/man/restic-migrate.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -26,77 +27,81 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-f\fP, \fB\-\-force\fP[=false]
-	apply a migration a second time
+    apply a migration a second time

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for migrate
+    help for migrate


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-mount.1
+++ b/doc/man/restic-mount.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -46,7 +47,8 @@ Mon Jan 2 15:04:05 \-0700 MST 2006

 .PP
 For details please see the documentation for time.Format() at:
-  https://godoc.org/time#Time.Format
+  
+\[la]https://godoc.org/time#Time.Format\[ra]


 .SH EXIT STATUS
@@ -57,101 +59,105 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-\-allow\-other\fP[=false]
-	allow other users to access the data in the mounted directory
+    allow other users to access the data in the mounted directory

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for mount
+    help for mount

 .PP
 \fB\-H\fP, \fB\-\-host\fP=[]
-	only consider snapshots for this host (can be specified multiple times)
+    only consider snapshots for this host (can be specified multiple times)

 .PP
 \fB\-\-no\-default\-permissions\fP[=false]
-	for 'allow\-other', ignore Unix permissions and allow users to read all snapshot files
+    for 'allow\-other', ignore Unix permissions and allow users to read all snapshot files

 .PP
 \fB\-\-owner\-root\fP[=false]
-	use 'root' as the owner of files and dirs
+    use 'root' as the owner of files and dirs

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots which include this (absolute) \fB\fCpath\fR
+    only consider snapshots which include this (absolute) \fB\fCpath\fR

 .PP
 \fB\-\-snapshot\-template\fP="2006\-01\-02T15:04:05Z07:00"
-	set \fB\fCtemplate\fR to use for snapshot dirs
+    set \fB\fCtemplate\fR to use for snapshot dirs

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR
+    only consider snapshots which include this \fB\fCtaglist\fR


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-prune.1
+++ b/doc/man/restic-prune.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -26,73 +27,77 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for prune
+    help for prune


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-rebuild-index.1
+++ b/doc/man/restic-rebuild-index.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -26,73 +27,77 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for rebuild\-index
+    help for rebuild\-index


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-recover.1
+++ b/doc/man/restic-recover.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -14,7 +15,7 @@ restic\-recover \- Recover data from the repository

 .SH DESCRIPTION
 .PP
-The "recover" command build a new snapshot from all directories it can find in
+The "recover" command builds a new snapshot from all directories it can find in
 the raw data of the repository. It can be used if, for example, a snapshot has
 been removed by accident with "forget".

@@ -27,73 +28,77 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for recover
+    help for recover


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-restore.1
+++ b/doc/man/restic-restore.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -30,109 +31,113 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-e\fP, \fB\-\-exclude\fP=[]
-	exclude a \fB\fCpattern\fR (can be specified multiple times)
+    exclude a \fB\fCpattern\fR (can be specified multiple times)

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for restore
+    help for restore

 .PP
 \fB\-H\fP, \fB\-\-host\fP=[]
-	only consider snapshots for this host when the snapshot ID is "latest" (can be specified multiple times)
+    only consider snapshots for this host when the snapshot ID is "latest" (can be specified multiple times)

 .PP
 \fB\-\-iexclude\fP=[]
-	same as \fB\fC\-\-exclude\fR but ignores the casing of filenames
+    same as \fB\fC\-\-exclude\fR but ignores the casing of filenames

 .PP
 \fB\-\-iinclude\fP=[]
-	same as \fB\fC\-\-include\fR but ignores the casing of filenames
+    same as \fB\fC\-\-include\fR but ignores the casing of filenames

 .PP
 \fB\-i\fP, \fB\-\-include\fP=[]
-	include a \fB\fCpattern\fR, exclude everything else (can be specified multiple times)
+    include a \fB\fCpattern\fR, exclude everything else (can be specified multiple times)

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots which include this (absolute) \fB\fCpath\fR for snapshot ID "latest"
+    only consider snapshots which include this (absolute) \fB\fCpath\fR for snapshot ID "latest"

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR for snapshot ID "latest"
+    only consider snapshots which include this \fB\fCtaglist\fR for snapshot ID "latest"

 .PP
 \fB\-t\fP, \fB\-\-target\fP=""
-	directory to extract data to
+    directory to extract data to

 .PP
 \fB\-\-verify\fP[=false]
-	verify restored files content
+    verify restored files content


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-self-update.1
+++ b/doc/man/restic-self-update.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -28,77 +29,81 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for self\-update
+    help for self\-update

 .PP
 \fB\-\-output\fP=""
-	Save the downloaded file as \fB\fCfilename\fR (default: running binary itself)
+    Save the downloaded file as \fB\fCfilename\fR (default: running binary itself)


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-snapshots.1
+++ b/doc/man/restic-snapshots.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -25,97 +26,101 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-c\fP, \fB\-\-compact\fP[=false]
-	use compact format
+    use compact output format

 .PP
 \fB\-g\fP, \fB\-\-group\-by\fP=""
-	string for grouping snapshots by host,paths,tags
+    string for grouping snapshots by host,paths,tags

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for snapshots
+    help for snapshots

 .PP
 \fB\-H\fP, \fB\-\-host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+    only consider snapshots for this \fB\fChost\fR (can be specified multiple times)

 .PP
 \fB\-\-last\fP[=false]
-	only show the last snapshot for each host and path
+    only show the last snapshot for each host and path

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots for this \fB\fCpath\fR (can be specified multiple times)
+    only consider snapshots for this \fB\fCpath\fR (can be specified multiple times)

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR (can be specified multiple times)
+    only consider snapshots which include this \fB\fCtaglist\fR (can be specified multiple times)


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-stats.1
+++ b/doc/man/restic-stats.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -55,89 +56,93 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for stats
+    help for stats

 .PP
 \fB\-H\fP, \fB\-\-host\fP=[]
-	only consider snapshots with the given \fB\fChost\fR (can be specified multiple times)
+    only consider snapshots with the given \fB\fChost\fR (can be specified multiple times)

 .PP
 \fB\-\-mode\fP="restore\-size"
-	counting mode: restore\-size (default), files\-by\-contents, blobs\-per\-file or raw\-data
+    counting mode: restore\-size (default), files\-by\-contents, blobs\-per\-file or raw\-data

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots which include this (absolute) \fB\fCpath\fR (can be specified multiple times)
+    only consider snapshots which include this (absolute) \fB\fCpath\fR (can be specified multiple times)

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR in the format \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+    only consider snapshots which include this \fB\fCtaglist\fR in the format \fB\fCtag[,tag,...]\fR (can be specified multiple times)


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-tag.1
+++ b/doc/man/restic-tag.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -32,97 +33,101 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-\-add\fP=[]
-	\fB\fCtag\fR which will be added to the existing tags (can be given multiple times)
+    \fB\fCtag\fR which will be added to the existing tags (can be given multiple times)

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for tag
+    help for tag

 .PP
 \fB\-H\fP, \fB\-\-host\fP=[]
-	only consider snapshots for this \fB\fChost\fR, when no snapshot ID is given (can be specified multiple times)
+    only consider snapshots for this \fB\fChost\fR, when no snapshot ID is given (can be specified multiple times)

 .PP
 \fB\-\-path\fP=[]
-	only consider snapshots which include this (absolute) \fB\fCpath\fR, when no snapshot\-ID is given
+    only consider snapshots which include this (absolute) \fB\fCpath\fR, when no snapshot\-ID is given

 .PP
 \fB\-\-remove\fP=[]
-	\fB\fCtag\fR which will be removed from the existing tags (can be given multiple times)
+    \fB\fCtag\fR which will be removed from the existing tags (can be given multiple times)

 .PP
 \fB\-\-set\fP=[]
-	\fB\fCtag\fR which will replace the existing tags (can be given multiple times)
+    \fB\fCtag\fR which will replace the existing tags (can be given multiple times)

 .PP
 \fB\-\-tag\fP=[]
-	only consider snapshots which include this \fB\fCtaglist\fR, when no snapshot\-ID is given
+    only consider snapshots which include this \fB\fCtaglist\fR, when no snapshot\-ID is given


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-unlock.1
+++ b/doc/man/restic-unlock.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -25,77 +26,81 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for unlock
+    help for unlock

 .PP
 \fB\-\-remove\-all\fP[=false]
-	remove all locks, even non\-stale ones
+    remove all locks, even non\-stale ones


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic-version.1
+++ b/doc/man/restic-version.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -26,73 +27,77 @@ Exit status is 0 if the command was successful, and non\-zero if there was any e
 .SH OPTIONS
 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for version
+    help for version


 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/man/restic.1
+++ b/doc/man/restic.1
@@ -1,6 +1,7 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
 .nh
-.TH restic backup(1)Jan 2017
-generated by \fB\fCrestic generate\fR
+.ad l
+

 .SH NAME
 .PP
@@ -21,71 +22,75 @@ directories in an encrypted repository stored on different backends.
 .SH OPTIONS
 .PP
 \fB\-\-cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)

 .PP
 \fB\-\-cache\-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+    set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)

 .PP
 \fB\-\-cleanup\-cache\fP[=false]
-	auto remove old cache directories
+    auto remove old cache directories

 .PP
 \fB\-h\fP, \fB\-\-help\fP[=false]
-	help for restic
+    help for restic

 .PP
 \fB\-\-json\fP[=false]
-	set output mode to JSON for commands that support it
+    set output mode to JSON for commands that support it

 .PP
 \fB\-\-key\-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+    \fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)

 .PP
 \fB\-\-limit\-download\fP=0
-	limits downloads to a maximum rate in KiB/s. (default: unlimited)
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-limit\-upload\fP=0
-	limits uploads to a maximum rate in KiB/s. (default: unlimited)
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)

 .PP
 \fB\-\-no\-cache\fP[=false]
-	do not use a local cache
+    do not use a local cache

 .PP
 \fB\-\-no\-lock\fP[=false]
-	do not lock the repo, this allows some operations on read\-only repos
+    do not lock the repository, this allows some operations on read\-only repositories

 .PP
 \fB\-o\fP, \fB\-\-option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)

 .PP
 \fB\-\-password\-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)
+    shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC\_PASSWORD\_COMMAND)

 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)
+    \fB\fCfile\fR to read the repository password from (default: $RESTIC\_PASSWORD\_FILE)

 .PP
 \fB\-q\fP, \fB\-\-quiet\fP[=false]
-	do not output comprehensive progress report
+    do not output comprehensive progress report

 .PP
 \fB\-r\fP, \fB\-\-repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+    \fB\fCrepository\fR to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-repository\-file\fP=""
+    \fB\fCfile\fR to read the repository location from (default: $RESTIC\_REPOSITORY\_FILE)

 .PP
 \fB\-\-tls\-client\-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+    path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key

 .PP
 \fB\-v\fP, \fB\-\-verbose\fP[=0]
-	be verbose (specify \-\-verbose multiple times or level \-\-verbose=\fB\fCn\fR)
+    be verbose (specify multiple times or a level using \-\-verbose=\fB\fCn\fR, max level/times is 3)


 .SH SEE ALSO
--- a/doc/zsh-completion.zsh
+++ b/doc/zsh-completion.zsh
@@ -14,14 +14,15 @@ function _restic {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]' \
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]' \
    "1: :->cmnds" \
    "*::arg:->args"

@@ -174,14 +175,15 @@ function _restic_backup {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_cache {
@@ -198,14 +200,15 @@ function _restic_cache {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_cat {
@@ -219,14 +222,15 @@ function _restic_cat {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_check {
@@ -244,14 +248,15 @@ function _restic_check {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_copy {
@@ -262,7 +267,7 @@ function _restic_copy {
    '--password-command2[shell `command` to obtain the destination repository password from (default: $RESTIC_PASSWORD_COMMAND2)]:' \
    '--password-file2[`file` to read the destination repository password from (default: $RESTIC_PASSWORD_FILE2)]:' \
    '*--path[only consider snapshots which include this (absolute) `path`, when no snapshot ID is given]:' \
-    '--repo2[destination repository to copy snapshots to (default: $RESTIC_REPOSITORY2)]:' \
+    '--repo2[destination `repository` to copy snapshots to (default: $RESTIC_REPOSITORY2)]:' \
    '--tag[only consider snapshots which include this `taglist`, when no snapshot ID is given]:' \
    '*--cacert[`file` to load root certificates from (default: use system certificates)]:' \
    '--cache-dir[set the cache `directory`. (default: use system default cache directory)]:' \
@@ -272,14 +277,15 @@ function _restic_copy {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_diff {
@@ -294,14 +300,15 @@ function _restic_diff {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_dump {
@@ -318,14 +325,15 @@ function _restic_dump {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_find {
@@ -351,14 +359,15 @@ function _restic_find {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_forget {
@@ -374,7 +383,7 @@ function _restic_forget {
    '*--host[only consider snapshots with the given `host` (can be specified multiple times)]:' \
    '--tag[only consider snapshots which include this `taglist` in the format `tag[,tag,...]` (can be specified multiple times)]:' \
    '*--path[only consider snapshots which include this (absolute) `path` (can be specified multiple times)]:' \
-    '(-c --compact)'{-c,--compact}'[use compact format]' \
+    '(-c --compact)'{-c,--compact}'[use compact output format]' \
    '(-g --group-by)'{-g,--group-by}'[string for grouping snapshots by host,paths,tags]:' \
    '(-n --dry-run)'{-n,--dry-run}'[do not delete anything, just print what would be done]' \
    '--prune[automatically run the '\''prune'\'' command if snapshots have been removed]' \
@@ -387,14 +396,15 @@ function _restic_forget {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_generate {
@@ -411,14 +421,15 @@ function _restic_generate {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_help {
@@ -431,14 +442,15 @@ function _restic_help {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_init {
@@ -448,7 +460,7 @@ function _restic_init {
    '--key-hint2[key ID of key to try decrypting the secondary repository first (default: $RESTIC_KEY_HINT2)]:' \
    '--password-command2[shell `command` to obtain the secondary repository password from (default: $RESTIC_PASSWORD_COMMAND2)]:' \
    '--password-file2[`file` to read the secondary repository password from (default: $RESTIC_PASSWORD_FILE2)]:' \
-    '--repo2[secondary repository to copy chunker parameters from (default: $RESTIC_REPOSITORY2)]:' \
+    '--repo2[secondary `repository` to copy chunker parameters from (default: $RESTIC_REPOSITORY2)]:' \
    '*--cacert[`file` to load root certificates from (default: use system certificates)]:' \
    '--cache-dir[set the cache `directory`. (default: use system default cache directory)]:' \
    '--cleanup-cache[auto remove old cache directories]' \
@@ -457,14 +469,15 @@ function _restic_init {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_key {
@@ -481,14 +494,15 @@ function _restic_key {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_list {
@@ -502,14 +516,15 @@ function _restic_list {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_ls {
@@ -528,14 +543,15 @@ function _restic_ls {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_migrate {
@@ -550,14 +566,15 @@ function _restic_migrate {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_mount {
@@ -578,14 +595,15 @@ function _restic_mount {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_prune {
@@ -599,14 +617,15 @@ function _restic_prune {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_rebuild-index {
@@ -620,14 +639,15 @@ function _restic_rebuild-index {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_recover {
@@ -641,14 +661,15 @@ function _restic_recover {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_restore {
@@ -671,14 +692,15 @@ function _restic_restore {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_self-update {
@@ -693,19 +715,20 @@ function _restic_self-update {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_snapshots {
  _arguments \
-    '(-c --compact)'{-c,--compact}'[use compact format]' \
+    '(-c --compact)'{-c,--compact}'[use compact output format]' \
    '(-g --group-by)'{-g,--group-by}'[string for grouping snapshots by host,paths,tags]:' \
    '(-h --help)'{-h,--help}'[help for snapshots]' \
    '(*-H *--host)'{\*-H,\*--host}'[only consider snapshots for this `host` (can be specified multiple times)]:' \
@@ -720,14 +743,15 @@ function _restic_snapshots {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_stats {
@@ -745,14 +769,15 @@ function _restic_stats {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_tag {
@@ -772,14 +797,15 @@ function _restic_tag {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_unlock {
@@ -794,14 +820,15 @@ function _restic_unlock {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

 function _restic_version {
@@ -815,13 +842,14 @@ function _restic_version {
    '--limit-download[limits downloads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--limit-upload[limits uploads to a maximum rate in KiB/s. (default: unlimited)]:' \
    '--no-cache[do not use a local cache]' \
-    '--no-lock[do not lock the repo, this allows some operations on read-only repos]' \
+    '--no-lock[do not lock the repository, this allows some operations on read-only repositories]' \
    '(*-o *--option)'{\*-o,\*--option}'[set extended option (`key=value`, can be specified multiple times)]:' \
    '--password-command[shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)]:' \
    '(-p --password-file)'{-p,--password-file}'[`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)]:' \
    '(-q --quiet)'{-q,--quiet}'[do not output comprehensive progress report]' \
    '(-r --repo)'{-r,--repo}'[`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)]:' \
+    '--repository-file[`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)]:' \
    '--tls-client-cert[path to a `file` containing PEM encoded TLS client certificate and private key]:' \
-    '(-v --verbose)'{-v,--verbose}'[be verbose (specify --verbose multiple times or level --verbose=`n`)]'
+    '(-v --verbose)'{-v,--verbose}'[be verbose (specify multiple times or a level using --verbose=`n`, max level/times is 3)]'
 }

--- a/go.mod
+++ b/go.mod
@@ -13,17 +13,14 @@ require (
 	github.com/elithrar/simple-scrypt v1.3.0
 	github.com/go-ole/go-ole v1.2.4
 	github.com/google/go-cmp v0.5.2
+	github.com/google/uuid v1.1.2 // indirect
 	github.com/gopherjs/gopherjs v0.0.0-20200217142428-fce0ec30dd00 // indirect
 	github.com/hashicorp/golang-lru v0.5.4
-	github.com/json-iterator/go v1.1.10 // indirect
 	github.com/juju/ratelimit v1.0.1
-	github.com/klauspost/cpuid v1.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/kurin/blazer v0.5.3
-	github.com/minio/minio-go/v6 v6.0.57
+	github.com/minio/minio-go/v7 v7.0.5
 	github.com/minio/sha256-simd v0.1.1
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.1 // indirect
 	github.com/ncw/swift v1.0.52
 	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
 	github.com/pkg/errors v0.9.1
@@ -41,7 +38,7 @@ require (
 	golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43
 	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208
 	golang.org/x/sys v0.0.0-20201007082116-8445cc04cbdf
-	golang.org/x/text v0.3.3
+	golang.org/x/text v0.3.4
 	google.golang.org/api v0.32.0
 	gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b // indirect
 	gopkg.in/ini.v1 v1.61.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -84,7 +84,6 @@ github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumC
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dnaeon/go-vcr v1.0.1 h1:r8L/HqC0Hje5AXMu1ooW8oyQyOFv4GxqpL0nRP7SLLY=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/elithrar/simple-scrypt v1.3.0 h1:KIlOlxdoQf9JWKl5lMAJ28SY2URB0XTRDn2TckyzAZg=
 github.com/elithrar/simple-scrypt v1.3.0/go.mod h1:U2XQRI95XHY0St410VE3UjT7vuKb1qPwrl/EJwEqnZo=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -152,6 +151,10 @@ github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200905233945-acf8798be1f7/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5 h1:sjZBwGj9Jlw33ImPtvFviGYvseOtDM7hkSKB7+Tv3SM=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
@@ -167,8 +170,6 @@ github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/json-iterator/go v1.1.9 h1:9yzud/Ht36ygwatGx56VwCZtlI/2AD15T1X2sjSuGns=
-github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.10 h1:Kz6Cvnvv2wGdaG/V8yMvfkmNiXq9Ya2KUv4rouJJr68=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
@@ -183,7 +184,6 @@ github.com/klauspost/cpuid v1.2.3 h1:CCtW0xUnWGVINKvE/WWOYKdsPV6mawAtvQuSl8guwQs
 github.com/klauspost/cpuid v1.2.3/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid v1.3.1 h1:5JNjFYYQrZeKRJ0734q51WCEEn2huer72Dc7K+R/b6s=
 github.com/klauspost/cpuid v1.3.1/go.mod h1:bYW4mA6ZgKPob1/Dlai2LviZJO7KGI3uoWLd42rAQw4=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
@@ -198,8 +198,8 @@ github.com/kurin/blazer v0.5.3/go.mod h1:4FCXMUWo9DllR2Do4TtBd377ezyAJ51vB5uTBjt
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/minio/md5-simd v1.1.0 h1:QPfiOqlZH+Cj9teu0t9b1nTBfPbyTl16Of5MeuShdK4=
 github.com/minio/md5-simd v1.1.0/go.mod h1:XpBqgZULrMYD3R+M28PcmP0CkI7PEMzB3U77ZrKZ0Gw=
-github.com/minio/minio-go/v6 v6.0.57 h1:ixPkbKkyD7IhnluRgQpGSpHdpvNVaW6OD5R9IAO/9Tw=
-github.com/minio/minio-go/v6 v6.0.57/go.mod h1:5+R/nM9Pwrh0vqF+HbYYDQ84wdUFPyXHkrdT4AIkifM=
+github.com/minio/minio-go/v7 v7.0.5 h1:I2NIJ2ojwJqD/YByemC1M59e1b4FW9kS7NlOar7HPV4=
+github.com/minio/minio-go/v7 v7.0.5/go.mod h1:TA0CQCjJZHM5SJj9IjqR0NmpmQJ6bCbXifAJ3mUU6Hw=
 github.com/minio/sha256-simd v0.1.1 h1:5QHSlgo3nt5yKOJrC7W8w7X+NFl8cMPZm96iu8kKUJU=
 github.com/minio/sha256-simd v0.1.1/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
@@ -232,11 +232,12 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
 github.com/restic/chunker v0.4.0 h1:YUPYCUn70MYP7VO4yllypp2SjmsRhRJaad3xKu1QFRw=
 github.com/restic/chunker v0.4.0/go.mod h1:z0cH2BejpW636LXw0R/BGyv+Ey8+m9QGiOanDHItzyw=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rs/xid v1.2.1 h1:mhH9Nq+C1fY2l1XIpgxIiUOfNpRBYH1kKcr+qfKgjRc=
+github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/sirupsen/logrus v1.5.0/go.mod h1:+F7Ogzej0PZc/94MaYx/nvG9jOFMD2osvC3s+Squfpo=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.2.0 h1:42S6lae5dvLc7BrLu/0ugRtcFVjoJNMC/N3yZFZkDFs=
 github.com/smartystreets/assertions v1.2.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo=
@@ -279,11 +280,10 @@ go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190513172903-22d7a77e9e5f h1:R423Cnkcp5JABoeemiGEPlt9tHXFfw5kvc0yqlxRPWo=
-golang.org/x/crypto v0.0.0-20190513172903-22d7a77e9e5f/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a h1:vclmkQCjlDX5OydZ9wv8rBCcS0QyQY66Mpf/7BZbInM=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -326,8 +326,6 @@ golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190522155817-f3200d17e092 h1:4QSRKanuywn15aTZvI/mIDEgPQpswuFndXpOj3rKEco=
-golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -374,8 +372,6 @@ golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894 h1:Cz4ceDQGXuKRnVBDTS23GTn/pU5OE2C0WrNTOYK1Uuc=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -399,6 +395,7 @@ golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200828194041-157a740278f4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -412,6 +409,8 @@ golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.4 h1:0YWbFKbhXG/wIiuHDSKpS0Iy7FSA+u45VtBMfQcFTTc=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -565,14 +564,14 @@ gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b h1:QRR6H1YWRnHb4Y/HeNFCTJLFVxaq6wH4YuVdsUOr75U=
 gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/ini.v1 v1.42.0 h1:7N3gPTt50s8GuLortA00n8AqRTk75qOP98+mTPpgzRk=
-gopkg.in/ini.v1 v1.42.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/ini.v1 v1.57.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/ini.v1 v1.61.0 h1:LBCdW4FmFYL4s/vDZD1RQYX7oAR6IjujCYgMdbHBR10=
 gopkg.in/ini.v1 v1.61.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/tomb.v2 v2.0.0-20161208151619-d5d1b5820637 h1:yiW+nvdHb9LVqSHQBXfZCieqV4fzYhNBql77zY0ykqs=
 gopkg.in/tomb.v2 v2.0.0-20161208151619-d5d1b5820637/go.mod h1:BHsqpu/nsuzkT5BpiH1EMZPLyqSMM8JbIavyFACoFNk=
 gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
--- a/helpers/prepare-release/main.go
+++ b/helpers/prepare-release/main.go
@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"strings"
+	"time"

 	"github.com/spf13/pflag"
 )
@@ -186,34 +187,44 @@ func preCheckChangelogCurrent() {
 	}
 }

-func preCheckChangelogRelease() {
+func preCheckChangelogRelease() bool {
 	if opts.IgnoreChangelogReleaseDate {
-		return
+		return true
 	}

-	d, err := os.Open("changelog")
-	if err != nil {
-		die("error opening dir: %v", err)
-	}
-
-	names, err := d.Readdirnames(-1)
-	if err != nil {
-		_ = d.Close()
-		die("error listing dir: %v", err)
-	}
-
-	err = d.Close()
-	if err != nil {
-		die("error closing dir: %v", err)
-	}
-
-	for _, name := range names {
+	for _, name := range readdir("changelog") {
 		if strings.HasPrefix(name, opts.Version+"_") {
-			return
+			return true
 		}
 	}

-	die("unable to find subdir with date for version %v in changelog", opts.Version)
+	return false
+}
+
+func createChangelogRelease() {
+	date := time.Now().Format("2006-01-02")
+	target := filepath.Join("changelog", fmt.Sprintf("%s_%s", opts.Version, date))
+	mkdir(target)
+
+	for _, name := range readdir(filepath.Join("changelog", "unreleased")) {
+		if name == ".gitignore" {
+			continue
+		}
+
+		src := filepath.Join("changelog", "unreleased", name)
+		dest := filepath.Join(target, name)
+
+		err := os.Rename(src, dest)
+		if err != nil {
+			die("rename %v -> %v failed: %w", src, dest, err)
+		}
+	}
+
+	run("git", "add", target)
+	run("git", "add", "-u", filepath.Join("changelog", "unreleased"))
+
+	msg := fmt.Sprintf("Prepare changelog for %v", opts.Version)
+	run("git", "commit", "-m", msg, target)
 }

 func preCheckChangelogVersion() {
@@ -425,7 +436,9 @@ func main() {
 	preCheckUncommittedChanges()
 	preCheckVersionExists()
 	preCheckDockerBuilderGoVersion()
-	preCheckChangelogRelease()
+	if !preCheckChangelogRelease() {
+		createChangelogRelease()
+	}
 	preCheckChangelogCurrent()
 	preCheckChangelogVersion()

--- a/internal/archiver/archiver.go
+++ b/internal/archiver/archiver.go
@@ -191,19 +191,29 @@ func (arch *Archiver) nodeFromFileInfo(filename string, fi os.FileInfo) (*restic
 }

 // loadSubtree tries to load the subtree referenced by node. In case of an error, nil is returned.
-func (arch *Archiver) loadSubtree(ctx context.Context, node *restic.Node) *restic.Tree {
+// If there is no node to load, then nil is returned without an error.
+func (arch *Archiver) loadSubtree(ctx context.Context, node *restic.Node) (*restic.Tree, error) {
 	if node == nil || node.Type != "dir" || node.Subtree == nil {
-		return nil
+		return nil, nil
 	}

 	tree, err := arch.Repo.LoadTree(ctx, *node.Subtree)
 	if err != nil {
 		debug.Log("unable to load tree %v: %v", node.Subtree.Str(), err)
-		// TODO: handle error
-		return nil
+		// a tree in the repository is not readable -> warn the user
+		return nil, arch.wrapLoadTreeError(*node.Subtree, err)
 	}

-	return tree
+	return tree, nil
+}
+
+func (arch *Archiver) wrapLoadTreeError(id restic.ID, err error) error {
+	if arch.Repo.Index().Has(id, restic.TreeBlob) {
+		err = errors.Errorf("tree %v could not be loaded; the repository could be damaged: %v", id, err)
+	} else {
+		err = errors.Errorf("tree %v is not known; the repository could be damaged, run `rebuild-index` to try to repair it", id)
+	}
+	return err
 }

 // SaveDir stores a directory in the repo and returns the node. snPath is the
@@ -434,7 +444,10 @@ func (arch *Archiver) Save(ctx context.Context, snPath, target string, previous

 		snItem := snPath + "/"
 		start := time.Now()
-		oldSubtree := arch.loadSubtree(ctx, previous)
+		oldSubtree, err := arch.loadSubtree(ctx, previous)
+		if err != nil {
+			arch.error(abstarget, fi, err)
+		}

 		fn.isTree = true
 		fn.tree, err = arch.SaveDir(ctx, snPath, fi, target, oldSubtree,
@@ -572,7 +585,10 @@ func (arch *Archiver) SaveTree(ctx context.Context, snPath string, atree *Tree,
 		start := time.Now()

 		oldNode := previous.Find(name)
-		oldSubtree := arch.loadSubtree(ctx, oldNode)
+		oldSubtree, err := arch.loadSubtree(ctx, oldNode)
+		if err != nil {
+			arch.error(join(snPath, name), nil, err)
+		}

 		// not a leaf node, archive subtree
 		subtree, err := arch.SaveTree(ctx, join(snPath, name), &subatree, oldSubtree)
@@ -730,6 +746,7 @@ func (arch *Archiver) loadParentTree(ctx context.Context, snapshotID restic.ID)
 	tree, err := arch.Repo.LoadTree(ctx, *sn.Tree)
 	if err != nil {
 		debug.Log("unable to load tree %v: %v", *sn.Tree, err)
+		arch.error("/", nil, arch.wrapLoadTreeError(*sn.Tree, err))
 		return nil
 	}
 	return tree
--- a/internal/backend/foreground.go
+++ b/internal/backend/foreground.go
@@ -0,0 +1,26 @@
+package backend
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// StartForeground runs cmd in the foreground, by temporarily switching to the
+// new process group created for cmd. The returned function `bg` switches back
+// to the previous process group.
+//
+// The command's environment has all RESTIC_* variables removed.
+func StartForeground(cmd *exec.Cmd) (bg func() error, err error) {
+	env := os.Environ() // Returns a copy that we can modify.
+
+	cmd.Env = env[:0]
+	for _, kv := range env {
+		if strings.HasPrefix(kv, "RESTIC_") {
+			continue
+		}
+		cmd.Env = append(cmd.Env, kv)
+	}
+
+	return startForeground(cmd)
+}
--- a/internal/backend/foreground_solaris.go
+++ b/internal/backend/foreground_solaris.go
@@ -7,10 +7,7 @@ import (
 	"github.com/restic/restic/internal/errors"
 )

-// StartForeground runs cmd in the foreground, by temporarily switching to the
-// new process group created for cmd. The returned function `bg` switches back
-// to the previous process group.
-func StartForeground(cmd *exec.Cmd) (bg func() error, err error) {
+func startForeground(cmd *exec.Cmd) (bg func() error, err error) {
 	// run the command in it's own process group so that SIGINT
 	// is not sent to it.
 	cmd.SysProcAttr = &syscall.SysProcAttr{
--- a/internal/backend/foreground_test.go
+++ b/internal/backend/foreground_test.go
@@ -0,0 +1,38 @@
+// +build !windows
+
+package backend_test
+
+import (
+	"bufio"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+
+	"github.com/restic/restic/internal/backend"
+	rtest "github.com/restic/restic/internal/test"
+)
+
+func TestForeground(t *testing.T) {
+	err := os.Setenv("RESTIC_PASSWORD", "supersecret")
+	rtest.OK(t, err)
+
+	cmd := exec.Command("env")
+	stdout, err := cmd.StdoutPipe()
+	rtest.OK(t, err)
+
+	bg, err := backend.StartForeground(cmd)
+	rtest.OK(t, err)
+	defer cmd.Wait()
+
+	err = bg()
+	rtest.OK(t, err)
+
+	sc := bufio.NewScanner(stdout)
+	for sc.Scan() {
+		if strings.HasPrefix(sc.Text(), "RESTIC_PASSWORD=") {
+			t.Error("subprocess got to see the password")
+		}
+	}
+	rtest.OK(t, err)
+}
--- a/internal/backend/foreground_unix.go
+++ b/internal/backend/foreground_unix.go
@@ -24,10 +24,7 @@ func tcsetpgrp(fd int, pid int) error {
 	return errno
 }

-// StartForeground runs cmd in the foreground, by temporarily switching to the
-// new process group created for cmd. The returned function `bg` switches back
-// to the previous process group.
-func StartForeground(cmd *exec.Cmd) (bg func() error, err error) {
+func startForeground(cmd *exec.Cmd) (bg func() error, err error) {
 	// open the TTY, we need the file descriptor
 	tty, err := os.OpenFile("/dev/tty", os.O_RDWR, 0)
 	if err != nil {
--- a/internal/backend/foreground_windows.go
+++ b/internal/backend/foreground_windows.go
@@ -6,10 +6,7 @@ import (
 	"github.com/restic/restic/internal/errors"
 )

-// StartForeground runs cmd in the foreground, by temporarily switching to the
-// new process group created for cmd. The returned function `bg` switches back
-// to the previous process group.
-func StartForeground(cmd *exec.Cmd) (bg func() error, err error) {
+func startForeground(cmd *exec.Cmd) (bg func() error, err error) {
 	// just start the process and hope for the best
 	err = cmd.Start()
 	if err != nil {
--- a/internal/backend/layout.go
+++ b/internal/backend/layout.go
@@ -1,6 +1,7 @@
 package backend

 import (
+	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -24,7 +25,7 @@ type Layout interface {
 // Filesystem is the abstraction of a file system used for a backend.
 type Filesystem interface {
 	Join(...string) string
-	ReadDir(string) ([]os.FileInfo, error)
+	ReadDir(context.Context, string) ([]os.FileInfo, error)
 	IsNotExist(error) bool
 }

@@ -36,7 +37,7 @@ type LocalFilesystem struct {
 }

 // ReadDir returns all entries of a directory.
-func (l *LocalFilesystem) ReadDir(dir string) ([]os.FileInfo, error) {
+func (l *LocalFilesystem) ReadDir(ctx context.Context, dir string) ([]os.FileInfo, error) {
 	f, err := fs.Open(dir)
 	if err != nil {
 		return nil, err
@@ -68,8 +69,8 @@ func (l *LocalFilesystem) IsNotExist(err error) bool {
 var backendFilenameLength = len(restic.ID{}) * 2
 var backendFilename = regexp.MustCompile(fmt.Sprintf("^[a-fA-F0-9]{%d}$", backendFilenameLength))

-func hasBackendFile(fs Filesystem, dir string) (bool, error) {
-	entries, err := fs.ReadDir(dir)
+func hasBackendFile(ctx context.Context, fs Filesystem, dir string) (bool, error) {
+	entries, err := fs.ReadDir(ctx, dir)
 	if err != nil && fs.IsNotExist(errors.Cause(err)) {
 		return false, nil
 	}
@@ -94,20 +95,20 @@ var ErrLayoutDetectionFailed = errors.New("auto-detecting the filesystem layout
 // DetectLayout tries to find out which layout is used in a local (or sftp)
 // filesystem at the given path. If repo is nil, an instance of LocalFilesystem
 // is used.
-func DetectLayout(repo Filesystem, dir string) (Layout, error) {
+func DetectLayout(ctx context.Context, repo Filesystem, dir string) (Layout, error) {
 	debug.Log("detect layout at %v", dir)
 	if repo == nil {
 		repo = &LocalFilesystem{}
 	}

 	// key file in the "keys" dir (DefaultLayout)
-	foundKeysFile, err := hasBackendFile(repo, repo.Join(dir, defaultLayoutPaths[restic.KeyFile]))
+	foundKeysFile, err := hasBackendFile(ctx, repo, repo.Join(dir, defaultLayoutPaths[restic.KeyFile]))
 	if err != nil {
 		return nil, err
 	}

 	// key file in the "key" dir (S3LegacyLayout)
-	foundKeyFile, err := hasBackendFile(repo, repo.Join(dir, s3LayoutPaths[restic.KeyFile]))
+	foundKeyFile, err := hasBackendFile(ctx, repo, repo.Join(dir, s3LayoutPaths[restic.KeyFile]))
 	if err != nil {
 		return nil, err
 	}
@@ -134,7 +135,7 @@ func DetectLayout(repo Filesystem, dir string) (Layout, error) {

 // ParseLayout parses the config string and returns a Layout. When layout is
 // the empty string, DetectLayout is used. If that fails, defaultLayout is used.
-func ParseLayout(repo Filesystem, layout, defaultLayout, path string) (l Layout, err error) {
+func ParseLayout(ctx context.Context, repo Filesystem, layout, defaultLayout, path string) (l Layout, err error) {
 	debug.Log("parse layout string %q for backend at %v", layout, path)
 	switch layout {
 	case "default":
@@ -148,12 +149,12 @@ func ParseLayout(repo Filesystem, layout, defaultLayout, path string) (l Layout,
 			Join: repo.Join,
 		}
 	case "":
-		l, err = DetectLayout(repo, path)
+		l, err = DetectLayout(ctx, repo, path)

 		// use the default layout if auto detection failed
 		if errors.Cause(err) == ErrLayoutDetectionFailed && defaultLayout != "" {
 			debug.Log("error: %v, use default layout %v", err, defaultLayout)
-			return ParseLayout(repo, defaultLayout, "", path)
+			return ParseLayout(ctx, repo, defaultLayout, "", path)
 		}

 		if err != nil {
--- a/internal/backend/layout_test.go
+++ b/internal/backend/layout_test.go
@@ -1,6 +1,7 @@
 package backend

 import (
+	"context"
 	"fmt"
 	"path"
 	"path/filepath"
@@ -371,7 +372,7 @@ func TestDetectLayout(t *testing.T) {
 			t.Run(fmt.Sprintf("%v/fs-%T", test.filename, fs), func(t *testing.T) {
 				rtest.SetupTarTestFixture(t, path, filepath.Join("testdata", test.filename))

-				layout, err := DetectLayout(fs, filepath.Join(path, "repo"))
+				layout, err := DetectLayout(context.TODO(), fs, filepath.Join(path, "repo"))
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -409,7 +410,7 @@ func TestParseLayout(t *testing.T) {

 	for _, test := range tests {
 		t.Run(test.layoutName, func(t *testing.T) {
-			layout, err := ParseLayout(&LocalFilesystem{}, test.layoutName, test.defaultLayoutName, filepath.Join(path, "repo"))
+			layout, err := ParseLayout(context.TODO(), &LocalFilesystem{}, test.layoutName, test.defaultLayoutName, filepath.Join(path, "repo"))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -441,7 +442,7 @@ func TestParseLayoutInvalid(t *testing.T) {

 	for _, name := range invalidNames {
 		t.Run(name, func(t *testing.T) {
-			layout, err := ParseLayout(nil, name, "", path)
+			layout, err := ParseLayout(context.TODO(), nil, name, "", path)
 			if err == nil {
 				t.Fatalf("expected error not found for layout name %v, layout is %v", name, layout)
 			}
--- a/internal/backend/local/layout_test.go
+++ b/internal/backend/local/layout_test.go
@@ -36,7 +36,7 @@ func TestLayout(t *testing.T) {
 			rtest.SetupTarTestFixture(t, path, filepath.Join("..", "testdata", test.filename))

 			repo := filepath.Join(path, "repo")
-			be, err := Open(Config{
+			be, err := Open(context.TODO(), Config{
 				Path:   repo,
 				Layout: test.layout,
 			})
--- a/internal/backend/local/local.go
+++ b/internal/backend/local/local.go
@@ -27,9 +27,9 @@ var _ restic.Backend = &Local{}
 const defaultLayout = "default"

 // Open opens the local backend as specified by config.
-func Open(cfg Config) (*Local, error) {
+func Open(ctx context.Context, cfg Config) (*Local, error) {
 	debug.Log("open local backend at %v (layout %q)", cfg.Path, cfg.Layout)
-	l, err := backend.ParseLayout(&backend.LocalFilesystem{}, cfg.Layout, defaultLayout, cfg.Path)
+	l, err := backend.ParseLayout(ctx, &backend.LocalFilesystem{}, cfg.Layout, defaultLayout, cfg.Path)
 	if err != nil {
 		return nil, err
 	}
@@ -39,10 +39,10 @@ func Open(cfg Config) (*Local, error) {

 // Create creates all the necessary files and directories for a new local
 // backend at dir. Afterwards a new config blob should be created.
-func Create(cfg Config) (*Local, error) {
+func Create(ctx context.Context, cfg Config) (*Local, error) {
 	debug.Log("create local backend at %v (layout %q)", cfg.Path, cfg.Layout)

-	l, err := backend.ParseLayout(&backend.LocalFilesystem{}, cfg.Layout, defaultLayout, cfg.Path)
+	l, err := backend.ParseLayout(ctx, &backend.LocalFilesystem{}, cfg.Layout, defaultLayout, cfg.Path)
 	if err != nil {
 		return nil, err
 	}
--- a/internal/backend/local/local_test.go
+++ b/internal/backend/local/local_test.go
@@ -1,6 +1,7 @@
 package local_test

 import (
+	"context"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -32,13 +33,13 @@ func newTestSuite(t testing.TB) *test.Suite {
 		// CreateFn is a function that creates a temporary repository for the tests.
 		Create: func(config interface{}) (restic.Backend, error) {
 			cfg := config.(local.Config)
-			return local.Create(cfg)
+			return local.Create(context.TODO(), cfg)
 		},

 		// OpenFn is a function that opens a previously created temporary repository.
 		Open: func(config interface{}) (restic.Backend, error) {
 			cfg := config.(local.Config)
-			return local.Open(cfg)
+			return local.Open(context.TODO(), cfg)
 		},

 		// CleanupFn removes data created during the tests.
@@ -91,7 +92,7 @@ func empty(t testing.TB, dir string) {
 func openclose(t testing.TB, dir string) {
 	cfg := local.Config{Path: dir}

-	be, err := local.Open(cfg)
+	be, err := local.Open(context.TODO(), cfg)
 	if err != nil {
 		t.Logf("Open returned error %v", err)
 	}
--- a/internal/backend/s3/s3.go
+++ b/internal/backend/s3/s3.go
@@ -14,8 +14,8 @@ import (
 	"github.com/restic/restic/internal/errors"
 	"github.com/restic/restic/internal/restic"

-	"github.com/minio/minio-go/v6"
-	"github.com/minio/minio-go/v6/pkg/credentials"
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio-go/v7/pkg/credentials"

 	"github.com/restic/restic/internal/debug"
 )
@@ -33,7 +33,7 @@ var _ restic.Backend = &Backend{}

 const defaultLayout = "default"

-func open(cfg Config, rt http.RoundTripper) (*Backend, error) {
+func open(ctx context.Context, cfg Config, rt http.RoundTripper) (*Backend, error) {
 	debug.Log("open, config %#v", cfg)

 	if cfg.MaxRetries > 0 {
@@ -66,9 +66,14 @@ func open(cfg Config, rt http.RoundTripper) (*Backend, error) {
 			},
 		},
 	})
-	client, err := minio.NewWithCredentials(cfg.Endpoint, creds, !cfg.UseHTTP, cfg.Region)
+	client, err := minio.New(cfg.Endpoint, &minio.Options{
+		Creds:     creds,
+		Secure:    !cfg.UseHTTP,
+		Region:    cfg.Region,
+		Transport: rt,
+	})
 	if err != nil {
-		return nil, errors.Wrap(err, "minio.NewWithCredentials")
+		return nil, errors.Wrap(err, "minio.New")
 	}

 	sem, err := backend.NewSemaphore(cfg.Connections)
@@ -82,9 +87,7 @@ func open(cfg Config, rt http.RoundTripper) (*Backend, error) {
 		cfg:    cfg,
 	}

-	client.SetCustomTransport(rt)
-
-	l, err := backend.ParseLayout(be, cfg.Layout, defaultLayout, cfg.Prefix)
+	l, err := backend.ParseLayout(ctx, be, cfg.Layout, defaultLayout, cfg.Prefix)
 	if err != nil {
 		return nil, err
 	}
@@ -96,18 +99,18 @@ func open(cfg Config, rt http.RoundTripper) (*Backend, error) {

 // Open opens the S3 backend at bucket and region. The bucket is created if it
 // does not exist yet.
-func Open(cfg Config, rt http.RoundTripper) (restic.Backend, error) {
-	return open(cfg, rt)
+func Open(ctx context.Context, cfg Config, rt http.RoundTripper) (restic.Backend, error) {
+	return open(ctx, cfg, rt)
 }

 // Create opens the S3 backend at bucket and region and creates the bucket if
 // it does not exist yet.
-func Create(cfg Config, rt http.RoundTripper) (restic.Backend, error) {
-	be, err := open(cfg, rt)
+func Create(ctx context.Context, cfg Config, rt http.RoundTripper) (restic.Backend, error) {
+	be, err := open(ctx, cfg, rt)
 	if err != nil {
 		return nil, errors.Wrap(err, "open")
 	}
-	found, err := be.client.BucketExists(cfg.Bucket)
+	found, err := be.client.BucketExists(ctx, cfg.Bucket)

 	if err != nil && be.IsAccessDenied(err) {
 		err = nil
@@ -121,7 +124,7 @@ func Create(cfg Config, rt http.RoundTripper) (restic.Backend, error) {

 	if !found {
 		// create new bucket with default ACL in default region
-		err = be.client.MakeBucket(cfg.Bucket, "")
+		err = be.client.MakeBucket(ctx, cfg.Bucket, minio.MakeBucketOptions{})
 		if err != nil {
 			return nil, errors.Wrap(err, "client.MakeBucket")
 		}
@@ -176,7 +179,7 @@ func (fi fileInfo) IsDir() bool        { return fi.isDir }   // abbreviation for
 func (fi fileInfo) Sys() interface{}   { return nil }        // underlying data source (can return nil)

 // ReadDir returns the entries for a directory.
-func (be *Backend) ReadDir(dir string) (list []os.FileInfo, err error) {
+func (be *Backend) ReadDir(ctx context.Context, dir string) (list []os.FileInfo, err error) {
 	debug.Log("ReadDir(%v)", dir)

 	// make sure dir ends with a slash
@@ -184,10 +187,13 @@ func (be *Backend) ReadDir(dir string) (list []os.FileInfo, err error) {
 		dir += "/"
 	}

-	done := make(chan struct{})
-	defer close(done)
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()

-	for obj := range be.client.ListObjects(be.cfg.Bucket, dir, false, done) {
+	for obj := range be.client.ListObjects(ctx, be.cfg.Bucket, minio.ListObjectsOptions{
+		Prefix:    dir,
+		Recursive: false,
+	}) {
 		if obj.Err != nil {
 			return nil, err
 		}
@@ -248,7 +254,7 @@ func (be *Backend) Save(ctx context.Context, h restic.Handle, rd restic.RewindRe
 	opts.ContentType = "application/octet-stream"

 	debug.Log("PutObject(%v, %v, %v)", be.cfg.Bucket, objName, rd.Length())
-	n, err := be.client.PutObjectWithContext(ctx, be.cfg.Bucket, objName, ioutil.NopCloser(rd), int64(rd.Length()), opts)
+	n, err := be.client.PutObject(ctx, be.cfg.Bucket, objName, ioutil.NopCloser(rd), int64(rd.Length()), opts)

 	debug.Log("%v -> %v bytes, err %#v: %v", objName, n, err, err)

@@ -305,7 +311,7 @@ func (be *Backend) openReader(ctx context.Context, h restic.Handle, length int,

 	be.sem.GetToken()
 	coreClient := minio.Core{Client: be.client}
-	rd, _, _, err := coreClient.GetObjectWithContext(ctx, be.cfg.Bucket, objName, opts)
+	rd, _, _, err := coreClient.GetObject(ctx, be.cfg.Bucket, objName, opts)
 	if err != nil {
 		be.sem.ReleaseToken()
 		return nil, err
@@ -332,7 +338,7 @@ func (be *Backend) Stat(ctx context.Context, h restic.Handle) (bi restic.FileInf
 	opts := minio.GetObjectOptions{}

 	be.sem.GetToken()
-	obj, err = be.client.GetObjectWithContext(ctx, be.cfg.Bucket, objName, opts)
+	obj, err = be.client.GetObject(ctx, be.cfg.Bucket, objName, opts)
 	if err != nil {
 		debug.Log("GetObject() err %v", err)
 		be.sem.ReleaseToken()
@@ -363,7 +369,7 @@ func (be *Backend) Test(ctx context.Context, h restic.Handle) (bool, error) {
 	objName := be.Filename(h)

 	be.sem.GetToken()
-	_, err := be.client.StatObject(be.cfg.Bucket, objName, minio.StatObjectOptions{})
+	_, err := be.client.StatObject(ctx, be.cfg.Bucket, objName, minio.StatObjectOptions{})
 	be.sem.ReleaseToken()

 	if err == nil {
@@ -379,7 +385,7 @@ func (be *Backend) Remove(ctx context.Context, h restic.Handle) error {
 	objName := be.Filename(h)

 	be.sem.GetToken()
-	err := be.client.RemoveObject(be.cfg.Bucket, objName)
+	err := be.client.RemoveObject(ctx, be.cfg.Bucket, objName, minio.RemoveObjectOptions{})
 	be.sem.ReleaseToken()

 	debug.Log("Remove(%v) at %v -> err %v", h, objName, err)
@@ -409,7 +415,10 @@ func (be *Backend) List(ctx context.Context, t restic.FileType, fn func(restic.F
 	// NB: unfortunately we can't protect this with be.sem.GetToken() here.
 	// Doing so would enable a deadlock situation (gh-1399), as ListObjects()
 	// starts its own goroutine and returns results via a channel.
-	listresp := be.client.ListObjects(be.cfg.Bucket, prefix, recursive, ctx.Done())
+	listresp := be.client.ListObjects(ctx, be.cfg.Bucket, minio.ListObjectsOptions{
+		Prefix:    prefix,
+		Recursive: recursive,
+	})

 	for obj := range listresp {
 		if obj.Err != nil {
@@ -473,7 +482,7 @@ func (be *Backend) Delete(ctx context.Context) error {
 func (be *Backend) Close() error { return nil }

 // Rename moves a file based on the new layout l.
-func (be *Backend) Rename(h restic.Handle, l backend.Layout) error {
+func (be *Backend) Rename(ctx context.Context, h restic.Handle, l backend.Layout) error {
 	debug.Log("Rename %v to %v", h, l)
 	oldname := be.Filename(h)
 	newname := l.Filename(h)
@@ -485,14 +494,17 @@ func (be *Backend) Rename(h restic.Handle, l backend.Layout) error {

 	debug.Log("  %v -> %v", oldname, newname)

-	src := minio.NewSourceInfo(be.cfg.Bucket, oldname, nil)
-
-	dst, err := minio.NewDestinationInfo(be.cfg.Bucket, newname, nil, nil)
-	if err != nil {
-		return errors.Wrap(err, "NewDestinationInfo")
+	src := minio.CopySrcOptions{
+		Bucket: be.cfg.Bucket,
+		Object: oldname,
 	}

-	err = be.client.CopyObject(dst, src)
+	dst := minio.CopyDestOptions{
+		Bucket: be.cfg.Bucket,
+		Object: newname,
+	}
+
+	_, err := be.client.CopyObject(ctx, dst, src)
 	if err != nil && be.IsNotExist(err) {
 		debug.Log("copy failed: %v, seems to already have been renamed", err)
 		return nil
@@ -503,5 +515,5 @@ func (be *Backend) Rename(h restic.Handle, l backend.Layout) error {
 		return err
 	}

-	return be.client.RemoveObject(be.cfg.Bucket, oldname)
+	return be.client.RemoveObject(ctx, be.cfg.Bucket, oldname, minio.RemoveObjectOptions{})
 }
--- a/internal/backend/s3/s3_test.go
+++ b/internal/backend/s3/s3_test.go
@@ -107,7 +107,7 @@ type MinioTestConfig struct {

 func createS3(t testing.TB, cfg MinioTestConfig, tr http.RoundTripper) (be restic.Backend, err error) {
 	for i := 0; i < 10; i++ {
-		be, err = s3.Create(cfg.Config, tr)
+		be, err = s3.Create(context.TODO(), cfg.Config, tr)
 		if err != nil {
 			t.Logf("s3 open: try %d: error %v", i, err)
 			time.Sleep(500 * time.Millisecond)
@@ -154,7 +154,7 @@ func newMinioTestSuite(ctx context.Context, t testing.TB) *test.Suite {
 				return nil, err
 			}

-			exists, err := be.Test(context.TODO(), restic.Handle{Type: restic.ConfigFile})
+			exists, err := be.Test(ctx, restic.Handle{Type: restic.ConfigFile})
 			if err != nil {
 				return nil, err
 			}
@@ -169,7 +169,7 @@ func newMinioTestSuite(ctx context.Context, t testing.TB) *test.Suite {
 		// OpenFn is a function that opens a previously created temporary repository.
 		Open: func(config interface{}) (restic.Backend, error) {
 			cfg := config.(MinioTestConfig)
-			return s3.Open(cfg.Config, tr)
+			return s3.Open(ctx, cfg.Config, tr)
 		},

 		// CleanupFn removes data created during the tests.
@@ -248,7 +248,7 @@ func newS3TestSuite(t testing.TB) *test.Suite {
 		Create: func(config interface{}) (restic.Backend, error) {
 			cfg := config.(s3.Config)

-			be, err := s3.Create(cfg, tr)
+			be, err := s3.Create(context.TODO(), cfg, tr)
 			if err != nil {
 				return nil, err
 			}
@@ -268,14 +268,14 @@ func newS3TestSuite(t testing.TB) *test.Suite {
 		// OpenFn is a function that opens a previously created temporary repository.
 		Open: func(config interface{}) (restic.Backend, error) {
 			cfg := config.(s3.Config)
-			return s3.Open(cfg, tr)
+			return s3.Open(context.TODO(), cfg, tr)
 		},

 		// CleanupFn removes data created during the tests.
 		Cleanup: func(config interface{}) error {
 			cfg := config.(s3.Config)

-			be, err := s3.Open(cfg, tr)
+			be, err := s3.Open(context.TODO(), cfg, tr)
 			if err != nil {
 				return err
 			}
--- a/internal/backend/sftp/layout_test.go
+++ b/internal/backend/sftp/layout_test.go
@@ -42,7 +42,7 @@ func TestLayout(t *testing.T) {
 			rtest.SetupTarTestFixture(t, path, filepath.Join("..", "testdata", test.filename))

 			repo := filepath.Join(path, "repo")
-			be, err := sftp.Open(sftp.Config{
+			be, err := sftp.Open(context.TODO(), sftp.Config{
 				Command: fmt.Sprintf("%q -e", sftpServer),
 				Path:    repo,
 				Layout:  test.layout,
--- a/internal/backend/sftp/sftp.go
+++ b/internal/backend/sftp/sftp.go
@@ -109,7 +109,7 @@ func (r *SFTP) clientError() error {
 // Open opens an sftp backend as described by the config by running
 // "ssh" with the appropriate arguments (or cfg.Command, if set). The function
 // preExec is run just before, postExec just after starting a program.
-func Open(cfg Config) (*SFTP, error) {
+func Open(ctx context.Context, cfg Config) (*SFTP, error) {
 	debug.Log("open backend with config %#v", cfg)

 	cmd, args, err := buildSSHCommand(cfg)
@@ -123,7 +123,7 @@ func Open(cfg Config) (*SFTP, error) {
 		return nil, err
 	}

-	sftp.Layout, err = backend.ParseLayout(sftp, cfg.Layout, defaultLayout, cfg.Path)
+	sftp.Layout, err = backend.ParseLayout(ctx, sftp, cfg.Layout, defaultLayout, cfg.Path)
 	if err != nil {
 		return nil, err
 	}
@@ -152,7 +152,7 @@ func (r *SFTP) Join(p ...string) string {
 }

 // ReadDir returns the entries for a directory.
-func (r *SFTP) ReadDir(dir string) ([]os.FileInfo, error) {
+func (r *SFTP) ReadDir(ctx context.Context, dir string) ([]os.FileInfo, error) {
 	fi, err := r.c.ReadDir(dir)

 	// sftp client does not specify dir name on error, so add it here
@@ -207,7 +207,7 @@ func buildSSHCommand(cfg Config) (cmd string, args []string, err error) {
 // Create creates an sftp backend as described by the config by running "ssh"
 // with the appropriate arguments (or cfg.Command, if set). The function
 // preExec is run just before, postExec just after starting a program.
-func Create(cfg Config) (*SFTP, error) {
+func Create(ctx context.Context, cfg Config) (*SFTP, error) {
 	cmd, args, err := buildSSHCommand(cfg)
 	if err != nil {
 		return nil, err
@@ -219,7 +219,7 @@ func Create(cfg Config) (*SFTP, error) {
 		return nil, err
 	}

-	sftp.Layout, err = backend.ParseLayout(sftp, cfg.Layout, defaultLayout, cfg.Path)
+	sftp.Layout, err = backend.ParseLayout(ctx, sftp, cfg.Layout, defaultLayout, cfg.Path)
 	if err != nil {
 		return nil, err
 	}
@@ -241,7 +241,7 @@ func Create(cfg Config) (*SFTP, error) {
 	}

 	// open backend
-	return Open(cfg)
+	return Open(ctx, cfg)
 }

 // Location returns this backend's location (the directory name).
@@ -467,8 +467,8 @@ func (r *SFTP) Close() error {
 	return nil
 }

-func (r *SFTP) deleteRecursive(name string) error {
-	entries, err := r.ReadDir(name)
+func (r *SFTP) deleteRecursive(ctx context.Context, name string) error {
+	entries, err := r.ReadDir(ctx, name)
 	if err != nil {
 		return errors.Wrap(err, "ReadDir")
 	}
@@ -476,7 +476,7 @@ func (r *SFTP) deleteRecursive(name string) error {
 	for _, fi := range entries {
 		itemName := r.Join(name, fi.Name())
 		if fi.IsDir() {
-			err := r.deleteRecursive(itemName)
+			err := r.deleteRecursive(ctx, itemName)
 			if err != nil {
 				return errors.Wrap(err, "ReadDir")
 			}
@@ -499,6 +499,6 @@ func (r *SFTP) deleteRecursive(name string) error {
 }

 // Delete removes all data in the backend.
-func (r *SFTP) Delete(context.Context) error {
-	return r.deleteRecursive(r.p)
+func (r *SFTP) Delete(ctx context.Context) error {
+	return r.deleteRecursive(ctx, r.p)
 }
--- a/internal/backend/sftp/sftp_test.go
+++ b/internal/backend/sftp/sftp_test.go
@@ -1,6 +1,7 @@
 package sftp_test

 import (
+	"context"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -50,13 +51,13 @@ func newTestSuite(t testing.TB) *test.Suite {
 		// CreateFn is a function that creates a temporary repository for the tests.
 		Create: func(config interface{}) (restic.Backend, error) {
 			cfg := config.(sftp.Config)
-			return sftp.Create(cfg)
+			return sftp.Create(context.TODO(), cfg)
 		},

 		// OpenFn is a function that opens a previously created temporary repository.
 		Open: func(config interface{}) (restic.Backend, error) {
 			cfg := config.(sftp.Config)
-			return sftp.Open(cfg)
+			return sftp.Open(context.TODO(), cfg)
 		},

 		// CleanupFn removes data created during the tests.
--- a/internal/checker/checker.go
+++ b/internal/checker/checker.go
@@ -2,11 +2,14 @@ package checker

 import (
 	"context"
+	cryptosha256 "crypto/sha256"
 	"fmt"
 	"io"
 	"os"
 	"sync"

+	simdsha256 "github.com/minio/sha256-simd"
+
 	"github.com/restic/restic/internal/debug"
 	"github.com/restic/restic/internal/errors"
 	"github.com/restic/restic/internal/pack"
@@ -756,10 +759,100 @@ func checkPack(ctx context.Context, r restic.Repository, id restic.ID) error {
 			continue
 		}

+		// inject error for testing
+		// if i == 23 {
+		// 	plaintext[0] ^= 0x01
+		// }
+
 		hash := restic.Hash(plaintext)
 		if !hash.Equal(blob.ID) {
 			debug.Log("  Blob ID does not match, want %v, got %v", blob.ID, hash)
 			errs = append(errs, errors.Errorf("Blob ID does not match, want %v, got %v", blob.ID.Str(), hash.Str()))
+
+			fmt.Fprintf(os.Stderr, "pack %v: blob %v (offset %v, length %v): ID does not match\n", id.String(), i, blob.Offset, blob.Length)
+			fmt.Fprintf(os.Stderr, "  want           %v\n", blob.ID)
+			fmt.Fprintf(os.Stderr, "  got            %v\n", hash)
+			fmt.Fprintf(os.Stderr, "  crypto/sha256  %02x\n", cryptosha256.Sum256(plaintext))
+			fmt.Fprintf(os.Stderr, "  SIMD sha256    %02x\n", simdsha256.Sum256(plaintext))
+
+			// save the blob's plaintext to a temp file
+			f, err := os.OpenFile(fmt.Sprintf("/tmp/%s.plaintext", blob.ID), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
+			if err != nil {
+				panic("unable to create tempfile: " + err.Error())
+			}
+
+			_, err = f.Write(plaintext)
+			if err != nil {
+				panic("write error: " + err.Error())
+			}
+
+			err = f.Close()
+			if err != nil {
+				panic("close error: " + err.Error())
+			}
+
+			// save the raw buffer
+			f, err = os.OpenFile(fmt.Sprintf("/tmp/%s.buf", blob.ID), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
+			if err != nil {
+				panic("unable to create tempfile: " + err.Error())
+			}
+
+			_, err = f.Write(buf)
+			if err != nil {
+				panic("write error: " + err.Error())
+			}
+
+			err = f.Close()
+			if err != nil {
+				panic("close error: " + err.Error())
+			}
+
+			// extract the encrypted blob again
+			f, err = os.OpenFile(fmt.Sprintf("/tmp/%s.raw", blob.ID), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
+			if err != nil {
+				panic("unable to create tempfile: " + err.Error())
+			}
+
+			_, err = packfile.Seek(int64(blob.Offset), 0)
+			if err != nil {
+				panic(errors.Errorf("Seek(%v): %v", blob.Offset, err).Error())
+			}
+
+			_, err = io.CopyN(f, packfile, int64(blob.Length))
+			if err != nil {
+				panic("copyN error: " + err.Error())
+			}
+
+			err = f.Close()
+			if err != nil {
+				panic("close error: " + err.Error())
+			}
+
+			// save the raw pack file
+			f, err = os.OpenFile(fmt.Sprintf("/tmp/%s.pack", id), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
+			if err != nil {
+				panic("unable to create tempfile: " + err.Error())
+			}
+
+			_, err = packfile.Seek(0, 0)
+			if err != nil {
+				panic(errors.Errorf("Seek(%v): %v", 0, err).Error())
+			}
+
+			_, err = io.Copy(f, packfile)
+			if err != nil {
+				panic("copyN error: " + err.Error())
+			}
+
+			if err == io.EOF {
+				err = nil
+			}
+
+			err = f.Close()
+			if err != nil {
+				panic("close error: " + err.Error())
+			}
+
 			continue
 		}
 	}
--- a/internal/crypto/crypto_test.go
+++ b/internal/crypto/crypto_test.go
@@ -3,11 +3,15 @@ package crypto_test
 import (
 	"bytes"
 	"crypto/rand"
+	"encoding/json"
 	"io"
+	"os"
 	"testing"

 	"github.com/restic/restic/internal/crypto"
+	"github.com/restic/restic/internal/errors"
 	rtest "github.com/restic/restic/internal/test"
+	"golang.org/x/sync/errgroup"

 	"github.com/restic/chunker"
 )
@@ -279,24 +283,75 @@ func BenchmarkEncrypt(b *testing.B) {
 	}
 }

+func writeTempfile(name string, data []byte) {
+	f, err := os.Create("/tmp/" + name)
+	if err != nil {
+		panic(err)
+	}
+
+	_, err = f.Write(data)
+	if err != nil {
+		panic(err)
+	}
+
+	err = f.Close()
+	if err != nil {
+		panic(err)
+	}
+}
+
+func writeJSON(name string, data interface{}) {
+	buf, err := json.Marshal(data)
+	if err != nil {
+		panic(err)
+	}
+
+	writeTempfile(name, buf)
+}
+
 func BenchmarkDecrypt(b *testing.B) {
 	size := 8 << 20 // 8MiB
-	data := make([]byte, size)
+	data := rtest.Random(42, size)

 	k := crypto.NewRandomKey()

-	plaintext := make([]byte, 0, size)
 	ciphertext := make([]byte, 0, size+crypto.Extension)
 	nonce := crypto.NewRandomNonce()
 	ciphertext = k.Seal(ciphertext, nonce, data, nil)

-	var err error
-
 	b.ResetTimer()
 	b.SetBytes(int64(size))

-	for i := 0; i < b.N; i++ {
-		_, err = k.Open(plaintext, nonce, ciphertext, nil)
-		rtest.OK(b, err)
+	var wg errgroup.Group
+
+	for i := 0; i < 5; i++ {
+		wg.Go(func() error {
+			buf := make([]byte, len(ciphertext))
+
+			for i := 0; i < b.N; i++ {
+				buf = buf[:cap(buf)]
+				copy(buf, ciphertext)
+				result, err := k.Open(buf[:0], nonce, buf, nil)
+				rtest.OK(b, err)
+
+				if !bytes.Equal(data, result) {
+					writeJSON("benchmark-decrypt-encryption-key.raw", k.EncryptionKey)
+					writeJSON("benchmark-decrypt-mac-key.raw", k.MACKey)
+					writeTempfile("benchmark-decrypt-nonce.raw", nonce)
+					writeTempfile("benchmark-decrypt-ciphertext.raw", ciphertext)
+					writeTempfile("benchmark-decrypt-plaintext.raw", data)
+					writeTempfile("benchmark-decrypt-result.raw", result)
+
+					return errors.New("wrong plaintext")
+				}
+			}
+
+			return nil
+		})
+	}
+
+	err := wg.Wait()
+	if err != nil {
+		b.Fatal(err)
 	}
 }
--- a/internal/debug/debug.go
+++ b/internal/debug/debug.go
@@ -12,8 +12,6 @@ import (
 	"strings"

 	"github.com/restic/restic/internal/fs"
-
-	"github.com/restic/restic/internal/errors"
 )

 var opts struct {
@@ -50,20 +48,7 @@ func initDebugLogger() {

 	fmt.Fprintf(os.Stderr, "debug log file %v\n", debugfile)

-	f, err := fs.OpenFile(debugfile, os.O_WRONLY|os.O_APPEND, 0600)
-
-	if err == nil {
-		_, err = f.Seek(2, 0)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "unable to seek to the end of %v: %v\n", debugfile, err)
-			os.Exit(3)
-		}
-	}
-
-	if err != nil && os.IsNotExist(errors.Cause(err)) {
-		f, err = fs.OpenFile(debugfile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
-	}
-
+	f, err := fs.OpenFile(debugfile, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "unable to open debug log file: %v\n", err)
 		os.Exit(2)
--- a/internal/dump/acl_test.go
+++ b/internal/dump/acl_test.go
@@ -21,6 +21,13 @@ func Test_acl_decode(t *testing.T) {
 			},
 			want: "user::rw-\nuser:0:rwx\nuser:65534:rwx\ngroup::rwx\nmask::rwx\nother::r--\n",
 		},
+		{
+			name: "decode group",
+			args: args{
+				xattr: []byte{2, 0, 0, 0, 8, 0, 1, 0, 254, 255, 0, 0},
+			},
+			want: "group:65534:--x\n",
+		},
 		{
 			name: "decode fail",
 			args: args{
@@ -28,6 +35,13 @@ func Test_acl_decode(t *testing.T) {
 			},
 			want: "",
 		},
+		{
+			name: "decode empty fail",
+			args: args{
+				xattr: []byte(""),
+			},
+			want: "",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -36,6 +50,10 @@ func Test_acl_decode(t *testing.T) {
 			if tt.want != a.String() {
 				t.Errorf("acl.decode() = %v, want: %v", a.String(), tt.want)
 			}
+			a.decode(tt.args.xattr)
+			if tt.want != a.String() {
+				t.Errorf("second acl.decode() = %v, want: %v", a.String(), tt.want)
+			}
 		})
 	}
 }
--- a/internal/dump/tar.go
+++ b/internal/dump/tar.go
@@ -4,6 +4,7 @@ import (
 	"archive/tar"
 	"context"
 	"io"
+	"os"
 	"path"
 	"path/filepath"
 	"strings"
@@ -65,6 +66,15 @@ func tarTree(ctx context.Context, repo restic.Repository, rootNode *restic.Node,
 	return err
 }

+// copied from archive/tar.FileInfoHeader
+const (
+	// Mode constants from the USTAR spec:
+	// See http://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_06
+	c_ISUID = 04000 // Set uid
+	c_ISGID = 02000 // Set gid
+	c_ISVTX = 01000 // Save text (sticky bit)
+)
+
 func tarNode(ctx context.Context, tw *tar.Writer, node *restic.Node, repo restic.Repository) error {
 	relPath, err := filepath.Rel("/", node.Path)
 	if err != nil {
@@ -74,15 +84,32 @@ func tarNode(ctx context.Context, tw *tar.Writer, node *restic.Node, repo restic
 	header := &tar.Header{
 		Name:       filepath.ToSlash(relPath),
 		Size:       int64(node.Size),
-		Mode:       int64(node.Mode),
+		Mode:       int64(node.Mode.Perm()), // c_IS* constants are added later
 		Uid:        int(node.UID),
 		Gid:        int(node.GID),
+		Uname:      node.User,
+		Gname:      node.Group,
 		ModTime:    node.ModTime,
 		AccessTime: node.AccessTime,
 		ChangeTime: node.ChangeTime,
 		PAXRecords: parseXattrs(node.ExtendedAttributes),
 	}

+	// adapted from archive/tar.FileInfoHeader
+	if node.Mode&os.ModeSetuid != 0 {
+		header.Mode |= c_ISUID
+	}
+	if node.Mode&os.ModeSetgid != 0 {
+		header.Mode |= c_ISGID
+	}
+	if node.Mode&os.ModeSticky != 0 {
+		header.Mode |= c_ISVTX
+	}
+
+	if IsFile(node) {
+		header.Typeflag = tar.TypeReg
+	}
+
 	if IsLink(node) {
 		header.Typeflag = tar.TypeSymlink
 		header.Linkname = node.LinkTarget
@@ -90,6 +117,7 @@ func tarNode(ctx context.Context, tw *tar.Writer, node *restic.Node, repo restic

 	if IsDir(node) {
 		header.Typeflag = tar.TypeDir
+		header.Name += "/"
 	}

 	err = tw.WriteHeader(header)
--- a/internal/dump/tar_test.go
+++ b/internal/dump/tar_test.go
@@ -9,6 +9,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"

@@ -68,6 +69,14 @@ func TestWriteTar(t *testing.T) {
 			},
 			target: "/",
 		},
+		{
+			name: "file and symlink in root",
+			args: archiver.TestDir{
+				"file1": archiver.TestFile{Content: "string"},
+				"file2": archiver.TestSymlink{Target: "file1"},
+			},
+			target: "/",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -128,7 +137,7 @@ func checkTar(t *testing.T, testDir string, srcTar *bytes.Buffer) error {
 		}

 		matchPath := filepath.Join(testDir, hdr.Name)
-		match, err := os.Stat(matchPath)
+		match, err := os.Lstat(matchPath)
 		if err != nil {
 			return err
 		}
@@ -140,7 +149,12 @@ func checkTar(t *testing.T, testDir string, srcTar *bytes.Buffer) error {
 			return fmt.Errorf("modTime does not match, got: %s, want: %s", fileTime, tarTime)
 		}

-		if hdr.Typeflag == tar.TypeDir {
+		if os.FileMode(hdr.Mode).Perm() != match.Mode().Perm() || os.FileMode(hdr.Mode)&^os.ModePerm != 0 {
+			return fmt.Errorf("mode does not match, got: %v, want: %v", os.FileMode(hdr.Mode), match.Mode())
+		}
+
+		switch hdr.Typeflag {
+		case tar.TypeDir:
 			// this is a folder
 			if hdr.Name == "." {
 				// we don't need to check the root folder
@@ -151,8 +165,18 @@ func checkTar(t *testing.T, testDir string, srcTar *bytes.Buffer) error {
 			if filepath.Base(hdr.Name) != filebase {
 				return fmt.Errorf("foldernames don't match got %v want %v", filepath.Base(hdr.Name), filebase)
 			}
-
-		} else {
+			if !strings.HasSuffix(hdr.Name, "/") {
+				return fmt.Errorf("foldernames must end with separator got %v", hdr.Name)
+			}
+		case tar.TypeSymlink:
+			target, err := fs.Readlink(matchPath)
+			if err != nil {
+				return err
+			}
+			if target != hdr.Linkname {
+				return fmt.Errorf("symlink target does not match, got %s want %s", target, hdr.Linkname)
+			}
+		default:
 			if match.Size() != hdr.Size {
 				return fmt.Errorf("size does not match got %v want %v", hdr.Size, match.Size())
 			}
--- a/internal/filter/filter.go
+++ b/internal/filter/filter.go
@@ -11,6 +11,47 @@ import (
 // second argument.
 var ErrBadString = errors.New("filter.Match: string is empty")

+type patternPart struct {
+	pattern  string // First is "/" for absolute pattern; "" for "**".
+	isSimple bool
+}
+
+// Pattern represents a preparsed filter pattern
+type Pattern []patternPart
+
+func prepareStr(str string) ([]string, error) {
+	if str == "" {
+		return nil, ErrBadString
+	}
+	return splitPath(str), nil
+}
+
+func preparePattern(pattern string) Pattern {
+	parts := splitPath(filepath.Clean(pattern))
+	patterns := make([]patternPart, len(parts))
+	for i, part := range parts {
+		isSimple := !strings.ContainsAny(part, "\\[]*?")
+		// Replace "**" with the empty string to get faster comparisons
+		// (length-check only) in hasDoubleWildcard.
+		if part == "**" {
+			part = ""
+		}
+		patterns[i] = patternPart{part, isSimple}
+	}
+
+	return patterns
+}
+
+// Split p into path components. Assuming p has been Cleaned, no component
+// will be empty. For absolute paths, the first component is "/".
+func splitPath(p string) []string {
+	parts := strings.Split(filepath.ToSlash(p), "/")
+	if parts[0] == "" {
+		parts[0] = "/"
+	}
+	return parts
+}
+
 // Match returns true if str matches the pattern. When the pattern is
 // malformed, filepath.ErrBadPattern is returned. The empty pattern matches
 // everything, when str is the empty string ErrBadString is returned.
@@ -26,21 +67,13 @@ func Match(pattern, str string) (matched bool, err error) {
 		return true, nil
 	}

-	pattern = filepath.Clean(pattern)
+	patterns := preparePattern(pattern)
+	strs, err := prepareStr(str)

-	if str == "" {
-		return false, ErrBadString
+	if err != nil {
+		return false, err
 	}

-	// convert file path separator to '/'
-	if filepath.Separator != '/' {
-		pattern = strings.Replace(pattern, string(filepath.Separator), "/", -1)
-		str = strings.Replace(str, string(filepath.Separator), "/", -1)
-	}
-
-	patterns := strings.Split(pattern, "/")
-	strs := strings.Split(str, "/")
-
 	return match(patterns, strs)
 }

@@ -59,26 +92,18 @@ func ChildMatch(pattern, str string) (matched bool, err error) {
 		return true, nil
 	}

-	pattern = filepath.Clean(pattern)
+	patterns := preparePattern(pattern)
+	strs, err := prepareStr(str)

-	if str == "" {
-		return false, ErrBadString
+	if err != nil {
+		return false, err
 	}

-	// convert file path separator to '/'
-	if filepath.Separator != '/' {
-		pattern = strings.Replace(pattern, string(filepath.Separator), "/", -1)
-		str = strings.Replace(str, string(filepath.Separator), "/", -1)
-	}
-
-	patterns := strings.Split(pattern, "/")
-	strs := strings.Split(str, "/")
-
 	return childMatch(patterns, strs)
 }

-func childMatch(patterns, strs []string) (matched bool, err error) {
-	if patterns[0] != "" {
+func childMatch(patterns Pattern, strs []string) (matched bool, err error) {
+	if patterns[0].pattern != "/" {
 		// relative pattern can always be nested down
 		return true, nil
 	}
@@ -99,9 +124,9 @@ func childMatch(patterns, strs []string) (matched bool, err error) {
 	return match(patterns[0:l], strs)
 }

-func hasDoubleWildcard(list []string) (ok bool, pos int) {
+func hasDoubleWildcard(list Pattern) (ok bool, pos int) {
 	for i, item := range list {
-		if item == "**" {
+		if item.pattern == "" {
 			return true, i
 		}
 	}
@@ -109,14 +134,18 @@ func hasDoubleWildcard(list []string) (ok bool, pos int) {
 	return false, 0
 }

-func match(patterns, strs []string) (matched bool, err error) {
+func match(patterns Pattern, strs []string) (matched bool, err error) {
 	if ok, pos := hasDoubleWildcard(patterns); ok {
 		// gradually expand '**' into separate wildcards
+		newPat := make(Pattern, len(strs))
+		// copy static prefix once
+		copy(newPat, patterns[:pos])
 		for i := 0; i <= len(strs)-len(patterns)+1; i++ {
-			newPat := make([]string, pos)
-			copy(newPat, patterns[:pos])
-			for k := 0; k < i; k++ {
-				newPat = append(newPat, "*")
+			// limit to static prefix and already appended '*'
+			newPat := newPat[:pos+i]
+			// in the first iteration the wildcard expands to nothing
+			if i > 0 {
+				newPat[pos+i-1] = patternPart{"*", false}
 			}
 			newPat = append(newPat, patterns[pos+1:]...)

@@ -138,13 +167,27 @@ func match(patterns, strs []string) (matched bool, err error) {
 	}

 	if len(patterns) <= len(strs) {
+		minOffset := 0
+		maxOffset := len(strs) - len(patterns)
+		// special case absolute patterns
+		if patterns[0].pattern == "/" {
+			maxOffset = 0
+		} else if strs[0] == "/" {
+			// skip absolute path marker if pattern is not rooted
+			minOffset = 1
+		}
 	outer:
-		for offset := len(strs) - len(patterns); offset >= 0; offset-- {
+		for offset := maxOffset; offset >= minOffset; offset-- {

 			for i := len(patterns) - 1; i >= 0; i-- {
-				ok, err := filepath.Match(patterns[i], strs[offset+i])
-				if err != nil {
-					return false, errors.Wrap(err, "Match")
+				var ok bool
+				if patterns[i].isSimple {
+					ok = patterns[i].pattern == strs[offset+i]
+				} else {
+					ok, err = filepath.Match(patterns[i].pattern, strs[offset+i])
+					if err != nil {
+						return false, errors.Wrap(err, "Match")
+					}
 				}

 				if !ok {
@@ -159,22 +202,55 @@ func match(patterns, strs []string) (matched bool, err error) {
 	return false, nil
 }

-// List returns true if str matches one of the patterns. Empty patterns are
-// ignored.
-func List(patterns []string, str string) (matched bool, childMayMatch bool, err error) {
+// ParsePatterns prepares a list of patterns for use with List.
+func ParsePatterns(patterns []string) []Pattern {
+	patpat := make([]Pattern, 0)
 	for _, pat := range patterns {
 		if pat == "" {
 			continue
 		}

-		m, err := Match(pat, str)
+		pats := preparePattern(pat)
+		patpat = append(patpat, pats)
+	}
+	return patpat
+}
+
+// List returns true if str matches one of the patterns. Empty patterns are ignored.
+func List(patterns []Pattern, str string) (matched bool, err error) {
+	matched, _, err = list(patterns, false, str)
+	return matched, err
+}
+
+// ListWithChild returns true if str matches one of the patterns. Empty patterns are ignored.
+func ListWithChild(patterns []Pattern, str string) (matched bool, childMayMatch bool, err error) {
+	return list(patterns, true, str)
+}
+
+// List returns true if str matches one of the patterns. Empty patterns are ignored.
+func list(patterns []Pattern, checkChildMatches bool, str string) (matched bool, childMayMatch bool, err error) {
+	if len(patterns) == 0 {
+		return false, false, nil
+	}
+
+	strs, err := prepareStr(str)
+	if err != nil {
+		return false, false, err
+	}
+	for _, pat := range patterns {
+		m, err := match(pat, strs)
 		if err != nil {
 			return false, false, err
 		}

-		c, err := ChildMatch(pat, str)
-		if err != nil {
-			return false, false, err
+		var c bool
+		if checkChildMatches {
+			c, err = childMatch(pat, strs)
+			if err != nil {
+				return false, false, err
+			}
+		} else {
+			c = true
 		}

 		matched = matched || m
--- a/internal/filter/filter_test.go
+++ b/internal/filter/filter_test.go
@@ -240,25 +240,28 @@ func ExampleMatch_wildcards() {
 }

 var filterListTests = []struct {
-	patterns []string
-	path     string
-	match    bool
+	patterns   []string
+	path       string
+	match      bool
+	childMatch bool
 }{
-	{[]string{"*.go"}, "/foo/bar/test.go", true},
-	{[]string{"*.c"}, "/foo/bar/test.go", false},
-	{[]string{"*.go", "*.c"}, "/foo/bar/test.go", true},
-	{[]string{"*"}, "/foo/bar/test.go", true},
-	{[]string{"x"}, "/foo/bar/test.go", false},
-	{[]string{"?"}, "/foo/bar/test.go", false},
-	{[]string{"?", "x"}, "/foo/bar/x", true},
-	{[]string{"/*/*/bar/test.*"}, "/foo/bar/test.go", false},
-	{[]string{"/*/*/bar/test.*", "*.go"}, "/foo/bar/test.go", true},
-	{[]string{"", "*.c"}, "/foo/bar/test.go", false},
+	{[]string{}, "/foo/bar/test.go", false, false},
+	{[]string{"*.go"}, "/foo/bar/test.go", true, true},
+	{[]string{"*.c"}, "/foo/bar/test.go", false, true},
+	{[]string{"*.go", "*.c"}, "/foo/bar/test.go", true, true},
+	{[]string{"*"}, "/foo/bar/test.go", true, true},
+	{[]string{"x"}, "/foo/bar/test.go", false, true},
+	{[]string{"?"}, "/foo/bar/test.go", false, true},
+	{[]string{"?", "x"}, "/foo/bar/x", true, true},
+	{[]string{"/*/*/bar/test.*"}, "/foo/bar/test.go", false, false},
+	{[]string{"/*/*/bar/test.*", "*.go"}, "/foo/bar/test.go", true, true},
+	{[]string{"", "*.c"}, "/foo/bar/test.go", false, true},
 }

 func TestList(t *testing.T) {
 	for i, test := range filterListTests {
-		match, _, err := filter.List(test.patterns, test.path)
+		patterns := filter.ParsePatterns(test.patterns)
+		match, err := filter.List(patterns, test.path)
 		if err != nil {
 			t.Errorf("test %d failed: expected no error for patterns %q, but error returned: %v",
 				i, test.patterns, err)
@@ -266,19 +269,64 @@ func TestList(t *testing.T) {
 		}

 		if match != test.match {
-			t.Errorf("test %d: filter.MatchList(%q, %q): expected %v, got %v",
+			t.Errorf("test %d: filter.List(%q, %q): expected %v, got %v",
 				i, test.patterns, test.path, test.match, match)
 		}
+
+		match, childMatch, err := filter.ListWithChild(patterns, test.path)
+		if err != nil {
+			t.Errorf("test %d failed: expected no error for patterns %q, but error returned: %v",
+				i, test.patterns, err)
+			continue
+		}
+
+		if match != test.match || childMatch != test.childMatch {
+			t.Errorf("test %d: filter.ListWithChild(%q, %q): expected %v, %v, got %v, %v",
+				i, test.patterns, test.path, test.match, test.childMatch, match, childMatch)
+		}
 	}
 }

 func ExampleList() {
-	match, _, _ := filter.List([]string{"*.c", "*.go"}, "/home/user/file.go")
+	patterns := filter.ParsePatterns([]string{"*.c", "*.go"})
+	match, _ := filter.List(patterns, "/home/user/file.go")
 	fmt.Printf("match: %v\n", match)
 	// Output:
 	// match: true
 }

+func TestInvalidStrs(t *testing.T) {
+	_, err := filter.Match("test", "")
+	if err == nil {
+		t.Error("Match accepted invalid path")
+	}
+
+	_, err = filter.ChildMatch("test", "")
+	if err == nil {
+		t.Error("ChildMatch accepted invalid path")
+	}
+
+	patterns := []string{"test"}
+	_, err = filter.List(filter.ParsePatterns(patterns), "")
+	if err == nil {
+		t.Error("List accepted invalid path")
+	}
+}
+
+func TestInvalidPattern(t *testing.T) {
+	patterns := []string{"test/["}
+	_, err := filter.List(filter.ParsePatterns(patterns), "test/example")
+	if err == nil {
+		t.Error("List accepted invalid pattern")
+	}
+
+	patterns = []string{"test/**/["}
+	_, err = filter.List(filter.ParsePatterns(patterns), "test/example")
+	if err == nil {
+		t.Error("List accepted invalid pattern")
+	}
+}
+
 func extractTestLines(t testing.TB) (lines []string) {
 	f, err := os.Open("testdata/libreoffice.txt.bz2")
 	if err != nil {
@@ -360,30 +408,60 @@ func BenchmarkFilterLines(b *testing.B) {
 }

 func BenchmarkFilterPatterns(b *testing.B) {
-	patterns := []string{
-		"sdk/*",
-		"*.html",
-	}
 	lines := extractTestLines(b)
-	var c uint
-
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		c = 0
-		for _, line := range lines {
-			match, _, err := filter.List(patterns, line)
-			if err != nil {
-				b.Fatal(err)
-			}
-
-			if match {
-				c++
-			}
+	modlines := make([]string, 200)
+	for i, line := range lines {
+		if i >= len(modlines) {
+			break
 		}
+		modlines[i] = line + "-does-not-match"
+	}
+	tests := []struct {
+		name     string
+		patterns []filter.Pattern
+		matches  uint
+	}{
+		{"Relative", filter.ParsePatterns([]string{
+			"does-not-match",
+			"sdk/*",
+			"*.html",
+		}), 22185},
+		{"Absolute", filter.ParsePatterns([]string{
+			"/etc",
+			"/home/*/test",
+			"/usr/share/doc/libreoffice/sdk/docs/java",
+		}), 150},
+		{"Wildcard", filter.ParsePatterns([]string{
+			"/etc/**/example",
+			"/home/**/test",
+			"/usr/**/java",
+		}), 150},
+		{"ManyNoMatch", filter.ParsePatterns(modlines), 0},
+	}

-		if c != 22185 {
-			b.Fatalf("wrong number of matches: expected 22185, got %d", c)
-		}
+	for _, test := range tests {
+		b.Run(test.name, func(b *testing.B) {
+			var c uint
+			b.ReportAllocs()
+			b.ResetTimer()
+
+			for i := 0; i < b.N; i++ {
+				c = 0
+				for _, line := range lines {
+					match, err := filter.List(test.patterns, line)
+					if err != nil {
+						b.Fatal(err)
+					}
+
+					if match {
+						c++
+					}
+				}
+
+				if c != test.matches {
+					b.Fatalf("wrong number of matches: expected %d, got %d", test.matches, c)
+				}
+			}
+		})
 	}
 }
--- a/internal/fs/fs_local_vss.go
+++ b/internal/fs/fs_local_vss.go
@@ -21,7 +21,7 @@ type LocalVss struct {
 	FS
 	snapshots       map[string]VssSnapshot
 	failedSnapshots map[string]struct{}
-	mutex           *sync.RWMutex
+	mutex           sync.RWMutex
 	msgError        ErrorHandler
 	msgMessage      MessageHandler
 }
@@ -36,7 +36,6 @@ func NewLocalVss(msgError ErrorHandler, msgMessage MessageHandler) *LocalVss {
 		FS:              Local{},
 		snapshots:       make(map[string]VssSnapshot),
 		failedSnapshots: make(map[string]struct{}),
-		mutex:           &sync.RWMutex{},
 		msgError:        msgError,
 		msgMessage:      msgMessage,
 	}
--- a/internal/fs/vss.go
+++ b/internal/fs/vss.go
@@ -26,8 +26,8 @@ type VssSnapshot struct {
 }

 // HasSufficientPrivilegesForVSS returns true if the user is allowed to use VSS.
-func HasSufficientPrivilegesForVSS() bool {
-	return false
+func HasSufficientPrivilegesForVSS() error {
+	return errors.New("VSS snapshots are only supported on windows")
 }

 // NewVssSnapshot creates a new vss snapshot. If creating the snapshots doesn't
--- a/internal/fs/vss_windows.go
+++ b/internal/fs/vss_windows.go
@@ -686,10 +686,10 @@ func (p *VssSnapshot) GetSnapshotDeviceObject() string {
 }

 // initializeCOMInterface initialize an instance of the VSS COM api
-func initializeVssCOMInterface() (*ole.IUnknown, uintptr, error) {
+func initializeVssCOMInterface() (*ole.IUnknown, error) {
 	vssInstance, err := loadIVssBackupComponentsConstructor()
 	if err != nil {
-		return nil, 0, err
+		return nil, err
 	}

 	// ensure COM is initialized before use
@@ -697,22 +697,33 @@ func initializeVssCOMInterface() (*ole.IUnknown, uintptr, error) {

 	var oleIUnknown *ole.IUnknown
 	result, _, _ := vssInstance.Call(uintptr(unsafe.Pointer(&oleIUnknown)))
+	hresult := HRESULT(result)

-	return oleIUnknown, result, nil
+	switch hresult {
+	case S_OK:
+	case E_ACCESSDENIED:
+		return oleIUnknown, newVssError(
+			"The caller does not have sufficient backup privileges or is not an administrator",
+			hresult)
+	default:
+		return oleIUnknown, newVssError("Failed to create VSS instance", hresult)
+	}
+
+	if oleIUnknown == nil {
+		return nil, newVssError("Failed to initialize COM interface", hresult)
+	}
+
+	return oleIUnknown, nil
 }

-// HasSufficientPrivilegesForVSS returns true if the user is allowed to use VSS.
-func HasSufficientPrivilegesForVSS() bool {
-	oleIUnknown, result, err := initializeVssCOMInterface()
+// HasSufficientPrivilegesForVSS returns nil if the user is allowed to use VSS.
+func HasSufficientPrivilegesForVSS() error {
+	oleIUnknown, err := initializeVssCOMInterface()
 	if oleIUnknown != nil {
 		oleIUnknown.Release()
 	}

-	if err != nil {
-		return false
-	}
-
-	return !(HRESULT(result) == E_ACCESSDENIED)
+	return err
 }

 // NewVssSnapshot creates a new vss snapshot. If creating the snapshots doesn't
@@ -734,24 +745,12 @@ func NewVssSnapshot(

 	timeoutInMillis := uint32(timeoutInSeconds * 1000)

-	oleIUnknown, result, err := initializeVssCOMInterface()
-	if err != nil {
-		if oleIUnknown != nil {
-			oleIUnknown.Release()
-		}
-		return VssSnapshot{}, err
+	oleIUnknown, err := initializeVssCOMInterface()
+	if oleIUnknown != nil {
+		defer oleIUnknown.Release()
 	}
-	defer oleIUnknown.Release()
-
-	switch HRESULT(result) {
-	case S_OK:
-	case E_ACCESSDENIED:
-		return VssSnapshot{}, newVssTextError(fmt.Sprintf("%s (%#x) The caller does not have "+
-			"sufficient backup privileges or is not an administrator.", HRESULT(result).Str(),
-			result))
-	default:
-		return VssSnapshot{}, newVssTextError(fmt.Sprintf("Failed to create VSS instance: %s (%#x)",
-			HRESULT(result).Str(), result))
+	if err != nil {
+		return VssSnapshot{}, err
 	}

 	comInterface, err := queryInterface(oleIUnknown, UUID_IVSS)
--- a/internal/migrations/s3_layout.go
+++ b/internal/migrations/s3_layout.go
@@ -64,7 +64,7 @@ func (m *S3Layout) moveFiles(ctx context.Context, be *s3.Backend, l backend.Layo
 		debug.Log("move %v", h)

 		return retry(maxErrors, printErr, func() error {
-			return be.Rename(h, l)
+			return be.Rename(ctx, h, l)
 		})
 	})
 }
--- a/internal/repository/master_index.go
+++ b/internal/repository/master_index.go
@@ -52,22 +52,6 @@ func (mi *MasterIndex) LookupSize(id restic.ID, tpe restic.BlobType) (uint, bool
 	return 0, false
 }

-// ListPack returns the list of blobs in a pack. The first matching index is
-// returned, or nil if no index contains information about the pack id.
-func (mi *MasterIndex) ListPack(id restic.ID) (list []restic.PackedBlob) {
-	mi.idxMutex.RLock()
-	defer mi.idxMutex.RUnlock()
-
-	for _, idx := range mi.idx {
-		list := idx.ListPack(id)
-		if len(list) > 0 {
-			return list
-		}
-	}
-
-	return nil
-}
-
 // AddPending adds a given blob to list of pending Blobs
 // Before doing so it checks if this blob is already known.
 // Returns true if adding was successful and false if the blob
--- a/internal/repository/testing.go
+++ b/internal/repository/testing.go
@@ -76,7 +76,7 @@ func TestRepository(t testing.TB) (r restic.Repository, cleanup func()) {
 	if dir != "" {
 		_, err := os.Stat(dir)
 		if err != nil {
-			be, err := local.Create(local.Config{Path: dir})
+			be, err := local.Create(context.TODO(), local.Config{Path: dir})
 			if err != nil {
 				t.Fatalf("error creating local backend at %v: %v", dir, err)
 			}
@@ -93,7 +93,7 @@ func TestRepository(t testing.TB) (r restic.Repository, cleanup func()) {

 // TestOpenLocal opens a local repository.
 func TestOpenLocal(t testing.TB, dir string) (r restic.Repository) {
-	be, err := local.Open(local.Config{Path: dir})
+	be, err := local.Open(context.TODO(), local.Config{Path: dir})
 	if err != nil {
 		t.Fatal(err)
 	}
--- a/internal/restic/progress.go
+++ b/internal/restic/progress.go
@@ -40,7 +40,7 @@ type Progress struct {
 	start      time.Time
 	c          *time.Ticker
 	cancel     chan struct{}
-	o          *sync.Once
+	once       sync.Once
 	d          time.Duration
 	lastUpdate time.Time

@@ -79,7 +79,6 @@ func (p *Progress) Start() {
 		return
 	}

-	p.o = &sync.Once{}
 	p.cancel = make(chan struct{})
 	p.running = true
 	p.Reset()
@@ -187,7 +186,7 @@ func (p *Progress) Done() {
 	}

 	p.running = false
-	p.o.Do(func() {
+	p.once.Do(func() {
 		close(p.cancel)
 	})

--- a/internal/ui/stdio_wrapper.go
+++ b/internal/ui/stdio_wrapper.go
@@ -55,32 +55,18 @@ func (w *lineWriter) Write(data []byte) (n int, err error) {

 	// look for line breaks
 	buf := w.buf.Bytes()
-	skip := 0
-	for i := 0; i < len(buf); {
-		if buf[i] == '\n' {
-			// found line
-			w.print(string(buf[:i+1]))
-			buf = buf[i+1:]
-			skip += i + 1
-			i = 0
-			continue
-		}
-
-		i++
+	i := bytes.LastIndexByte(buf, '\n')
+	if i != -1 {
+		w.print(string(buf[:i+1]))
+		w.buf.Next(i + 1)
 	}

-	_ = w.buf.Next(skip)
-
 	return n, err
 }

-func (w *lineWriter) Flush() error {
+func (w *lineWriter) Close() error {
 	if w.buf.Len() > 0 {
 		w.print(string(append(w.buf.Bytes(), '\n')))
 	}
 	return nil
 }
-
-func (w *lineWriter) Close() error {
-	return w.Flush()
-}
--- a/internal/ui/stdio_wrapper_test.go
+++ b/internal/ui/stdio_wrapper_test.go
@@ -1,6 +1,7 @@
 package ui

 import (
+	"strings"
 	"testing"

 	"github.com/google/go-cmp/cmp"
@@ -8,16 +9,14 @@ import (

 func TestStdioWrapper(t *testing.T) {
 	var tests = []struct {
-		inputs  [][]byte
-		outputs []string
+		inputs [][]byte
+		output string
 	}{
 		{
 			inputs: [][]byte{
 				[]byte("foo"),
 			},
-			outputs: []string{
-				"foo\n",
-			},
+			output: "foo\n",
 		},
 		{
 			inputs: [][]byte{
@@ -26,10 +25,8 @@ func TestStdioWrapper(t *testing.T) {
 				[]byte("\n"),
 				[]byte("baz"),
 			},
-			outputs: []string{
-				"foobar\n",
+			output: "foobar\n" +
 				"baz\n",
-			},
 		},
 		{
 			inputs: [][]byte{
@@ -37,11 +34,9 @@ func TestStdioWrapper(t *testing.T) {
 				[]byte("bar\nbaz\n"),
 				[]byte("bump\n"),
 			},
-			outputs: []string{
-				"foobar\n",
-				"baz\n",
+			output: "foobar\n" +
+				"baz\n" +
 				"bump\n",
-			},
 		},
 		{
 			inputs: [][]byte{
@@ -53,23 +48,17 @@ func TestStdioWrapper(t *testing.T) {
 				[]byte("x"),
 				[]byte("z"),
 			},
-			outputs: []string{
-				"foobar\n",
-				"baz\n",
-				"bump\n",
+			output: "foobar\n" +
+				"baz\n" +
+				"bump\n" +
 				"xxxz\n",
-			},
 		},
 	}

 	for _, test := range tests {
 		t.Run("", func(t *testing.T) {
-			var lines []string
-			print := func(s string) {
-				lines = append(lines, s)
-			}
-
-			w := newLineWriter(print)
+			var output strings.Builder
+			w := newLineWriter(func(s string) { output.WriteString(s) })

 			for _, data := range test.inputs {
 				n, err := w.Write(data)
@@ -87,8 +76,8 @@ func TestStdioWrapper(t *testing.T) {
 				t.Fatal(err)
 			}

-			if !cmp.Equal(test.outputs, lines) {
-				t.Error(cmp.Diff(test.outputs, lines))
+			if outstr := output.String(); outstr != test.output {
+				t.Error(cmp.Diff(test.output, outstr))
 			}
 		})
 	}
--- a/internal/ui/termstatus/status.go
+++ b/internal/ui/termstatus/status.go
@@ -10,6 +10,7 @@ import (
 	"strings"

 	"golang.org/x/crypto/ssh/terminal"
+	"golang.org/x/text/width"
 )

 // Terminal is used to write messages and display status lines which can be
@@ -234,19 +235,23 @@ func (t *Terminal) undoStatus(lines int) {
 	}
 }

-// Print writes a line to the terminal.
-func (t *Terminal) Print(line string) {
+func (t *Terminal) print(line string, isErr bool) {
 	// make sure the line ends with a line break
 	if line[len(line)-1] != '\n' {
 		line += "\n"
 	}

 	select {
-	case t.msg <- message{line: line}:
+	case t.msg <- message{line: line, err: isErr}:
 	case <-t.closed:
 	}
 }

+// Print writes a line to the terminal.
+func (t *Terminal) Print(line string) {
+	t.print(line, false)
+}
+
 // Printf uses fmt.Sprintf to write a line to the terminal.
 func (t *Terminal) Printf(msg string, args ...interface{}) {
 	s := fmt.Sprintf(msg, args...)
@@ -255,15 +260,7 @@ func (t *Terminal) Printf(msg string, args ...interface{}) {

 // Error writes an error to the terminal.
 func (t *Terminal) Error(line string) {
-	// make sure the line ends with a line break
-	if line[len(line)-1] != '\n' {
-		line += "\n"
-	}
-
-	select {
-	case t.msg <- message{line: line, err: true}:
-	case <-t.closed:
-	}
+	t.print(line, true)
 }

 // Errorf uses fmt.Sprintf to write an error line to the terminal.
@@ -272,18 +269,33 @@ func (t *Terminal) Errorf(msg string, args ...interface{}) {
 	t.Error(s)
 }

-// truncate returns a string that has at most maxlen characters. If maxlen is
-// negative, the empty string is returned.
-func truncate(s string, maxlen int) string {
-	if maxlen < 0 {
-		return ""
-	}
-
-	if len(s) < maxlen {
+// Truncate s to fit in width (number of terminal cells) w.
+// If w is negative, returns the empty string.
+func truncate(s string, w int) string {
+	if len(s) < w {
+		// Since the display width of a character is at most 2
+		// and all of ASCII (single byte per rune) has width 1,
+		// no character takes more bytes to encode than its width.
 		return s
 	}

-	return s[:maxlen]
+	for i, r := range s {
+		// Determine width of the rune. This cannot be determined without
+		// knowing the terminal font, so let's just be careful and treat
+		// all ambigous characters as full-width, i.e., two cells.
+		wr := 2
+		switch width.LookupRune(r).Kind() {
+		case width.Neutral, width.EastAsianNarrow:
+			wr = 1
+		}
+
+		w -= wr
+		if w < 0 {
+			return s[:i]
+		}
+	}
+
+	return s
 }

 // SetStatus updates the status lines.
--- a/internal/ui/termstatus/status_test.go
+++ b/internal/ui/termstatus/status_test.go
@@ -5,7 +5,7 @@ import "testing"
 func TestTruncate(t *testing.T) {
 	var tests = []struct {
 		input  string
-		maxlen int
+		width  int
 		output string
 	}{
 		{"", 80, ""},
@@ -18,14 +18,17 @@ func TestTruncate(t *testing.T) {
 		{"foo", 1, "f"},
 		{"foo", 0, ""},
 		{"foo", -1, ""},
+		{"Löwen", 4, "Löwe"},
+		{"あああああああああ/data", 10, "あああああ"},
+		{"あああああああああ/data", 11, "あああああ"},
 	}

 	for _, test := range tests {
 		t.Run("", func(t *testing.T) {
-			out := truncate(test.input, test.maxlen)
+			out := truncate(test.input, test.width)
 			if out != test.output {
-				t.Fatalf("wrong output for input %v, maxlen %d: want %q, got %q",
-					test.input, test.maxlen, test.output, out)
+				t.Fatalf("wrong output for input %v, width %d: want %q, got %q",
+					test.input, test.width, test.output, out)
 			}
 		})
 	}
Author	SHA1	Message	Date
Alexander Neumann	271eabd239	Add crypto debug benchmark	2020-12-23 10:46:53 +01:00
Alexander Neumann	0333ef3325	Add code to debug wrong hash issue	2020-12-20 14:51:15 +01:00
Alexander Neumann	b7e1ece1e0	Add version for 0.11.0	2020-11-05 09:41:35 +01:00
Alexander Neumann	c5300a2c56	Update manpages and auto-completion	2020-11-05 09:41:35 +01:00
Alexander Neumann	1bd92896d7	Generate CHANGELOG.md for 0.11.0	2020-11-05 09:41:22 +01:00
Alexander Neumann	9dba01021e	Prepare changelog for 0.11.0	2020-11-05 09:41:22 +01:00
Alexander Neumann	23f6b8c3fd	Add .vscode to gitignore	2020-11-05 09:40:56 +01:00
Alexander Neumann	79a50e3b1f	helpers: Create changelog subdir for release	2020-11-05 09:39:06 +01:00
Alexander Neumann	b8a5ca2d10	Add gitignore to changelog/unreleased	2020-11-05 09:01:32 +01:00
fgma	916b2d303b	vss: fix potential crash (not reachable in restic) (#3045 ) HasSufficientPrivilegesForVSS() now returns an error	2020-11-04 22:14:18 +01:00
Alexander Neumann	a06f5c28c0	Merge pull request #3055 from greatroar/cleanup Don't separately allocate sync.{Mutex,Once} if not necessary	2020-11-04 11:11:21 +01:00
greatroar	c2f3eee5af	Don't separately allocate sync.{Mutex,Once} if not necessary Separate allocation of synchronization devices suggests they're shared between objects, but they're not.	2020-11-04 09:55:43 +01:00
rawtaz	62345abe4a	Merge pull request #3053 from maikell/patch-1 Update README.md	2020-11-03 19:06:59 +01:00
Maikel van Leeuwen	e024fc6d4d	Update README.md Typo in link. Links to https://forum.restic.net%3E/ should be https://forum.restic.net	2020-11-03 18:51:11 +01:00
Alexander Neumann	0db9024aad	Merge pull request #3052 from restic/error-on-invalid-size Return an error for invalid sizes	2020-11-03 12:13:49 +01:00
Alexander Neumann	21ba15577e	Return an error for invalid sizes	2020-11-03 11:53:49 +01:00
Alexander Neumann	2fb1957ca4	Rewrite README as Markdown	2020-11-03 09:20:09 +01:00
Alexander Neumann	9a88fb253b	Merge pull request #3051 from greatroar/sanitize-env Sanitize environment before starting backend processes (rclone, ssh)	2020-11-02 21:18:57 +01:00
Alexander Neumann	f14436953a	Merge pull request #3050 from greatroar/widechars Fix string truncation in ui/termstatus	2020-11-02 16:58:51 +01:00
greatroar	11fbaaae9a	Sanitize environment before starting backend processes (rclone, ssh) The restic security model includes full trust of the local machine, so this should not fix any actual security problems, but it's better to be safe than sorry. Fixes #2192.	2020-11-02 16:41:23 +01:00
greatroar	3ed84ff0c6	Fix string truncation in ui/termstatus Fixes #3046.	2020-11-02 12:50:49 +01:00
Alexander Neumann	8e965ed4eb	Merge pull request #3039 from MichaelEischer/tar-proper-dirs Properly dump directories to tar	2020-11-02 12:30:26 +01:00
Alexander Neumann	5f0fa2129e	Improve readability It's time to use a switch statement.	2020-11-02 11:24:26 +01:00
Alexander Neumann	04dfa19c7e	Improve changelog	2020-11-02 11:23:09 +01:00
Alexander Neumann	6509c207f4	Merge pull request #2997 from MichaelEischer/faster-excludes Speedup exclude/include checking	2020-11-02 11:07:21 +01:00
Alexander Neumann	445b845267	Merge pull request #2978 from MichaelEischer/warn-tree-error Warn if backup failed to read tree blob	2020-11-02 10:14:12 +01:00
Alexander Neumann	3ff37215df	Merge pull request #2935 from MichaelEischer/upgrade-minio Upgrade minio SDK to version 7	2020-11-02 09:09:10 +01:00
MichaelEischer	5d379b5359	Merge pull request #3042 from rubiojr/remove-unused-function Remove unused function	2020-11-01 21:55:22 +01:00
Sergio Rubio	e708628cfd	Remove unused function Not currently used, and it'd need to be added to the MasterIndex interface first.	2020-10-28 13:24:49 +01:00
MichaelEischer	bb4b3481a6	Merge pull request #3031 from greatroar/debug-no-seek Allow debug logging to pipes and terminals	2020-10-25 17:59:06 +01:00
MichaelEischer	ad3a52e6f0	Merge pull request #3026 from greatroar/refactor-ui internal/ui refactoring	2020-10-25 17:51:39 +01:00
Michael Eischer	1aa61e6def	Add changelog	2020-10-24 22:49:29 +02:00
Michael Eischer	8d7d6ad2d5	dump: include username in tar	2020-10-24 22:42:01 +02:00
Michael Eischer	fe09e6f865	dump: test proper permissions and directory name	2020-10-24 22:42:01 +02:00
Michael Eischer	1e3c9a2c11	dump: Fix file permission to tar mapping The file permissions included a go specific directory bit which accidentially forced the usage of the GNU header format. This leads to problems with 7zip on Windows or when extended attributes are used.	2020-10-24 22:42:01 +02:00
Michael Eischer	e21dcb0eea	dump: Additional ACL tests	2020-10-24 22:41:01 +02:00
greatroar	63be3704d9	Allow debug logging to pipes and terminals	2020-10-19 22:30:30 +02:00
greatroar	35419de232	Simplify ui.StdioWrapper.Write Instead of looping to find line breaks, make it look for the last one.	2020-10-17 20:30:46 +02:00
greatroar	863a590a81	Refactor termstatus.Term.{Print,Error} methods	2020-10-17 20:30:46 +02:00
greatroar	7c0b6a82db	Remove unused public method ui.linesWriter.Flush	2020-10-17 20:30:24 +02:00
Michael Eischer	45e9a55c62	Wire context into backend layout detection	2020-10-09 22:37:24 +02:00
Michael Eischer	307a6ba3a3	Upgrade minio sdk to v7 This changes are primarily straightforward modifications to pass the parameters in the now expected way.	2020-10-09 22:37:24 +02:00
Michael Eischer	50da20d93d	Warn if backup failed to read tree blob	2020-10-09 22:36:27 +02:00
Michael Eischer	88c8e903d2	filter: Fix glob matching on absolute path marker on windows A pattern part containing "/" is used to mark a path or a pattern as absolute. However, on Windows the path separator is "\" such that glob patterns like "?" could match the marker. The code now explicitly skips the marker when the pattern does not represent an absolute path.	2020-10-09 16:11:05 +02:00
greatroar	740758a5fa	Optimize filter pattern matching By replacing "**" with "", checking for this special path component can be reduced to a length-zero check. name old time/op new time/op delta FilterLines-8 44.7ms ± 5% 44.9ms ± 5% ~ (p=0.631 n=10+10) FilterPatterns/Relative-8 13.6ms ± 4% 13.4ms ± 5% ~ (p=0.165 n=10+10) FilterPatterns/Absolute-8 10.9ms ± 5% 10.7ms ± 4% ~ (p=0.052 n=10+10) FilterPatterns/Wildcard-8 53.7ms ± 5% 50.4ms ± 5% -6.00% (p=0.000 n=10+10) FilterPatterns/ManyNoMatch-8 128ms ± 2% 95ms ± 1% -25.54% (p=0.000 n=10+10) name old alloc/op new alloc/op delta FilterPatterns/Relative-8 3.57MB ± 0% 3.57MB ± 0% ~ (p=1.000 n=9+8) FilterPatterns/Absolute-8 3.57MB ± 0% 3.57MB ± 0% ~ (p=0.903 n=9+8) FilterPatterns/Wildcard-8 19.7MB ± 0% 19.7MB ± 0% -0.00% (p=0.022 n=10+9) FilterPatterns/ManyNoMatch-8 3.57MB ± 0% 3.57MB ± 0% ~ (all equal) name old allocs/op new allocs/op delta FilterPatterns/Relative-8 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Absolute-8 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Wildcard-8 88.7k ± 0% 88.7k ± 0% ~ (all equal) FilterPatterns/ManyNoMatch-8 22.2k ± 0% 22.2k ± 0% ~ (all equal)	2020-10-09 15:51:14 +02:00
Michael Eischer	8388e67c4b	filter: cleanup path separator conversion	2020-10-07 21:14:07 +02:00
Michael Eischer	0acc3c5923	filter: special case patterns without globbing characters In case a part of a path is a simple string, we can just check for equality without complex parsing in filepath.Match. name old time/op new time/op delta FilterLines-4 34.8ms ±17% 41.2ms ±23% +18.36% (p=0.000 n=10+10) FilterPatterns/Relative-4 21.7ms ± 6% 12.1ms ±23% -44.46% (p=0.000 n=10+10) FilterPatterns/Absolute-4 10.0ms ± 5% 9.1ms ±11% -9.80% (p=0.006 n=10+9) FilterPatterns/Wildcard-4 47.0ms ± 7% 42.2ms ± 5% -10.19% (p=0.000 n=9+10) FilterPatterns/ManyNoMatch-4 190ms ± 1% 131ms ±20% -31.47% (p=0.000 n=8+10) name old alloc/op new alloc/op delta FilterPatterns/Relative-4 3.57MB ± 0% 3.57MB ± 0% ~ (p=0.870 n=9+9) FilterPatterns/Absolute-4 3.57MB ± 0% 3.57MB ± 0% ~ (p=0.145 n=10+10) FilterPatterns/Wildcard-4 14.3MB ± 0% 19.7MB ± 0% +37.91% (p=0.000 n=10+10) FilterPatterns/ManyNoMatch-4 3.57MB ± 0% 3.57MB ± 0% ~ (p=0.421 n=10+9) name old allocs/op new allocs/op delta FilterPatterns/Relative-4 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Absolute-4 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Wildcard-4 88.7k ± 0% 88.7k ± 0% ~ (all equal) FilterPatterns/ManyNoMatch-4 22.2k ± 0% 22.2k ± 0% ~ (all equal)	2020-10-07 20:55:43 +02:00
Michael Eischer	54a124de3b	filter: explicitly test separate ListWithChild function	2020-10-07 20:47:52 +02:00
Michael Eischer	bcc3bddcf4	filter: only check whether a child path could match when necessary When checking excludes there is no need to test whether a child path could also match the pattern, as it is by definition excluded. Previously childMayMatch was calculated but then discarded. For simple absolute paths this can account for half the time spent for checking pattern matches. name old time/op new time/op delta FilterPatterns/Relative-4 23.3ms ± 9% 21.7ms ± 6% -6.68% (p=0.004 n=10+10) FilterPatterns/Absolute-4 13.9ms ± 7% 10.0ms ± 5% -27.61% (p=0.000 n=10+10) FilterPatterns/Wildcard-4 51.4ms ± 7% 47.0ms ± 7% -8.51% (p=0.001 n=9+9) FilterPatterns/ManyNoMatch-4 551ms ± 9% 190ms ± 1% -65.41% (p=0.000 n=10+8) name old alloc/op new alloc/op delta FilterPatterns/Relative-4 3.57MB ± 0% 3.57MB ± 0% ~ (p=0.665 n=10+9) FilterPatterns/Absolute-4 3.57MB ± 0% 3.57MB ± 0% ~ (p=0.480 n=9+10) FilterPatterns/Wildcard-4 14.3MB ± 0% 14.3MB ± 0% ~ (p=0.431 n=9+10) FilterPatterns/ManyNoMatch-4 3.57MB ± 0% 3.57MB ± 0% ~ (all equal) name old allocs/op new allocs/op delta FilterPatterns/Relative-4 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Absolute-4 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Wildcard-4 88.7k ± 0% 88.7k ± 0% ~ (all equal) FilterPatterns/ManyNoMatch-4 22.2k ± 0% 22.2k ± 0% ~ (all equal)	2020-10-07 20:47:52 +02:00
Michael Eischer	17c53efb0d	filter: Optimize double wildcard expansion This only allocates a single slice to expand the double wildcard and only copies the pattern prefix once. name old time/op new time/op delta FilterPatterns/Relative-4 22.7ms ± 5% 23.3ms ± 9% ~ (p=0.353 n=10+10) FilterPatterns/Absolute-4 14.2ms ±13% 13.9ms ± 7% ~ (p=0.853 n=10+10) FilterPatterns/Wildcard-4 266ms ±16% 51ms ± 7% -80.67% (p=0.000 n=10+9) FilterPatterns/ManyNoMatch-4 554ms ± 6% 551ms ± 9% ~ (p=0.436 n=10+10) name old alloc/op new alloc/op delta FilterPatterns/Relative-4 3.57MB ± 0% 3.57MB ± 0% ~ (p=0.349 n=10+10) FilterPatterns/Absolute-4 3.57MB ± 0% 3.57MB ± 0% ~ (p=0.073 n=10+9) FilterPatterns/Wildcard-4 141MB ± 0% 14MB ± 0% -89.89% (p=0.000 n=10+9) FilterPatterns/ManyNoMatch-4 3.57MB ± 0% 3.57MB ± 0% ~ (all equal) name old allocs/op new allocs/op delta FilterPatterns/Relative-4 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Absolute-4 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Wildcard-4 1.63M ± 0% 0.09M ± 0% -94.56% (p=0.000 n=10+10) FilterPatterns/ManyNoMatch-4 22.2k ± 0% 22.2k ± 0% ~ (all equal)	2020-10-07 20:47:48 +02:00
Michael Eischer	7959796269	filter: Special case for absolute paths name old time/op new time/op delta FilterPatterns/Relative-4 23.6ms ±20% 22.7ms ± 5% ~ (p=0.684 n=10+10) FilterPatterns/Absolute-4 32.3ms ± 8% 14.2ms ±13% -56.01% (p=0.000 n=10+10) FilterPatterns/Wildcard-4 334ms ±17% 266ms ±16% -20.56% (p=0.000 n=10+10) FilterPatterns/ManyNoMatch-4 709ms ± 7% 554ms ± 6% -21.89% (p=0.000 n=10+10) name old alloc/op new alloc/op delta FilterPatterns/Relative-4 3.57MB ± 0% 3.57MB ± 0% +0.00% (p=0.046 n=9+10) FilterPatterns/Absolute-4 3.57MB ± 0% 3.57MB ± 0% ~ (p=0.464 n=10+10) FilterPatterns/Wildcard-4 141MB ± 0% 141MB ± 0% ~ (p=0.163 n=9+10) FilterPatterns/ManyNoMatch-4 3.57MB ± 0% 3.57MB ± 0% ~ (all equal) name old allocs/op new allocs/op delta FilterPatterns/Relative-4 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Absolute-4 22.2k ± 0% 22.2k ± 0% ~ (all equal) FilterPatterns/Wildcard-4 1.63M ± 0% 1.63M ± 0% ~ (p=0.072 n=10+10) FilterPatterns/ManyNoMatch-4 22.2k ± 0% 22.2k ± 0% ~ (all equal)	2020-10-07 20:47:29 +02:00
Michael Eischer	375c2a56de	filter: Parse filter patterns only once name old time/op new time/op delta FilterPatterns/Relative-4 30.3ms ±10% 23.6ms ±20% -22.12% (p=0.000 n=10+10) FilterPatterns/Absolute-4 49.0ms ± 3% 32.3ms ± 8% -33.94% (p=0.000 n=8+10) FilterPatterns/Wildcard-4 345ms ± 9% 334ms ±17% ~ (p=0.315 n=10+10) FilterPatterns/ManyNoMatch-4 3.93s ± 2% 0.71s ± 7% -81.98% (p=0.000 n=9+10) name old alloc/op new alloc/op delta FilterPatterns/Relative-4 4.63MB ± 0% 3.57MB ± 0% -22.98% (p=0.000 n=9+9) FilterPatterns/Absolute-4 8.54MB ± 0% 3.57MB ± 0% -58.20% (p=0.000 n=10+10) FilterPatterns/Wildcard-4 146MB ± 0% 141MB ± 0% -2.93% (p=0.000 n=9+9) FilterPatterns/ManyNoMatch-4 907MB ± 0% 4MB ± 0% -99.61% (p=0.000 n=9+9) name old allocs/op new allocs/op delta FilterPatterns/Relative-4 66.6k ± 0% 22.2k ± 0% -66.67% (p=0.000 n=10+10) FilterPatterns/Absolute-4 88.7k ± 0% 22.2k ± 0% -75.00% (p=0.000 n=10+10) FilterPatterns/Wildcard-4 1.70M ± 0% 1.63M ± 0% -3.92% (p=0.000 n=10+10) FilterPatterns/ManyNoMatch-4 4.46M ± 0% 0.02M ± 0% -99.50% (p=0.000 n=10+10)	2020-10-07 20:47:27 +02:00
Michael Eischer	b8eacd1364	filter: Reduce redundant path and pattern splitting A single call to filter.List will split the path only once and also split each search pattern only once and use it for both match and childMatch. name old time/op new time/op delta FilterPatterns/Relative-4 62.1ms ±15% 30.3ms ±10% -51.22% (p=0.000 n=9+10) FilterPatterns/Absolute-4 111ms ±10% 49ms ± 3% -56.08% (p=0.000 n=10+8) FilterPatterns/Wildcard-4 393ms ±15% 345ms ± 9% -12.30% (p=0.000 n=10+10) FilterPatterns/ManyNoMatch-4 10.0s ± 3% 3.9s ± 2% -60.53% (p=0.000 n=10+9) name old alloc/op new alloc/op delta FilterPatterns/Relative-4 16.4MB ± 0% 4.6MB ± 0% -71.76% (p=0.000 n=10+9) FilterPatterns/Absolute-4 31.4MB ± 0% 8.5MB ± 0% -72.77% (p=0.000 n=9+10) FilterPatterns/Wildcard-4 168MB ± 0% 146MB ± 0% -13.19% (p=0.000 n=10+9) FilterPatterns/ManyNoMatch-4 3.23GB ± 0% 0.91GB ± 0% -71.96% (p=0.000 n=10+9) name old allocs/op new allocs/op delta FilterPatterns/Relative-4 178k ± 0% 67k ± 0% -62.50% (p=0.000 n=10+10) FilterPatterns/Absolute-4 266k ± 0% 89k ± 0% -66.67% (p=0.000 n=10+10) FilterPatterns/Wildcard-4 1.87M ± 0% 1.70M ± 0% -9.47% (p=0.000 n=10+10) FilterPatterns/ManyNoMatch-4 17.7M ± 0% 4.5M ± 0% -74.87% (p=0.000 n=9+10)	2020-10-07 18:13:19 +02:00
Michael Eischer	e73c281142	filter: Benchmark absolute paths, wildcards and long filter lists	2020-10-07 17:54:36 +02:00
Michael Eischer	fdd3b14db3	filter: test some corner cases	2020-10-07 17:09:44 +02:00
@@ -1 +1 @@
 .10.0
 .11.0