Add version for 0.13.1

Generate CHANGELOG.md for 0.13.1
Prepare changelog for 0.13.1
2026-02-22 16:56:24 +00:00 · 2022-04-10 10:58:55 +02:00 · 2022-04-10 10:58:22 +02:00 · 2022-04-10 10:58:22 +02:00 · 2022-04-10 10:56:55 +02:00 · 2022-04-10 10:56:37 +02:00
480 changed files with 11242 additions and 18178 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +0,0 @@
-# Workaround for https://github.com/golang/go/issues/52268.
-**/testdata/fuzz/*/* eol=lf
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,13 +0,0 @@
-version: 2
-updates:
-  # Dependencies listed in go.mod
-  - package-ecosystem: "gomod"
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "weekly"
-
-  # Dependencies listed in .github/workflows/*.yml
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -9,7 +9,7 @@ on:
  pull_request:

 env:
-  latest_go: "1.19.x"
+  latest_go: "1.18.x"
  GO111MODULE: on

 jobs:
@@ -19,31 +19,47 @@ jobs:
        # list of jobs to run:
        include:
          - job_name: Windows
-            go: 1.19.x
+            go: 1.18.x
            os: windows-latest
+            install_verb: install

          - job_name: macOS
-            go: 1.19.x
+            go: 1.18.x
            os: macOS-latest
            test_fuse: false
-
-          - job_name: Linux
-            go: 1.19.x
-            os: ubuntu-latest
-            test_cloud_backends: true
-            test_fuse: true
-            check_changelog: true
-
-          - job_name: Linux (race)
-            go: 1.19.x
-            os: ubuntu-latest
-            test_fuse: true
-            test_opts: "-race"
+            install_verb: install

          - job_name: Linux
            go: 1.18.x
            os: ubuntu-latest
+            test_cloud_backends: true
            test_fuse: true
+            check_changelog: true
+            install_verb: install
+
+          - job_name: Linux
+            go: 1.17.x
+            os: ubuntu-latest
+            test_fuse: true
+            install_verb: install
+
+          - job_name: Linux
+            go: 1.16.x
+            os: ubuntu-latest
+            test_fuse: true
+            install_verb: get
+
+          - job_name: Linux
+            go: 1.15.x
+            os: ubuntu-latest
+            test_fuse: true
+            install_verb: get
+
+          - job_name: Linux
+            go: 1.14.x
+            os: ubuntu-latest
+            test_fuse: true
+            install_verb: get

    name: ${{ matrix.job_name }} Go ${{ matrix.go }}
    runs-on: ${{ matrix.os }}
@@ -53,14 +69,14 @@ jobs:

    steps:
      - name: Set up Go ${{ matrix.go }}
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v2
        with:
          go-version: ${{ matrix.go }}

      - name: Get programs (Linux/macOS)
        run: |
          echo "build Go tools"
-          go install github.com/restic/rest-server/cmd/rest-server@latest
+          go ${{ matrix.install_verb }} github.com/restic/rest-server/cmd/rest-server@latest

          echo "install minio server"
          mkdir $HOME/bin
@@ -82,7 +98,7 @@ jobs:
          chmod 755 $HOME/bin/rclone
          rm -rf rclone*

-          # add $HOME/bin to path ($GOBIN was already added to the path by setup-go@v3)
+          # add $HOME/bin to path ($GOBIN was already added to the path by setup-go@v2)
          echo $HOME/bin >> $GITHUB_PATH
        if: matrix.os == 'ubuntu-latest' || matrix.os == 'macOS-latest'

@@ -92,7 +108,7 @@ jobs:
          $ProgressPreference = 'SilentlyContinue'

          echo "build Go tools"
-          go install github.com/restic/rest-server/...
+          go ${{ matrix.install_verb }} github.com/restic/rest-server/...

          echo "install minio server"
          mkdir $Env:USERPROFILE/bin
@@ -104,7 +120,7 @@ jobs:
          unzip rclone.zip
          copy rclone*/rclone.exe $Env:USERPROFILE/bin

-          # add $USERPROFILE/bin to path ($GOBIN was already added to the path by setup-go@v3)
+          # add $USERPROFILE/bin to path ($GOBIN was already added to the path by setup-go@v2)
          echo $Env:USERPROFILE\bin >> $Env:GITHUB_PATH

          echo "install tar"
@@ -126,7 +142,7 @@ jobs:
        if: matrix.os == 'windows-latest'

      - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2

      - name: Build with build.go
        run: |
@@ -136,7 +152,7 @@ jobs:
        env:
          RESTIC_TEST_FUSE: ${{ matrix.test_fuse }}
        run: |
-          go test -cover ${{matrix.test_opts}} ./...
+          go test -cover ./...

      - name: Test cloud backends
        env:
@@ -177,9 +193,7 @@ jobs:

        # only run cloud backend tests for pull requests from and pushes to our
        # own repo, otherwise the secrets are not available
-        # Skip for Dependabot pull requests as these are run without secrets
-        # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#responding-to-events
-        if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && (github.actor != 'dependabot[bot]') && matrix.test_cloud_backends
+        if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && matrix.test_cloud_backends

      - name: Check changelog files with calens
        run: |
@@ -195,16 +209,15 @@ jobs:

      # ATTENTION: the list of architectures must be in sync with helpers/build-release-binaries/main.go!
      matrix:
-        # run cross-compile in three batches parallel so the overall tests run faster
+        # run cross-compile in two batches parallel so the overall tests run faster
        targets:
-          - "linux/386 linux/amd64 linux/arm linux/arm64 linux/ppc64le linux/mips linux/mipsle linux/mips64 linux/mips64le linux/s390x"
+          - "linux/386 linux/amd64 linux/arm linux/arm64 linux/ppc64le linux/mips linux/mipsle linux/mips64 linux/mips64le linux/s390x \
+            openbsd/386 openbsd/amd64"

-          - "openbsd/386 openbsd/amd64 \
-            freebsd/386 freebsd/amd64 freebsd/arm \
+          - "freebsd/386 freebsd/amd64 freebsd/arm \
            aix/ppc64 \
-            darwin/amd64 darwin/arm64"
-
-          - "netbsd/386 netbsd/amd64 \
+            darwin/amd64 darwin/arm64 \
+            netbsd/386 netbsd/amd64 \
            windows/386 windows/amd64 \
            solaris/amd64"

@@ -217,7 +230,7 @@ jobs:

    steps:
      - name: Set up Go ${{ env.latest_go }}
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v2
        with:
          go-version: ${{ env.latest_go }}

@@ -226,7 +239,7 @@ jobs:
          go install github.com/mitchellh/gox@latest

      - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2

      - name: Cross-compile with gox for ${{ matrix.targets }}
        env:
@@ -242,21 +255,22 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Set up Go ${{ env.latest_go }}
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v2
        with:
          go-version: ${{ env.latest_go }}

      - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2

      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v2
        with:
          # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
-          version: v1.49
+          version: v1.45
          # Optional: show only new issues if it's a pull request. The default value is `false`.
          only-new-issues: true
          args: --verbose --timeout 5m
+          skip-go-installation: true

        # only run golangci-lint for pull requests, otherwise ALL hints get
        # reported. We need to slowly address all issues until we can enable
@@ -274,11 +288,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2

      - name: Docker meta
        id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v3
        with:
          # list of Docker images to use as base name for tags
          images: |
@@ -294,14 +308,14 @@ jobs:
            type=sha

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v1

      - name: Build and push
        id: docker_build
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v2
        with:
          push: false
          context: .
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -24,7 +24,7 @@ linters:
    - govet

    # make sure names and comments are used according to the conventions
-    - revive
+    - golint

    # detect when assignments to existing variables are not used
    - ineffassign
@@ -51,9 +51,7 @@ issues:

  # list of things to not warn about
  exclude:
-    # revive: do not warn about missing comments for exported stuff
-    - exported (function|method|var|type|const) .* should have comment or be unexported
-    # revive: ignore constants in all caps
+    # golint: do not warn about missing comments for exported stuff
+    - exported (function|method|var|type|const) `.*` should have comment or be unexported
+    # golint: ignore constants in all caps
    - don't use ALL_CAPS in Go names; use CamelCase
-    # revive: lots of packages don't have such a comment
-    - "package-comments: should have a package comment"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -48,8 +48,9 @@ environment was used and so on. Please tell us at least the following things:
 Remember, the easier it is for us to reproduce the bug, the earlier it will be
 corrected!

-In addition, you can instruct restic to create a debug log by setting the
-environment variable `DEBUG_LOG` to a file, e.g. like this:
+In addition, you can compile restic with debug support by running
+`go run build.go -tags debug` and instructing it to create a debug
+log by setting the environment variable `DEBUG_LOG` to a file, e.g. like this:

    $ export DEBUG_LOG=/tmp/restic-debug.log
    $ restic backup ~/work
@@ -65,8 +66,8 @@ Development Environment
 The repository contains the code written for restic in the directories
 `cmd/` and `internal/`.

-Make sure you have the minimum required Go version installed. Clone the repo
-(without having `$GOPATH` set) and `cd` into the directory:
+Restic requires Go version 1.14 or later for compiling. Clone the repo (without
+having `$GOPATH` set) and `cd` into the directory:

    $ unset GOPATH
    $ git clone https://github.com/restic/restic
@@ -76,7 +77,7 @@ Then use the `go` tool to build restic:

    $ go build ./cmd/restic
    $ ./restic version
-    restic 0.14.0-dev (compiled manually) compiled with go1.19 on linux/amd64
+    restic 0.10.0-dev (compiled manually) compiled with go1.15.2 on linux/amd64

 You can run all tests with the following command:

--- a/2
+++ b/2
@@ -1 +1 @@
-0.15.1
+0.13.1
--- a/build.go
+++ b/build.go
@@ -3,8 +3,8 @@
 // This program aims to make building Go programs for end users easier by just
 // calling it with `go run`, without having to setup a GOPATH.
 //
-// This program checks for a minimum Go version. It will use Go modules for
-// compilation. It builds the package configured as Main in the Config struct.
+// This program needs Go >= 1.12. It'll use Go modules for compilation. It
+// builds the package configured as Main in the Config struct.

 // BSD 2-Clause License
 //
@@ -43,6 +43,7 @@ package main
 import (
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -58,7 +59,7 @@ var config = Config{
 	Main:             "./cmd/restic",                           // package name for the main package
 	DefaultBuildTags: []string{"selfupdate"},                   // specify build tags which are always used
 	Tests:            []string{"./..."},                        // tests to run
-	MinVersion:       GoVersion{Major: 1, Minor: 18, Patch: 0}, // minimum Go version supported
+	MinVersion:       GoVersion{Major: 1, Minor: 14, Patch: 0}, // minimum Go version supported
 }

 // Config configures the build.
@@ -178,7 +179,7 @@ func test(cwd string, env map[string]string, args ...string) error {
 // getVersion returns the version string from the file VERSION in the current
 // directory.
 func getVersionFromFile() string {
-	buf, err := os.ReadFile("VERSION")
+	buf, err := ioutil.ReadFile("VERSION")
 	if err != nil {
 		verbosePrintf("error reading file VERSION: %v\n", err)
 		return ""
@@ -318,8 +319,12 @@ func (v GoVersion) String() string {
 }

 func main() {
+	if !goVersion.AtLeast(GoVersion{1, 12, 0}) {
+		die("Go version (%v) is too old, restic requires Go >= 1.12\n", goVersion)
+	}
+
 	if !goVersion.AtLeast(config.MinVersion) {
-		fmt.Fprintf(os.Stderr, "Detected version %s is too old, restic requires at least %s\n", goVersion, config.MinVersion)
+		fmt.Fprintf(os.Stderr, "%s detected, this program requires at least %s\n", goVersion, config.MinVersion)
 		os.Exit(1)
 	}

--- a/changelog/0.13.1_2022-04-10/issue-3685
+++ b/changelog/0.13.1_2022-04-10/issue-3685
@@ -0,0 +1,7 @@
+Bugfix: Fix the diff command
+
+There was a bug in the `diff` command, it would always show files in a removed
+directory as added. We've fixed that.
+
+https://github.com/restic/restic/issues/3685
+https://github.com/restic/restic/pull/3686
--- a/changelog/0.13.1_2022-04-10/issue-3692
+++ b/changelog/0.13.1_2022-04-10/issue-3692
@@ -0,0 +1,12 @@
+Bugfix: Fix rclone (shimmed by Scoop) and sftp stopped working on Windows
+
+In #3602 a fix was introduced to fix the problem that rclone prematurely exits
+when Ctrl+C is pressed on Windows. The solution was to create the subprocess
+with its console detached from the restic console. However, such solution
+fails when using rclone install by scoop or using sftp with a passphrase-
+protected private key. We've fixed that by using a different approach to prevent
+Ctrl-C from passing down too early.
+
+https://github.com/restic/restic/issues/3681
+https://github.com/restic/restic/issues/3692
+https://github.com/restic/restic/pull/3696
--- a/changelog/0.14.0_2022-08-25/issue-1153
+++ b/changelog/0.14.0_2022-08-25/issue-1153
@@ -1,9 +0,0 @@
-Enhancement: Support pruning even when the disk is full
-
-When running out of disk space it was no longer possible to add or remove
-data from a repository. To help with recovering from such a deadlock, the
-prune command now supports an `--unsafe-recover-no-free-space` option to
-recover from these situations. Make sure to read the documentation first!
-
-https://github.com/restic/restic/issues/1153
-https://github.com/restic/restic/pull/3481
--- a/changelog/0.14.0_2022-08-25/issue-1842
+++ b/changelog/0.14.0_2022-08-25/issue-1842
@@ -1,8 +0,0 @@
-Change: Support debug log creation in release builds
-
-Creating a debug log was only possible in debug builds which required users to
-manually build restic. We changed the release builds to allow creating debug
-logs by simply setting the environment variable `DEBUG_LOG=logname.log`.
-
-https://github.com/restic/restic/issues/1842
-https://github.com/restic/restic/pull/3826
--- a/changelog/0.14.0_2022-08-25/issue-21
+++ b/changelog/0.14.0_2022-08-25/issue-21
@@ -1,28 +0,0 @@
-Enhancement: Add compression support
-
-We've added compression support to the restic repository format. To create a
-repository using the new format run `init --repository-version 2`. Please note
-that the repository cannot be read by restic versions prior to 0.14.0.
-
-You can configure whether data is compressed with the option `--compression`. It
-can be set to `auto` (the default, which will compress very fast), `max` (which
-will trade backup speed and CPU usage for better compression), or `off` (which
-disables compression). Each setting is only applied for the current run of restic
-and does *not* apply to future runs. The option can also be set via the
-environment variable `RESTIC_COMPRESSION`.
-
-To upgrade in place run `migrate upgrade_repo_v2` followed by `prune`. See the
-documentation for more details. The migration checks the repository integrity
-and upgrades the repository format, but will not change any data. Afterwards,
-prune will rewrite the metadata to make use of compression.
-
-As an alternative you can use the `copy` command to migrate snapshots; First
-create a new repository using
-`init --repository-version 2 --copy-chunker-params --repo2 path/to/old/repo`,
-and then use the `copy` command to copy all snapshots to the new repository.
-
-https://github.com/restic/restic/issues/21
-https://github.com/restic/restic/issues/3779
-https://github.com/restic/restic/pull/3666
-https://github.com/restic/restic/pull/3704
-https://github.com/restic/restic/pull/3733
--- a/changelog/0.14.0_2022-08-25/issue-2162
+++ b/changelog/0.14.0_2022-08-25/issue-2162
@@ -1,18 +0,0 @@
-Enhancement: Adaptive IO concurrency based on backend connections
-
-Many commands used hard-coded limits for the number of concurrent operations.
-This prevented speed improvements by increasing the number of connections used
-by a backend.
-
-These limits have now been replaced by using the configured number of backend
-connections instead, which can be controlled using the
-`-o <backend-name>.connections=5` option. Commands will then automatically
-scale their parallelism accordingly.
-
-To limit the number of CPU cores used by restic, you can set the environment
-variable `GOMAXPROCS` accordingly. For example to use a single CPU core, use
-`GOMAXPROCS=1`.
-
-https://github.com/restic/restic/issues/2162
-https://github.com/restic/restic/issues/1467
-https://github.com/restic/restic/pull/3611
--- a/changelog/0.14.0_2022-08-25/issue-2248
+++ b/changelog/0.14.0_2022-08-25/issue-2248
@@ -1,8 +0,0 @@
-Bugfix: Support `self-update` on Windows
-
-Restic `self-update` would fail in situations where the operating system
-locks running binaries, including Windows. The new behavior works around
-this by renaming the running file and swapping the updated file in place.
-
-https://github.com/restic/restic/issues/2248
-https://github.com/restic/restic/pull/3675
--- a/changelog/0.14.0_2022-08-25/issue-2291
+++ b/changelog/0.14.0_2022-08-25/issue-2291
@@ -1,12 +0,0 @@
-Enhancement: Allow pack size customization
-
-Restic now uses a target pack size of 16 MiB by default. This can be customized
-using the `--pack-size size` option. Supported pack sizes range between 4 and
-128 MiB.
-
-It is possible to migrate an existing repository to _larger_ pack files using
-`prune --repack-small`. This will rewrite every pack file which is
-significantly smaller than the target size.
-
-https://github.com/restic/restic/issues/2291
-https://github.com/restic/restic/pull/3731
--- a/changelog/0.14.0_2022-08-25/issue-2295
+++ b/changelog/0.14.0_2022-08-25/issue-2295
@@ -1,14 +0,0 @@
-Enhancement: Allow use of SAS token to authenticate to Azure
-
-Previously restic only supported AccountKeys to authenticate to Azure
-storage accounts, which necessitates giving a significant amount of
-access.
-
-We added support for Azure SAS tokens which are a more fine-grained
-and time-limited manner of granting access. Set the `AZURE_ACCOUNT_NAME`
-and `AZURE_ACCOUNT_SAS` environment variables to use a SAS token for
-authentication. Note that if `AZURE_ACCOUNT_KEY` is set, it will take
-precedence.
-
-https://github.com/restic/restic/issues/2295
-https://github.com/restic/restic/pull/3661
--- a/changelog/0.14.0_2022-08-25/issue-2696
+++ b/changelog/0.14.0_2022-08-25/issue-2696
@@ -1,13 +0,0 @@
-Enhancement: Improve backup speed with many small files
-
-We have restructured the backup pipeline to continue reading files while all
-upload connections are busy. This allows the backup to already prepare the next
-data file such that the upload can continue as soon as a connection becomes
-available. This can especially improve the backup performance for high latency
-backends.
-
-The upload concurrency is now controlled using the `-o <backend-name>.connections=5`
-option.
-
-https://github.com/restic/restic/issues/2696
-https://github.com/restic/restic/pull/3489
--- a/changelog/0.14.0_2022-08-25/issue-2907
+++ b/changelog/0.14.0_2022-08-25/issue-2907
@@ -1,15 +0,0 @@
-Enhancement: Make snapshot directory structure of `mount` command customizable
-
-We've added the possibility to customize the snapshot directory structure of
-the `mount` command using templates passed to the `--snapshot-template` option.
-The formatting of snapshots' timestamps is now controlled using `--time-template`
-and supports subdirectories to for example group snapshots by year. Please
-see `restic help mount` for further details.
-
-Characters in tag names which are not allowed in a filename are replaced by
-underscores `_`. For example a tag `foo/bar` will result in a directory name
-of `foo_bar`.
-
-https://github.com/restic/restic/issues/2907
-https://github.com/restic/restic/pull/2913
-https://github.com/restic/restic/pull/3691
--- a/changelog/0.14.0_2022-08-25/issue-3114
+++ b/changelog/0.14.0_2022-08-25/issue-3114
@@ -1,12 +0,0 @@
-Enhancement: Optimize handling of duplicate blobs in `prune`
-
-Restic `prune` always used to repack all data files containing duplicate
-blobs. This effectively removed all duplicates during prune. However, as a
-consequence all these data files were repacked even if the unused repository
-space threshold could be reached with less work.
-
-This is now changed and `prune` works nice and fast even when there are lots
-of duplicate blobs.
-
-https://github.com/restic/restic/issues/3114
-https://github.com/restic/restic/pull/3290
--- a/changelog/0.14.0_2022-08-25/issue-3295
+++ b/changelog/0.14.0_2022-08-25/issue-3295
@@ -1,13 +0,0 @@
-Change: Deprecate `check --check-unused` and add further checks
-
-Since restic 0.12.0, it is expected to still have unused blobs after running
-`prune`. This made the `--check-unused` option of the `check` command rather
-useless and tended to confuse users. This option has been deprecated and is
-now ignored.
-
-The `check` command now also warns if a repository is using either the legacy
-S3 layout or mixed pack files with both tree and data blobs. The latter is
-known to cause performance problems.
-
-https://github.com/restic/restic/issues/3295
-https://github.com/restic/restic/pull/3730
--- a/changelog/0.14.0_2022-08-25/issue-3428
+++ b/changelog/0.14.0_2022-08-25/issue-3428
@@ -1,14 +0,0 @@
-Bugfix: List snapshots in backend at most once to resolve snapshot IDs
-
-Many commands support specifying a list of snapshot IDs which are then used to
-determine the snapshots to be processed by the command. To resolve snapshot IDs
-or `latest`, and check that these exist, restic previously listed all snapshots
-stored in the repository. Depending on the backend this could be a slow and/or
-expensive operation.
-
-Restic now lists the snapshots only once and remembers the result in order to
-resolve all further snapshot IDs swiftly.
-
-https://github.com/restic/restic/issues/3428
-https://github.com/restic/restic/pull/3570
-https://github.com/restic/restic/pull/3395
--- a/changelog/0.14.0_2022-08-25/issue-3432
+++ b/changelog/0.14.0_2022-08-25/issue-3432
@@ -1,14 +0,0 @@
-Bugfix: Fix rare 'not found in repository' error for `copy` command
-
-In rare cases `copy` (and other commands) would report that `LoadTree(...)`
-returned an `id [...] not found in repository` error. This could be caused by
-a backup or copy command running concurrently. The error was only temporary;
-running the failed restic command a second time as a workaround did resolve the
-error.
-
-This issue has now been fixed by correcting the order in which restic reads data
-from the repository. It is now guaranteed that restic only loads snapshots for
-which all necessary data is already available.
-
-https://github.com/restic/restic/issues/3432
-https://github.com/restic/restic/pull/3570
--- a/changelog/0.14.0_2022-08-25/issue-3465
+++ b/changelog/0.14.0_2022-08-25/issue-3465
@@ -1,10 +0,0 @@
-Enhancement: Improve handling of temporary files on Windows
-
-In some cases restic failed to delete temporary files, causing the current
-command to fail. This has now been fixed by ensuring that Windows automatically
-deletes the file. In addition, temporary files are only written to disk when
-necessary, reducing disk writes.
-
-https://github.com/restic/restic/issues/3465
-https://github.com/restic/restic/issues/1551
-https://github.com/restic/restic/pull/3610
--- a/changelog/0.14.0_2022-08-25/issue-3685
+++ b/changelog/0.14.0_2022-08-25/issue-3685
@@ -1,7 +0,0 @@
-Bugfix: The `diff` command incorrectly listed some files as added
-
-There was a bug in the `diff` command, causing it to always show files in a
-removed directory as added. This has now been fixed.
-
-https://github.com/restic/restic/issues/3685
-https://github.com/restic/restic/pull/3686
--- a/changelog/0.14.0_2022-08-25/issue-3692
+++ b/changelog/0.14.0_2022-08-25/issue-3692
@@ -1,13 +0,0 @@
-Bugfix: Fix rclone (shimmed by Scoop) and sftp not working on Windows
-
-In #3602 a fix was introduced to address the problem of `rclone` prematurely
-exiting when Ctrl+C is pressed on Windows. The solution was to create the
-subprocess with its console detached from the restic console.
-
-However, this solution failed when using `rclone` installed by Scoop or using
-`sftp` with a passphrase-protected private key. We've now fixed this by using
-a different approach to prevent Ctrl-C from passing down too early.
-
-https://github.com/restic/restic/issues/3681
-https://github.com/restic/restic/issues/3692
-https://github.com/restic/restic/pull/3696
--- a/changelog/0.14.0_2022-08-25/issue-3709
+++ b/changelog/0.14.0_2022-08-25/issue-3709
@@ -1,11 +0,0 @@
-Enhancement: Validate exclude patterns before backing up
-
-Exclude patterns provided via `--exclude`, `--iexclude`, `--exclude-file` or
-`--iexclude-file` previously weren't validated. As a consequence, invalid
-patterns resulted in files that were meant to be excluded being backed up.
-
-Restic now validates all patterns before running the backup and aborts with
-a fatal error if an invalid pattern is detected.
-
-https://github.com/restic/restic/issues/3709
-https://github.com/restic/restic/pull/3734
--- a/changelog/0.14.0_2022-08-25/issue-3720
+++ b/changelog/0.14.0_2022-08-25/issue-3720
@@ -1,13 +0,0 @@
-Bugfix: Directory sync errors for repositories accessed via SMB
-
-On Linux and macOS, accessing a repository via a SMB/CIFS mount resulted in
-restic failing to save the lock file, yielding the following errors:
-
-Save(<lock/071fe833f0>) returned error, retrying after 552.330144ms: sync /repo/locks: no such file or directory
-Save(<lock/bf789d7343>) returned error, retrying after 552.330144ms: sync /repo/locks: invalid argument
-
-This has now been fixed by ignoring the relevant error codes.
-
-https://github.com/restic/restic/issues/3720
-https://github.com/restic/restic/issues/3751
-https://github.com/restic/restic/pull/3752
--- a/changelog/0.14.0_2022-08-25/issue-3736
+++ b/changelog/0.14.0_2022-08-25/issue-3736
@@ -1,8 +0,0 @@
-Bugfix: The `stats` command miscalculated restore size for multiple snapshots
-
-Since restic 0.10.0 the restore size calculated by the `stats` command for
-multiple snapshots was too low. The hardlink detection was accidentally applied
-across multiple snapshots and thus ignored many files. This has now been fixed.
-
-https://github.com/restic/restic/issues/3736
-https://github.com/restic/restic/pull/3740
--- a/changelog/0.14.0_2022-08-25/issue-3837
+++ b/changelog/0.14.0_2022-08-25/issue-3837
@@ -1,8 +0,0 @@
-Enhancement: Improve SFTP repository initialization over slow links
-
-The `init` command, when used on an SFTP backend, now sends multiple `mkdir`
-commands to the backend concurrently. This reduces the waiting times when
-creating a repository over a very slow connection.
-
-https://github.com/restic/restic/issues/3837
-https://github.com/restic/restic/pull/3840
--- a/changelog/0.14.0_2022-08-25/issue-3861
+++ b/changelog/0.14.0_2022-08-25/issue-3861
@@ -1,9 +0,0 @@
-Bugfix: Yield error on invalid policy to `forget`
-
-The `forget` command previously silently ignored invalid/unsupported
-units in the duration options, such as e.g. `--keep-within-daily 2w`.
-
-Specifying an invalid/unsupported duration unit now results in an error.
-
-https://github.com/restic/restic/issues/3861
-https://github.com/restic/restic/pull/3862
--- a/changelog/0.14.0_2022-08-25/pull-3419
+++ b/changelog/0.14.0_2022-08-25/pull-3419
@@ -1,21 +0,0 @@
-Enhancement: Use config file permissions to control file group access
-
-Previously files in a local/SFTP repository would always end up with very
-restrictive access permissions, allowing access only to the owner. This
-prevented a number of valid use-cases involving groups and ACLs.
-
-We now use the permissions of the config file in the repository to decide
-whether group access should be given to newly created repository files or
-not. We arrange for repository files to be created group readable exactly
-when the repository config file is group readable.
-
-To opt-in to group readable repositories, a simple `chmod -R g+r` or
-equivalent on the config file can be used. For repositories that should
-be writable by group members a tad more setup is required, see the docs.
-
-Posix ACLs can also be used now that the group permissions being forced to
-zero no longer masks the effect of ACL entries.
-
-https://github.com/restic/restic/issues/2351
-https://github.com/restic/restic/pull/3419
-https://forum.restic.net/t/1391
--- a/changelog/0.14.0_2022-08-25/pull-3475
+++ b/changelog/0.14.0_2022-08-25/pull-3475
@@ -1,9 +0,0 @@
-Enhancement: Allow limiting IO concurrency for local and SFTP backend
-
-Restic did not support limiting the IO concurrency / number of connections for
-accessing repositories stored using the local or SFTP backends. The number of
-connections is now limited as for other backends, and can be configured via the
-the `-o local.connections=2` and `-o sftp.connections=5` options. This ensures
-that restic does not overwhelm the backend with concurrent IO operations.
-
-https://github.com/restic/restic/pull/3475
--- a/changelog/0.14.0_2022-08-25/pull-3484
+++ b/changelog/0.14.0_2022-08-25/pull-3484
@@ -1,13 +0,0 @@
-Enhancement: Stream data in `check` and `prune` commands
-
-The commands `check --read-data` and `prune` previously downloaded data files
-into temporary files which could end up being written to disk. This could cause
-a large amount of data being written to disk.
-
-The pack files are now instead streamed, which removes the need for temporary
-files. Please note that *uploads* during `backup` and `prune` still require
-temporary files.
-
-https://github.com/restic/restic/pull/3484
-https://github.com/restic/restic/issues/3710
-https://github.com/restic/restic/pull/3717
--- a/changelog/0.14.0_2022-08-25/pull-3513
+++ b/changelog/0.14.0_2022-08-25/pull-3513
@@ -1,10 +0,0 @@
-Enhancement: Improve speed of `copy` command
-
-The `copy` command could require a long time to copy snapshots for non-local
-backends. This has been improved to provide a throughput comparable to the
-`restore` command.
-
-Additionally, `copy` now displays a progress bar.
-
-https://github.com/restic/restic/issues/2923
-https://github.com/restic/restic/pull/3513
--- a/changelog/0.14.0_2022-08-25/pull-3680
+++ b/changelog/0.14.0_2022-08-25/pull-3680
@@ -1,8 +0,0 @@
-Change: Update dependencies and require Go 1.15 or newer
-
-We've updated most dependencies. Since some libraries require newer language
-features we're dropping support for Go 1.14, which means that restic now
-requires at least Go 1.15 to build.
-
-https://github.com/restic/restic/issues/3680
-https://github.com/restic/restic/issues/3883
--- a/changelog/0.14.0_2022-08-25/pull-3716
+++ b/changelog/0.14.0_2022-08-25/pull-3716
@@ -1,7 +0,0 @@
-Bugfix: Print "wrong password" to stderr instead of stdout
-
-If an invalid password was entered, the error message was printed on stdout and
-not on stderr as intended. This has now been fixed.
-
-https://github.com/restic/restic/pull/3716
-https://forum.restic.net/t/4965
--- a/changelog/0.14.0_2022-08-25/pull-3729
+++ b/changelog/0.14.0_2022-08-25/pull-3729
@@ -1,8 +0,0 @@
-Enhancement: Display full IDs in `check` warnings
-
-When running commands to inspect or repair a damaged repository, it is often
-necessary to supply the full IDs of objects stored in the repository.
-
-The output of `check` now includes full IDs instead of their shortened variant.
-
-https://github.com/restic/restic/pull/3729
--- a/changelog/0.14.0_2022-08-25/pull-3742
+++ b/changelog/0.14.0_2022-08-25/pull-3742
@@ -1,19 +0,0 @@
-Change: Replace `--repo2` option used by `init`/`copy` with `--from-repo`
-
-The `init` and `copy` commands can read data from another repository.
-However, confusingly `--repo2` referred to the repository *from* which the
-`init` command copies parameters, but for the `copy` command `--repo2`
-referred to the copy *destination*.
-
-We've introduced a new option, `--from-repo`, which always refers to the
-source repository for both commands. The old parameter names have been
-deprecated but still work. To create a new repository and copy all snapshots
-to it, the commands are now as follows:
-
-```
-restic -r /srv/restic-repo-copy init --from-repo /srv/restic-repo --copy-chunker-params
-restic -r /srv/restic-repo-copy copy --from-repo /srv/restic-repo
-```
-
-https://github.com/restic/restic/pull/3742
-https://forum.restic.net/t/5017
--- a/changelog/0.14.0_2022-08-25/pull-3772
+++ b/changelog/0.14.0_2022-08-25/pull-3772
@@ -1,14 +0,0 @@
-Bugfix: Correctly rebuild index for legacy repositories
-
-After running `rebuild-index` on a legacy repository containing mixed pack
-files (that is, pack files which store both metadata and file data), `check`
-printed warnings like `pack 12345678 contained in several indexes: ...`.
-This warning was not critical, but has now nonetheless been fixed by properly
-handling mixed pack files while rebuilding the index.
-
-Running `prune` for such legacy repositories will also fix the warning by
-reorganizing the pack files which caused it.
-
-https://github.com/restic/restic/pull/3772
-https://github.com/restic/restic/pull/3884
-https://forum.restic.net/t/5044/13
--- a/changelog/0.14.0_2022-08-25/pull-3773
+++ b/changelog/0.14.0_2022-08-25/pull-3773
@@ -1,7 +0,0 @@
-Enhancement: Optimize memory usage for directories with many files
-
-Backing up a directory with hundreds of thousands or more files caused restic
-to require large amounts of memory. We've now optimized the `backup` command
-such that it requires up to 30% less memory.
-
-https://github.com/restic/restic/pull/3773
--- a/changelog/0.14.0_2022-08-25/pull-3776
+++ b/changelog/0.14.0_2022-08-25/pull-3776
@@ -1,11 +0,0 @@
-Bugfix: Limit number of key files tested while opening a repository
-
-Previously, restic tested the password against every key in the repository
-when opening a repository. The more keys there were in the repository, the
-slower this operation became.
-
-Restic now tests the password against up to 20 key files in the repository.
-Alternatively, you can use the `--key-hint=<key ID>` option to specify a
-specific key file to use instead.
-
-https://github.com/restic/restic/pull/3776
--- a/changelog/0.14.0_2022-08-25/pull-3819
+++ b/changelog/0.14.0_2022-08-25/pull-3819
@@ -1,11 +0,0 @@
-Enhancement: Validate include/exclude patterns before restoring
-
-Patterns provided to `restore` via `--exclude`, `--iexclude`, `--include`
-and `--iinclude` weren't validated before running the restore. Invalid
-patterns would result in error messages being printed repeatedly, and
-possibly unwanted files being restored.
-
-Restic now validates all patterns before running the restore, and aborts
-with a fatal error if an invalid pattern is detected.
-
-https://github.com/restic/restic/pull/3819
--- a/changelog/0.15.0_2023-01-12/issue-14
+++ b/changelog/0.15.0_2023-01-12/issue-14
@@ -1,8 +0,0 @@
-Enhancement: Implement `rewrite` command
-
-Restic now has a `rewrite` command which allows to rewrite existing snapshots
-to remove unwanted files.
-
-https://github.com/restic/restic/issues/14
-https://github.com/restic/restic/pull/2731
-https://github.com/restic/restic/pull/4079
--- a/changelog/0.15.0_2023-01-12/issue-1734
+++ b/changelog/0.15.0_2023-01-12/issue-1734
@@ -1,15 +0,0 @@
-Enhancement: Inform about successful retries after errors
-
-When a recoverable error is encountered, restic shows a warning message saying
-that it's retrying, e.g.:
-
-`Save(<data/956b9ced99>) returned error, retrying after 357.131936ms: ...`
-
-This message can be confusing in that it never clearly states whether the retry
-is successful or not. This has now been fixed such that restic follows up with
-a message confirming a successful retry, e.g.:
-
-`Save(<data/956b9ced99>) operation successful after 1 retries`
-
-https://github.com/restic/restic/issues/1734
-https://github.com/restic/restic/pull/2661
--- a/changelog/0.15.0_2023-01-12/issue-1866
+++ b/changelog/0.15.0_2023-01-12/issue-1866
@@ -1,12 +0,0 @@
-Enhancement: Improve handling of directories with duplicate entries
-
-If for some reason a directory contains a duplicate entry, the `backup` command
-would previously fail with a `node "path/to/file" already present` or `nodes
-are not ordered got "path/to/file", last "path/to/file"` error.
-
-The error handling has been improved to only report a warning in this case. Make
-sure to check that the filesystem in question is not damaged if you see this!
-
-https://github.com/restic/restic/issues/1866
-https://github.com/restic/restic/issues/3937
-https://github.com/restic/restic/pull/3880
--- a/changelog/0.15.0_2023-01-12/issue-2015
+++ b/changelog/0.15.0_2023-01-12/issue-2015
@@ -1,10 +0,0 @@
-Bugfix: Make `mount` return exit code 0 after receiving Ctrl-C / SIGINT
-
-To stop the `mount` command, a user has to press Ctrl-C or send a SIGINT
-signal to restic. This used to cause restic to exit with a non-zero exit code.
-
-The exit code has now been changed to zero as the above is the expected way
-to stop the `mount` command and should therefore be considered successful.
-
-https://github.com/restic/restic/issues/2015
-https://github.com/restic/restic/pull/3894
--- a/changelog/0.15.0_2023-01-12/issue-2134
+++ b/changelog/0.15.0_2023-01-12/issue-2134
@@ -1,19 +0,0 @@
-Enhancement: Support B2 API keys restricted to hiding but not deleting files
-
-When the B2 backend does not have the necessary permissions to permanently
-delete files, it now automatically falls back to hiding files. This allows
-using restic with an application key which is not allowed to delete files.
-This can prevent an attacker from deleting backups with such an API key.
-
-To use this feature create an application key without the `deleteFiles`
-capability. It is recommended to restrict the key to just one bucket.
-For example using the `b2` command line tool:
-
-`b2 create-key --bucket <bucketName> <keyName> listBuckets,readFiles,writeFiles,listFiles`
-
-Alternatively, you can use the S3 backend to access B2, as described
-in the documentation. In this mode, files are also only hidden instead
-of being deleted permanently.
-
-https://github.com/restic/restic/issues/2134
-https://github.com/restic/restic/pull/2398
--- a/changelog/0.15.0_2023-01-12/issue-2152
+++ b/changelog/0.15.0_2023-01-12/issue-2152
@@ -1,11 +0,0 @@
-Enhancement: Make `init` open only one connection for the SFTP backend
-
-The `init` command using the SFTP backend used to connect twice to the
-repository. This could be inconvenient if the user must enter a password,
-or cause `init` to fail if the server does not correctly close the first SFTP
-connection.
-
-This has now been fixed by reusing the first/initial SFTP connection opened.
-
-https://github.com/restic/restic/issues/2152
-https://github.com/restic/restic/pull/3882
--- a/changelog/0.15.0_2023-01-12/issue-2533
+++ b/changelog/0.15.0_2023-01-12/issue-2533
@@ -1,13 +0,0 @@
-Enhancement: Handle cache corruption on disk and in downloads
-
-In rare situations, like for example after a system crash, the data stored
-in the cache might be corrupted. This could cause restic to fail and required
-manually deleting the cache.
-
-Restic now automatically removes broken data from the cache, allowing it
-to recover from such a situation without user intervention. In addition,
-restic retries downloads which return corrupt data in order to also handle
-temporary download problems.
-
-https://github.com/restic/restic/issues/2533
-https://github.com/restic/restic/pull/3521
--- a/changelog/0.15.0_2023-01-12/issue-2591
+++ b/changelog/0.15.0_2023-01-12/issue-2591
@@ -1,17 +0,0 @@
-Bugfix: Don't read password from stdin for `backup --stdin`
-
-The `backup` command when used with `--stdin` previously tried to read first
-the password, then the data to be backed up from standard input. This meant
-it would often confuse part of the data for the password.
-
-From now on, it will instead exit with the message `Fatal: cannot read both
-password and data from stdin` unless the password is passed in some other
-way (such as `--restic-password-file`, `RESTIC_PASSWORD`, etc).
-
-To enter the password interactively a password command has to be used. For
-example on Linux, `mysqldump somedatabase | restic backup --stdin
--password-command='sh -c "systemd-ask-password < /dev/tty"'` securely reads
-the password from the terminal.
-
-https://github.com/restic/restic/issues/2591
-https://github.com/restic/restic/pull/4011
--- a/changelog/0.15.0_2023-01-12/issue-2699
+++ b/changelog/0.15.0_2023-01-12/issue-2699
@@ -1,9 +0,0 @@
-Enhancement: Support restoring symbolic links on Windows
-
-The `restore` command now supports restoring symbolic links on Windows. Because
-of Windows specific restrictions this is only possible when running restic with
-the `SeCreateSymbolicLinkPrivilege` privilege or as an administrator.
-
-https://github.com/restic/restic/issues/1078
-https://github.com/restic/restic/issues/2699
-https://github.com/restic/restic/pull/2875
--- a/changelog/0.15.0_2023-01-12/issue-2715
+++ b/changelog/0.15.0_2023-01-12/issue-2715
@@ -1,20 +0,0 @@
-Enhancement: Stricter repository lock handling
-
-Previously, restic commands kept running even if they failed to refresh their
-locks in time. This could be a problem e.g. in case the client system running
-a backup entered the standby power mode while the backup was still in progress
-(which would prevent the client from refreshing its lock), and after a short
-delay another host successfully runs `unlock` and `prune` on the repository,
-which would remove all data added by the in-progress backup. If the backup
-client later continues its backup, even though its lock had expired in the
-meantime, this would lead to an incomplete snapshot.
-
-To address this, lock handling is now much stricter. Commands requiring a lock
-are canceled if the lock is not refreshed successfully in time. In addition,
-if a lock file is not readable restic will not allow starting a command. It may
-be necessary to remove invalid lock files manually or use `unlock --remove-all`.
-Please make sure that no other restic processes are running concurrently before
-doing this, however.
-
-https://github.com/restic/restic/issues/2715
-https://github.com/restic/restic/pull/3569
--- a/changelog/0.15.0_2023-01-12/issue-2724
+++ b/changelog/0.15.0_2023-01-12/issue-2724
@@ -1,9 +0,0 @@
-Change: Include full snapshot ID in JSON output of `backup`
-
-We have changed the JSON output of the backup command to include the full
-snapshot ID instead of just a shortened version, as the latter can be ambiguous
-in some rare cases. To derive the short ID, please truncate the full ID down to
-eight characters.
-
-https://github.com/restic/restic/issues/2724
-https://github.com/restic/restic/pull/3993
--- a/changelog/0.15.0_2023-01-12/issue-3029
+++ b/changelog/0.15.0_2023-01-12/issue-3029
@@ -1,8 +0,0 @@
-Enhancement: Add support for `credential_process` to S3 backend
-
-Restic now uses a newer library for the S3 backend, which adds support for the
-`credential_process` option in the AWS credential configuration.
-
-https://github.com/restic/restic/issues/3029
-https://github.com/restic/restic/issues/4034
-https://github.com/restic/restic/pull/4025
--- a/changelog/0.15.0_2023-01-12/issue-3096
+++ b/changelog/0.15.0_2023-01-12/issue-3096
@@ -1,8 +0,0 @@
-Enhancement: Make `mount` command support macOS using macFUSE 4.x
-
-Restic now uses a different FUSE library for mounting snapshots and making them
-available as a FUSE filesystem using the `mount` command. This adds support for
-macFUSE 4.x which can be used to make this work on recent macOS versions.
-
-https://github.com/restic/restic/issues/3096
-https://github.com/restic/restic/pull/4024
--- a/changelog/0.15.0_2023-01-12/issue-3124
+++ b/changelog/0.15.0_2023-01-12/issue-3124
@@ -1,7 +0,0 @@
-Enhancement: Support JSON output for the `init` command
-
-The `init` command used to ignore the `--json` option, but now outputs a JSON
-message if the repository was created successfully.
-
-https://github.com/restic/restic/issues/3124
-https://github.com/restic/restic/pull/3132
--- a/changelog/0.15.0_2023-01-12/issue-3161
+++ b/changelog/0.15.0_2023-01-12/issue-3161
@@ -1,14 +0,0 @@
-Bugfix: Delete files on Backblaze B2 more reliably
-
-Restic used to only delete the latest version of files stored in B2. In most
-cases this worked well as there was only a single version of the file. However,
-due to retries while uploading it is possible for multiple file versions to be
-stored at B2. This could lead to various problems for files that should have
-been deleted but still existed.
-
-The implementation has now been changed to delete all versions of files, which
-doubles the amount of Class B transactions necessary to delete files, but
-assures that no file versions are left behind.
-
-https://github.com/restic/restic/issues/3161
-https://github.com/restic/restic/pull/3885
--- a/changelog/0.15.0_2023-01-12/issue-3336
+++ b/changelog/0.15.0_2023-01-12/issue-3336
@@ -1,12 +0,0 @@
-Bugfix: Make SFTP backend report no space left on device
-
-Backing up to an SFTP backend would spew repeated SSH_FX_FAILURE messages when
-the remote disk was full. Restic now reports "sftp: no space left on device"
-and exits immediately when it detects this condition.
-
-A fix for this issue was implemented in restic 0.12.1, but unfortunately the
-fix itself contained a bug that prevented it from taking effect.
-
-https://github.com/restic/restic/issues/3336
-https://github.com/restic/restic/pull/3345
-https://github.com/restic/restic/pull/4075
--- a/changelog/0.15.0_2023-01-12/issue-3567
+++ b/changelog/0.15.0_2023-01-12/issue-3567
@@ -1,10 +0,0 @@
-Bugfix: Improve handling of interrupted syscalls in `mount` command
-
-Accessing restic's FUSE mount could result in "input/output" errors when using
-programs in which syscalls can be interrupted. This is for example the case for
-Go programs. This has now been fixed by improved error handling of interrupted
-syscalls.
-
-https://github.com/restic/restic/issues/3567
-https://github.com/restic/restic/issues/3694
-https://github.com/restic/restic/pull/3875
--- a/changelog/0.15.0_2023-01-12/issue-3897
+++ b/changelog/0.15.0_2023-01-12/issue-3897
@@ -1,7 +0,0 @@
-Bugfix: Fix stuck `copy` command when `-o <backend>.connections=1`
-
-When running the `copy` command with `-o <backend>.connections=1` the
-command would be infinitely stuck. This has now been fixed.
-
-https://github.com/restic/restic/issues/3897
-https://github.com/restic/restic/pull/3898
--- a/changelog/0.15.0_2023-01-12/issue-3918
+++ b/changelog/0.15.0_2023-01-12/issue-3918
@@ -1,9 +0,0 @@
-Bugfix: Correct prune statistics for partially compressed repositories
-
-In a partially compressed repository, one data blob can exist both in an
-uncompressed and a compressed version. This caused the `prune` statistics to
-become inaccurate and e.g. report a too high value for the unused size, such
-as "unused size after prune: 16777215.991 TiB". This has now been fixed.
-
-https://github.com/restic/restic/issues/3918
-https://github.com/restic/restic/pull/3980
--- a/changelog/0.15.0_2023-01-12/issue-3929
+++ b/changelog/0.15.0_2023-01-12/issue-3929
@@ -1,11 +0,0 @@
-Change: Make `unlock` display message only when locks were actually removed
-
-The `unlock` command used to print the "successfully removed locks" message
-whenever it was run, regardless of lock files having being removed or not.
-
-This has now been changed such that it only prints the message if any lock
-files were actually removed. In addition, it also reports the number of
-removed lock files.
-
-https://github.com/restic/restic/issues/3929
-https://github.com/restic/restic/pull/3935
--- a/changelog/0.15.0_2023-01-12/issue-3932
+++ b/changelog/0.15.0_2023-01-12/issue-3932
@@ -1,15 +0,0 @@
-Enhancement: Improve handling of ErrDot errors in rclone and sftp backends
-
-Since Go 1.19, restic can no longer implicitly run relative executables which
-are found in the current directory (e.g. `rclone` if found in `.`). This is a
-security feature of Go to prevent against running unintended and possibly
-harmful executables.
-
-The error message for this was just "cannot run executable found relative to
-current directory". This has now been improved to yield a more specific error
-message, informing the user how to explicitly allow running the executable
-using the `-o rclone.program` and `-o sftp.command` extended options with `./`.
-
-https://github.com/restic/restic/issues/3932
-https://pkg.go.dev/os/exec#hdr-Executables_in_the_current_directory
-https://go.dev/blog/path-security
--- a/changelog/0.15.0_2023-01-12/issue-4003
+++ b/changelog/0.15.0_2023-01-12/issue-4003
@@ -1,8 +0,0 @@
-Bugfix: Make `backup` no longer hang on Solaris when seeing a FIFO file
-
-The `backup` command used to hang on Solaris whenever it encountered a FIFO
-file (named pipe), due to a bug in the handling of extended attributes. This
-bug has now been fixed.
-
-https://github.com/restic/restic/issues/4003
-https://github.com/restic/restic/pull/4053
--- a/changelog/0.15.0_2023-01-12/issue-4016
+++ b/changelog/0.15.0_2023-01-12/issue-4016
@@ -1,8 +0,0 @@
-Bugfix: Support ExFAT-formatted local backends on macOS Ventura
-
-ExFAT-formatted disks could not be used as local backends starting from macOS
-Ventura. Restic commands would fail with an "inappropriate ioctl for device"
-error. This has now been fixed.
-
-https://github.com/restic/restic/issues/4016
-https://github.com/restic/restic/pull/4021
--- a/changelog/0.15.0_2023-01-12/issue-4033
+++ b/changelog/0.15.0_2023-01-12/issue-4033
@@ -1,11 +0,0 @@
-Change: Don't print skipped snapshots by default in `copy` command
-
-The `copy` command used to print each snapshot that was skipped because it
-already existed in the target repository. The amount of this output could
-practically bury the list of snapshots that were actually copied.
-
-From now on, the skipped snapshots are by default not printed at all, but
-this can be re-enabled by increasing the verbosity level of the command.
-
-https://github.com/restic/restic/issues/4033
-https://github.com/restic/restic/pull/4066
--- a/changelog/0.15.0_2023-01-12/issue-4085
+++ b/changelog/0.15.0_2023-01-12/issue-4085
@@ -1,10 +0,0 @@
-Bugfix: Make `init` ignore "Access Denied" errors when creating S3 buckets
-
-In restic 0.9.0 through 0.13.0, the `init` command ignored some permission
-errors from S3 backends when trying to check for bucket existence, so that
-manually created buckets with custom permissions could be used for backups.
-
-This feature became broken in 0.14.0, but has now been restored again.
-
-https://github.com/restic/restic/issues/4085
-https://github.com/restic/restic/pull/4086
--- a/changelog/0.15.0_2023-01-12/issue-4103
+++ b/changelog/0.15.0_2023-01-12/issue-4103
@@ -1,10 +0,0 @@
-Bugfix: Don't generate negative UIDs and GIDs in tar files from `dump`
-
-When using a 32-bit build of restic, the `dump` command could in some cases
-create tar files containing negative UIDs and GIDs, which cannot be read by
-GNU tar. This corner case especially applies to backups from stdin on Windows.
-
-This is now fixed such that `dump` creates valid tar files in these cases too.
-
-https://github.com/restic/restic/issues/4103
-https://github.com/restic/restic/pull/4104
--- a/changelog/0.15.0_2023-01-12/issue-79
+++ b/changelog/0.15.0_2023-01-12/issue-79
@@ -1,17 +0,0 @@
-Enhancement: Restore files with long runs of zeros as sparse files
-
-When using `restore --sparse`, the restorer may now write files containing long
-runs of zeros as sparse files (also called files with holes), where the zeros
-are not actually written to disk.
-
-How much space is saved by writing sparse files depends on the operating
-system, file system and the distribution of zeros in the file.
-
-During backup restic still reads the whole file including sparse regions, but
-with optimized processing speed of sparse regions.
-
-https://github.com/restic/restic/issues/79
-https://github.com/restic/restic/issues/3903
-https://github.com/restic/restic/pull/2601
-https://github.com/restic/restic/pull/3854
-https://forum.restic.net/t/sparse-file-support/1264
--- a/changelog/0.15.0_2023-01-12/pull-2750
+++ b/changelog/0.15.0_2023-01-12/pull-2750
@@ -1,7 +0,0 @@
-Enhancement: Make backup file read concurrency configurable
-
-The `backup` command now supports a `--read-concurrency` option which allows
-tuning restic for very fast storage like NVMe disks by controlling the number
-of concurrent file reads during the backup process.
-
-https://github.com/restic/restic/pull/2750
--- a/changelog/0.15.0_2023-01-12/pull-3780
+++ b/changelog/0.15.0_2023-01-12/pull-3780
@@ -1,8 +0,0 @@
-Bugfix: Make `restore` replace existing symlinks
-
-When restoring a symlink, restic used to report an error if the target path
-already existed. This has now been fixed such that the potentially existing
-target path is first removed before the symlink is restored.
-
-https://github.com/restic/restic/issues/2578
-https://github.com/restic/restic/pull/3780
--- a/changelog/0.15.0_2023-01-12/pull-3899
+++ b/changelog/0.15.0_2023-01-12/pull-3899
@@ -1,6 +0,0 @@
-Enhancement: Optimize prune memory usage
-
-The `prune` command needs large amounts of memory in order to determine what to
-keep and what to remove. This is now optimized to use up to 30% less memory.
-
-https://github.com/restic/restic/pull/3899
--- a/changelog/0.15.0_2023-01-12/pull-3905
+++ b/changelog/0.15.0_2023-01-12/pull-3905
@@ -1,6 +0,0 @@
-Enhancement: Improve speed of parent snapshot detection in `backup` command
-
-Backing up a large number of files using `--files-from-verbatim` or `--files-from-raw`
-options could require a long time to find the parent snapshot. This has been improved.
-
-https://github.com/restic/restic/pull/3905
--- a/changelog/0.15.0_2023-01-12/pull-3915
+++ b/changelog/0.15.0_2023-01-12/pull-3915
@@ -1,12 +0,0 @@
-Enhancement: Add compression statistics to the `stats` command
-
-When executed with `--mode raw-data` on a repository that supports compression,
-the `stats` command now calculates and displays, for the selected repository or
-snapshots: the uncompressed size of the data; the compression progress
-(percentage of data that has been compressed); the compression ratio of the
-compressed data; the total space saving.
-
-It also takes into account both the compressed and uncompressed data if the
-repository is only partially compressed.
-
-https://github.com/restic/restic/pull/3915
--- a/changelog/0.15.0_2023-01-12/pull-3925
+++ b/changelog/0.15.0_2023-01-12/pull-3925
@@ -1,6 +0,0 @@
-Enhancement: Provide command completion for PowerShell
-
-Restic already provided generation of completion files for bash, fish and zsh.
-Now powershell is supported, too.
-
-https://github.com/restic/restic/pull/3925/files
--- a/changelog/0.15.0_2023-01-12/pull-3931
+++ b/changelog/0.15.0_2023-01-12/pull-3931
@@ -1,10 +0,0 @@
-Enhancement: Allow `backup` file tree scanner to be disabled
-
-The `backup` command walks the file tree in a separate scanner process to find
-the total size and file/directory count, and uses this to provide an ETA. This
-can slow down backups, especially of network filesystems.
-
-The command now has a new option `--no-scan` which can be used to disable this
-scanning in order to speed up backups when needed.
-
-https://github.com/restic/restic/pull/3931
--- a/changelog/0.15.0_2023-01-12/pull-3943
+++ b/changelog/0.15.0_2023-01-12/pull-3943
@@ -1,9 +0,0 @@
-Enhancement: Ignore additional/unknown files in repository
-
-If a restic repository had additional files in it (not created by restic),
-commands like `find` and `restore` could become confused and fail with an
-`multiple IDs with prefix "12345678" found` error. These commands now
-ignore such additional files.
-
-https://github.com/restic/restic/pull/3943
-https://forum.restic.net/t/which-protocol-should-i-choose-for-remote-linux-backups/5446/17
--- a/changelog/0.15.0_2023-01-12/pull-3951
+++ b/changelog/0.15.0_2023-01-12/pull-3951
@@ -1,7 +0,0 @@
-Bugfix: Make `ls` return exit code 1 if snapshot cannot be loaded
-
-The `ls` command used to show a warning and return exit code 0 when failing
-to load a snapshot. This has now been fixed such that it instead returns exit
-code 1 (still showing a warning).
-
-https://github.com/restic/restic/pull/3951
--- a/changelog/0.15.0_2023-01-12/pull-3955
+++ b/changelog/0.15.0_2023-01-12/pull-3955
@@ -1,9 +0,0 @@
-Enhancement: Improve `backup` performance for small files
-
-When backing up small files restic was slower than it could be. In particular
-this affected backups using maximum compression.
-
-This has been fixed by reworking the internal parallelism of the backup
-command, making it back up small files around two times faster.
-
-https://github.com/restic/restic/pull/3955
--- a/changelog/0.15.0_2023-01-12/pull-4041
+++ b/changelog/0.15.0_2023-01-12/pull-4041
@@ -1,7 +0,0 @@
-Change: Update dependencies and require Go 1.18 or newer
-
-Most dependencies have been updated. Since some libraries require newer language
-features, support for Go 1.15-1.17 has been dropped, which means that restic now
-requires at least Go 1.18 to build.
-
-https://github.com/restic/restic/pull/4041
--- a/changelog/0.15.0_2023-01-12/pull-4100
+++ b/changelog/0.15.0_2023-01-12/pull-4100
@@ -1,11 +0,0 @@
-Bugfix: Make `self-update` enabled by default only in release builds
-
-The `self-update` command was previously included by default in all builds of
-restic as opposed to only in official release builds, even if the `selfupdate`
-tag was not explicitly enabled when building.
-
-This has now been corrected, and the `self-update` command is only available
-if restic was built with `-tags selfupdate` (as done for official release
-builds by `build.go`).
-
-https://github.com/restic/restic/pull/4100
--- a/changelog/0.15.1_2023-01-30/issue-3750
+++ b/changelog/0.15.1_2023-01-30/issue-3750
@@ -1,10 +0,0 @@
-Bugfix: Remove `b2_download_file_by_name: 404` warning from B2 backend
-
-In some cases the B2 backend could print `b2_download_file_by_name: 404: :
-b2.b2err` warnings. These are only debug messages and can be safely ignored.
-
-Restic now uses an updated library for accessing B2, which removes the warning.
-
-https://github.com/restic/restic/issues/3750
-https://github.com/restic/restic/issues/4144
-https://github.com/restic/restic/pull/4146
--- a/changelog/0.15.1_2023-01-30/issue-4147
+++ b/changelog/0.15.1_2023-01-30/issue-4147
@@ -1,7 +0,0 @@
-Bugfix: Make `prune --quiet` not print progress bar
-
-A regression in restic 0.15.0 caused `prune --quiet` to show a progress bar
-while deciding how to process each pack files. This has now been fixed.
-
-https://github.com/restic/restic/issues/4147
-https://github.com/restic/restic/pull/4153
--- a/changelog/0.15.1_2023-01-30/pull-4152
+++ b/changelog/0.15.1_2023-01-30/pull-4152
@@ -1,19 +0,0 @@
-Enhancement: Ignore empty lock files
-
-With restic 0.15.0 the checks for stale locks became much stricter than before.
-In particular, empty or unreadable locks were no longer silently ignored. This
-made restic to complain with `Load(<lock/1234567812>, 0, 0) returned error,
-retrying after 552.330144ms: load(<lock/1234567812>): invalid data returned`
-and fail in the end.
-
-The error message is now clarified and the implementation changed to ignore
-empty lock files which are sometimes created as the result of a failed uploads
-on some backends.
-
-Please note that unreadable lock files still have to cleaned up manually. To do
-so, you can run `restic unlock --remove-all` which removes all existing lock
-files. But first make sure that no other restic process is currently using the
-repository.
-
-https://github.com/restic/restic/issues/4143
-https://github.com/restic/restic/pull/4152
--- a/changelog/0.15.1_2023-01-30/pull-4163
+++ b/changelog/0.15.1_2023-01-30/pull-4163
@@ -1,13 +0,0 @@
-Bugfix: Make `self-update --output` work with new filename on Windows
-
-Since restic 0.14.0 the `self-update` command did not work when a custom output
-filename was specified via the `--output` option. This has now been fixed.
-
-As a workaround, either use an older restic version to run the self-update or
-create an empty file with the output filename before updating e.g. using CMD:
-
-`type nul > new-file.exe`
-`restic self-update --output new-file.exe`
-
-https://github.com/restic/restic/pull/4163
-https://forum.restic.net/t/self-update-windows-started-failing-after-release-of-0-15/5836
--- a/changelog/0.15.1_2023-01-30/pull-4167
+++ b/changelog/0.15.1_2023-01-30/pull-4167
@@ -1,6 +0,0 @@
-Bugfix: Add missing ETA in `backup` progress bar
-
-A regression in restic 0.15.0 caused the ETA to be missing from the progress
-bar displayed by the `backup` command. This has now been fixed.
-
-https://github.com/restic/restic/pull/4167
--- a/changelog/TEMPLATE
+++ b/changelog/TEMPLATE
@@ -1,5 +1,5 @@
 # The first line must start with Bugfix:, Enhancement: or Change:,
-# including the colon. Use present tense. Remove lines starting with '#'
+# including the colon. Use present use. Remove lines starting with '#'
 # from this template.
 Enhancement: Allow custom bar in the foo command

--- a/cmd/restic/cleanup.go
+++ b/cmd/restic/cleanup.go
@@ -11,7 +11,7 @@ import (

 var cleanupHandlers struct {
 	sync.Mutex
-	list []func(code int) (int, error)
+	list []func() error
 	done bool
 	ch   chan os.Signal
 }
@@ -25,7 +25,7 @@ func init() {
 // AddCleanupHandler adds the function f to the list of cleanup handlers so
 // that it is executed when all the cleanup handlers are run, e.g. when SIGINT
 // is received.
-func AddCleanupHandler(f func(code int) (int, error)) {
+func AddCleanupHandler(f func() error) {
 	cleanupHandlers.Lock()
 	defer cleanupHandlers.Unlock()

@@ -36,24 +36,22 @@ func AddCleanupHandler(f func(code int) (int, error)) {
 }

 // RunCleanupHandlers runs all registered cleanup handlers
-func RunCleanupHandlers(code int) int {
+func RunCleanupHandlers() {
 	cleanupHandlers.Lock()
 	defer cleanupHandlers.Unlock()

 	if cleanupHandlers.done {
-		return code
+		return
 	}
 	cleanupHandlers.done = true

 	for _, f := range cleanupHandlers.list {
-		var err error
-		code, err = f(code)
+		err := f()
 		if err != nil {
 			Warnf("error in cleanup handler: %v\n", err)
 		}
 	}
 	cleanupHandlers.list = nil
-	return code
 }

 // CleanupHandler handles the SIGINT signals.
@@ -77,6 +75,6 @@ func CleanupHandler(c <-chan os.Signal) {
 // Exit runs the cleanup handlers and then terminates the process with the
 // given exit code.
 func Exit(code int) {
-	code = RunCleanupHandlers(code)
+	RunCleanupHandlers()
 	os.Exit(code)
 }
--- a/cmd/restic/cmd_backup.go
+++ b/cmd/restic/cmd_backup.go
@@ -6,17 +6,16 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
 	"runtime"
-	"strconv"
 	"strings"
-	"sync"
 	"time"

 	"github.com/spf13/cobra"
-	"golang.org/x/sync/errgroup"
+	tomb "gopkg.in/tomb.v2"

 	"github.com/restic/restic/internal/archiver"
 	"github.com/restic/restic/internal/debug"
@@ -25,13 +24,12 @@ import (
 	"github.com/restic/restic/internal/repository"
 	"github.com/restic/restic/internal/restic"
 	"github.com/restic/restic/internal/textfile"
-	"github.com/restic/restic/internal/ui"
 	"github.com/restic/restic/internal/ui/backup"
 	"github.com/restic/restic/internal/ui/termstatus"
 )

 var cmdBackup = &cobra.Command{
-	Use:   "backup [flags] [FILE/DIR] ...",
+	Use:   "backup [flags] FILE/DIR [FILE/DIR] ...",
 	Short: "Create a new backup of files and/or directories",
 	Long: `
 The "backup" command creates a new snapshot and saves the files and directories
@@ -56,59 +54,44 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 	},
 	DisableAutoGenTag: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx := cmd.Context()
-		var wg sync.WaitGroup
-		cancelCtx, cancel := context.WithCancel(ctx)
-		defer func() {
-			// shutdown termstatus
-			cancel()
-			wg.Wait()
-		}()
-
+		var t tomb.Tomb
 		term := termstatus.New(globalOptions.stdout, globalOptions.stderr, globalOptions.Quiet)
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			term.Run(cancelCtx)
-		}()
+		t.Go(func() error { term.Run(t.Context(globalOptions.ctx)); return nil })

-		// use the terminal for stdout/stderr
-		prevStdout, prevStderr := globalOptions.stdout, globalOptions.stderr
-		defer func() {
-			globalOptions.stdout, globalOptions.stderr = prevStdout, prevStderr
-		}()
-		stdioWrapper := ui.NewStdioWrapper(term)
-		globalOptions.stdout, globalOptions.stderr = stdioWrapper.Stdout(), stdioWrapper.Stderr()
-
-		return runBackup(ctx, backupOptions, globalOptions, term, args)
+		err := runBackup(backupOptions, globalOptions, term, args)
+		t.Kill(nil)
+		if werr := t.Wait(); werr != nil {
+			panic(fmt.Sprintf("term.Run() returned err: %v", err))
+		}
+		return err
 	},
 }

 // BackupOptions bundles all options for the backup command.
 type BackupOptions struct {
-	excludePatternOptions
-
-	Parent            string
-	Force             bool
-	ExcludeOtherFS    bool
-	ExcludeIfPresent  []string
-	ExcludeCaches     bool
-	ExcludeLargerThan string
-	Stdin             bool
-	StdinFilename     string
-	Tags              restic.TagLists
-	Host              string
-	FilesFrom         []string
-	FilesFromVerbatim []string
-	FilesFromRaw      []string
-	TimeStamp         string
-	WithAtime         bool
-	IgnoreInode       bool
-	IgnoreCtime       bool
-	UseFsSnapshot     bool
-	DryRun            bool
-	ReadConcurrency   uint
-	NoScan            bool
+	Parent                  string
+	Force                   bool
+	Excludes                []string
+	InsensitiveExcludes     []string
+	ExcludeFiles            []string
+	InsensitiveExcludeFiles []string
+	ExcludeOtherFS          bool
+	ExcludeIfPresent        []string
+	ExcludeCaches           bool
+	ExcludeLargerThan       string
+	Stdin                   bool
+	StdinFilename           string
+	Tags                    restic.TagLists
+	Host                    string
+	FilesFrom               []string
+	FilesFromVerbatim       []string
+	FilesFromRaw            []string
+	TimeStamp               string
+	WithAtime               bool
+	IgnoreInode             bool
+	IgnoreCtime             bool
+	UseFsSnapshot           bool
+	DryRun                  bool
 }

 var backupOptions BackupOptions
@@ -120,11 +103,12 @@ func init() {
 	cmdRoot.AddCommand(cmdBackup)

 	f := cmdBackup.Flags()
-	f.StringVar(&backupOptions.Parent, "parent", "", "use this parent `snapshot` (default: last snapshot in the repository that has the same target files/directories, and is not newer than the snapshot time)")
+	f.StringVar(&backupOptions.Parent, "parent", "", "use this parent `snapshot` (default: last snapshot in the repo that has the same target files/directories, and is not newer than the snapshot time)")
 	f.BoolVarP(&backupOptions.Force, "force", "f", false, `force re-reading the target files/directories (overrides the "parent" flag)`)
-
-	initExcludePatternOptions(f, &backupOptions.excludePatternOptions)
-
+	f.StringArrayVarP(&backupOptions.Excludes, "exclude", "e", nil, "exclude a `pattern` (can be specified multiple times)")
+	f.StringArrayVar(&backupOptions.InsensitiveExcludes, "iexclude", nil, "same as --exclude `pattern` but ignores the casing of filenames")
+	f.StringArrayVar(&backupOptions.ExcludeFiles, "exclude-file", nil, "read exclude patterns from a `file` (can be specified multiple times)")
+	f.StringArrayVar(&backupOptions.InsensitiveExcludeFiles, "iexclude-file", nil, "same as --exclude-file but ignores casing of `file`names in patterns")
 	f.BoolVarP(&backupOptions.ExcludeOtherFS, "one-file-system", "x", false, "exclude other file systems, don't cross filesystem boundaries and subvolumes")
 	f.StringArrayVar(&backupOptions.ExcludeIfPresent, "exclude-if-present", nil, "takes `filename[:header]`, exclude contents of directories containing filename (except filename itself) if header of that file is as provided (can be specified multiple times)")
 	f.BoolVar(&backupOptions.ExcludeCaches, "exclude-caches", false, `excludes cache directories that are marked with a CACHEDIR.TAG file. See https://bford.info/cachedir/ for the Cache Directory Tagging Standard`)
@@ -132,7 +116,7 @@ func init() {
 	f.BoolVar(&backupOptions.Stdin, "stdin", false, "read backup from stdin")
 	f.StringVar(&backupOptions.StdinFilename, "stdin-filename", "stdin", "`filename` to use when reading from stdin")
 	f.Var(&backupOptions.Tags, "tag", "add `tags` for the new snapshot in the format `tag[,tag,...]` (can be specified multiple times)")
-	f.UintVar(&backupOptions.ReadConcurrency, "read-concurrency", 0, "read `n` files concurrently (default: $RESTIC_READ_CONCURRENCY or 2)")
+
 	f.StringVarP(&backupOptions.Host, "host", "H", "", "set the `hostname` for the snapshot manually. To prevent an expensive rescan use the \"parent\" flag")
 	f.StringVar(&backupOptions.Host, "hostname", "", "set the `hostname` for the snapshot manually")
 	err := f.MarkDeprecated("hostname", "use --host")
@@ -140,6 +124,7 @@ func init() {
 		// MarkDeprecated only returns an error when the flag could not be found
 		panic(err)
 	}
+
 	f.StringArrayVar(&backupOptions.FilesFrom, "files-from", nil, "read the files to backup from `file` (can be combined with file args; can be specified multiple times)")
 	f.StringArrayVar(&backupOptions.FilesFromVerbatim, "files-from-verbatim", nil, "read the files to backup from `file` (can be combined with file args; can be specified multiple times)")
 	f.StringArrayVar(&backupOptions.FilesFromRaw, "files-from-raw", nil, "read the files to backup from `file` (can be combined with file args; can be specified multiple times)")
@@ -148,14 +133,9 @@ func init() {
 	f.BoolVar(&backupOptions.IgnoreInode, "ignore-inode", false, "ignore inode number changes when checking for modified files")
 	f.BoolVar(&backupOptions.IgnoreCtime, "ignore-ctime", false, "ignore ctime changes when checking for modified files")
 	f.BoolVarP(&backupOptions.DryRun, "dry-run", "n", false, "do not upload or write any data, just show what would be done")
-	f.BoolVar(&backupOptions.NoScan, "no-scan", false, "do not run scanner to estimate size of backup")
 	if runtime.GOOS == "windows" {
 		f.BoolVar(&backupOptions.UseFsSnapshot, "use-fs-snapshot", false, "use filesystem snapshot where possible (currently only Windows VSS)")
 	}
-
-	// parse read concurrency from env, on error the default value will be used
-	readConcurrency, _ := strconv.ParseUint(os.Getenv("RESTIC_READ_CONCURRENCY"), 10, 32)
-	backupOptions.ReadConcurrency = uint(readConcurrency)
 }

 // filterExisting returns a slice of all existing items, or an error if no
@@ -163,7 +143,7 @@ func init() {
 func filterExisting(items []string) (result []string, err error) {
 	for _, item := range items {
 		_, err := fs.Lstat(item)
-		if errors.Is(err, os.ErrNotExist) {
+		if err != nil && os.IsNotExist(errors.Cause(err)) {
 			Warnf("%v does not exist, skipping\n", item)
 			continue
 		}
@@ -195,7 +175,7 @@ func readLines(filename string) ([]string, error) {
 	)

 	if filename == "-" {
-		data, err = io.ReadAll(os.Stdin)
+		data, err = ioutil.ReadAll(os.Stdin)
 	} else {
 		data, err = textfile.Read(filename)
 	}
@@ -272,10 +252,6 @@ func readFilenamesRaw(r io.Reader) (names []string, err error) {
 // Check returns an error when an invalid combination of options was set.
 func (opts BackupOptions) Check(gopts GlobalOptions, args []string) error {
 	if gopts.password == "" {
-		if opts.Stdin {
-			return errors.Fatal("cannot read both password and data from stdin")
-		}
-
 		filesFrom := append(append(opts.FilesFrom, opts.FilesFromVerbatim...), opts.FilesFromRaw...)
 		for _, filename := range filesFrom {
 			if filename == "-" {
@@ -316,11 +292,30 @@ func collectRejectByNameFuncs(opts BackupOptions, repo *repository.Repository, t
 		fs = append(fs, f)
 	}

-	fsPatterns, err := opts.excludePatternOptions.CollectPatterns()
-	if err != nil {
-		return nil, err
+	// add patterns from file
+	if len(opts.ExcludeFiles) > 0 {
+		excludes, err := readExcludePatternsFromFiles(opts.ExcludeFiles)
+		if err != nil {
+			return nil, err
+		}
+		opts.Excludes = append(opts.Excludes, excludes...)
+	}
+
+	if len(opts.InsensitiveExcludeFiles) > 0 {
+		excludes, err := readExcludePatternsFromFiles(opts.InsensitiveExcludeFiles)
+		if err != nil {
+			return nil, err
+		}
+		opts.InsensitiveExcludes = append(opts.InsensitiveExcludes, excludes...)
+	}
+
+	if len(opts.InsensitiveExcludes) > 0 {
+		fs = append(fs, rejectByInsensitivePattern(opts.InsensitiveExcludes))
+	}
+
+	if len(opts.Excludes) > 0 {
+		fs = append(fs, rejectByPattern(opts.Excludes))
 	}
-	fs = append(fs, fsPatterns...)

 	if opts.ExcludeCaches {
 		opts.ExcludeIfPresent = append(opts.ExcludeIfPresent, "CACHEDIR.TAG:Signature: 8a477f597d28d172789f06886806bc55")
@@ -361,6 +356,53 @@ func collectRejectFuncs(opts BackupOptions, repo *repository.Repository, targets
 	return fs, nil
 }

+// readExcludePatternsFromFiles reads all exclude files and returns the list of
+// exclude patterns. For each line, leading and trailing white space is removed
+// and comment lines are ignored. For each remaining pattern, environment
+// variables are resolved. For adding a literal dollar sign ($), write $$ to
+// the file.
+func readExcludePatternsFromFiles(excludeFiles []string) ([]string, error) {
+	getenvOrDollar := func(s string) string {
+		if s == "$" {
+			return "$"
+		}
+		return os.Getenv(s)
+	}
+
+	var excludes []string
+	for _, filename := range excludeFiles {
+		err := func() (err error) {
+			data, err := textfile.Read(filename)
+			if err != nil {
+				return err
+			}
+
+			scanner := bufio.NewScanner(bytes.NewReader(data))
+			for scanner.Scan() {
+				line := strings.TrimSpace(scanner.Text())
+
+				// ignore empty lines
+				if line == "" {
+					continue
+				}
+
+				// strip comments
+				if strings.HasPrefix(line, "#") {
+					continue
+				}
+
+				line = os.Expand(line, getenvOrDollar)
+				excludes = append(excludes, line)
+			}
+			return scanner.Err()
+		}()
+		if err != nil {
+			return nil, err
+		}
+	}
+	return excludes, nil
+}
+
 // collectTargets returns a list of target files/dirs from several sources.
 func collectTargets(opts BackupOptions, args []string) (targets []string, err error) {
 	if opts.Stdin {
@@ -383,7 +425,7 @@ func collectTargets(opts BackupOptions, args []string) (targets []string, err er
 			var expanded []string
 			expanded, err := filepath.Glob(line)
 			if err != nil {
-				return nil, fmt.Errorf("pattern: %s: %w", line, err)
+				return nil, errors.WithMessage(err, fmt.Sprintf("pattern: %s", line))
 			}
 			if len(expanded) == 0 {
 				Warnf("pattern %q does not match any files, skipping\n", line)
@@ -430,24 +472,31 @@ func collectTargets(opts BackupOptions, args []string) (targets []string, err er

 // parent returns the ID of the parent snapshot. If there is none, nil is
 // returned.
-func findParentSnapshot(ctx context.Context, repo restic.Repository, opts BackupOptions, targets []string, timeStampLimit time.Time) (*restic.Snapshot, error) {
-	if opts.Force {
-		return nil, nil
+func findParentSnapshot(ctx context.Context, repo restic.Repository, opts BackupOptions, targets []string, timeStampLimit time.Time) (parentID *restic.ID, err error) {
+	// Force using a parent
+	if !opts.Force && opts.Parent != "" {
+		id, err := restic.FindSnapshot(ctx, repo, opts.Parent)
+		if err != nil {
+			return nil, errors.Fatalf("invalid id %q: %v", opts.Parent, err)
+		}
+
+		parentID = &id
 	}

-	snName := opts.Parent
-	if snName == "" {
-		snName = "latest"
+	// Find last snapshot to set it as parent, if not already set
+	if !opts.Force && parentID == nil {
+		id, err := restic.FindLatestSnapshot(ctx, repo, targets, []restic.TagList{}, []string{opts.Host}, &timeStampLimit)
+		if err == nil {
+			parentID = &id
+		} else if err != restic.ErrNoSnapshotFound {
+			return nil, err
+		}
 	}
-	sn, err := restic.FindFilteredSnapshot(ctx, repo.Backend(), repo, []string{opts.Host}, []restic.TagList{}, targets, &timeStampLimit, snName)
-	// Snapshot not found is ok if no explicit parent was set
-	if opts.Parent == "" && errors.Is(err, restic.ErrNoSnapshotFound) {
-		err = nil
-	}
-	return sn, err
+
+	return parentID, nil
 }

-func runBackup(ctx context.Context, opts BackupOptions, gopts GlobalOptions, term *termstatus.Terminal, args []string) error {
+func runBackup(opts BackupOptions, gopts GlobalOptions, term *termstatus.Terminal, args []string) error {
 	err := opts.Check(gopts, args)
 	if err != nil {
 		return err
@@ -466,11 +515,13 @@ func runBackup(ctx context.Context, opts BackupOptions, gopts GlobalOptions, ter
 		}
 	}

+	var t tomb.Tomb
+
 	if gopts.verbosity >= 2 && !gopts.JSON {
 		Verbosef("open repository\n")
 	}

-	repo, err := OpenRepository(ctx, gopts)
+	repo, err := OpenRepository(gopts)
 	if err != nil {
 		return err
 	}
@@ -481,18 +532,28 @@ func runBackup(ctx context.Context, opts BackupOptions, gopts GlobalOptions, ter
 	} else {
 		progressPrinter = backup.NewTextProgress(term, gopts.verbosity)
 	}
-	progressReporter := backup.NewProgress(progressPrinter,
-		calculateProgressInterval(!gopts.Quiet, gopts.JSON))
-	defer progressReporter.Done()
+	progressReporter := backup.NewProgress(progressPrinter)

 	if opts.DryRun {
 		repo.SetDryRun()
+		progressReporter.SetDryRun()
 	}

+	// use the terminal for stdout/stderr
+	prevStdout, prevStderr := gopts.stdout, gopts.stderr
+	defer func() {
+		gopts.stdout, gopts.stderr = prevStdout, prevStderr
+	}()
+	gopts.stdout, gopts.stderr = progressPrinter.Stdout(), progressPrinter.Stderr()
+
+	progressReporter.SetMinUpdatePause(calculateProgressInterval(!gopts.Quiet, gopts.JSON))
+
+	t.Go(func() error { return progressReporter.Run(t.Context(gopts.ctx)) })
+
 	if !gopts.JSON {
 		progressPrinter.V("lock repository")
 	}
-	lock, ctx, err := lockRepo(ctx, repo)
+	lock, err := lockRepo(gopts.ctx, repo)
 	defer unlockRepo(lock)
 	if err != nil {
 		return err
@@ -510,30 +571,30 @@ func runBackup(ctx context.Context, opts BackupOptions, gopts GlobalOptions, ter
 		return err
 	}

-	var parentSnapshot *restic.Snapshot
+	if !gopts.JSON {
+		progressPrinter.V("load index files")
+	}
+	err = repo.LoadIndex(gopts.ctx)
+	if err != nil {
+		return err
+	}
+
+	var parentSnapshotID *restic.ID
 	if !opts.Stdin {
-		parentSnapshot, err = findParentSnapshot(ctx, repo, opts, targets, timeStamp)
+		parentSnapshotID, err = findParentSnapshot(gopts.ctx, repo, opts, targets, timeStamp)
 		if err != nil {
 			return err
 		}

 		if !gopts.JSON {
-			if parentSnapshot != nil {
-				progressPrinter.P("using parent snapshot %v\n", parentSnapshot.ID().Str())
+			if parentSnapshotID != nil {
+				progressPrinter.P("using parent snapshot %v\n", parentSnapshotID.Str())
 			} else {
 				progressPrinter.P("no parent snapshot found, will read all files\n")
 			}
 		}
 	}

-	if !gopts.JSON {
-		progressPrinter.V("load index files")
-	}
-	err = repo.LoadIndex(ctx)
-	if err != nil {
-		return err
-	}
-
 	selectByNameFilter := func(item string) bool {
 		for _, reject := range rejectByNameFuncs {
 			if reject(item) {
@@ -559,7 +620,7 @@ func runBackup(ctx context.Context, opts BackupOptions, gopts GlobalOptions, ter
 		}

 		errorHandler := func(item string, err error) error {
-			return progressReporter.Error(item, err)
+			return progressReporter.Error(item, nil, err)
 		}

 		messageHandler := func(msg string, args ...interface{}) {
@@ -586,31 +647,25 @@ func runBackup(ctx context.Context, opts BackupOptions, gopts GlobalOptions, ter
 		targets = []string{filename}
 	}

-	wg, wgCtx := errgroup.WithContext(ctx)
-	cancelCtx, cancel := context.WithCancel(wgCtx)
-	defer cancel()
+	sc := archiver.NewScanner(targetFS)
+	sc.SelectByName = selectByNameFilter
+	sc.Select = selectFilter
+	sc.Error = progressReporter.ScannerError
+	sc.Result = progressReporter.ReportTotal

-	if !opts.NoScan {
-		sc := archiver.NewScanner(targetFS)
-		sc.SelectByName = selectByNameFilter
-		sc.Select = selectFilter
-		sc.Error = progressPrinter.ScannerError
-		sc.Result = progressReporter.ReportTotal
-
-		if !gopts.JSON {
-			progressPrinter.V("start scan on %v", targets)
-		}
-		wg.Go(func() error { return sc.Scan(cancelCtx, targets) })
+	if !gopts.JSON {
+		progressPrinter.V("start scan on %v", targets)
 	}
+	t.Go(func() error { return sc.Scan(t.Context(gopts.ctx), targets) })

-	arch := archiver.New(repo, targetFS, archiver.Options{ReadConcurrency: backupOptions.ReadConcurrency})
+	arch := archiver.New(repo, targetFS, archiver.Options{})
 	arch.SelectByName = selectByNameFilter
 	arch.Select = selectFilter
 	arch.WithAtime = opts.WithAtime
 	success := true
-	arch.Error = func(item string, err error) error {
+	arch.Error = func(item string, fi os.FileInfo, err error) error {
 		success = false
-		return progressReporter.Error(item, err)
+		return progressReporter.Error(item, fi, err)
 	}
 	arch.CompleteItem = progressReporter.CompleteItem
 	arch.StartFile = progressReporter.StartFile
@@ -625,24 +680,28 @@ func runBackup(ctx context.Context, opts BackupOptions, gopts GlobalOptions, ter
 		arch.ChangeIgnoreFlags |= archiver.ChangeIgnoreCtime
 	}

+	if parentSnapshotID == nil {
+		parentSnapshotID = &restic.ID{}
+	}
+
 	snapshotOpts := archiver.SnapshotOptions{
 		Excludes:       opts.Excludes,
 		Tags:           opts.Tags.Flatten(),
 		Time:           timeStamp,
 		Hostname:       opts.Host,
-		ParentSnapshot: parentSnapshot,
+		ParentSnapshot: *parentSnapshotID,
 	}

 	if !gopts.JSON {
 		progressPrinter.V("start backup on %v", targets)
 	}
-	_, id, err := arch.Snapshot(ctx, targets, snapshotOpts)
+	_, id, err := arch.Snapshot(gopts.ctx, targets, snapshotOpts)

 	// cleanly shutdown all running goroutines
-	cancel()
+	t.Kill(nil)

 	// let's see if one returned an error
-	werr := wg.Wait()
+	werr := t.Wait()

 	// return original error
 	if err != nil {
@@ -650,7 +709,7 @@ func runBackup(ctx context.Context, opts BackupOptions, gopts GlobalOptions, ter
 	}

 	// Report finished execution
-	progressReporter.Finish(id, opts.DryRun)
+	progressReporter.Finish(id)
 	if !gopts.JSON && !opts.DryRun {
 		progressPrinter.P("snapshot %s saved\n", id.Str())
 	}
--- a/cmd/restic/cmd_backup_test.go
+++ b/cmd/restic/cmd_backup_test.go
@@ -14,7 +14,8 @@ import (
 )

 func TestCollectTargets(t *testing.T) {
-	dir := rtest.TempDir(t)
+	dir, cleanup := rtest.TempDir(t)
+	defer cleanup()

 	fooSpace := "foo "
 	barStar := "bar*"              // Must sort before the others, below.
--- a/cmd/restic/cmd_cache.go
+++ b/cmd/restic/cmd_cache.go
@@ -11,7 +11,6 @@ import (
 	"github.com/restic/restic/internal/cache"
 	"github.com/restic/restic/internal/errors"
 	"github.com/restic/restic/internal/fs"
-	"github.com/restic/restic/internal/ui"
 	"github.com/restic/restic/internal/ui/table"
 	"github.com/spf13/cobra"
 )
@@ -139,7 +138,7 @@ func runCache(opts CacheOptions, gopts GlobalOptions, args []string) error {
 			if err != nil {
 				return err
 			}
-			size = fmt.Sprintf("%11s", ui.FormatBytes(uint64(bytes)))
+			size = fmt.Sprintf("%11s", formatBytes(uint64(bytes)))
 		}

 		name := entry.Name()
--- a/cmd/restic/cmd_cat.go
+++ b/cmd/restic/cmd_cat.go
@@ -1,7 +1,6 @@
 package main

 import (
-	"context"
 	"encoding/json"

 	"github.com/spf13/cobra"
@@ -25,7 +24,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 `,
 	DisableAutoGenTag: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runCat(cmd.Context(), globalOptions, args)
+		return runCat(globalOptions, args)
 	},
 }

@@ -33,32 +32,40 @@ func init() {
 	cmdRoot.AddCommand(cmdCat)
 }

-func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
+func runCat(gopts GlobalOptions, args []string) error {
 	if len(args) < 1 || (args[0] != "masterkey" && args[0] != "config" && len(args) != 2) {
 		return errors.Fatal("type or ID not specified")
 	}

-	repo, err := OpenRepository(ctx, gopts)
+	repo, err := OpenRepository(gopts)
 	if err != nil {
 		return err
 	}

 	if !gopts.NoLock {
-		var lock *restic.Lock
-		lock, ctx, err = lockRepo(ctx, repo)
-		defer unlockRepo(lock)
+		lock, err := lockRepo(gopts.ctx, repo)
 		if err != nil {
 			return err
 		}
+
+		defer unlockRepo(lock)
 	}

 	tpe := args[0]

 	var id restic.ID
-	if tpe != "masterkey" && tpe != "config" && tpe != "snapshot" {
+	if tpe != "masterkey" && tpe != "config" {
 		id, err = restic.ParseID(args[1])
 		if err != nil {
-			return errors.Fatalf("unable to parse ID: %v\n", err)
+			if tpe != "snapshot" {
+				return errors.Fatalf("unable to parse ID: %v\n", err)
+			}
+
+			// find snapshot id with prefix
+			id, err = restic.FindSnapshot(gopts.ctx, repo, args[1])
+			if err != nil {
+				return errors.Fatalf("could not find snapshot: %v\n", err)
+			}
 		}
 	}

@@ -72,7 +79,7 @@ func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
 		Println(string(buf))
 		return nil
 	case "index":
-		buf, err := repo.LoadUnpacked(ctx, restic.IndexFile, id, nil)
+		buf, err := repo.LoadAndDecrypt(gopts.ctx, nil, restic.IndexFile, id)
 		if err != nil {
 			return err
 		}
@@ -80,12 +87,13 @@ func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
 		Println(string(buf))
 		return nil
 	case "snapshot":
-		sn, err := restic.FindSnapshot(ctx, repo.Backend(), repo, args[1])
+		sn := &restic.Snapshot{}
+		err = repo.LoadJSONUnpacked(gopts.ctx, restic.SnapshotFile, id, sn)
 		if err != nil {
-			return errors.Fatalf("could not find snapshot: %v\n", err)
+			return err
 		}

-		buf, err := json.MarshalIndent(sn, "", "  ")
+		buf, err := json.MarshalIndent(&sn, "", "  ")
 		if err != nil {
 			return err
 		}
@@ -93,12 +101,19 @@ func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
 		Println(string(buf))
 		return nil
 	case "key":
-		key, err := repository.LoadKey(ctx, repo, id)
+		h := restic.Handle{Type: restic.KeyFile, Name: id.String()}
+		buf, err := backend.LoadAll(gopts.ctx, nil, repo.Backend(), h)
 		if err != nil {
 			return err
 		}

-		buf, err := json.MarshalIndent(&key, "", "  ")
+		key := &repository.Key{}
+		err = json.Unmarshal(buf, key)
+		if err != nil {
+			return err
+		}
+
+		buf, err = json.MarshalIndent(&key, "", "  ")
 		if err != nil {
 			return err
 		}
@@ -114,7 +129,7 @@ func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
 		Println(string(buf))
 		return nil
 	case "lock":
-		lock, err := restic.LoadLock(ctx, repo, id)
+		lock, err := restic.LoadLock(gopts.ctx, repo, id)
 		if err != nil {
 			return err
 		}
@@ -129,7 +144,7 @@ func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {

 	case "pack":
 		h := restic.Handle{Type: restic.PackFile, Name: id.String()}
-		buf, err := backend.LoadAll(ctx, nil, repo.Backend(), h)
+		buf, err := backend.LoadAll(gopts.ctx, nil, repo.Backend(), h)
 		if err != nil {
 			return err
 		}
@@ -143,7 +158,7 @@ func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
 		return err

 	case "blob":
-		err = repo.LoadIndex(ctx)
+		err = repo.LoadIndex(gopts.ctx)
 		if err != nil {
 			return err
 		}
@@ -154,7 +169,7 @@ func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
 				continue
 			}

-			buf, err := repo.LoadBlob(ctx, t, id, nil)
+			buf, err := repo.LoadBlob(gopts.ctx, t, id, nil)
 			if err != nil {
 				return err
 			}
--- a/cmd/restic/cmd_check.go
+++ b/cmd/restic/cmd_check.go
@@ -1,9 +1,8 @@
 package main

 import (
-	"context"
+	"io/ioutil"
 	"math/rand"
-	"os"
 	"strconv"
 	"strings"
 	"sync"
@@ -35,7 +34,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 `,
 	DisableAutoGenTag: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runCheck(cmd.Context(), checkOptions, globalOptions, args)
+		return runCheck(checkOptions, globalOptions, args)
 	},
 	PreRunE: func(cmd *cobra.Command, args []string) error {
 		return checkFlags(checkOptions)
@@ -58,13 +57,7 @@ func init() {
 	f := cmdCheck.Flags()
 	f.BoolVar(&checkOptions.ReadData, "read-data", false, "read all data blobs")
 	f.StringVar(&checkOptions.ReadDataSubset, "read-data-subset", "", "read a `subset` of data packs, specified as 'n/t' for specific part, or either 'x%' or 'x.y%' or a size in bytes with suffixes k/K, m/M, g/G, t/T for a random subset")
-	var ignored bool
-	f.BoolVar(&ignored, "check-unused", false, "find unused blobs")
-	err := f.MarkDeprecated("check-unused", "`--check-unused` is deprecated and will be ignored")
-	if err != nil {
-		// MarkDeprecated only returns an error when the flag is not found
-		panic(err)
-	}
+	f.BoolVar(&checkOptions.CheckUnused, "check-unused", false, "find unused blobs")
 	f.BoolVar(&checkOptions.WithCache, "with-cache", false, "use the cache")
 }

@@ -149,10 +142,10 @@ func parsePercentage(s string) (float64, error) {

 // prepareCheckCache configures a special cache directory for check.
 //
-//   - if --with-cache is specified, the default cache is used
-//   - if the user explicitly requested --no-cache, we don't use any cache
-//   - if the user provides --cache-dir, we use a cache in a temporary sub-directory of the specified directory and the sub-directory is deleted after the check
-//   - by default, we use a cache in a temporary directory that is deleted after the check
+//  * if --with-cache is specified, the default cache is used
+//  * if the user explicitly requested --no-cache, we don't use any cache
+//  * if the user provides --cache-dir, we use a cache in a temporary sub-directory of the specified directory and the sub-directory is deleted after the check
+//  * by default, we use a cache in a temporary directory that is deleted after the check
 func prepareCheckCache(opts CheckOptions, gopts *GlobalOptions) (cleanup func()) {
 	cleanup = func() {}
 	if opts.WithCache {
@@ -171,7 +164,7 @@ func prepareCheckCache(opts CheckOptions, gopts *GlobalOptions) (cleanup func())
 	}

 	// use a cache in a temporary directory
-	tempdir, err := os.MkdirTemp(cachedir, "restic-check-cache-")
+	tempdir, err := ioutil.TempDir(cachedir, "restic-check-cache-")
 	if err != nil {
 		// if an error occurs, don't use any cache
 		Warnf("unable to create temporary directory for cache during check, disabling cache: %v\n", err)
@@ -192,26 +185,25 @@ func prepareCheckCache(opts CheckOptions, gopts *GlobalOptions) (cleanup func())
 	return cleanup
 }

-func runCheck(ctx context.Context, opts CheckOptions, gopts GlobalOptions, args []string) error {
+func runCheck(opts CheckOptions, gopts GlobalOptions, args []string) error {
 	if len(args) != 0 {
 		return errors.Fatal("the check command expects no arguments, only options - please see `restic help check` for usage and flags")
 	}

 	cleanup := prepareCheckCache(opts, &gopts)
-	AddCleanupHandler(func(code int) (int, error) {
+	AddCleanupHandler(func() error {
 		cleanup()
-		return code, nil
+		return nil
 	})

-	repo, err := OpenRepository(ctx, gopts)
+	repo, err := OpenRepository(gopts)
 	if err != nil {
 		return err
 	}

 	if !gopts.NoLock {
 		Verbosef("create exclusive lock for repository\n")
-		var lock *restic.Lock
-		lock, ctx, err = lockRepoExclusive(ctx, repo)
+		lock, err := lockRepoExclusive(gopts.ctx, repo)
 		defer unlockRepo(lock)
 		if err != nil {
 			return err
@@ -219,36 +211,20 @@ func runCheck(ctx context.Context, opts CheckOptions, gopts GlobalOptions, args
 	}

 	chkr := checker.New(repo, opts.CheckUnused)
-	err = chkr.LoadSnapshots(ctx)
-	if err != nil {
-		return err
-	}

 	Verbosef("load indexes\n")
-	hints, errs := chkr.LoadIndex(ctx)
+	hints, errs := chkr.LoadIndex(gopts.ctx)

-	errorsFound := false
-	suggestIndexRebuild := false
-	mixedFound := false
+	dupFound := false
 	for _, hint := range hints {
-		switch hint.(type) {
-		case *checker.ErrDuplicatePacks, *checker.ErrOldIndexFormat:
-			Printf("%v\n", hint)
-			suggestIndexRebuild = true
-		case *checker.ErrMixedPack:
-			Printf("%v\n", hint)
-			mixedFound = true
-		default:
-			Warnf("error: %v\n", hint)
-			errorsFound = true
+		Printf("%v\n", hint)
+		if _, ok := hint.(checker.ErrDuplicatePacks); ok {
+			dupFound = true
 		}
 	}

-	if suggestIndexRebuild {
-		Printf("Duplicate packs/old indexes are non-critical, you can run `restic rebuild-index' to correct this.\n")
-	}
-	if mixedFound {
-		Printf("Mixed packs with tree and data blobs are non-critical, you can run `restic prune` to correct this.\n")
+	if dupFound {
+		Printf("This is non-critical, you can run `restic rebuild-index' to correct this\n")
 	}

 	if len(errs) > 0 {
@@ -258,26 +234,25 @@ func runCheck(ctx context.Context, opts CheckOptions, gopts GlobalOptions, args
 		return errors.Fatal("LoadIndex returned errors")
 	}

+	errorsFound := false
 	orphanedPacks := 0
 	errChan := make(chan error)

 	Verbosef("check all packs\n")
-	go chkr.Packs(ctx, errChan)
+	go chkr.Packs(gopts.ctx, errChan)

 	for err := range errChan {
 		if checker.IsOrphanedPack(err) {
 			orphanedPacks++
 			Verbosef("%v\n", err)
-		} else if err == checker.ErrLegacyLayout {
-			Verbosef("repository still uses the S3 legacy layout\nPlease run `restic migrate s3legacy` to correct this.\n")
-		} else {
-			errorsFound = true
-			Warnf("%v\n", err)
+			continue
 		}
+		errorsFound = true
+		Warnf("%v\n", err)
 	}

 	if orphanedPacks > 0 {
-		Verbosef("%d additional files were found in the repo, which likely contain duplicate data.\nThis is non-critical, you can run `restic prune` to correct this.\n", orphanedPacks)
+		Verbosef("%d additional files were found in the repo, which likely contain duplicate data.\nYou can run `restic prune` to correct this.\n", orphanedPacks)
 	}

 	Verbosef("check snapshots, trees and blobs\n")
@@ -289,17 +264,13 @@ func runCheck(ctx context.Context, opts CheckOptions, gopts GlobalOptions, args
 		defer wg.Done()
 		bar := newProgressMax(!gopts.Quiet, 0, "snapshots")
 		defer bar.Done()
-		chkr.Structure(ctx, bar, errChan)
+		chkr.Structure(gopts.ctx, bar, errChan)
 	}()

 	for err := range errChan {
 		errorsFound = true
-		if e, ok := err.(*checker.TreeError); ok {
-			var clean string
-			if stdoutCanUpdateStatus() {
-				clean = clearLine(0)
-			}
-			Warnf(clean+"error for tree %v:\n", e.ID.Str())
+		if e, ok := err.(checker.TreeError); ok {
+			Warnf("error for tree %v:\n", e.ID.Str())
 			for _, treeErr := range e.Errors {
 				Warnf("  %v\n", treeErr)
 			}
@@ -314,7 +285,7 @@ func runCheck(ctx context.Context, opts CheckOptions, gopts GlobalOptions, args
 	wg.Wait()

 	if opts.CheckUnused {
-		for _, id := range chkr.UnusedBlobs(ctx) {
+		for _, id := range chkr.UnusedBlobs(gopts.ctx) {
 			Verbosef("unused blob %v\n", id)
 			errorsFound = true
 		}
@@ -326,7 +297,7 @@ func runCheck(ctx context.Context, opts CheckOptions, gopts GlobalOptions, args
 		p := newProgressMax(!gopts.Quiet, packCount, "packs")
 		errChan := make(chan error)

-		go chkr.ReadPacks(ctx, packs, p, errChan)
+		go chkr.ReadPacks(gopts.ctx, packs, p, errChan)

 		for err := range errChan {
 			errorsFound = true
--- a/cmd/restic/cmd_copy.go
+++ b/cmd/restic/cmd_copy.go
@@ -4,9 +4,7 @@ import (
 	"context"
 	"fmt"

-	"github.com/restic/restic/internal/backend"
 	"github.com/restic/restic/internal/debug"
-	"github.com/restic/restic/internal/repository"
 	"github.com/restic/restic/internal/restic"
 	"golang.org/x/sync/errgroup"

@@ -32,14 +30,16 @@ This can be mitigated by the "--copy-chunker-params" option when initializing a
 new destination repository using the "init" command.
 `,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runCopy(cmd.Context(), copyOptions, globalOptions, args)
+		return runCopy(copyOptions, globalOptions, args)
 	},
 }

 // CopyOptions bundles all options for the copy command.
 type CopyOptions struct {
 	secondaryRepoOptions
-	snapshotFilterOptions
+	Hosts []string
+	Tags  restic.TagLists
+	Paths []string
 }

 var copyOptions CopyOptions
@@ -48,55 +48,45 @@ func init() {
 	cmdRoot.AddCommand(cmdCopy)

 	f := cmdCopy.Flags()
-	initSecondaryRepoOptions(f, &copyOptions.secondaryRepoOptions, "destination", "to copy snapshots from")
-	initMultiSnapshotFilterOptions(f, &copyOptions.snapshotFilterOptions, true)
+	initSecondaryRepoOptions(f, &copyOptions.secondaryRepoOptions, "destination", "to copy snapshots to")
+	f.StringArrayVarP(&copyOptions.Hosts, "host", "H", nil, "only consider snapshots for this `host`, when no snapshot ID is given (can be specified multiple times)")
+	f.Var(&copyOptions.Tags, "tag", "only consider snapshots which include this `taglist`, when no snapshot ID is given")
+	f.StringArrayVar(&copyOptions.Paths, "path", nil, "only consider snapshots which include this (absolute) `path`, when no snapshot ID is given")
 }

-func runCopy(ctx context.Context, opts CopyOptions, gopts GlobalOptions, args []string) error {
-	secondaryGopts, isFromRepo, err := fillSecondaryGlobalOpts(opts.secondaryRepoOptions, gopts, "destination")
-	if err != nil {
-		return err
-	}
-	if isFromRepo {
-		// swap global options, if the secondary repo was set via from-repo
-		gopts, secondaryGopts = secondaryGopts, gopts
-	}
-
-	srcRepo, err := OpenRepository(ctx, gopts)
+func runCopy(opts CopyOptions, gopts GlobalOptions, args []string) error {
+	dstGopts, err := fillSecondaryGlobalOpts(opts.secondaryRepoOptions, gopts, "destination")
 	if err != nil {
 		return err
 	}

-	dstRepo, err := OpenRepository(ctx, secondaryGopts)
+	ctx, cancel := context.WithCancel(gopts.ctx)
+	defer cancel()
+
+	srcRepo, err := OpenRepository(gopts)
+	if err != nil {
+		return err
+	}
+
+	dstRepo, err := OpenRepository(dstGopts)
 	if err != nil {
 		return err
 	}

 	if !gopts.NoLock {
-		var srcLock *restic.Lock
-		srcLock, ctx, err = lockRepo(ctx, srcRepo)
+		srcLock, err := lockRepo(ctx, srcRepo)
 		defer unlockRepo(srcLock)
 		if err != nil {
 			return err
 		}
 	}

-	dstLock, ctx, err := lockRepo(ctx, dstRepo)
+	dstLock, err := lockRepo(ctx, dstRepo)
 	defer unlockRepo(dstLock)
 	if err != nil {
 		return err
 	}

-	srcSnapshotLister, err := backend.MemorizeList(ctx, srcRepo.Backend(), restic.SnapshotFile)
-	if err != nil {
-		return err
-	}
-
-	dstSnapshotLister, err := backend.MemorizeList(ctx, dstRepo.Backend(), restic.SnapshotFile)
-	if err != nil {
-		return err
-	}
-
 	debug.Log("Loading source index")
 	if err := srcRepo.LoadIndex(ctx); err != nil {
 		return err
@@ -108,7 +98,7 @@ func runCopy(ctx context.Context, opts CopyOptions, gopts GlobalOptions, args []
 	}

 	dstSnapshotByOriginal := make(map[restic.ID][]*restic.Snapshot)
-	for sn := range FindFilteredSnapshots(ctx, dstSnapshotLister, dstRepo, opts.Hosts, opts.Tags, opts.Paths, nil) {
+	for sn := range FindFilteredSnapshots(ctx, dstRepo, opts.Hosts, opts.Tags, opts.Paths, nil) {
 		if sn.Original != nil && !sn.Original.IsNull() {
 			dstSnapshotByOriginal[*sn.Original] = append(dstSnapshotByOriginal[*sn.Original], sn)
 		}
@@ -119,7 +109,8 @@ func runCopy(ctx context.Context, opts CopyOptions, gopts GlobalOptions, args []
 	// remember already processed trees across all snapshots
 	visitedTrees := restic.NewIDSet()

-	for sn := range FindFilteredSnapshots(ctx, srcSnapshotLister, srcRepo, opts.Hosts, opts.Tags, opts.Paths, args) {
+	for sn := range FindFilteredSnapshots(ctx, srcRepo, opts.Hosts, opts.Tags, opts.Paths, args) {
+		Verbosef("\nsnapshot %s of %v at %s)\n", sn.ID().Str(), sn.Paths, sn.Time)

 		// check whether the destination has a snapshot with the same persistent ID which has similar snapshot fields
 		srcOriginal := *sn.ID()
@@ -130,8 +121,7 @@ func runCopy(ctx context.Context, opts CopyOptions, gopts GlobalOptions, args []
 			isCopy := false
 			for _, originalSn := range originalSns {
 				if similarSnapshots(originalSn, sn) {
-					Verboseff("\nsnapshot %s of %v at %s)\n", sn.ID().Str(), sn.Paths, sn.Time)
-					Verboseff("skipping source snapshot %s, was already copied to snapshot %s\n", sn.ID().Str(), originalSn.ID().Str())
+					Verbosef("skipping source snapshot %s, was already copied to snapshot %s\n", sn.ID().Str(), originalSn.ID().Str())
 					isCopy = true
 					break
 				}
@@ -140,20 +130,25 @@ func runCopy(ctx context.Context, opts CopyOptions, gopts GlobalOptions, args []
 				continue
 			}
 		}
-		Verbosef("\nsnapshot %s of %v at %s)\n", sn.ID().Str(), sn.Paths, sn.Time)
 		Verbosef("  copy started, this may take a while...\n")
-		if err := copyTree(ctx, srcRepo, dstRepo, visitedTrees, *sn.Tree, gopts.Quiet); err != nil {
+
+		if err := copyTree(ctx, srcRepo, dstRepo, visitedTrees, *sn.Tree); err != nil {
 			return err
 		}
 		debug.Log("tree copied")

+		if err = dstRepo.Flush(ctx); err != nil {
+			return err
+		}
+		debug.Log("flushed packs and saved index")
+
 		// save snapshot
 		sn.Parent = nil // Parent does not have relevance in the new repo.
 		// Use Original as a persistent snapshot ID
 		if sn.Original == nil {
 			sn.Original = sn.ID()
 		}
-		newID, err := restic.SaveSnapshot(ctx, dstRepo, sn)
+		newID, err := dstRepo.SaveJSONUnpacked(ctx, restic.SnapshotFile, sn)
 		if err != nil {
 			return err
 		}
@@ -181,61 +176,82 @@ func similarSnapshots(sna *restic.Snapshot, snb *restic.Snapshot) bool {
 	return true
 }

+const numCopyWorkers = 8
+
 func copyTree(ctx context.Context, srcRepo restic.Repository, dstRepo restic.Repository,
-	visitedTrees restic.IDSet, rootTreeID restic.ID, quiet bool) error {
+	visitedTrees restic.IDSet, rootTreeID restic.ID) error {

-	wg, wgCtx := errgroup.WithContext(ctx)
+	idChan := make(chan restic.ID)
+	wg, ctx := errgroup.WithContext(ctx)

-	treeStream := restic.StreamTrees(wgCtx, wg, srcRepo, restic.IDs{rootTreeID}, func(treeID restic.ID) bool {
+	treeStream := restic.StreamTrees(ctx, wg, srcRepo, restic.IDs{rootTreeID}, func(treeID restic.ID) bool {
 		visited := visitedTrees.Has(treeID)
 		visitedTrees.Insert(treeID)
 		return visited
 	}, nil)

-	copyBlobs := restic.NewBlobSet()
-	packList := restic.NewIDSet()
-
-	enqueue := func(h restic.BlobHandle) {
-		pb := srcRepo.Index().Lookup(h)
-		copyBlobs.Insert(h)
-		for _, p := range pb {
-			packList.Insert(p.PackID)
-		}
-	}
-
 	wg.Go(func() error {
+		defer close(idChan)
+		// reused buffer
+		var buf []byte
 		for tree := range treeStream {
 			if tree.Error != nil {
 				return fmt.Errorf("LoadTree(%v) returned error %v", tree.ID.Str(), tree.Error)
 			}

 			// Do we already have this tree blob?
-			treeHandle := restic.BlobHandle{ID: tree.ID, Type: restic.TreeBlob}
-			if !dstRepo.Index().Has(treeHandle) {
+			if !dstRepo.Index().Has(restic.BlobHandle{ID: tree.ID, Type: restic.TreeBlob}) {
 				// copy raw tree bytes to avoid problems if the serialization changes
-				enqueue(treeHandle)
+				var err error
+				buf, err = srcRepo.LoadBlob(ctx, restic.TreeBlob, tree.ID, buf)
+				if err != nil {
+					return fmt.Errorf("LoadBlob(%v) for tree returned error %v", tree.ID, err)
+				}
+
+				_, _, err = dstRepo.SaveBlob(ctx, restic.TreeBlob, buf, tree.ID, false)
+				if err != nil {
+					return fmt.Errorf("SaveBlob(%v) for tree returned error %v", tree.ID.Str(), err)
+				}
 			}

 			for _, entry := range tree.Nodes {
 				// Recursion into directories is handled by StreamTrees
 				// Copy the blobs for this file.
 				for _, blobID := range entry.Content {
-					h := restic.BlobHandle{Type: restic.DataBlob, ID: blobID}
-					if !dstRepo.Index().Has(h) {
-						enqueue(h)
+					select {
+					case idChan <- blobID:
+					case <-ctx.Done():
+						return ctx.Err()
 					}
 				}
 			}
 		}
 		return nil
 	})
-	err := wg.Wait()
-	if err != nil {
-		return err
-	}

-	bar := newProgressMax(!quiet, uint64(len(packList)), "packs copied")
-	_, err = repository.Repack(ctx, srcRepo, dstRepo, packList, copyBlobs, bar)
-	bar.Done()
-	return err
+	for i := 0; i < numCopyWorkers; i++ {
+		wg.Go(func() error {
+			// reused buffer
+			var buf []byte
+			for blobID := range idChan {
+				// Do we already have this data blob?
+				if dstRepo.Index().Has(restic.BlobHandle{ID: blobID, Type: restic.DataBlob}) {
+					continue
+				}
+				debug.Log("Copying blob %s\n", blobID.Str())
+				var err error
+				buf, err = srcRepo.LoadBlob(ctx, restic.DataBlob, blobID, buf)
+				if err != nil {
+					return fmt.Errorf("LoadBlob(%v) returned error %v", blobID, err)
+				}
+
+				_, _, err = dstRepo.SaveBlob(ctx, restic.DataBlob, buf, blobID, false)
+				if err != nil {
+					return fmt.Errorf("SaveBlob(%v) returned error %v", blobID, err)
+				}
+			}
+			return nil
+		})
+	}
+	return wg.Wait()
 }
--- a/cmd/restic/cmd_debug.go
+++ b/cmd/restic/cmd_debug.go
@@ -1,4 +1,3 @@
-//go:build debug
 // +build debug

 package main
@@ -13,17 +12,14 @@ import (
 	"os"
 	"runtime"
 	"sort"
-	"sync"
 	"time"

-	"github.com/klauspost/compress/zstd"
 	"github.com/spf13/cobra"
 	"golang.org/x/sync/errgroup"

 	"github.com/restic/restic/internal/backend"
 	"github.com/restic/restic/internal/crypto"
 	"github.com/restic/restic/internal/errors"
-	"github.com/restic/restic/internal/index"
 	"github.com/restic/restic/internal/pack"
 	"github.com/restic/restic/internal/repository"
 	"github.com/restic/restic/internal/restic"
@@ -48,21 +44,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 `,
 	DisableAutoGenTag: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runDebugDump(cmd.Context(), globalOptions, args)
+		return runDebugDump(globalOptions, args)
 	},
 }

 var tryRepair bool
 var repairByte bool
 var extractPack bool
-var reuploadBlobs bool

 func init() {
 	cmdRoot.AddCommand(cmdDebug)
 	cmdDebug.AddCommand(cmdDebugDump)
 	cmdDebug.AddCommand(cmdDebugExamine)
 	cmdDebugExamine.Flags().BoolVar(&extractPack, "extract-pack", false, "write blobs to the current directory")
-	cmdDebugExamine.Flags().BoolVar(&reuploadBlobs, "reupload-blobs", false, "reupload blobs to the repository")
 	cmdDebugExamine.Flags().BoolVar(&tryRepair, "try-repair", false, "try to repair broken blobs with single bit flips")
 	cmdDebugExamine.Flags().BoolVar(&repairByte, "repair-byte", false, "try to repair broken blobs by trying bytes")
 }
@@ -78,7 +72,7 @@ func prettyPrintJSON(wr io.Writer, item interface{}) error {
 }

 func debugPrintSnapshots(ctx context.Context, repo *repository.Repository, wr io.Writer) error {
-	return restic.ForAllSnapshots(ctx, repo.Backend(), repo, nil, func(id restic.ID, snapshot *restic.Snapshot, err error) error {
+	return restic.ForAllSnapshots(ctx, repo, nil, func(id restic.ID, snapshot *restic.Snapshot, err error) error {
 		if err != nil {
 			return err
 		}
@@ -106,9 +100,10 @@ type Blob struct {

 func printPacks(ctx context.Context, repo *repository.Repository, wr io.Writer) error {

-	var m sync.Mutex
-	return restic.ParallelList(ctx, repo.Backend(), restic.PackFile, repo.Connections(), func(ctx context.Context, id restic.ID, size int64) error {
-		blobs, _, err := repo.ListPack(ctx, id, size)
+	return repo.List(ctx, restic.PackFile, func(id restic.ID, size int64) error {
+		h := restic.Handle{Type: restic.PackFile, Name: id.String()}
+
+		blobs, _, err := pack.List(repo.Key(), restic.ReaderAt(ctx, repo.Backend(), h), size)
 		if err != nil {
 			Warnf("error for pack %v: %v\n", id.Str(), err)
 			return nil
@@ -127,14 +122,12 @@ func printPacks(ctx context.Context, repo *repository.Repository, wr io.Writer)
 			}
 		}

-		m.Lock()
-		defer m.Unlock()
 		return prettyPrintJSON(wr, p)
 	})
 }

 func dumpIndexes(ctx context.Context, repo restic.Repository, wr io.Writer) error {
-	return index.ForAllIndexes(ctx, repo, func(id restic.ID, idx *index.Index, oldFormat bool, err error) error {
+	return repository.ForAllIndexes(ctx, repo, func(id restic.ID, idx *repository.Index, oldFormat bool, err error) error {
 		Printf("index_id: %v\n", id)
 		if err != nil {
 			return err
@@ -144,19 +137,18 @@ func dumpIndexes(ctx context.Context, repo restic.Repository, wr io.Writer) erro
 	})
 }

-func runDebugDump(ctx context.Context, gopts GlobalOptions, args []string) error {
+func runDebugDump(gopts GlobalOptions, args []string) error {
 	if len(args) != 1 {
 		return errors.Fatal("type not specified")
 	}

-	repo, err := OpenRepository(ctx, gopts)
+	repo, err := OpenRepository(gopts)
 	if err != nil {
 		return err
 	}

 	if !gopts.NoLock {
-		var lock *restic.Lock
-		lock, ctx, err = lockRepo(ctx, repo)
+		lock, err := lockRepo(gopts.ctx, repo)
 		defer unlockRepo(lock)
 		if err != nil {
 			return err
@@ -167,20 +159,20 @@ func runDebugDump(ctx context.Context, gopts GlobalOptions, args []string) error

 	switch tpe {
 	case "indexes":
-		return dumpIndexes(ctx, repo, gopts.stdout)
+		return dumpIndexes(gopts.ctx, repo, gopts.stdout)
 	case "snapshots":
-		return debugPrintSnapshots(ctx, repo, gopts.stdout)
+		return debugPrintSnapshots(gopts.ctx, repo, gopts.stdout)
 	case "packs":
-		return printPacks(ctx, repo, gopts.stdout)
+		return printPacks(gopts.ctx, repo, gopts.stdout)
 	case "all":
 		Printf("snapshots:\n")
-		err := debugPrintSnapshots(ctx, repo, gopts.stdout)
+		err := debugPrintSnapshots(gopts.ctx, repo, gopts.stdout)
 		if err != nil {
 			return err
 		}

 		Printf("\nindexes:\n")
-		err = dumpIndexes(ctx, repo, gopts.stdout)
+		err = dumpIndexes(gopts.ctx, repo, gopts.stdout)
 		if err != nil {
 			return err
 		}
@@ -196,7 +188,7 @@ var cmdDebugExamine = &cobra.Command{
 	Short:             "Examine a pack file",
 	DisableAutoGenTag: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runDebugExamine(cmd.Context(), globalOptions, args)
+		return runDebugExamine(globalOptions, args)
 	},
 }

@@ -315,104 +307,76 @@ func decryptUnsigned(ctx context.Context, k *crypto.Key, buf []byte) []byte {
 	return out
 }

-func loadBlobs(ctx context.Context, repo restic.Repository, packID restic.ID, list []restic.Blob) error {
-	dec, err := zstd.NewReader(nil)
-	if err != nil {
-		panic(err)
-	}
+func loadBlobs(ctx context.Context, repo restic.Repository, pack restic.ID, list []restic.Blob) error {
 	be := repo.Backend()
 	h := restic.Handle{
-		Name: packID.String(),
+		Name: pack.String(),
 		Type: restic.PackFile,
 	}
+	for _, blob := range list {
+		Printf("      loading blob %v at %v (length %v)\n", blob.ID, blob.Offset, blob.Length)
+		buf := make([]byte, blob.Length)
+		err := be.Load(ctx, h, int(blob.Length), int64(blob.Offset), func(rd io.Reader) error {
+			n, err := io.ReadFull(rd, buf)
+			if err != nil {
+				return fmt.Errorf("read error after %d bytes: %v", n, err)
+			}
+			return nil
+		})
+		if err != nil {
+			Warnf("error read: %v\n", err)
+			continue
+		}

-	wg, ctx := errgroup.WithContext(ctx)
+		key := repo.Key()

-	if reuploadBlobs {
-		repo.StartPackUploader(ctx, wg)
+		nonce, plaintext := buf[:key.NonceSize()], buf[key.NonceSize():]
+		plaintext, err = key.Open(plaintext[:0], nonce, plaintext, nil)
+		if err != nil {
+			Warnf("error decrypting blob: %v\n", err)
+			var plain []byte
+			if tryRepair || repairByte {
+				plain = tryRepairWithBitflip(ctx, key, buf, repairByte)
+			}
+			var prefix string
+			if plain != nil {
+				id := restic.Hash(plain)
+				if !id.Equal(blob.ID) {
+					Printf("         repaired blob (length %v), hash is %v, ID does not match, wanted %v\n", len(plain), id, blob.ID)
+					prefix = "repaired-wrong-hash-"
+				} else {
+					Printf("         successfully repaired blob (length %v), hash is %v, ID matches\n", len(plain), id)
+					prefix = "repaired-"
+				}
+			} else {
+				plain = decryptUnsigned(ctx, key, buf)
+				prefix = "damaged-"
+			}
+			err = storePlainBlob(blob.ID, prefix, plain)
+			if err != nil {
+				return err
+			}
+			continue
+		}
+
+		id := restic.Hash(plaintext)
+		var prefix string
+		if !id.Equal(blob.ID) {
+			Printf("         successfully decrypted blob (length %v), hash is %v, ID does not match, wanted %v\n", len(plaintext), id, blob.ID)
+			prefix = "wrong-hash-"
+		} else {
+			Printf("         successfully decrypted blob (length %v), hash is %v, ID matches\n", len(plaintext), id)
+			prefix = "correct-"
+		}
+		if extractPack {
+			err = storePlainBlob(id, prefix, plaintext)
+			if err != nil {
+				return err
+			}
+		}
 	}

-	wg.Go(func() error {
-		for _, blob := range list {
-			Printf("      loading blob %v at %v (length %v)\n", blob.ID, blob.Offset, blob.Length)
-			buf := make([]byte, blob.Length)
-			err := be.Load(ctx, h, int(blob.Length), int64(blob.Offset), func(rd io.Reader) error {
-				n, err := io.ReadFull(rd, buf)
-				if err != nil {
-					return fmt.Errorf("read error after %d bytes: %v", n, err)
-				}
-				return nil
-			})
-			if err != nil {
-				Warnf("error read: %v\n", err)
-				continue
-			}
-
-			key := repo.Key()
-
-			nonce, plaintext := buf[:key.NonceSize()], buf[key.NonceSize():]
-			plaintext, err = key.Open(plaintext[:0], nonce, plaintext, nil)
-			outputPrefix := ""
-			filePrefix := ""
-			if err != nil {
-				Warnf("error decrypting blob: %v\n", err)
-				if tryRepair || repairByte {
-					plaintext = tryRepairWithBitflip(ctx, key, buf, repairByte)
-				}
-				if plaintext != nil {
-					outputPrefix = "repaired "
-					filePrefix = "repaired-"
-				} else {
-					plaintext = decryptUnsigned(ctx, key, buf)
-					err = storePlainBlob(blob.ID, "damaged-", plaintext)
-					if err != nil {
-						return err
-					}
-					continue
-				}
-			}
-
-			if blob.IsCompressed() {
-				decompressed, err := dec.DecodeAll(plaintext, nil)
-				if err != nil {
-					Printf("         failed to decompress blob %v\n", blob.ID)
-				}
-				if decompressed != nil {
-					plaintext = decompressed
-				}
-			}
-
-			id := restic.Hash(plaintext)
-			var prefix string
-			if !id.Equal(blob.ID) {
-				Printf("         successfully %vdecrypted blob (length %v), hash is %v, ID does not match, wanted %v\n", outputPrefix, len(plaintext), id, blob.ID)
-				prefix = "wrong-hash-"
-			} else {
-				Printf("         successfully %vdecrypted blob (length %v), hash is %v, ID matches\n", outputPrefix, len(plaintext), id)
-				prefix = "correct-"
-			}
-			if extractPack {
-				err = storePlainBlob(id, filePrefix+prefix, plaintext)
-				if err != nil {
-					return err
-				}
-			}
-			if reuploadBlobs {
-				_, _, _, err := repo.SaveBlob(ctx, blob.Type, plaintext, id, true)
-				if err != nil {
-					return err
-				}
-				Printf("         uploaded %v %v\n", blob.Type, id)
-			}
-		}
-
-		if reuploadBlobs {
-			return repo.Flush(ctx)
-		}
-		return nil
-	})
-
-	return wg.Wait()
+	return nil
 }

 func storePlainBlob(id restic.ID, prefix string, plain []byte) error {
@@ -437,21 +401,13 @@ func storePlainBlob(id restic.ID, prefix string, plain []byte) error {
 	return nil
 }

-func runDebugExamine(ctx context.Context, gopts GlobalOptions, args []string) error {
-	repo, err := OpenRepository(ctx, gopts)
-	if err != nil {
-		return err
-	}
-
+func runDebugExamine(gopts GlobalOptions, args []string) error {
 	ids := make([]restic.ID, 0)
 	for _, name := range args {
 		id, err := restic.ParseID(name)
 		if err != nil {
-			id, err = restic.Find(ctx, repo.Backend(), restic.PackFile, name)
-			if err != nil {
-				Warnf("error: %v\n", err)
-				continue
-			}
+			Warnf("error: %v\n", err)
+			continue
 		}
 		ids = append(ids, id)
 	}
@@ -460,22 +416,26 @@ func runDebugExamine(ctx context.Context, gopts GlobalOptions, args []string) er
 		return errors.Fatal("no pack files to examine")
 	}

+	repo, err := OpenRepository(gopts)
+	if err != nil {
+		return err
+	}
+
 	if !gopts.NoLock {
-		var lock *restic.Lock
-		lock, ctx, err = lockRepo(ctx, repo)
+		lock, err := lockRepo(gopts.ctx, repo)
 		defer unlockRepo(lock)
 		if err != nil {
 			return err
 		}
 	}

-	err = repo.LoadIndex(ctx)
+	err = repo.LoadIndex(gopts.ctx)
 	if err != nil {
 		return err
 	}

 	for _, id := range ids {
-		err := examinePack(ctx, repo, id)
+		err := examinePack(gopts.ctx, repo, id)
 		if err != nil {
 			Warnf("error: %v\n", err)
 		}
@@ -515,15 +475,27 @@ func examinePack(ctx context.Context, repo restic.Repository, id restic.ID) erro

 	blobsLoaded := false
 	// examine all data the indexes have for the pack file
-	for b := range repo.Index().ListPacks(ctx, restic.NewIDSet(id)) {
-		blobs := b.Blobs
+	for _, idx := range repo.Index().(*repository.MasterIndex).All() {
+		idxIDs, err := idx.IDs()
+		if err != nil {
+			idxIDs = restic.IDs{}
+		}
+
+		blobs := idx.ListPack(id)
 		if len(blobs) == 0 {
 			continue
 		}

-		checkPackSize(blobs, fi.Size)
+		Printf("    index %v:\n", idxIDs)

-		err = loadBlobs(ctx, repo, id, blobs)
+		// convert list of blobs to []restic.Blob
+		var list []restic.Blob
+		for _, b := range blobs {
+			list = append(list, b.Blob)
+		}
+		checkPackSize(list, fi.Size)
+
+		err = loadBlobs(ctx, repo, id, list)
 		if err != nil {
 			Warnf("error: %v\n", err)
 		} else {
@@ -534,7 +506,7 @@ func examinePack(ctx context.Context, repo restic.Repository, id restic.ID) erro
 	Printf("  ========================================\n")
 	Printf("  inspect the pack itself\n")

-	blobs, _, err := repo.ListPack(ctx, id, fi.Size)
+	blobs, _, err := pack.List(repo.Key(), restic.ReaderAt(ctx, repo.Backend(), h), fi.Size)
 	if err != nil {
 		return fmt.Errorf("pack %v: %v", id.Str(), err)
 	}
@@ -559,13 +531,17 @@ func checkPackSize(blobs []restic.Blob, fileSize int64) {
 		if offset != uint64(pb.Offset) {
 			Printf("      hole in file, want offset %v, got %v\n", offset, pb.Offset)
 		}
-		offset = uint64(pb.Offset + pb.Length)
+		offset += uint64(pb.Length)
 		size += uint64(pb.Length)
 	}
-	size += uint64(pack.CalculateHeaderSize(blobs))
+
+	// compute header size, per blob: 1 byte type, 4 byte length, 32 byte id
+	size += uint64(restic.CiphertextLength(len(blobs) * (1 + 4 + 32)))
+	// length in uint32 little endian
+	size += 4

 	if uint64(fileSize) != size {
-		Printf("      file sizes do not match: computed %v, file size is %v\n", size, fileSize)
+		Printf("      file sizes do not match: computed %v from index, file size is %v\n", size, fileSize)
 	} else {
 		Printf("      file sizes match\n")
 	}
--- a/cmd/restic/cmd_diff.go
+++ b/cmd/restic/cmd_diff.go
@@ -7,11 +7,10 @@ import (
 	"reflect"
 	"sort"

-	"github.com/restic/restic/internal/backend"
 	"github.com/restic/restic/internal/debug"
 	"github.com/restic/restic/internal/errors"
+	"github.com/restic/restic/internal/repository"
 	"github.com/restic/restic/internal/restic"
-	"github.com/restic/restic/internal/ui"
 	"github.com/spf13/cobra"
 )

@@ -36,7 +35,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 `,
 	DisableAutoGenTag: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runDiff(cmd.Context(), diffOptions, globalOptions, args)
+		return runDiff(diffOptions, globalOptions, args)
 	},
 }

@@ -54,12 +53,12 @@ func init() {
 	f.BoolVar(&diffOptions.ShowMetadata, "metadata", false, "print changes in metadata")
 }

-func loadSnapshot(ctx context.Context, be restic.Lister, repo restic.Repository, desc string) (*restic.Snapshot, error) {
-	sn, err := restic.FindSnapshot(ctx, be, repo, desc)
+func loadSnapshot(ctx context.Context, repo *repository.Repository, desc string) (*restic.Snapshot, error) {
+	id, err := restic.FindSnapshot(ctx, repo, desc)
 	if err != nil {
 		return nil, errors.Fatal(err.Error())
 	}
-	return sn, err
+	return restic.LoadSnapshot(ctx, repo, id)
 }

 // Comparer collects all things needed to compare two snapshots.
@@ -161,7 +160,7 @@ func updateBlobs(repo restic.Repository, blobs restic.BlobSet, stats *DiffStat)

 func (c *Comparer) printDir(ctx context.Context, mode string, stats *DiffStat, blobs restic.BlobSet, prefix string, id restic.ID) error {
 	debug.Log("print %v tree %v", mode, id)
-	tree, err := restic.LoadTree(ctx, c.repo, id)
+	tree, err := c.repo.LoadTree(ctx, id)
 	if err != nil {
 		return err
 	}
@@ -188,7 +187,7 @@ func (c *Comparer) printDir(ctx context.Context, mode string, stats *DiffStat, b

 func (c *Comparer) collectDir(ctx context.Context, blobs restic.BlobSet, id restic.ID) error {
 	debug.Log("print tree %v", id)
-	tree, err := restic.LoadTree(ctx, c.repo, id)
+	tree, err := c.repo.LoadTree(ctx, id)
 	if err != nil {
 		return err
 	}
@@ -232,12 +231,12 @@ func uniqueNodeNames(tree1, tree2 *restic.Tree) (tree1Nodes, tree2Nodes map[stri

 func (c *Comparer) diffTree(ctx context.Context, stats *DiffStatsContainer, prefix string, id1, id2 restic.ID) error {
 	debug.Log("diffing %v to %v", id1, id2)
-	tree1, err := restic.LoadTree(ctx, c.repo, id1)
+	tree1, err := c.repo.LoadTree(ctx, id1)
 	if err != nil {
 		return err
 	}

-	tree2, err := restic.LoadTree(ctx, c.repo, id2)
+	tree2, err := c.repo.LoadTree(ctx, id2)
 	if err != nil {
 		return err
 	}
@@ -322,36 +321,37 @@ func (c *Comparer) diffTree(ctx context.Context, stats *DiffStatsContainer, pref
 	return nil
 }

-func runDiff(ctx context.Context, opts DiffOptions, gopts GlobalOptions, args []string) error {
+func runDiff(opts DiffOptions, gopts GlobalOptions, args []string) error {
 	if len(args) != 2 {
 		return errors.Fatalf("specify two snapshot IDs")
 	}

-	repo, err := OpenRepository(ctx, gopts)
+	ctx, cancel := context.WithCancel(gopts.ctx)
+	defer cancel()
+
+	repo, err := OpenRepository(gopts)
 	if err != nil {
 		return err
 	}

+	if err = repo.LoadIndex(ctx); err != nil {
+		return err
+	}
+
 	if !gopts.NoLock {
-		var lock *restic.Lock
-		lock, ctx, err = lockRepo(ctx, repo)
+		lock, err := lockRepo(ctx, repo)
 		defer unlockRepo(lock)
 		if err != nil {
 			return err
 		}
 	}

-	// cache snapshots listing
-	be, err := backend.MemorizeList(ctx, repo.Backend(), restic.SnapshotFile)
-	if err != nil {
-		return err
-	}
-	sn1, err := loadSnapshot(ctx, be, repo, args[0])
+	sn1, err := loadSnapshot(ctx, repo, args[0])
 	if err != nil {
 		return err
 	}

-	sn2, err := loadSnapshot(ctx, be, repo, args[1])
+	sn2, err := loadSnapshot(ctx, repo, args[1])
 	if err != nil {
 		return err
 	}
@@ -360,10 +360,6 @@ func runDiff(ctx context.Context, opts DiffOptions, gopts GlobalOptions, args []
 		Verbosef("comparing snapshot %v to %v:\n\n", sn1.ID().Str(), sn2.ID().Str())
 	}

-	if err = repo.LoadIndex(ctx); err != nil {
-		return err
-	}
-
 	if sn1.Tree == nil {
 		return errors.Errorf("snapshot %v has nil tree", sn1.ID().Str())
 	}
@@ -426,8 +422,8 @@ func runDiff(ctx context.Context, opts DiffOptions, gopts GlobalOptions, args []
 		Printf("Others:      %5d new, %5d removed\n", stats.Added.Others, stats.Removed.Others)
 		Printf("Data Blobs:  %5d new, %5d removed\n", stats.Added.DataBlobs, stats.Removed.DataBlobs)
 		Printf("Tree Blobs:  %5d new, %5d removed\n", stats.Added.TreeBlobs, stats.Removed.TreeBlobs)
-		Printf("  Added:   %-5s\n", ui.FormatBytes(uint64(stats.Added.Bytes)))
-		Printf("  Removed: %-5s\n", ui.FormatBytes(uint64(stats.Removed.Bytes)))
+		Printf("  Added:   %-5s\n", formatBytes(uint64(stats.Added.Bytes)))
+		Printf("  Removed: %-5s\n", formatBytes(uint64(stats.Removed.Bytes)))
 	}

 	return nil
--- a/cmd/restic/cmd_dump.go
+++ b/cmd/restic/cmd_dump.go
@@ -34,13 +34,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 `,
 	DisableAutoGenTag: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runDump(cmd.Context(), dumpOptions, globalOptions, args)
+		return runDump(dumpOptions, globalOptions, args)
 	},
 }

 // DumpOptions collects all options for the dump command.
 type DumpOptions struct {
-	snapshotFilterOptions
+	Hosts   []string
+	Paths   []string
+	Tags    restic.TagLists
 	Archive string
 }

@@ -50,7 +52,9 @@ func init() {
 	cmdRoot.AddCommand(cmdDump)

 	flags := cmdDump.Flags()
-	initSingleSnapshotFilterOptions(flags, &dumpOptions.snapshotFilterOptions)
+	flags.StringArrayVarP(&dumpOptions.Hosts, "host", "H", nil, `only consider snapshots for this host when the snapshot ID is "latest" (can be specified multiple times)`)
+	flags.Var(&dumpOptions.Tags, "tag", "only consider snapshots which include this `taglist` for snapshot ID \"latest\"")
+	flags.StringArrayVar(&dumpOptions.Paths, "path", nil, "only consider snapshots which include this (absolute) `path` for snapshot ID \"latest\"")
 	flags.StringVarP(&dumpOptions.Archive, "archive", "a", "tar", "set archive `format` as \"tar\" or \"zip\"")
 }

@@ -83,7 +87,7 @@ func printFromTree(ctx context.Context, tree *restic.Tree, repo restic.Repositor
 			case l == 1 && dump.IsFile(node):
 				return d.WriteNode(ctx, node)
 			case l > 1 && dump.IsDir(node):
-				subtree, err := restic.LoadTree(ctx, repo, *node.Subtree)
+				subtree, err := repo.LoadTree(ctx, *node.Subtree)
 				if err != nil {
 					return errors.Wrapf(err, "cannot load subtree for %q", item)
 				}
@@ -92,7 +96,7 @@ func printFromTree(ctx context.Context, tree *restic.Tree, repo restic.Repositor
 				if err := checkStdoutArchive(); err != nil {
 					return err
 				}
-				subtree, err := restic.LoadTree(ctx, repo, *node.Subtree)
+				subtree, err := repo.LoadTree(ctx, *node.Subtree)
 				if err != nil {
 					return err
 				}
@@ -107,7 +111,9 @@ func printFromTree(ctx context.Context, tree *restic.Tree, repo restic.Repositor
 	return fmt.Errorf("path %q not found in snapshot", item)
 }

-func runDump(ctx context.Context, opts DumpOptions, gopts GlobalOptions, args []string) error {
+func runDump(opts DumpOptions, gopts GlobalOptions, args []string) error {
+	ctx := gopts.ctx
+
 	if len(args) != 2 {
 		return errors.Fatal("no file and no snapshot ID specified")
 	}
@@ -125,39 +131,52 @@ func runDump(ctx context.Context, opts DumpOptions, gopts GlobalOptions, args []

 	splittedPath := splitPath(path.Clean(pathToPrint))

-	repo, err := OpenRepository(ctx, gopts)
+	repo, err := OpenRepository(gopts)
 	if err != nil {
 		return err
 	}

 	if !gopts.NoLock {
-		var lock *restic.Lock
-		lock, ctx, err = lockRepo(ctx, repo)
+		lock, err := lockRepo(ctx, repo)
 		defer unlockRepo(lock)
 		if err != nil {
 			return err
 		}
 	}

-	sn, err := restic.FindFilteredSnapshot(ctx, repo.Backend(), repo, opts.Paths, opts.Tags, opts.Hosts, nil, snapshotIDString)
-	if err != nil {
-		return errors.Fatalf("failed to find snapshot: %v", err)
-	}
-
 	err = repo.LoadIndex(ctx)
 	if err != nil {
 		return err
 	}

-	tree, err := restic.LoadTree(ctx, repo, *sn.Tree)
+	var id restic.ID
+
+	if snapshotIDString == "latest" {
+		id, err = restic.FindLatestSnapshot(ctx, repo, opts.Paths, opts.Tags, opts.Hosts, nil)
+		if err != nil {
+			Exitf(1, "latest snapshot for criteria not found: %v Paths:%v Hosts:%v", err, opts.Paths, opts.Hosts)
+		}
+	} else {
+		id, err = restic.FindSnapshot(ctx, repo, snapshotIDString)
+		if err != nil {
+			Exitf(1, "invalid id %q: %v", snapshotIDString, err)
+		}
+	}
+
+	sn, err := restic.LoadSnapshot(gopts.ctx, repo, id)
 	if err != nil {
-		return errors.Fatalf("loading tree for snapshot %q failed: %v", snapshotIDString, err)
+		Exitf(2, "loading snapshot %q failed: %v", snapshotIDString, err)
+	}
+
+	tree, err := repo.LoadTree(ctx, *sn.Tree)
+	if err != nil {
+		Exitf(2, "loading tree for snapshot %q failed: %v", snapshotIDString, err)
 	}

 	d := dump.New(opts.Archive, repo, os.Stdout)
 	err = printFromTree(ctx, tree, repo, "/", splittedPath, d)
 	if err != nil {
-		return errors.Fatalf("cannot dump file: %v", err)
+		Exitf(2, "cannot dump file: %v", err)
 	}

 	return nil
--- a/cmd/restic/cmd_find.go
+++ b/cmd/restic/cmd_find.go
@@ -9,7 +9,6 @@ import (

 	"github.com/spf13/cobra"

-	"github.com/restic/restic/internal/backend"
 	"github.com/restic/restic/internal/debug"
 	"github.com/restic/restic/internal/errors"
 	"github.com/restic/restic/internal/filter"
@@ -38,7 +37,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 `,
 	DisableAutoGenTag: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runFind(cmd.Context(), findOptions, globalOptions, args)
+		return runFind(findOptions, globalOptions, args)
 	},
 }

@@ -51,7 +50,9 @@ type FindOptions struct {
 	PackID, ShowPackID bool
 	CaseInsensitive    bool
 	ListLong           bool
-	snapshotFilterOptions
+	Hosts              []string
+	Paths              []string
+	Tags               restic.TagLists
 }

 var findOptions FindOptions
@@ -70,7 +71,9 @@ func init() {
 	f.BoolVarP(&findOptions.CaseInsensitive, "ignore-case", "i", false, "ignore case for pattern")
 	f.BoolVarP(&findOptions.ListLong, "long", "l", false, "use a long listing format showing size and mode")

-	initMultiSnapshotFilterOptions(f, &findOptions.snapshotFilterOptions, true)
+	f.StringArrayVarP(&findOptions.Hosts, "host", "H", nil, "only consider snapshots for this `host`, when no snapshot ID is given (can be specified multiple times)")
+	f.Var(&findOptions.Tags, "tag", "only consider snapshots which include this `taglist`, when no snapshot-ID is given")
+	f.StringArrayVar(&findOptions.Paths, "path", nil, "only consider snapshots which include this (absolute) `path`, when no snapshot-ID is given")
 }

 type findPattern struct {
@@ -467,7 +470,7 @@ func (f *Finder) indexPacksToBlobs(ctx context.Context, packIDs map[string]struc

 	// remember which packs were found in the index
 	indexPackIDs := make(map[string]struct{})
-	f.repo.Index().Each(wctx, func(pb restic.PackedBlob) {
+	for pb := range f.repo.Index().Each(wctx) {
 		idStr := pb.PackID.String()
 		// keep entry in packIDs as Each() returns individual index entries
 		matchingID := false
@@ -485,7 +488,7 @@ func (f *Finder) indexPacksToBlobs(ctx context.Context, packIDs map[string]struc
 			f.blobIDs[pb.ID.String()] = struct{}{}
 			indexPackIDs[idStr] = struct{}{}
 		}
-	})
+	}

 	for id := range indexPackIDs {
 		delete(packIDs, id)
@@ -534,7 +537,7 @@ func (f *Finder) findObjectsPacks(ctx context.Context) {
 	}
 }

-func runFind(ctx context.Context, opts FindOptions, gopts GlobalOptions, args []string) error {
+func runFind(opts FindOptions, gopts GlobalOptions, args []string) error {
 	if len(args) == 0 {
 		return errors.Fatal("wrong number of arguments")
 	}
@@ -568,28 +571,25 @@ func runFind(ctx context.Context, opts FindOptions, gopts GlobalOptions, args []
 		return errors.Fatal("cannot have several ID types")
 	}

-	repo, err := OpenRepository(ctx, gopts)
+	repo, err := OpenRepository(gopts)
 	if err != nil {
 		return err
 	}

 	if !gopts.NoLock {
-		var lock *restic.Lock
-		lock, ctx, err = lockRepo(ctx, repo)
+		lock, err := lockRepo(gopts.ctx, repo)
 		defer unlockRepo(lock)
 		if err != nil {
 			return err
 		}
 	}

-	snapshotLister, err := backend.MemorizeList(ctx, repo.Backend(), restic.SnapshotFile)
-	if err != nil {
+	if err = repo.LoadIndex(gopts.ctx); err != nil {
 		return err
 	}

-	if err = repo.LoadIndex(ctx); err != nil {
-		return err
-	}
+	ctx, cancel := context.WithCancel(gopts.ctx)
+	defer cancel()

 	f := &Finder{
 		repo:        repo,
@@ -618,7 +618,7 @@ func runFind(ctx context.Context, opts FindOptions, gopts GlobalOptions, args []
 		}
 	}

-	for sn := range FindFilteredSnapshots(ctx, snapshotLister, repo, opts.Hosts, opts.Tags, opts.Paths, opts.Snapshots) {
+	for sn := range FindFilteredSnapshots(ctx, repo, opts.Hosts, opts.Tags, opts.Paths, opts.Snapshots) {
 		if f.blobIDs != nil || f.treeIDs != nil {
 			if err = f.findIDs(ctx, sn); err != nil && err.Error() != "OK" {
 				return err
--- a/cmd/restic/cmd_forget.go
+++ b/cmd/restic/cmd_forget.go
@@ -14,16 +14,11 @@ var cmdForget = &cobra.Command{
 	Use:   "forget [flags] [snapshot ID] [...]",
 	Short: "Remove snapshots from the repository",
 	Long: `
-The "forget" command removes snapshots according to a policy. All snapshots are
-first divided into groups according to "--group-by", and after that the policy
-specified by the "--keep-*" options is applied to each group individually.
-
-Please note that this command really only deletes the snapshot object in the
-repository, which is a reference to data stored there. In order to remove the
-unreferenced data after "forget" was run successfully, see the "prune" command.
-
-Please also read the documentation for "forget" to learn about some important
-security considerations.
+The "forget" command removes snapshots according to a policy. Please note that
+this command really only deletes the snapshot object in the repository, which
+is a reference to data stored there. In order to remove the unreferenced data
+after "forget" was run successfully, see the "prune" command. Please also read
+the documentation for "forget" to learn about important security considerations.

 EXIT STATUS
 ===========
@@ -32,7 +27,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 `,
 	DisableAutoGenTag: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return runForget(cmd.Context(), forgetOptions, globalOptions, args)
+		return runForget(forgetOptions, globalOptions, args)
 	},
 }

@@ -52,7 +47,9 @@ type ForgetOptions struct {
 	WithinYearly  restic.Duration
 	KeepTags      restic.TagLists

-	snapshotFilterOptions
+	Hosts   []string
+	Tags    restic.TagLists
+	Paths   []string
 	Compact bool

 	// Grouping
@@ -79,9 +76,9 @@ func init() {
 	f.VarP(&forgetOptions.WithinWeekly, "keep-within-weekly", "", "keep weekly snapshots that are newer than `duration` (eg. 1y5m7d2h) relative to the latest snapshot")
 	f.VarP(&forgetOptions.WithinMonthly, "keep-within-monthly", "", "keep monthly snapshots that are newer than `duration` (eg. 1y5m7d2h) relative to the latest snapshot")
 	f.VarP(&forgetOptions.WithinYearly, "keep-within-yearly", "", "keep yearly snapshots that are newer than `duration` (eg. 1y5m7d2h) relative to the latest snapshot")
-	f.Var(&forgetOptions.KeepTags, "keep-tag", "keep snapshots with this `taglist` (can be specified multiple times)")

-	initMultiSnapshotFilterOptions(f, &forgetOptions.snapshotFilterOptions, false)
+	f.Var(&forgetOptions.KeepTags, "keep-tag", "keep snapshots with this `taglist` (can be specified multiple times)")
+	f.StringArrayVar(&forgetOptions.Hosts, "host", nil, "only consider snapshots with the given `host` (can be specified multiple times)")
 	f.StringArrayVar(&forgetOptions.Hosts, "hostname", nil, "only consider snapshots with the given `hostname` (can be specified multiple times)")
 	err := f.MarkDeprecated("hostname", "use --host")
 	if err != nil {
@@ -89,9 +86,12 @@ func init() {
 		panic(err)
 	}

+	f.Var(&forgetOptions.Tags, "tag", "only consider snapshots which include this `taglist` in the format `tag[,tag,...]` (can be specified multiple times)")
+
+	f.StringArrayVar(&forgetOptions.Paths, "path", nil, "only consider snapshots which include this (absolute) `path` (can be specified multiple times)")
 	f.BoolVarP(&forgetOptions.Compact, "compact", "c", false, "use compact output format")

-	f.StringVarP(&forgetOptions.GroupBy, "group-by", "g", "host,paths", "`group` snapshots by host, paths and/or tags, separated by comma (disable grouping with '')")
+	f.StringVarP(&forgetOptions.GroupBy, "group-by", "g", "host,paths", "string for grouping snapshots by host,paths,tags")
 	f.BoolVarP(&forgetOptions.DryRun, "dry-run", "n", false, "do not delete anything, just print what would be done")
 	f.BoolVar(&forgetOptions.Prune, "prune", false, "automatically run the 'prune' command if snapshots have been removed")

@@ -99,13 +99,13 @@ func init() {
 	addPruneOptions(cmdForget)
 }

-func runForget(ctx context.Context, opts ForgetOptions, gopts GlobalOptions, args []string) error {
+func runForget(opts ForgetOptions, gopts GlobalOptions, args []string) error {
 	err := verifyPruneOptions(&pruneOptions)
 	if err != nil {
 		return err
 	}

-	repo, err := OpenRepository(ctx, gopts)
+	repo, err := OpenRepository(gopts)
 	if err != nil {
 		return err
 	}
@@ -115,18 +115,20 @@ func runForget(ctx context.Context, opts ForgetOptions, gopts GlobalOptions, arg
 	}

 	if !opts.DryRun || !gopts.NoLock {
-		var lock *restic.Lock
-		lock, ctx, err = lockRepoExclusive(ctx, repo)
+		lock, err := lockRepoExclusive(gopts.ctx, repo)
 		defer unlockRepo(lock)
 		if err != nil {
 			return err
 		}
 	}

+	ctx, cancel := context.WithCancel(gopts.ctx)
+	defer cancel()
+
 	var snapshots restic.Snapshots
 	removeSnIDs := restic.NewIDSet()

-	for sn := range FindFilteredSnapshots(ctx, repo.Backend(), repo, opts.Hosts, opts.Tags, opts.Paths, args) {
+	for sn := range FindFilteredSnapshots(ctx, repo, opts.Hosts, opts.Tags, opts.Paths, args) {
 		snapshots = append(snapshots, sn)
 	}

@@ -217,7 +219,7 @@ func runForget(ctx context.Context, opts ForgetOptions, gopts GlobalOptions, arg

 	if len(removeSnIDs) > 0 {
 		if !opts.DryRun {
-			err := DeleteFilesChecked(ctx, gopts, repo, removeSnIDs, restic.SnapshotFile)
+			err := DeleteFilesChecked(gopts, repo, removeSnIDs, restic.SnapshotFile)
 			if err != nil {
 				return err
 			}
@@ -237,14 +239,10 @@ func runForget(ctx context.Context, opts ForgetOptions, gopts GlobalOptions, arg

 	if len(removeSnIDs) > 0 && opts.Prune {
 		if !gopts.JSON {
-			if opts.DryRun {
-				Verbosef("%d snapshots would be removed, running prune dry run\n", len(removeSnIDs))
-			} else {
-				Verbosef("%d snapshots have been removed, running prune\n", len(removeSnIDs))
-			}
+			Verbosef("%d snapshots have been removed, running prune\n", len(removeSnIDs))
 		}
 		pruneOptions.DryRun = opts.DryRun
-		return runPruneWithRepo(ctx, pruneOptions, gopts, repo, removeSnIDs)
+		return runPruneWithRepo(pruneOptions, gopts, repo, removeSnIDs)
 	}

 	return nil
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Alexander Neumann	594f155eb6	Add version for 0.13.1	2022-04-10 10:58:55 +02:00
Alexander Neumann	90f1a9b5f5	Generate CHANGELOG.md for 0.13.1	2022-04-10 10:58:22 +02:00
Alexander Neumann	2ad3d50535	Prepare changelog for 0.13.1	2022-04-10 10:58:22 +02:00
Charlie Jiang	59fd21e30e	Fix rclone (scoop shim) and sftp issue due to detached console on Windows	2022-04-10 10:56:55 +02:00
greatroar	c31f1e797b	Cast unix.Statfs_t.Type to int64 when checking for btrfs Fixes #3687. Uses the cast suggested by @MichaelEischer, except that the contant isn't cast along, because it's untyped and will be converted by the compiler as necessary.	2022-04-10 10:56:37 +02:00
Alexander Neumann	53ac0bfe85	Fix diff Nodes in trees were always printed with a `+` in diff, regardless of whether or not a dir was added or removed. Let's use the mode we were passed in printDir(). Closes #3685	2022-04-10 10:56:19 +02:00
@@ -1 +1 @@
 .15.1
 .13.1