Add version for 0.16.2

Apparently it's now required to bring your own theme.

.github/ISSUE_TEMPLATE/Bug.md

@@ -32,23 +32,30 @@ Output of `restic version`
 --------------------------
 
 
-How did you run restic exactly?
--------------------------------
+
+What backend/service did you use to store the repository?
+---------------------------------------------------------
+
+
+
+Problem description / Steps to reproduce
+----------------------------------------
 
 <!--
 This section should include at least:
 
+ * A description of the problem you are having with restic.
+
  * The complete command line and any environment variables you used to
    configure restic's backend access. Make sure to replace sensitive values!
 
  * The output of the commands, what restic prints gives may give us much
    information to diagnose the problem!
+
+ * The more time you spend describing an easy way to reproduce the behavior (if
+   this is possible), the easier it is for the project developers to fix it!
 -->
 
-What backend/server/service did you use to store the repository?
-----------------------------------------------------------------
-
-
 
 Expected behavior
 -----------------
@@ -65,22 +72,12 @@ In this section, please try to concentrate on observations, so only describe
 what you observed directly.
 -->
 
-Steps to reproduce the behavior
--------------------------------
-
-<!--
-The more time you spend describing an easy way to reproduce the behavior (if
-this is possible), the easier it is for the project developers to fix it!
--->
-
 Do you have any idea what may have caused this?
 -----------------------------------------------
 
-
-
-Do you have an idea how to solve the issue?
--------------------------------------------
-
+<!--
+Did something noteworthy happen on your system, Internet connection, backend services, etc?
+-->
 
 
 Did restic help you today? Did it make you happy in any way?

.github/workflows/docker.yml

@@ -22,10 +22,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        uses: docker/login-action@b4bedf8053341df3b5a9f9e0f2cf4e79e27360c6
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -42,10 +42,17 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226
+
+      - name: Ensure consistent binaries
+        run: |
+          echo "removing git directory for consistency with release binaries"
+          rm -rf .git
+        # remove VCS information from release builds, keep VCS for nightly builds on master
+        if: github.ref != 'refs/heads/master'
 
       - name: Build and push Docker image
         uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4

.github/workflows/tests.yml

@@ -13,7 +13,7 @@ permissions:
   contents: read
 
 env:
-  latest_go: "1.20.x"
+  latest_go: "1.21.x"
   GO111MODULE: on
 
 jobs:
@@ -23,34 +23,34 @@ jobs:
         # list of jobs to run:
         include:
           - job_name: Windows
-            go: 1.20.x
+            go: 1.21.x
             os: windows-latest
 
           - job_name: macOS
-            go: 1.20.x
+            go: 1.21.x
             os: macOS-latest
             test_fuse: false
 
           - job_name: Linux
-            go: 1.20.x
+            go: 1.21.x
             os: ubuntu-latest
             test_cloud_backends: true
             test_fuse: true
             check_changelog: true
 
           - job_name: Linux (race)
-            go: 1.20.x
+            go: 1.21.x
             os: ubuntu-latest
             test_fuse: true
             test_opts: "-race"
 
           - job_name: Linux
-            go: 1.19.x
+            go: 1.20.x
             os: ubuntu-latest
             test_fuse: true
 
           - job_name: Linux
-            go: 1.18.x
+            go: 1.19.x
             os: ubuntu-latest
             test_fuse: true
 
@@ -135,7 +135,7 @@ jobs:
         if: matrix.os == 'windows-latest'
 
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Build with build.go
         run: |
@@ -231,7 +231,7 @@ jobs:
           go-version: ${{ env.latest_go }}
 
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Cross-compile for subset ${{ matrix.subset }}
         run: |
@@ -249,7 +249,7 @@ jobs:
           go-version: ${{ env.latest_go }}
 
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3
@@ -289,7 +289,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Docker meta
         id: meta
@@ -309,10 +309,10 @@ jobs:
             type=sha
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Build and push
         id: docker_build

.readthedocs.yaml

@@ -0,0 +1,18 @@
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+version: 2
+
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "3.11"
+
+# Build documentation in the docs/ directory with Sphinx
+sphinx:
+  configuration: doc/conf.py
+
+# https://docs.readthedocs.io/en/stable/guides/reproducible-builds.html
+python:
+  install:
+  - requirements: doc/requirements.txt

CHANGELOG.md

@@ -1,3 +1,157 @@
+Changelog for restic 0.16.2 (2023-10-29)
+=======================================
+
+The following sections list the changes in restic 0.16.2 relevant to
+restic users. The changes are ordered by importance.
+
+Summary
+-------
+
+ * Fix #4540: Restore ARMv5 support for ARM binaries
+ * Fix #4545: Repair documentation build on Read the Docs
+
+Details
+-------
+
+ * Bugfix #4540: Restore ARMv5 support for ARM binaries
+
+   The official release binaries for restic 0.16.1 were accidentally built to require ARMv7. The
+   build process is now updated to restore support for ARMv5.
+
+   Please note that restic 0.17.0 will drop support for ARMv5 and require at least ARMv6.
+
+   https://github.com/restic/restic/issues/4540
+
+ * Bugfix #4545: Repair documentation build on Read the Docs
+
+   For restic 0.16.1, no documentation was available at https://restic.readthedocs.io/ .
+
+   The documentation build process is now updated to work again.
+
+   https://github.com/restic/restic/pull/4545
+
+
+Changelog for restic 0.16.1 (2023-10-24)
+=======================================
+
+The following sections list the changes in restic 0.16.1 relevant to
+restic users. The changes are ordered by importance.
+
+Summary
+-------
+
+ * Fix #4513: Make `key list` command honor `--no-lock`
+ * Fix #4516: Do not try to load password on command line autocomplete
+ * Fix #4523: Update zstd library to fix possible data corruption at max. compression
+ * Chg #4532: Update dependencies and require Go 1.19 or newer
+ * Enh #229: Show progress bar while loading the index
+ * Enh #4128: Automatically set `GOMAXPROCS` in resource-constrained containers
+ * Enh #4480: Allow setting REST password and username via environment variables
+ * Enh #4511: Include inode numbers in JSON output for `find` and `ls` commands
+ * Enh #4519: Add config option to set SFTP command arguments
+
+Details
+-------
+
+ * Bugfix #4513: Make `key list` command honor `--no-lock`
+
+   The `key list` command now supports the `--no-lock` options. This allows determining which
+   keys a repo can be accessed by without the need for having write access (e.g., read-only sftp
+   access, filesystem snapshot).
+
+   https://github.com/restic/restic/issues/4513
+   https://github.com/restic/restic/pull/4514
+
+ * Bugfix #4516: Do not try to load password on command line autocomplete
+
+   The command line autocompletion previously tried to load the repository password. This could
+   cause the autocompletion not to work. Now, this step gets skipped.
+
+   https://github.com/restic/restic/issues/4516
+   https://github.com/restic/restic/pull/4526
+
+ * Bugfix #4523: Update zstd library to fix possible data corruption at max. compression
+
+   In restic 0.16.0, backups where the compression level was set to `max` (using `--compression
+   max`) could in rare and very specific circumstances result in data corruption due to a bug in the
+   library used for compressing data.
+
+   Restic now uses the latest version of the library used to compress data, which includes a fix for
+   this issue. Please note that the `auto` compression level (which restic uses by default) was
+   never affected, and even if you used `max` compression, chances of being affected by this issue
+   were very small.
+
+   To check a repository for any corruption, run `restic check --read-data`. This will download
+   and verify the whole repository and can be used at any time to completely verify the integrity of
+   a repository. If the `check` command detects anomalies, follow the suggested steps.
+
+   To simplify any needed repository repair and minimize data loss, there is also a new and
+   experimental `repair packs` command that salvages all valid data from the affected pack files
+   (see `restic help repair packs` for more information).
+
+   https://github.com/restic/restic/issues/4523
+   https://github.com/restic/restic/pull/4530
+
+ * Change #4532: Update dependencies and require Go 1.19 or newer
+
+   We have updated all dependencies. Since some libraries require newer Go standard library
+   features, support for Go 1.18 has been dropped, which means that restic now requires at least Go
+   1.19 to build.
+
+   https://github.com/restic/restic/pull/4532
+   https://github.com/restic/restic/pull/4533
+
+ * Enhancement #229: Show progress bar while loading the index
+
+   Restic did not provide any feedback while loading index files. Now, there is a progress bar that
+   shows the index loading progress.
+
+   https://github.com/restic/restic/issues/229
+   https://github.com/restic/restic/pull/4419
+
+ * Enhancement #4128: Automatically set `GOMAXPROCS` in resource-constrained containers
+
+   When running restic in a Linux container with CPU-usage limits, restic now automatically
+   adjusts `GOMAXPROCS`. This helps to reduce the memory consumption on hosts with many CPU
+   cores.
+
+   https://github.com/restic/restic/issues/4128
+   https://github.com/restic/restic/pull/4485
+   https://github.com/restic/restic/pull/4531
+
+ * Enhancement #4480: Allow setting REST password and username via environment variables
+
+   Previously, it was only possible to specify the REST-server username and password in the
+   repository URL, or by using the `--repository-file` option. This meant it was not possible to
+   use authentication in contexts where the repository URL is stored in publicly accessible way.
+
+   Restic now allows setting the username and password using the `RESTIC_REST_USERNAME` and
+   `RESTIC_REST_PASSWORD` variables.
+
+   https://github.com/restic/restic/pull/4480
+
+ * Enhancement #4511: Include inode numbers in JSON output for `find` and `ls` commands
+
+   Restic used to omit the inode numbers in the JSON messages emitted for nodes by the `ls` command
+   as well as for matches by the `find` command. It now includes those values whenever they are
+   available.
+
+   https://github.com/restic/restic/pull/4511
+
+ * Enhancement #4519: Add config option to set SFTP command arguments
+
+   When using the `sftp` backend, scenarios where a custom identity file was needed for the SSH
+   connection, required the full command to be specified: `-o sftp.command='ssh
+   user@host:port -i /ssh/my_private_key -s sftp'`
+
+   Now, the `-o sftp.args=...` option can be passed to restic to specify custom arguments for the
+   SSH command executed by the SFTP backend. This simplifies the above example to `-o
+   sftp.args='-i /ssh/my_private_key'`.
+
+   https://github.com/restic/restic/issues/4241
+   https://github.com/restic/restic/pull/4519
+
+
 Changelog for restic 0.16.0 (2023-07-31)
 =======================================
 
@@ -1371,7 +1525,7 @@ Details
 
    Restic did not support limiting the IO concurrency / number of connections for accessing
    repositories stored using the local or SFTP backends. The number of connections is now limited
-   as for other backends, and can be configured via the the `-o local.connections=2` and `-o
+   as for other backends, and can be configured via the `-o local.connections=2` and `-o
    sftp.connections=5` options. This ensures that restic does not overwhelm the backend with
    concurrent IO operations.
 

README.md

@@ -95,7 +95,7 @@ release. Instructions on how to do that are contained in the
 News
 ----
 
-You can follow the restic project on Twitter [@resticbackup](https://twitter.com/resticbackup) or by subscribing to
+You can follow the restic project on Mastodon [@resticbackup](https://fosstodon.org/@restic) or by subscribing to
 the [project blog](https://restic.net/blog/).
 
 License

VERSION

@@ -1 +1 @@
-0.16.0
+0.16.2

changelog/0.14.0_2022-08-25/pull-3475

@@ -3,7 +3,7 @@ Enhancement: Allow limiting IO concurrency for local and SFTP backend
 Restic did not support limiting the IO concurrency / number of connections for
 accessing repositories stored using the local or SFTP backends. The number of
 connections is now limited as for other backends, and can be configured via the
-the `-o local.connections=2` and `-o sftp.connections=5` options. This ensures
-that restic does not overwhelm the backend with concurrent IO operations.
+`-o local.connections=2` and `-o sftp.connections=5` options. This ensures that
+restic does not overwhelm the backend with concurrent IO operations.
 
 https://github.com/restic/restic/pull/3475

changelog/0.16.1_2023-10-24/issue-4128

@@ -0,0 +1,9 @@
+Enhancement: Automatically set `GOMAXPROCS` in resource-constrained containers
+
+When running restic in a Linux container with CPU-usage limits, restic now
+automatically adjusts `GOMAXPROCS`. This helps to reduce the memory consumption
+on hosts with many CPU cores.
+
+https://github.com/restic/restic/issues/4128
+https://github.com/restic/restic/pull/4485
+https://github.com/restic/restic/pull/4531

changelog/0.16.1_2023-10-24/issue-4513

@@ -0,0 +1,8 @@
+Bugfix: Make `key list` command honor `--no-lock`
+
+The `key list` command now supports the `--no-lock` options. This allows
+determining which keys a repo can be accessed by without the need for having
+write access (e.g., read-only sftp access, filesystem snapshot).
+
+https://github.com/restic/restic/issues/4513
+https://github.com/restic/restic/pull/4514

changelog/0.16.1_2023-10-24/issue-4516

@@ -0,0 +1,8 @@
+Bugfix: Do not try to load password on command line autocomplete
+
+The command line autocompletion previously tried to load the repository
+password. This could cause the autocompletion not to work. Now, this step gets
+skipped.
+
+https://github.com/restic/restic/issues/4516
+https://github.com/restic/restic/pull/4526

changelog/0.16.1_2023-10-24/issue-4523

@@ -0,0 +1,22 @@
+Bugfix: Update zstd library to fix possible data corruption at max. compression
+
+In restic 0.16.0, backups where the compression level was set to `max` (using
+`--compression max`) could in rare and very specific circumstances result in
+data corruption due to a bug in the library used for compressing data.
+
+Restic now uses the latest version of the library used to compress data, which
+includes a fix for this issue. Please note that the `auto` compression level
+(which restic uses by default) was never affected, and even if you used `max`
+compression, chances of being affected by this issue were very small.
+
+To check a repository for any corruption, run `restic check --read-data`. This
+will download and verify the whole repository and can be used at any time to
+completely verify the integrity of a repository. If the `check` command detects
+anomalies, follow the suggested steps.
+
+To simplify any needed repository repair and minimize data loss, there is also
+a new and experimental `repair packs` command that salvages all valid data from
+the affected pack files (see `restic help repair packs` for more information).
+
+https://github.com/restic/restic/issues/4523
+https://github.com/restic/restic/pull/4530

changelog/0.16.1_2023-10-24/pull-299

@@ -0,0 +1,7 @@
+Enhancement: Show progress bar while loading the index
+
+Restic did not provide any feedback while loading index files. Now, there is a
+progress bar that shows the index loading progress.
+
+https://github.com/restic/restic/issues/229
+https://github.com/restic/restic/pull/4419

changelog/0.16.1_2023-10-24/pull-4480

@@ -0,0 +1,11 @@
+Enhancement: Allow setting REST password and username via environment variables
+
+Previously, it was only possible to specify the REST-server username and
+password in the repository URL, or by using the `--repository-file` option.
+This meant it was not possible to use authentication in contexts where the
+repository URL is stored in publicly accessible way.
+
+Restic now allows setting the username and password using the
+`RESTIC_REST_USERNAME` and `RESTIC_REST_PASSWORD` variables.
+
+https://github.com/restic/restic/pull/4480

changelog/0.16.1_2023-10-24/pull-4511

@@ -0,0 +1,7 @@
+Enhancement: Include inode numbers in JSON output for `find` and `ls` commands
+
+Restic used to omit the inode numbers in the JSON messages emitted for nodes by
+the `ls` command as well as for matches by the `find` command. It now includes
+those values whenever they are available.
+
+https://github.com/restic/restic/pull/4511

changelog/0.16.1_2023-10-24/pull-4519

@@ -0,0 +1,12 @@
+Enhancement: Add config option to set SFTP command arguments
+
+When using the `sftp` backend, scenarios where a custom identity file was
+needed for the SSH connection, required the full command to be specified:
+`-o sftp.command='ssh user@host:port -i /ssh/my_private_key -s sftp'`
+
+Now, the `-o sftp.args=...` option can be passed to restic to specify
+custom arguments for the SSH command executed by the SFTP backend.
+This simplifies the above example to `-o sftp.args='-i /ssh/my_private_key'`.
+
+https://github.com/restic/restic/pull/4519
+https://github.com/restic/restic/issues/4241

changelog/0.16.1_2023-10-24/pull-4532

@@ -0,0 +1,8 @@
+Change: Update dependencies and require Go 1.19 or newer
+
+We have updated all dependencies. Since some libraries require newer Go
+standard library features, support for Go 1.18 has been dropped, which means
+that restic now requires at least Go 1.19 to build.
+
+https://github.com/restic/restic/pull/4532
+https://github.com/restic/restic/pull/4533

changelog/0.16.2_2023-10-29/issue-4540

@@ -0,0 +1,9 @@
+Bugfix: Restore ARMv5 support for ARM binaries
+
+The official release binaries for restic 0.16.1 were accidentally built to
+require ARMv7. The build process is now updated to restore support for ARMv5.
+
+Please note that restic 0.17.0 will drop support for ARMv5 and require at least
+ARMv6.
+
+https://github.com/restic/restic/issues/4540

changelog/0.16.2_2023-10-29/pull-4545

@@ -0,0 +1,8 @@
+Bugfix: Repair documentation build on Read the Docs
+
+For restic 0.16.1, no documentation was available at
+https://restic.readthedocs.io/ .
+
+The documentation build process is now updated to work again.
+
+https://github.com/restic/restic/pull/4545

cmd/restic/cmd_backup.go

@@ -546,7 +546,10 @@ func runBackup(ctx context.Context, opts BackupOptions, gopts GlobalOptions, ter
 	if !gopts.JSON {
 		progressPrinter.V("load index files")
 	}
-	err = repo.LoadIndex(ctx)
+
+	bar := newIndexTerminalProgress(gopts.Quiet, gopts.JSON, term)
+
+	err = repo.LoadIndex(ctx, bar)
 	if err != nil {
 		return err
 	}

cmd/restic/cmd_backup_integration_test.go

@@ -252,7 +252,7 @@ func TestBackupTreeLoadError(t *testing.T) {
 
 	r, err := OpenRepository(context.TODO(), env.gopts)
 	rtest.OK(t, err)
-	rtest.OK(t, r.LoadIndex(context.TODO()))
+	rtest.OK(t, r.LoadIndex(context.TODO(), nil))
 	treePacks := restic.NewIDSet()
 	r.Index().Each(context.TODO(), func(pb restic.PackedBlob) {
 		if pb.Type == restic.TreeBlob {

cmd/restic/cmd_cat.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"strings"
 
 	"github.com/spf13/cobra"
 
@@ -33,9 +34,34 @@ func init() {
 	cmdRoot.AddCommand(cmdCat)
 }
 
+func validateCatArgs(args []string) error {
+	var allowedCmds = []string{"config", "index", "snapshot", "key", "masterkey", "lock", "pack", "blob", "tree"}
+
+	if len(args) < 1 {
+		return errors.Fatal("type not specified")
+	}
+
+	validType := false
+	for _, v := range allowedCmds {
+		if v == args[0] {
+			validType = true
+			break
+		}
+	}
+	if !validType {
+		return errors.Fatalf("invalid type %q, must be one of [%s]", args[0], strings.Join(allowedCmds, "|"))
+	}
+
+	if args[0] != "masterkey" && args[0] != "config" && len(args) != 2 {
+		return errors.Fatal("ID not specified")
+	}
+
+	return nil
+}
+
 func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
-	if len(args) < 1 || (args[0] != "masterkey" && args[0] != "config" && len(args) != 2) {
-		return errors.Fatal("type or ID not specified")
+	if err := validateCatArgs(args); err != nil {
+		return err
 	}
 
 	repo, err := OpenRepository(ctx, gopts)
@@ -143,7 +169,8 @@ func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
 		return err
 
 	case "blob":
-		err = repo.LoadIndex(ctx)
+		bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+		err = repo.LoadIndex(ctx, bar)
 		if err != nil {
 			return err
 		}
@@ -171,7 +198,8 @@ func runCat(ctx context.Context, gopts GlobalOptions, args []string) error {
 			return errors.Fatalf("could not find snapshot: %v\n", err)
 		}
 
-		err = repo.LoadIndex(ctx)
+		bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+		err = repo.LoadIndex(ctx, bar)
 		if err != nil {
 			return err
 		}

cmd/restic/cmd_cat_test.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	rtest "github.com/restic/restic/internal/test"
+)
+
+func TestCatArgsValidation(t *testing.T) {
+	for _, test := range []struct {
+		args []string
+		err  string
+	}{
+		{[]string{}, "Fatal: type not specified"},
+		{[]string{"masterkey"}, ""},
+		{[]string{"invalid"}, `Fatal: invalid type "invalid"`},
+		{[]string{"snapshot"}, "Fatal: ID not specified"},
+		{[]string{"snapshot", "12345678"}, ""},
+	} {
+		t.Run("", func(t *testing.T) {
+			err := validateCatArgs(test.args)
+			if test.err == "" {
+				rtest.Assert(t, err == nil, "unexpected error %q", err)
+			} else {
+				rtest.Assert(t, strings.Contains(err.Error(), test.err), "unexpected error expected %q to contain %q", err, test.err)
+			}
+		})
+	}
+}

cmd/restic/cmd_check.go

@@ -226,7 +226,8 @@ func runCheck(ctx context.Context, opts CheckOptions, gopts GlobalOptions, args
 	}
 
 	Verbosef("load indexes\n")
-	hints, errs := chkr.LoadIndex(ctx)
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	hints, errs := chkr.LoadIndex(ctx, bar)
 
 	errorsFound := false
 	suggestIndexRebuild := false
@@ -329,11 +330,28 @@ func runCheck(ctx context.Context, opts CheckOptions, gopts GlobalOptions, args
 
 		go chkr.ReadPacks(ctx, packs, p, errChan)
 
+		var salvagePacks restic.IDs
+
 		for err := range errChan {
 			errorsFound = true
 			Warnf("%v\n", err)
+			if err, ok := err.(*checker.ErrPackData); ok {
+				if strings.Contains(err.Error(), "wrong data returned, hash is") {
+					salvagePacks = append(salvagePacks, err.PackID)
+				}
+			}
 		}
 		p.Done()
+
+		if len(salvagePacks) > 0 {
+			Warnf("\nThe repository contains pack files with damaged blobs. These blobs must be removed to repair the repository. This can be done using the following commands:\n\n")
+			var strIds []string
+			for _, id := range salvagePacks {
+				strIds = append(strIds, id.String())
+			}
+			Warnf("RESTIC_FEATURES=repair-packs-v1 restic repair packs %v\nrestic repair snapshots --forget\n\n", strings.Join(strIds, " "))
+			Warnf("Corrupted blobs are either caused by hardware problems or bugs in restic. Please open an issue at https://github.com/restic/restic/issues/new/choose for further troubleshooting!\n")
+		}
 	}
 
 	switch {

cmd/restic/cmd_copy.go

@@ -99,12 +99,13 @@ func runCopy(ctx context.Context, opts CopyOptions, gopts GlobalOptions, args []
 	}
 
 	debug.Log("Loading source index")
-	if err := srcRepo.LoadIndex(ctx); err != nil {
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	if err := srcRepo.LoadIndex(ctx, bar); err != nil {
 		return err
 	}
-
+	bar = newIndexProgress(gopts.Quiet, gopts.JSON)
 	debug.Log("Loading destination index")
-	if err := dstRepo.LoadIndex(ctx); err != nil {
+	if err := dstRepo.LoadIndex(ctx, bar); err != nil {
 		return err
 	}
 

cmd/restic/cmd_debug.go

@@ -134,7 +134,7 @@ func printPacks(ctx context.Context, repo *repository.Repository, wr io.Writer)
 }
 
 func dumpIndexes(ctx context.Context, repo restic.Repository, wr io.Writer) error {
-	return index.ForAllIndexes(ctx, repo, func(id restic.ID, idx *index.Index, oldFormat bool, err error) error {
+	return index.ForAllIndexes(ctx, repo.Backend(), repo, func(id restic.ID, idx *index.Index, oldFormat bool, err error) error {
 		Printf("index_id: %v\n", id)
 		if err != nil {
 			return err
@@ -469,7 +469,8 @@ func runDebugExamine(ctx context.Context, gopts GlobalOptions, args []string) er
 		}
 	}
 
-	err = repo.LoadIndex(ctx)
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	err = repo.LoadIndex(ctx, bar)
 	if err != nil {
 		return err
 	}

cmd/restic/cmd_diff.go

@@ -16,7 +16,7 @@ import (
 )
 
 var cmdDiff = &cobra.Command{
-	Use:   "diff [flags] snapshot-ID snapshot-ID",
+	Use:   "diff [flags] snapshotID snapshotID",
 	Short: "Show differences between two snapshots",
 	Long: `
 The "diff" command shows differences from the first to the second snapshot. The
@@ -29,6 +29,10 @@ directory:
 * M  The file's content was modified
 * T  The type was changed, e.g. a file was made a symlink
 
+To only compare files in specific subfolders, you can use the
+"<snapshotID>:<subfolder>" syntax, where "subfolder" is a path within the
+snapshot.
+
 EXIT STATUS
 ===========
 
@@ -359,8 +363,8 @@ func runDiff(ctx context.Context, opts DiffOptions, gopts GlobalOptions, args []
 	if !gopts.JSON {
 		Verbosef("comparing snapshot %v to %v:\n\n", sn1.ID().Str(), sn2.ID().Str())
 	}
-
-	if err = repo.LoadIndex(ctx); err != nil {
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	if err = repo.LoadIndex(ctx, bar); err != nil {
 		return err
 	}
 

cmd/restic/cmd_dump.go

@@ -24,9 +24,13 @@ single file is selected, it prints its contents to stdout. Folders are output
 as a tar (default) or zip file containing the contents of the specified folder.
 Pass "/" as file name to dump the whole snapshot as an archive file.
 
-The special snapshot "latest" can be used to use the latest snapshot in the
+The special snapshotID "latest" can be used to use the latest snapshot in the
 repository.
 
+To include the folder content at the root of the archive, you can use the
+"<snapshotID>:<subfolder>" syntax, where "subfolder" is a path within the
+snapshot.
+
 EXIT STATUS
 ===========
 
@@ -148,7 +152,8 @@ func runDump(ctx context.Context, opts DumpOptions, gopts GlobalOptions, args []
 		return errors.Fatalf("failed to find snapshot: %v", err)
 	}
 
-	err = repo.LoadIndex(ctx)
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	err = repo.LoadIndex(ctx, bar)
 	if err != nil {
 		return err
 	}

cmd/restic/cmd_find.go

@@ -126,7 +126,6 @@ func (s *statefulOutput) PrintPatternJSON(path string, node *restic.Node) {
 
 		// Make the following attributes disappear
 		Name               byte `json:"name,omitempty"`
-		Inode              byte `json:"inode,omitempty"`
 		ExtendedAttributes byte `json:"extended_attributes,omitempty"`
 		Device             byte `json:"device,omitempty"`
 		Content            byte `json:"content,omitempty"`
@@ -589,8 +588,8 @@ func runFind(ctx context.Context, opts FindOptions, gopts GlobalOptions, args []
 	if err != nil {
 		return err
 	}
-
-	if err = repo.LoadIndex(ctx); err != nil {
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	if err = repo.LoadIndex(ctx, bar); err != nil {
 		return err
 	}
 

cmd/restic/cmd_key.go

@@ -212,10 +212,13 @@ func runKey(ctx context.Context, gopts GlobalOptions, args []string) error {
 
 	switch args[0] {
 	case "list":
-		lock, ctx, err := lockRepo(ctx, repo, gopts.RetryLock, gopts.JSON)
-		defer unlockRepo(lock)
-		if err != nil {
-			return err
+		if !gopts.NoLock {
+			var lock *restic.Lock
+			lock, ctx, err = lockRepo(ctx, repo, gopts.RetryLock, gopts.JSON)
+			defer unlockRepo(lock)
+			if err != nil {
+				return err
+			}
 		}
 
 		return listKeys(ctx, repo, gopts)

cmd/restic/cmd_list.go

@@ -63,7 +63,7 @@ func runList(ctx context.Context, cmd *cobra.Command, gopts GlobalOptions, args
 	case "locks":
 		t = restic.LockFile
 	case "blobs":
-		return index.ForAllIndexes(ctx, repo, func(id restic.ID, idx *index.Index, oldFormat bool, err error) error {
+		return index.ForAllIndexes(ctx, repo.Backend(), repo, func(id restic.ID, idx *index.Index, oldFormat bool, err error) error {
 			if err != nil {
 				return err
 			}

cmd/restic/cmd_ls.go

@@ -87,6 +87,7 @@ func lsNodeJSON(enc *json.Encoder, path string, node *restic.Node) error {
 		ModTime     time.Time   `json:"mtime,omitempty"`
 		AccessTime  time.Time   `json:"atime,omitempty"`
 		ChangeTime  time.Time   `json:"ctime,omitempty"`
+		Inode       uint64      `json:"inode,omitempty"`
 		StructType  string      `json:"struct_type"` // "node"
 
 		size uint64 // Target for Size pointer.
@@ -102,6 +103,7 @@ func lsNodeJSON(enc *json.Encoder, path string, node *restic.Node) error {
 		ModTime:     node.ModTime,
 		AccessTime:  node.AccessTime,
 		ChangeTime:  node.ChangeTime,
+		Inode:       node.Inode,
 		StructType:  "node",
 	}
 	// Always print size for regular files, even when empty,
@@ -173,7 +175,8 @@ func runLs(ctx context.Context, opts LsOptions, gopts GlobalOptions, args []stri
 		return err
 	}
 
-	if err = repo.LoadIndex(ctx); err != nil {
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	if err = repo.LoadIndex(ctx, bar); err != nil {
 		return err
 	}
 

cmd/restic/cmd_mount.go

@@ -130,7 +130,8 @@ func runMount(ctx context.Context, opts MountOptions, gopts GlobalOptions, args
 		}
 	}
 
-	err = repo.LoadIndex(ctx)
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	err = repo.LoadIndex(ctx, bar)
 	if err != nil {
 		return err
 	}

cmd/restic/cmd_prune.go

@@ -187,7 +187,8 @@ func runPruneWithRepo(ctx context.Context, opts PruneOptions, gopts GlobalOption
 
 	Verbosef("loading indexes...\n")
 	// loading the index before the snapshots is ok, as we use an exclusive lock here
-	err := repo.LoadIndex(ctx)
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	err := repo.LoadIndex(ctx, bar)
 	if err != nil {
 		return err
 	}

cmd/restic/cmd_recover.go

@@ -58,7 +58,8 @@ func runRecover(ctx context.Context, gopts GlobalOptions) error {
 	}
 
 	Verbosef("load index files\n")
-	if err = repo.LoadIndex(ctx); err != nil {
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	if err = repo.LoadIndex(ctx, bar); err != nil {
 		return err
 	}
 
@@ -73,7 +74,7 @@ func runRecover(ctx context.Context, gopts GlobalOptions) error {
 	})
 
 	Verbosef("load %d trees\n", len(trees))
-	bar := newProgressMax(!gopts.Quiet, uint64(len(trees)), "trees loaded")
+	bar = newProgressMax(!gopts.Quiet, uint64(len(trees)), "trees loaded")
 	for id := range trees {
 		tree, err := restic.LoadTree(ctx, repo, id)
 		if err != nil {

cmd/restic/cmd_repair_index.go

@@ -88,7 +88,7 @@ func rebuildIndex(ctx context.Context, opts RepairIndexOptions, gopts GlobalOpti
 	} else {
 		Verbosef("loading indexes...\n")
 		mi := index.NewMasterIndex()
-		err := index.ForAllIndexes(ctx, repo, func(id restic.ID, idx *index.Index, oldFormat bool, err error) error {
+		err := index.ForAllIndexes(ctx, repo.Backend(), repo, func(id restic.ID, idx *index.Index, oldFormat bool, err error) error {
 			if err != nil {
 				Warnf("removing invalid index %v: %v\n", id, err)
 				obsoleteIndexes = append(obsoleteIndexes, id)

cmd/restic/cmd_repair_packs.go

@@ -0,0 +1,158 @@
+package main
+
+import (
+	"context"
+	"io"
+	"os"
+
+	"github.com/restic/restic/internal/errors"
+	"github.com/restic/restic/internal/repository"
+	"github.com/restic/restic/internal/restic"
+	"github.com/spf13/cobra"
+	"golang.org/x/sync/errgroup"
+)
+
+var cmdRepairPacks = &cobra.Command{
+	Use:   "packs [packIDs...]",
+	Short: "Salvage damaged pack files",
+	Long: `
+WARNING: The CLI for this command is experimental and will likely change in the future!
+
+The "repair packs" command extracts intact blobs from the specified pack files, rebuilds
+the index to remove the damaged pack files and removes the pack files from the repository.
+
+EXIT STATUS
+===========
+
+Exit status is 0 if the command was successful, and non-zero if there was any error.
+`,
+	DisableAutoGenTag: true,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return runRepairPacks(cmd.Context(), globalOptions, args)
+	},
+}
+
+func init() {
+	cmdRepair.AddCommand(cmdRepairPacks)
+}
+
+func runRepairPacks(ctx context.Context, gopts GlobalOptions, args []string) error {
+	// FIXME discuss and add proper feature flag mechanism
+	flag, _ := os.LookupEnv("RESTIC_FEATURES")
+	if flag != "repair-packs-v1" {
+		return errors.Fatal("This command is experimental and may change/be removed without notice between restic versions. " +
+			"Set the environment variable 'RESTIC_FEATURES=repair-packs-v1' to enable it.")
+	}
+
+	ids := restic.NewIDSet()
+	for _, arg := range args {
+		id, err := restic.ParseID(arg)
+		if err != nil {
+			return err
+		}
+		ids.Insert(id)
+	}
+	if len(ids) == 0 {
+		return errors.Fatal("no ids specified")
+	}
+
+	repo, err := OpenRepository(ctx, gopts)
+	if err != nil {
+		return err
+	}
+
+	lock, ctx, err := lockRepoExclusive(ctx, repo, gopts.RetryLock, gopts.JSON)
+	defer unlockRepo(lock)
+	if err != nil {
+		return err
+	}
+
+	return repairPacks(ctx, gopts, repo, ids)
+}
+
+func repairPacks(ctx context.Context, gopts GlobalOptions, repo *repository.Repository, ids restic.IDSet) error {
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	err := repo.LoadIndex(ctx, bar)
+	if err != nil {
+		return errors.Fatalf("%s", err)
+	}
+
+	Warnf("saving backup copies of pack files in current folder\n")
+	for id := range ids {
+		f, err := os.OpenFile("pack-"+id.String(), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o666)
+		if err != nil {
+			return errors.Fatalf("%s", err)
+		}
+
+		err = repo.Backend().Load(ctx, restic.Handle{Type: restic.PackFile, Name: id.String()}, 0, 0, func(rd io.Reader) error {
+			_, err := f.Seek(0, 0)
+			if err != nil {
+				return err
+			}
+			_, err = io.Copy(f, rd)
+			return err
+		})
+		if err != nil {
+			return errors.Fatalf("%s", err)
+		}
+	}
+
+	wg, wgCtx := errgroup.WithContext(ctx)
+	repo.StartPackUploader(wgCtx, wg)
+	repo.DisableAutoIndexUpdate()
+
+	Warnf("salvaging intact data from specified pack files\n")
+	bar = newProgressMax(!gopts.Quiet, uint64(len(ids)), "pack files")
+	defer bar.Done()
+
+	wg.Go(func() error {
+		// examine all data the indexes have for the pack file
+		for b := range repo.Index().ListPacks(wgCtx, ids) {
+			blobs := b.Blobs
+			if len(blobs) == 0 {
+				Warnf("no blobs found for pack %v\n", b.PackID)
+				bar.Add(1)
+				continue
+			}
+
+			err = repository.StreamPack(wgCtx, repo.Backend().Load, repo.Key(), b.PackID, blobs, func(blob restic.BlobHandle, buf []byte, err error) error {
+				if err != nil {
+					// Fallback path
+					buf, err = repo.LoadBlob(wgCtx, blob.Type, blob.ID, nil)
+					if err != nil {
+						Warnf("failed to load blob %v: %v\n", blob.ID, err)
+						return nil
+					}
+				}
+				id, _, _, err := repo.SaveBlob(wgCtx, blob.Type, buf, restic.ID{}, true)
+				if !id.Equal(blob.ID) {
+					panic("pack id mismatch during upload")
+				}
+				return err
+			})
+			if err != nil {
+				return err
+			}
+			bar.Add(1)
+		}
+		return repo.Flush(wgCtx)
+	})
+
+	if err := wg.Wait(); err != nil {
+		return errors.Fatalf("%s", err)
+	}
+	bar.Done()
+
+	// remove salvaged packs from index
+	err = rebuildIndexFiles(ctx, gopts, repo, ids, nil)
+	if err != nil {
+		return errors.Fatalf("%s", err)
+	}
+
+	// cleanup
+	Warnf("removing salvaged pack files\n")
+	DeleteFiles(ctx, gopts, repo, ids, restic.PackFile)
+
+	Warnf("\nUse `restic repair snapshots --forget` to remove the corrupted data blobs from all snapshots\n")
+	return nil
+}

cmd/restic/cmd_repair_snapshots.go

@@ -89,7 +89,8 @@ func runRepairSnapshots(ctx context.Context, gopts GlobalOptions, opts RepairOpt
 		return err
 	}
 
-	if err := repo.LoadIndex(ctx); err != nil {
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	if err := repo.LoadIndex(ctx, bar); err != nil {
 		return err
 	}
 

cmd/restic/cmd_restore.go

@@ -25,9 +25,12 @@ var cmdRestore = &cobra.Command{
 The "restore" command extracts the data from a snapshot from the repository to
 a directory.
 
-The special snapshot "latest" can be used to restore the latest snapshot in the
+The special snapshotID "latest" can be used to restore the latest snapshot in the
 repository.
 
+To only restore a specific subfolder, you can use the "<snapshotID>:<subfolder>"
+syntax, where "subfolder" is a path within the snapshot.
+
 EXIT STATUS
 ===========
 
@@ -82,9 +85,9 @@ func init() {
 
 	flags := cmdRestore.Flags()
 	flags.StringArrayVarP(&restoreOptions.Exclude, "exclude", "e", nil, "exclude a `pattern` (can be specified multiple times)")
-	flags.StringArrayVar(&restoreOptions.InsensitiveExclude, "iexclude", nil, "same as `--exclude` but ignores the casing of filenames")
+	flags.StringArrayVar(&restoreOptions.InsensitiveExclude, "iexclude", nil, "same as --exclude but ignores the casing of `pattern`")
 	flags.StringArrayVarP(&restoreOptions.Include, "include", "i", nil, "include a `pattern`, exclude everything else (can be specified multiple times)")
-	flags.StringArrayVar(&restoreOptions.InsensitiveInclude, "iinclude", nil, "same as `--include` but ignores the casing of filenames")
+	flags.StringArrayVar(&restoreOptions.InsensitiveInclude, "iinclude", nil, "same as --include but ignores the casing of `pattern`")
 	flags.StringVarP(&restoreOptions.Target, "target", "t", "", "directory to extract data to")
 
 	initSingleSnapshotFilter(flags, &restoreOptions.SnapshotFilter)
@@ -170,7 +173,8 @@ func runRestore(ctx context.Context, opts RestoreOptions, gopts GlobalOptions,
 		return errors.Fatalf("failed to find snapshot: %v", err)
 	}
 
-	err = repo.LoadIndex(ctx)
+	bar := newIndexTerminalProgress(gopts.Quiet, gopts.JSON, term)
+	err = repo.LoadIndex(ctx, bar)
 	if err != nil {
 		return err
 	}

cmd/restic/cmd_rewrite.go

@@ -212,7 +212,8 @@ func runRewrite(ctx context.Context, opts RewriteOptions, gopts GlobalOptions, a
 		return err
 	}
 
-	if err = repo.LoadIndex(ctx); err != nil {
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	if err = repo.LoadIndex(ctx, bar); err != nil {
 		return err
 	}
 

cmd/restic/cmd_stats.go

@@ -98,8 +98,8 @@ func runStats(ctx context.Context, opts StatsOptions, gopts GlobalOptions, args
 	if err != nil {
 		return err
 	}
-
-	if err = repo.LoadIndex(ctx); err != nil {
+	bar := newIndexProgress(gopts.Quiet, gopts.JSON)
+	if err = repo.LoadIndex(ctx, bar); err != nil {
 		return err
 	}
 

cmd/restic/cmd_tag.go

@@ -12,7 +12,7 @@ import (
 )
 
 var cmdTag = &cobra.Command{
-	Use:   "tag [flags] [snapshot-ID ...]",
+	Use:   "tag [flags] [snapshotID ...]",
 	Short: "Modify tags on snapshots",
 	Long: `
 The "tag" command allows you to modify tags on exiting snapshots.
@@ -20,7 +20,7 @@ The "tag" command allows you to modify tags on exiting snapshots.
 You can either set/replace the entire set of tags on a snapshot, or
 add tags to/remove tags from the existing set.
 
-When no snapshot-ID is given, all snapshots matching the host, tag and path filter criteria are modified.
+When no snapshotID is given, all snapshots matching the host, tag and path filter criteria are modified.
 
 EXIT STATUS
 ===========

cmd/restic/global.go

@@ -43,7 +43,7 @@ import (
 	"golang.org/x/term"
 )
 
-var version = "0.16.0"
+var version = "0.16.2"
 
 // TimeFormat is the format used for all timestamps printed by restic.
 const TimeFormat = "2006-01-02 15:04:05"

cmd/restic/integration_helpers_test.go

@@ -258,7 +258,7 @@ func removePacksExcept(gopts GlobalOptions, t testing.TB, keep restic.IDSet, rem
 	rtest.OK(t, err)
 
 	// Get all tree packs
-	rtest.OK(t, r.LoadIndex(context.TODO()))
+	rtest.OK(t, r.LoadIndex(context.TODO(), nil))
 
 	treePacks := restic.NewIDSet()
 	r.Index().Each(context.TODO(), func(pb restic.PackedBlob) {

cmd/restic/main.go

@@ -9,15 +9,20 @@ import (
 	"runtime"
 	godebug "runtime/debug"
 
+	"github.com/spf13/cobra"
+	"go.uber.org/automaxprocs/maxprocs"
+
 	"github.com/restic/restic/internal/debug"
+	"github.com/restic/restic/internal/errors"
 	"github.com/restic/restic/internal/options"
 	"github.com/restic/restic/internal/restic"
-
-	"github.com/spf13/cobra"
-
-	"github.com/restic/restic/internal/errors"
 )
 
+func init() {
+	// don't import `go.uber.org/automaxprocs` to disable the log output
+	_, _ = maxprocs.Set()
+}
+
 // cmdRoot is the base command when no other command has been specified.
 var cmdRoot = &cobra.Command{
 	Use:   "restic",
@@ -75,7 +80,7 @@ The full documentation can be found at https://restic.readthedocs.io/ .
 // user for authentication).
 func needsPassword(cmd string) bool {
 	switch cmd {
-	case "cache", "generate", "help", "options", "self-update", "version":
+	case "cache", "generate", "help", "options", "self-update", "version", "__complete":
 		return false
 	default:
 		return true

cmd/restic/progress.go

@@ -29,13 +29,12 @@ func calculateProgressInterval(show bool, json bool) time.Duration {
 	return interval
 }
 
-// newProgressMax returns a progress.Counter that prints to stdout.
-func newProgressMax(show bool, max uint64, description string) *progress.Counter {
+// newTerminalProgressMax returns a progress.Counter that prints to stdout or terminal if provided.
+func newGenericProgressMax(show bool, max uint64, description string, print func(status string)) *progress.Counter {
 	if !show {
 		return nil
 	}
 	interval := calculateProgressInterval(show, false)
-	canUpdateStatus := stdoutCanUpdateStatus()
 
 	return progress.NewCounter(interval, max, func(v uint64, max uint64, d time.Duration, final bool) {
 		var status string
@@ -47,14 +46,28 @@ func newProgressMax(show bool, max uint64, description string) *progress.Counter
 				ui.FormatDuration(d), ui.FormatPercent(v, max), v, max, description)
 		}
 
-		printProgress(status, canUpdateStatus)
+		print(status)
 		if final {
 			fmt.Print("\n")
 		}
 	})
 }
 
-func printProgress(status string, canUpdateStatus bool) {
+func newTerminalProgressMax(show bool, max uint64, description string, term *termstatus.Terminal) *progress.Counter {
+	return newGenericProgressMax(show, max, description, func(status string) {
+		term.SetStatus([]string{status})
+	})
+}
+
+// newProgressMax calls newTerminalProgress without a terminal (print to stdout)
+func newProgressMax(show bool, max uint64, description string) *progress.Counter {
+	return newGenericProgressMax(show, max, description, printProgress)
+}
+
+func printProgress(status string) {
+
+	canUpdateStatus := stdoutCanUpdateStatus()
+
 	w := stdoutTerminalWidth()
 	if w > 0 {
 		if w < 3 {
@@ -83,3 +96,11 @@ func printProgress(status string, canUpdateStatus bool) {
 
 	_, _ = os.Stdout.Write([]byte(clear + status + carriageControl))
 }
+
+func newIndexProgress(quiet bool, json bool) *progress.Counter {
+	return newProgressMax(!quiet && !json && stdoutIsTerminal(), 0, "index files loaded")
+}
+
+func newIndexTerminalProgress(quiet bool, json bool, term *termstatus.Terminal) *progress.Counter {
+	return newTerminalProgressMax(!quiet && !json && stdoutIsTerminal(), 0, "index files loaded", term)
+}

doc/020_installation.rst

@@ -279,7 +279,7 @@ From Source
 ***********
 
 restic is written in the Go programming language and you need at least
-Go version 1.18. Building for Solaris requires at least Go version 1.20.
+Go version 1.19. Building for Solaris requires at least Go version 1.20.
 Building restic may also work with older versions of Go,
 but that's not supported. See the `Getting
 started <https://go.dev/doc/install>`__ guide of the Go project for

doc/030_preparing_a_new_repo.rst

@@ -119,10 +119,10 @@ user's home directory.
 Also, if the SFTP server is enforcing domain-confined users, you can
 specify the user this way: ``user@domain@host``.
 
-.. note:: Please be aware that sftp servers do not expand the tilde character
+.. note:: Please be aware that SFTP servers do not expand the tilde character
           (``~``) normally used as an alias for a user's home directory. If you
           want to specify a path relative to the user's home directory, pass a
-          relative path to the sftp backend.
+          relative path to the SFTP backend.
 
 If you need to specify a port number or IPv6 address, you'll need to use
 URL syntax. E.g., the repository ``/srv/restic-repo`` on ``[::1]`` (localhost)
@@ -172,9 +172,11 @@ Then use it in the backend specification:
 
 Last, if you'd like to use an entirely different program to create the
 SFTP connection, you can specify the command to be run with the option
-``-o sftp.command="foobar"``.
+``-o sftp.command="foobar"``. Alternatively, ``-o sftp.args`` allows
+setting the arguments passed to the default SSH command (ignored when
+``sftp.command`` is set)
 
-.. note:: Please be aware that sftp servers close connections when no data is
+.. note:: Please be aware that SFTP servers close connections when no data is
           received by the client. This can happen when restic is processing huge
           amounts of unchanged data. To avoid this issue add the following lines 
           to the client's .ssh/config file:
@@ -209,6 +211,14 @@ are some more examples:
     $ restic -r rest:https://user:pass@host:8000/ init
     $ restic -r rest:https://user:pass@host:8000/my_backup_repo/ init
 
+The server username and password can be specified using environment
+variables as well:
+
+.. code-block:: console
+
+    $ export RESTIC_REST_USERNAME=<MY_REST_SERVER_USERNAME>
+    $ export RESTIC_REST_PASSWORD=<MY_REST_SERVER_PASSWORD>
+
 If you use TLS, restic will use the system's CA certificates to verify the
 server certificate. When the verification fails, restic refuses to proceed and
 exits with an error. If you have your own self-signed certificate, or a custom
@@ -321,7 +331,7 @@ Wasabi
 ************
 
 `Wasabi <https://wasabi.com>`__ is a low cost Amazon S3 conformant object storage provider.
-Due to it's S3 conformance, Wasabi can be used as a storage provider for a restic repository.
+Due to its S3 conformance, Wasabi can be used as a storage provider for a restic repository.
 
 -  Create a Wasabi bucket using the `Wasabi Console <https://console.wasabisys.com>`__.
 -  Determine the correct Wasabi service URL for your bucket `here <https://wasabi-support.zendesk.com/hc/en-us/articles/360015106031-What-are-the-service-URLs-for-Wasabi-s-different-regions->`__.
@@ -812,7 +822,7 @@ To make this work we can employ the help of the ``setgid`` permission bit
 available on Linux and most other Unix systems. This permission bit makes
 newly created directories inherit both the group owner (gid) and setgid bit
 from the parent directory. Setting this bit requires root but since it
-propagates down to any new directories we only have to do this priviledged
+propagates down to any new directories we only have to do this privileged
 setup once:
 
 .. code-block:: console

doc/040_backup.rst

@@ -146,7 +146,7 @@ change detection rule based on file metadata to determine whether a file is
 likely unchanged since a previous backup. If it is, the file is not scanned
 again.
 
-The previous backup snapshot, called "parent" snaphot in restic terminology,
+The previous backup snapshot, called "parent" snapshot in restic terminology,
 is determined as follows. By default restic groups snapshots by hostname and
 backup paths, and then selects the latest snapshot in the group that matches
 the current backup. You can change the selection criteria using the
@@ -593,9 +593,16 @@ environment variables. The following lists these environment variables:
     AWS_PROFILE                         Amazon credentials profile (alternative to specifying key and region)
     AWS_SHARED_CREDENTIALS_FILE         Location of the AWS CLI shared credentials file (default: ~/.aws/credentials)
 
-    ST_AUTH                             Auth URL for keystone v1 authentication
-    ST_USER                             Username for keystone v1 authentication
-    ST_KEY                              Password for keystone v1 authentication
+    AZURE_ACCOUNT_NAME                  Account name for Azure
+    AZURE_ACCOUNT_KEY                   Account key for Azure
+    AZURE_ACCOUNT_SAS                   Shared access signatures (SAS) for Azure
+    AZURE_ENDPOINT_SUFFIX               Endpoint suffix for Azure Storage (default: core.windows.net)
+
+    B2_ACCOUNT_ID                       Account ID or applicationKeyId for Backblaze B2
+    B2_ACCOUNT_KEY                      Account Key or applicationKey for Backblaze B2
+
+    GOOGLE_PROJECT_ID                   Project ID for Google Cloud Storage
+    GOOGLE_APPLICATION_CREDENTIALS      Application Credentials for Google Cloud Storage (e.g. $HOME/.config/gs-secret-restic-key.json)
 
     OS_AUTH_URL                         Auth URL for keystone authentication
     OS_REGION_NAME                      Region name for keystone authentication
@@ -619,19 +626,15 @@ environment variables. The following lists these environment variables:
     OS_STORAGE_URL                      Storage URL for token authentication
     OS_AUTH_TOKEN                       Auth token for token authentication
 
-    B2_ACCOUNT_ID                       Account ID or applicationKeyId for Backblaze B2
-    B2_ACCOUNT_KEY                      Account Key or applicationKey for Backblaze B2
-
-    AZURE_ACCOUNT_NAME                  Account name for Azure
-    AZURE_ACCOUNT_KEY                   Account key for Azure
-    AZURE_ACCOUNT_SAS                   Shared access signatures (SAS) for Azure
-    AZURE_ENDPOINT_SUFFIX               Endpoint suffix for Azure Storage (default: core.windows.net)
-
-    GOOGLE_PROJECT_ID                   Project ID for Google Cloud Storage
-    GOOGLE_APPLICATION_CREDENTIALS      Application Credentials for Google Cloud Storage (e.g. $HOME/.config/gs-secret-restic-key.json)
-
     RCLONE_BWLIMIT                      rclone bandwidth limit
 
+    RESTIC_REST_USERNAME                Restic REST Server username
+    RESTIC_REST_PASSWORD                Restic REST Server password
+
+    ST_AUTH                             Auth URL for keystone v1 authentication
+    ST_USER                             Username for keystone v1 authentication
+    ST_KEY                              Password for keystone v1 authentication
+
 See :ref:`caching` for the rules concerning cache locations when
 ``RESTIC_CACHE_DIR`` is not set.
 

doc/045_working_with_repos.rst

@@ -136,6 +136,8 @@ or the environment variable ``$RESTIC_FROM_KEY_HINT``.
     repository. You can avoid this limitation by using the rclone backend
     along with remotes which are configured in rclone.
 
+.. note:: If `copy` is aborted, `copy` will resume the interrupted copying when it is run again. It's possible that up to 10 minutes of progress can be lost because the repository index is only updated from time to time.
+
 .. _copy-filtering-snapshots:
 
 Filtering snapshots to copy
@@ -335,7 +337,7 @@ over 5 separate invocations:
     $ restic -r /srv/restic-repo check --read-data-subset=4/5
     $ restic -r /srv/restic-repo check --read-data-subset=5/5
 
-Use ``--read-data-subset=x%`` to check a randomly choosen subset of the
+Use ``--read-data-subset=x%`` to check a randomly chosen subset of the
 repository pack files. It takes one parameter, ``x``, the percentage of
 pack files to check as an integer or floating point number. This will not
 guarantee to cover all available pack files after sufficient runs, but it is

doc/050_restore.rst

@@ -106,7 +106,7 @@ Restic supports storage and preservation of hard links. However, since
 hard links exist in the scope of a filesystem by definition, restoring
 hard links from a fuse mount should be done by a program that preserves
 hard links. A program that does so is ``rsync``, used with the option
---hard-links.
+``--hard-links``.
 
 .. note:: ``restic mount`` is mostly useful if you want to restore just a few
    files out of a snapshot, or to check which files are contained in a snapshot.

doc/070_encryption.rst

@@ -49,3 +49,5 @@ per repository. In fact, you can use the ``list``, ``add``, ``remove``, and
     ----------------------------------------------------------------------
      5c657874    username    kasimir   2015-08-12 13:35:05
     *eb78040b    username    kasimir   2015-08-12 13:29:57
+
+Note that the currently used key is indicated by an asterisk (``*``).

doc/075_scripting.rst

@@ -145,7 +145,7 @@ Verbose status provides details about the progress, including details about back
 Summary
 ^^^^^^^
 
-Summary is the last output line in a successful backup. 
+Summary is the last output line in a successful backup.
 
 +---------------------------+---------------------------------------------------------+
 | ``message_type``          | Always "summary"                                        |
@@ -277,6 +277,8 @@ Match object
 +-----------------+----------------------------------------------+
 | ``group``       | Name of group                                |
 +-----------------+----------------------------------------------+
+| ``inode``       | Inode number                                 |
++-----------------+----------------------------------------------+
 | ``mode``        | UNIX file mode, shorthand of ``permissions`` |
 +-----------------+----------------------------------------------+
 | ``device_id``   | OS specific device identifier                |
@@ -470,6 +472,8 @@ node
 +-----------------+--------------------------+
 | ``ctime``       | Node creation time       |
 +-----------------+--------------------------+
+| ``inode``       | Inode number of node     |
++-----------------+--------------------------+
 
 
 restore
@@ -485,7 +489,7 @@ Status
 +----------------------+------------------------------------------------------------+
 |``seconds_elapsed``   | Time since restore started                                 |
 +----------------------+------------------------------------------------------------+
-|``percent_done``      | Percentage of data backed up (bytes_restored/total_bytes)  |
+|``percent_done``      | Percentage of data restored (bytes_restored/total_bytes)   |
 +----------------------+------------------------------------------------------------+
 |``total_files``       | Total number of files detected                             |
 +----------------------+------------------------------------------------------------+

doc/080_examples.rst

@@ -220,7 +220,7 @@ repository:
 
 .. code-block:: console
 
-   $ ./restic init
+   $ restic init
    created restic backend b5c661a86a at s3:https://s3.amazonaws.com/restic-demo
 
    Please note that knowledge of your password is required to access
@@ -236,14 +236,14 @@ restic is now ready to be used with Amazon S3. Try to create a backup:
    10+0 records out
    10485760 bytes (10 MB, 10 MiB) copied, 0,0891322 s, 118 MB/s
 
-   $ ./restic backup test.bin
+   $ restic backup test.bin
    scan [/home/philip/restic-demo/test.bin]
    scanned 0 directories, 1 files in 0:00
    [0:04] 100.00%  2.500 MiB/s  10.000 MiB / 10.000 MiB  1 / 1 items ... ETA 0:00 
    duration: 0:04, 2.47MiB/s
    snapshot 10fdbace saved
 
-   $ ./restic snapshots
+   $ restic snapshots
    ID        Date                 Host        Tags        Directory
    ----------------------------------------------------------------------
    10fdbace  2017-03-26 16:41:50  blackbox                /home/philip/restic-demo/test.bin
@@ -252,7 +252,7 @@ A snapshot was created and stored in the S3 bucket. By default backups to Amazon
 
 .. code-block:: console
 
-  $ ./restic backup -o s3.storage-class=REDUCED_REDUNDANCY test.bin
+  $ restic backup -o s3.storage-class=REDUCED_REDUNDANCY test.bin
 
 This snapshot may now be restored:
 
@@ -260,7 +260,7 @@ This snapshot may now be restored:
 
    $ mkdir restore
 
-   $ ./restic restore 10fdbace --target restore
+   $ restic restore 10fdbace --target restore
    restoring <Snapshot 10fdbace of [/home/philip/restic-demo/test.bin] at 2017-03-26 16:41:50.201418102 +0200 CEST by philip@blackbox> to restore
 
    $ ls restore/

doc/bash-completion.sh

@@ -2156,6 +2156,70 @@ _restic_repair_index()
     noun_aliases=()
 }
 
+_restic_repair_packs()
+{
+    last_command="restic_repair_packs"
+
+    command_aliases=()
+
+    commands=()
+
+    flags=()
+    two_word_flags=()
+    local_nonpersistent_flags=()
+    flags_with_completion=()
+    flags_completion=()
+
+    flags+=("--help")
+    flags+=("-h")
+    local_nonpersistent_flags+=("--help")
+    local_nonpersistent_flags+=("-h")
+    flags+=("--cacert=")
+    two_word_flags+=("--cacert")
+    flags+=("--cache-dir=")
+    two_word_flags+=("--cache-dir")
+    flags+=("--cleanup-cache")
+    flags+=("--compression=")
+    two_word_flags+=("--compression")
+    flags+=("--insecure-tls")
+    flags+=("--json")
+    flags+=("--key-hint=")
+    two_word_flags+=("--key-hint")
+    flags+=("--limit-download=")
+    two_word_flags+=("--limit-download")
+    flags+=("--limit-upload=")
+    two_word_flags+=("--limit-upload")
+    flags+=("--no-cache")
+    flags+=("--no-lock")
+    flags+=("--option=")
+    two_word_flags+=("--option")
+    two_word_flags+=("-o")
+    flags+=("--pack-size=")
+    two_word_flags+=("--pack-size")
+    flags+=("--password-command=")
+    two_word_flags+=("--password-command")
+    flags+=("--password-file=")
+    two_word_flags+=("--password-file")
+    two_word_flags+=("-p")
+    flags+=("--quiet")
+    flags+=("-q")
+    flags+=("--repo=")
+    two_word_flags+=("--repo")
+    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
+    flags+=("--tls-client-cert=")
+    two_word_flags+=("--tls-client-cert")
+    flags+=("--verbose")
+    flags+=("-v")
+
+    must_have_one_flag=()
+    must_have_one_noun=()
+    noun_aliases=()
+}
+
 _restic_repair_snapshots()
 {
     last_command="restic_repair_snapshots"
@@ -2249,6 +2313,7 @@ _restic_repair()
     commands=()
     commands+=("help")
     commands+=("index")
+    commands+=("packs")
     commands+=("snapshots")
 
     flags=()

doc/conf.py

@@ -12,14 +12,16 @@
 #
 # All configuration values have a default; values that are commented out
 # serve to show the default.
-import os
 
 # -- General configuration ------------------------------------------------
 
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
-extensions = ['sphinx.ext.extlinks']
+extensions = [
+    'sphinx.ext.extlinks',
+    'sphinx_rtd_theme',
+]
 
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
@@ -35,7 +37,7 @@ master_doc = 'index'
 
 # General information about the project.
 project = 'restic'
-copyright = '2018, restic authors'
+copyright = '2023, restic authors'
 author = 'fd0'
 
 # The version info for the project you're documenting, acts as replacement for
@@ -54,7 +56,7 @@ release = version
 #
 # This is also used if you do content translation via gettext catalogs.
 # Usually you set "language" from the command line for these cases.
-language = None
+language = "en"
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
@@ -72,21 +74,11 @@ todo_include_todos = False
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
-#
-if os.environ.get('READTHEDOCS') == 'True':
-    html_context = {
-        'css_files': [
-            'https://media.readthedocs.org/css/sphinx_rtd_theme.css',
-            'https://media.readthedocs.org/css/readthedocs-doc-embed.css',
-            '_static/css/restic.css',
-        ]
-    }
-else:
-    # we're not built by rtd => add rtd-theme
-    import sphinx_rtd_theme
-    html_theme = 'sphinx_rtd_theme'
-    html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
-    html_style = 'css/restic.css'
+html_theme = 'sphinx_rtd_theme'
+
+html_css_files = [
+    'css/restic.css',
+]
 
 html_logo = 'logo/logo.png'
 

doc/man/restic-backup.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -31,7 +31,7 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB-e\fP, \fB--exclude\fP=[]
-	exclude a \fB\fCpattern\fR (can be specified multiple times)
+	exclude a \fBpattern\fR (can be specified multiple times)
 
 .PP
 \fB--exclude-caches\fP[=false]
@@ -39,27 +39,27 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB--exclude-file\fP=[]
-	read exclude patterns from a \fB\fCfile\fR (can be specified multiple times)
+	read exclude patterns from a \fBfile\fR (can be specified multiple times)
 
 .PP
 \fB--exclude-if-present\fP=[]
-	takes \fB\fCfilename[:header]\fR, exclude contents of directories containing filename (except filename itself) if header of that file is as provided (can be specified multiple times)
+	takes \fBfilename[:header]\fR, exclude contents of directories containing filename (except filename itself) if header of that file is as provided (can be specified multiple times)
 
 .PP
 \fB--exclude-larger-than\fP=""
-	max \fB\fCsize\fR of the files to be backed up (allowed suffixes: k/K, m/M, g/G, t/T)
+	max \fBsize\fR of the files to be backed up (allowed suffixes: k/K, m/M, g/G, t/T)
 
 .PP
 \fB--files-from\fP=[]
-	read the files to backup from \fB\fCfile\fR (can be combined with file args; can be specified multiple times)
+	read the files to backup from \fBfile\fR (can be combined with file args; can be specified multiple times)
 
 .PP
 \fB--files-from-raw\fP=[]
-	read the files to backup from \fB\fCfile\fR (can be combined with file args; can be specified multiple times)
+	read the files to backup from \fBfile\fR (can be combined with file args; can be specified multiple times)
 
 .PP
 \fB--files-from-verbatim\fP=[]
-	read the files to backup from \fB\fCfile\fR (can be combined with file args; can be specified multiple times)
+	read the files to backup from \fBfile\fR (can be combined with file args; can be specified multiple times)
 
 .PP
 \fB-f\fP, \fB--force\fP[=false]
@@ -67,7 +67,7 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB-g\fP, \fB--group-by\fP=host,paths
-	\fB\fCgroup\fR snapshots by host, paths and/or tags, separated by comma (disable grouping with '')
+	\fBgroup\fR snapshots by host, paths and/or tags, separated by comma (disable grouping with '')
 
 .PP
 \fB-h\fP, \fB--help\fP[=false]
@@ -75,15 +75,15 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB-H\fP, \fB--host\fP=""
-	set the \fB\fChostname\fR for the snapshot manually. To prevent an expensive rescan use the "parent" flag
+	set the \fBhostname\fR for the snapshot manually. To prevent an expensive rescan use the "parent" flag
 
 .PP
 \fB--iexclude\fP=[]
-	same as --exclude \fB\fCpattern\fR but ignores the casing of filenames
+	same as --exclude \fBpattern\fR but ignores the casing of filenames
 
 .PP
 \fB--iexclude-file\fP=[]
-	same as --exclude-file but ignores casing of \fB\fCfile\fRnames in patterns
+	same as --exclude-file but ignores casing of \fBfile\fRnames in patterns
 
 .PP
 \fB--ignore-ctime\fP[=false]
@@ -103,11 +103,11 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB--parent\fP=""
-	use this parent \fB\fCsnapshot\fR (default: latest snapshot in the group determined by --group-by and not newer than the timestamp determined by --time)
+	use this parent \fBsnapshot\fR (default: latest snapshot in the group determined by --group-by and not newer than the timestamp determined by --time)
 
 .PP
 \fB--read-concurrency\fP=0
-	read \fB\fCn\fR files concurrently (default: $RESTIC_READ_CONCURRENCY or 2)
+	read \fBn\fR files concurrently (default: $RESTIC_READ_CONCURRENCY or 2)
 
 .PP
 \fB--stdin\fP[=false]
@@ -115,15 +115,15 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB--stdin-filename\fP="stdin"
-	\fB\fCfilename\fR to use when reading from stdin
+	\fBfilename\fR to use when reading from stdin
 
 .PP
 \fB--tag\fP=[]
-	add \fB\fCtags\fR for the new snapshot in the format \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	add \fBtags\fR for the new snapshot in the format \fBtag[,tag,...]\fR (can be specified multiple times)
 
 .PP
 \fB--time\fP=""
-	\fB\fCtime\fR of the backup (ex. '2012-11-01 22:08:41') (default: now)
+	\fBtime\fR of the backup (ex. '2012-11-01 22:08:41') (default: now)
 
 .PP
 \fB--with-atime\fP[=false]
@@ -133,11 +133,11 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -157,15 +157,15 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -177,19 +177,19 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -197,11 +197,11 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -209,7 +209,7 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-cache.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -32,7 +32,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--max-age\fP=30
-	max age in \fB\fCdays\fR for cache directories to be considered old
+	max age in \fBdays\fR for cache directories to be considered old
 
 .PP
 \fB--no-size\fP[=false]
@@ -42,11 +42,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -66,15 +66,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -86,19 +86,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -106,11 +106,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -118,7 +118,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-cat.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -30,11 +30,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -54,15 +54,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -74,19 +74,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -94,11 +94,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -106,7 +106,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-check.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -37,7 +37,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--read-data-subset\fP=""
-	read a \fB\fCsubset\fR of data packs, specified as 'n/t' for specific part, or either 'x%' or 'x.y%' or a size in bytes with suffixes k/K, m/M, g/G, t/T for a random subset
+	read a \fBsubset\fR of data packs, specified as 'n/t' for specific part, or either 'x%' or 'x.y%' or a size in bytes with suffixes k/K, m/M, g/G, t/T for a random subset
 
 .PP
 \fB--with-cache\fP[=false]
@@ -47,11 +47,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -71,15 +71,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -91,19 +91,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -111,11 +111,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -123,7 +123,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-copy.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -37,19 +37,19 @@ new destination repository using the "init" command.
 
 .PP
 \fB--from-password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the source repository password from (default: $RESTIC_FROM_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the source repository password from (default: $RESTIC_FROM_PASSWORD_COMMAND)
 
 .PP
 \fB--from-password-file\fP=""
-	\fB\fCfile\fR to read the source repository password from (default: $RESTIC_FROM_PASSWORD_FILE)
+	\fBfile\fR to read the source repository password from (default: $RESTIC_FROM_PASSWORD_FILE)
 
 .PP
 \fB--from-repo\fP=""
-	source \fB\fCrepository\fR to copy snapshots from (default: $RESTIC_FROM_REPOSITORY)
+	source \fBrepository\fR to copy snapshots from (default: $RESTIC_FROM_REPOSITORY)
 
 .PP
 \fB--from-repository-file\fP=""
-	\fB\fCfile\fR from which to read the source repository location to copy snapshots from (default: $RESTIC_FROM_REPOSITORY_FILE)
+	\fBfile\fR from which to read the source repository location to copy snapshots from (default: $RESTIC_FROM_REPOSITORY_FILE)
 
 .PP
 \fB-h\fP, \fB--help\fP[=false]
@@ -57,25 +57,25 @@ new destination repository using the "init" command.
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR (can be specified multiple times)
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR (can be specified multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR (can be specified multiple times)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -95,15 +95,15 @@ new destination repository using the "init" command.
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -115,19 +115,19 @@ new destination repository using the "init" command.
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -135,11 +135,11 @@ new destination repository using the "init" command.
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -147,7 +147,7 @@ new destination repository using the "init" command.
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-diff.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -8,7 +8,7 @@ restic-diff - Show differences between two snapshots
 
 .SH SYNOPSIS
 .PP
-\fBrestic diff [flags] snapshot-ID snapshot-ID\fP
+\fBrestic diff [flags] snapshotID snapshotID\fP
 
 
 .SH DESCRIPTION
@@ -31,6 +31,11 @@ T  The type was changed, e.g. a file was made a symlink
 
 .RE
 
+.PP
+To only compare files in specific subfolders, you can use the
+":" syntax, where "subfolder" is a path within the
+snapshot.
+
 
 .SH EXIT STATUS
 .PP
@@ -50,11 +55,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -74,15 +79,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -94,19 +99,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -114,11 +119,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -126,7 +131,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-dump.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -19,9 +19,14 @@ as a tar (default) or zip file containing the contents of the specified folder.
 Pass "/" as file name to dump the whole snapshot as an archive file.
 
 .PP
-The special snapshot "latest" can be used to use the latest snapshot in the
+The special snapshotID "latest" can be used to use the latest snapshot in the
 repository.
 
+.PP
+To include the folder content at the root of the archive, you can use the
+":" syntax, where "subfolder" is a path within the
+snapshot.
+
 
 .SH EXIT STATUS
 .PP
@@ -31,7 +36,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS
 .PP
 \fB-a\fP, \fB--archive\fP="tar"
-	set archive \fB\fCformat\fR as "tar" or "zip"
+	set archive \fBformat\fR as "tar" or "zip"
 
 .PP
 \fB-h\fP, \fB--help\fP[=false]
@@ -39,25 +44,25 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR, when snapshot ID "latest" is given (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR, when snapshot ID "latest" is given (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR, when snapshot ID "latest" is given (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -77,15 +82,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -97,19 +102,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -117,11 +122,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -129,7 +134,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-find.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -29,7 +29,7 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR (can be specified multiple times)
 
 .PP
 \fB--human-readable\fP[=false]
@@ -57,7 +57,7 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR (can be specified multiple times)
 
 .PP
 \fB--show-pack-id\fP[=false]
@@ -65,11 +65,11 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 
 .PP
 \fB-s\fP, \fB--snapshot\fP=[]
-	snapshot \fB\fCid\fR to search in (can be given multiple times)
+	snapshot \fBid\fR to search in (can be given multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR (can be specified multiple times)
 
 .PP
 \fB--tree\fP[=false]
@@ -79,11 +79,11 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -103,15 +103,15 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -123,19 +123,19 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -143,11 +143,11 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -155,7 +155,7 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
@@ -163,10 +163,7 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 
 
 .SH EXAMPLE
-.PP
-.RS
-
-.nf
+.EX
 restic find config.json
 restic find --json "*.yml" "*.json"
 restic find --json --blob 420f620f b46ebe8a ddd38656
@@ -180,8 +177,7 @@ EXIT STATUS
 Exit status is 0 if the command was successful, and non-zero if there was any error.
 
 
-.fi
-.RE
+.EE
 
 
 .SH SEE ALSO

doc/man/restic-forget.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -35,67 +35,67 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS
 .PP
 \fB-l\fP, \fB--keep-last\fP=0
-	keep the last \fB\fCn\fR snapshots (use 'unlimited' to keep all snapshots)
+	keep the last \fBn\fR snapshots (use 'unlimited' to keep all snapshots)
 
 .PP
 \fB-H\fP, \fB--keep-hourly\fP=0
-	keep the last \fB\fCn\fR hourly snapshots (use 'unlimited' to keep all hourly snapshots)
+	keep the last \fBn\fR hourly snapshots (use 'unlimited' to keep all hourly snapshots)
 
 .PP
 \fB-d\fP, \fB--keep-daily\fP=0
-	keep the last \fB\fCn\fR daily snapshots (use 'unlimited' to keep all daily snapshots)
+	keep the last \fBn\fR daily snapshots (use 'unlimited' to keep all daily snapshots)
 
 .PP
 \fB-w\fP, \fB--keep-weekly\fP=0
-	keep the last \fB\fCn\fR weekly snapshots (use 'unlimited' to keep all weekly snapshots)
+	keep the last \fBn\fR weekly snapshots (use 'unlimited' to keep all weekly snapshots)
 
 .PP
 \fB-m\fP, \fB--keep-monthly\fP=0
-	keep the last \fB\fCn\fR monthly snapshots (use 'unlimited' to keep all monthly snapshots)
+	keep the last \fBn\fR monthly snapshots (use 'unlimited' to keep all monthly snapshots)
 
 .PP
 \fB-y\fP, \fB--keep-yearly\fP=0
-	keep the last \fB\fCn\fR yearly snapshots (use 'unlimited' to keep all yearly snapshots)
+	keep the last \fBn\fR yearly snapshots (use 'unlimited' to keep all yearly snapshots)
 
 .PP
 \fB--keep-within\fP=
-	keep snapshots that are newer than \fB\fCduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
+	keep snapshots that are newer than \fBduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
 
 .PP
 \fB--keep-within-hourly\fP=
-	keep hourly snapshots that are newer than \fB\fCduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
+	keep hourly snapshots that are newer than \fBduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
 
 .PP
 \fB--keep-within-daily\fP=
-	keep daily snapshots that are newer than \fB\fCduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
+	keep daily snapshots that are newer than \fBduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
 
 .PP
 \fB--keep-within-weekly\fP=
-	keep weekly snapshots that are newer than \fB\fCduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
+	keep weekly snapshots that are newer than \fBduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
 
 .PP
 \fB--keep-within-monthly\fP=
-	keep monthly snapshots that are newer than \fB\fCduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
+	keep monthly snapshots that are newer than \fBduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
 
 .PP
 \fB--keep-within-yearly\fP=
-	keep yearly snapshots that are newer than \fB\fCduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
+	keep yearly snapshots that are newer than \fBduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
 
 .PP
 \fB--keep-tag\fP=[]
-	keep snapshots with this \fB\fCtaglist\fR (can be specified multiple times)
+	keep snapshots with this \fBtaglist\fR (can be specified multiple times)
 
 .PP
 \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR (can be specified multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR (can be specified multiple times)
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR (can be specified multiple times)
 
 .PP
 \fB-c\fP, \fB--compact\fP[=false]
@@ -103,7 +103,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-g\fP, \fB--group-by\fP=host,paths
-	\fB\fCgroup\fR snapshots by host, paths and/or tags, separated by comma (disable grouping with '')
+	\fBgroup\fR snapshots by host, paths and/or tags, separated by comma (disable grouping with '')
 
 .PP
 \fB-n\fP, \fB--dry-run\fP[=false]
@@ -115,11 +115,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--max-unused\fP="5%"
-	tolerate given \fB\fClimit\fR of unused data (absolute value in bytes with suffixes k/K, m/M, g/G, t/T, a value in % or the word 'unlimited')
+	tolerate given \fBlimit\fR of unused data (absolute value in bytes with suffixes k/K, m/M, g/G, t/T, a value in % or the word 'unlimited')
 
 .PP
 \fB--max-repack-size\fP=""
-	maximum \fB\fCsize\fR to repack (allowed suffixes: k/K, m/M, g/G, t/T)
+	maximum \fBsize\fR to repack (allowed suffixes: k/K, m/M, g/G, t/T)
 
 .PP
 \fB--repack-cacheable-only\fP[=false]
@@ -141,11 +141,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -165,15 +165,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -185,19 +185,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -205,11 +205,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -217,7 +217,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-generate.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -25,11 +25,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS
 .PP
 \fB--bash-completion\fP=""
-	write bash completion \fB\fCfile\fR
+	write bash completion \fBfile\fR
 
 .PP
 \fB--fish-completion\fP=""
-	write fish completion \fB\fCfile\fR
+	write fish completion \fBfile\fR
 
 .PP
 \fB-h\fP, \fB--help\fP[=false]
@@ -37,25 +37,25 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--man\fP=""
-	write man pages to \fB\fCdirectory\fR
+	write man pages to \fBdirectory\fR
 
 .PP
 \fB--powershell-completion\fP=""
-	write powershell completion \fB\fCfile\fR
+	write powershell completion \fBfile\fR
 
 .PP
 \fB--zsh-completion\fP=""
-	write zsh completion \fB\fCfile\fR
+	write zsh completion \fBfile\fR
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -75,15 +75,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -95,19 +95,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -115,11 +115,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -127,7 +127,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-init.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -32,19 +32,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--from-password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the source repository password from (default: $RESTIC_FROM_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the source repository password from (default: $RESTIC_FROM_PASSWORD_COMMAND)
 
 .PP
 \fB--from-password-file\fP=""
-	\fB\fCfile\fR to read the source repository password from (default: $RESTIC_FROM_PASSWORD_FILE)
+	\fBfile\fR to read the source repository password from (default: $RESTIC_FROM_PASSWORD_FILE)
 
 .PP
 \fB--from-repo\fP=""
-	source \fB\fCrepository\fR to copy chunker parameters from (default: $RESTIC_FROM_REPOSITORY)
+	source \fBrepository\fR to copy chunker parameters from (default: $RESTIC_FROM_REPOSITORY)
 
 .PP
 \fB--from-repository-file\fP=""
-	\fB\fCfile\fR from which to read the source repository location to copy chunker parameters from (default: $RESTIC_FROM_REPOSITORY_FILE)
+	\fBfile\fR from which to read the source repository location to copy chunker parameters from (default: $RESTIC_FROM_REPOSITORY_FILE)
 
 .PP
 \fB-h\fP, \fB--help\fP[=false]
@@ -58,11 +58,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -82,15 +82,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -102,19 +102,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -122,11 +122,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -134,7 +134,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-key.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -32,7 +32,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--new-password-file\fP=""
-	\fB\fCfile\fR from which to read the new password
+	\fBfile\fR from which to read the new password
 
 .PP
 \fB--user\fP=""
@@ -42,11 +42,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -66,15 +66,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -86,19 +86,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -106,11 +106,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -118,7 +118,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-list.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -30,11 +30,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -54,15 +54,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -74,19 +74,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -94,11 +94,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -106,7 +106,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-ls.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -43,7 +43,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR, when snapshot ID "latest" is given (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
 .PP
 \fB--human-readable\fP[=false]
@@ -55,7 +55,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR, when snapshot ID "latest" is given (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
 .PP
 \fB--recursive\fP[=false]
@@ -63,17 +63,17 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR, when snapshot ID "latest" is given (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -93,15 +93,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -113,19 +113,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -133,11 +133,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -145,7 +145,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-migrate.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -36,11 +36,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -60,15 +60,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -80,19 +80,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -100,11 +100,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -112,7 +112,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-mount.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -26,26 +26,18 @@ you can pass a time template via --time-template and path templates via
 .PP
 Example time template without colons:
 
-.PP
-.RS
-
-.nf
+.EX
 --time-template "2006-01-02_15-04-05"
 
-.fi
-.RE
+.EE
 
 .PP
 You need to specify a sample format for exactly the following timestamp:
 
-.PP
-.RS
-
-.nf
+.EX
 Mon Jan 2 15:04:05 -0700 MST 2006
 
-.fi
-.RE
+.EE
 
 .PP
 For details please see the documentation for time.Format() at:
@@ -84,7 +76,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR (can be specified multiple times)
 
 .PP
 \fB--no-default-permissions\fP[=false]
@@ -96,29 +88,29 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR (can be specified multiple times)
 
 .PP
 \fB--path-template\fP=[]
-	set \fB\fCtemplate\fR for path names (can be specified multiple times)
+	set \fBtemplate\fR for path names (can be specified multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR (can be specified multiple times)
 
 .PP
 \fB--time-template\fP="2006-01-02T15:04:05Z07:00"
-	set \fB\fCtemplate\fR to use for times
+	set \fBtemplate\fR to use for times
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -138,15 +130,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -158,19 +150,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -178,11 +170,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -190,7 +182,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-prune.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -33,11 +33,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--max-repack-size\fP=""
-	maximum \fB\fCsize\fR to repack (allowed suffixes: k/K, m/M, g/G, t/T)
+	maximum \fBsize\fR to repack (allowed suffixes: k/K, m/M, g/G, t/T)
 
 .PP
 \fB--max-unused\fP="5%"
-	tolerate given \fB\fClimit\fR of unused data (absolute value in bytes with suffixes k/K, m/M, g/G, t/T, a value in % or the word 'unlimited')
+	tolerate given \fBlimit\fR of unused data (absolute value in bytes with suffixes k/K, m/M, g/G, t/T, a value in % or the word 'unlimited')
 
 .PP
 \fB--repack-cacheable-only\fP[=false]
@@ -59,11 +59,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -83,15 +83,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -103,19 +103,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -123,11 +123,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -135,7 +135,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-recover.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -32,11 +32,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -56,15 +56,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -76,19 +76,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -96,11 +96,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -108,7 +108,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-repair-index.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -35,11 +35,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -59,15 +59,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -79,19 +79,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -99,11 +99,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -111,7 +111,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-repair-packs.1

@@ -0,0 +1,122 @@
+.nh
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
+
+.SH NAME
+.PP
+restic-repair-packs - Salvage damaged pack files
+
+
+.SH SYNOPSIS
+.PP
+\fBrestic repair packs [packIDs...] [flags]\fP
+
+
+.SH DESCRIPTION
+.PP
+WARNING: The CLI for this command is experimental and will likely change in the future!
+
+.PP
+The "repair packs" command extracts intact blobs from the specified pack files, rebuilds
+the index to remove the damaged pack files and removes the pack files from the repository.
+
+
+.SH EXIT STATUS
+.PP
+Exit status is 0 if the command was successful, and non-zero if there was any error.
+
+
+.SH OPTIONS
+.PP
+\fB-h\fP, \fB--help\fP[=false]
+	help for packs
+
+
+.SH OPTIONS INHERITED FROM PARENT COMMANDS
+.PP
+\fB--cacert\fP=[]
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+
+.PP
+\fB--cache-dir\fP=""
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
+
+.PP
+\fB--cleanup-cache\fP[=false]
+	auto remove old cache directories
+
+.PP
+\fB--compression\fP=auto
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
+
+.PP
+\fB--insecure-tls\fP[=false]
+	skip TLS certificate verification when connecting to the repository (insecure)
+
+.PP
+\fB--json\fP[=false]
+	set output mode to JSON for commands that support it
+
+.PP
+\fB--key-hint\fP=""
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+
+.PP
+\fB--limit-download\fP=0
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
+
+.PP
+\fB--limit-upload\fP=0
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
+
+.PP
+\fB--no-cache\fP[=false]
+	do not use a local cache
+
+.PP
+\fB--no-lock\fP[=false]
+	do not lock the repository, this allows some operations on read-only repositories
+
+.PP
+\fB-o\fP, \fB--option\fP=[]
+	set extended option (\fBkey=value\fR, can be specified multiple times)
+
+.PP
+\fB--pack-size\fP=0
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+
+.PP
+\fB--password-command\fP=""
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+
+.PP
+\fB-p\fP, \fB--password-file\fP=""
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+
+.PP
+\fB-q\fP, \fB--quiet\fP[=false]
+	do not output comprehensive progress report
+
+.PP
+\fB-r\fP, \fB--repo\fP=""
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+
+.PP
+\fB--repository-file\fP=""
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
+.PP
+\fB--tls-client-cert\fP=""
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+
+.PP
+\fB-v\fP, \fB--verbose\fP[=0]
+	be verbose (specify multiple times or a level using --verbose=n``, max level/times is 2)
+
+
+.SH SEE ALSO
+.PP
+\fBrestic-repair(1)\fP

doc/man/restic-repair-snapshots.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -55,25 +55,25 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR (can be specified multiple times)
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR (can be specified multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR (can be specified multiple times)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -93,15 +93,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -113,19 +113,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -133,11 +133,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -145,7 +145,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-repair.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -25,11 +25,11 @@ Repair the repository
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -49,15 +49,15 @@ Repair the repository
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -69,19 +69,19 @@ Repair the repository
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -89,11 +89,11 @@ Repair the repository
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -101,7 +101,7 @@ Repair the repository
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
@@ -110,4 +110,4 @@ Repair the repository
 
 .SH SEE ALSO
 .PP
-\fBrestic(1)\fP, \fBrestic-repair-index(1)\fP, \fBrestic-repair-snapshots(1)\fP
+\fBrestic(1)\fP, \fBrestic-repair-index(1)\fP, \fBrestic-repair-packs(1)\fP, \fBrestic-repair-snapshots(1)\fP

doc/man/restic-restore.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -17,9 +17,13 @@ The "restore" command extracts the data from a snapshot from the repository to
 a directory.
 
 .PP
-The special snapshot "latest" can be used to restore the latest snapshot in the
+The special snapshotID "latest" can be used to restore the latest snapshot in the
 repository.
 
+.PP
+To only restore a specific subfolder, you can use the ":"
+syntax, where "subfolder" is a path within the snapshot.
+
 
 .SH EXIT STATUS
 .PP
@@ -29,7 +33,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS
 .PP
 \fB-e\fP, \fB--exclude\fP=[]
-	exclude a \fB\fCpattern\fR (can be specified multiple times)
+	exclude a \fBpattern\fR (can be specified multiple times)
 
 .PP
 \fB-h\fP, \fB--help\fP[=false]
@@ -37,23 +41,23 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR, when snapshot ID "latest" is given (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
 .PP
 \fB--iexclude\fP=[]
-	same as \fB\fC--exclude\fR but ignores the casing of filenames
+	same as --exclude but ignores the casing of \fBpattern\fR
 
 .PP
 \fB--iinclude\fP=[]
-	same as \fB\fC--include\fR but ignores the casing of filenames
+	same as --include but ignores the casing of \fBpattern\fR
 
 .PP
 \fB-i\fP, \fB--include\fP=[]
-	include a \fB\fCpattern\fR, exclude everything else (can be specified multiple times)
+	include a \fBpattern\fR, exclude everything else (can be specified multiple times)
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR, when snapshot ID "latest" is given (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
 .PP
 \fB--sparse\fP[=false]
@@ -61,7 +65,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR, when snapshot ID "latest" is given (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
 .PP
 \fB-t\fP, \fB--target\fP=""
@@ -75,11 +79,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -99,15 +103,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -119,19 +123,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -139,11 +143,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -151,7 +155,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-rewrite.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -45,11 +45,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-e\fP, \fB--exclude\fP=[]
-	exclude a \fB\fCpattern\fR (can be specified multiple times)
+	exclude a \fBpattern\fR (can be specified multiple times)
 
 .PP
 \fB--exclude-file\fP=[]
-	read exclude patterns from a \fB\fCfile\fR (can be specified multiple times)
+	read exclude patterns from a \fBfile\fR (can be specified multiple times)
 
 .PP
 \fB--forget\fP[=false]
@@ -61,33 +61,33 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR (can be specified multiple times)
 
 .PP
 \fB--iexclude\fP=[]
-	same as --exclude \fB\fCpattern\fR but ignores the casing of filenames
+	same as --exclude \fBpattern\fR but ignores the casing of filenames
 
 .PP
 \fB--iexclude-file\fP=[]
-	same as --exclude-file but ignores casing of \fB\fCfile\fRnames in patterns
+	same as --exclude-file but ignores casing of \fBfile\fRnames in patterns
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR (can be specified multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR (can be specified multiple times)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -107,15 +107,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -127,19 +127,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -147,11 +147,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -159,7 +159,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-self-update.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -31,17 +31,17 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--output\fP=""
-	Save the downloaded file as \fB\fCfilename\fR (default: running binary itself)
+	Save the downloaded file as \fBfilename\fR (default: running binary itself)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -61,15 +61,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -81,19 +81,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -101,11 +101,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -113,7 +113,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-snapshots.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -28,7 +28,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-g\fP, \fB--group-by\fP=
-	\fB\fCgroup\fR snapshots by host, paths and/or tags, separated by comma
+	\fBgroup\fR snapshots by host, paths and/or tags, separated by comma
 
 .PP
 \fB-h\fP, \fB--help\fP[=false]
@@ -36,29 +36,29 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR (can be specified multiple times)
 
 .PP
 \fB--latest\fP=0
-	only show the last \fB\fCn\fR snapshots for each host and path
+	only show the last \fBn\fR snapshots for each host and path
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR (can be specified multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR (can be specified multiple times)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -78,15 +78,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -98,19 +98,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -118,11 +118,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -130,7 +130,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-stats.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -58,7 +58,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR (can be specified multiple times)
 
 .PP
 \fB--mode\fP="restore-size"
@@ -66,21 +66,21 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR (can be specified multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR (can be specified multiple times)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -100,15 +100,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -120,19 +120,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -140,11 +140,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -152,7 +152,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-tag.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -8,7 +8,7 @@ restic-tag - Modify tags on snapshots
 
 .SH SYNOPSIS
 .PP
-\fBrestic tag [flags] [snapshot-ID ...]\fP
+\fBrestic tag [flags] [snapshotID ...]\fP
 
 
 .SH DESCRIPTION
@@ -20,7 +20,7 @@ You can either set/replace the entire set of tags on a snapshot, or
 add tags to/remove tags from the existing set.
 
 .PP
-When no snapshot-ID is given, all snapshots matching the host, tag and path filter criteria are modified.
+When no snapshotID is given, all snapshots matching the host, tag and path filter criteria are modified.
 
 
 .SH EXIT STATUS
@@ -31,7 +31,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS
 .PP
 \fB--add\fP=[]
-	\fB\fCtags\fR which will be added to the existing tags in the format \fB\fCtag[,tag,...]\fR (can be given multiple times)
+	\fBtags\fR which will be added to the existing tags in the format \fBtag[,tag,...]\fR (can be given multiple times)
 
 .PP
 \fB-h\fP, \fB--help\fP[=false]
@@ -39,33 +39,33 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-H\fP, \fB--host\fP=[]
-	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+	only consider snapshots for this \fBhost\fR (can be specified multiple times)
 
 .PP
 \fB--path\fP=[]
-	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+	only consider snapshots including this (absolute) \fBpath\fR (can be specified multiple times)
 
 .PP
 \fB--remove\fP=[]
-	\fB\fCtags\fR which will be removed from the existing tags in the format \fB\fCtag[,tag,...]\fR (can be given multiple times)
+	\fBtags\fR which will be removed from the existing tags in the format \fBtag[,tag,...]\fR (can be given multiple times)
 
 .PP
 \fB--set\fP=[]
-	\fB\fCtags\fR which will replace the existing tags in the format \fB\fCtag[,tag,...]\fR (can be given multiple times)
+	\fBtags\fR which will replace the existing tags in the format \fBtag[,tag,...]\fR (can be given multiple times)
 
 .PP
 \fB--tag\fP=[]
-	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+	only consider snapshots including \fBtag[,tag,...]\fR (can be specified multiple times)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -85,15 +85,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -105,19 +105,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -125,11 +125,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -137,7 +137,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-unlock.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -34,11 +34,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -58,15 +58,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -78,19 +78,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -98,11 +98,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -110,7 +110,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic-version.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -31,11 +31,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -55,15 +55,15 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -75,19 +75,19 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -95,11 +95,11 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -107,7 +107,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

doc/man/restic.1

@@ -1,5 +1,5 @@
 .nh
-.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+.TH "restic backup" "1" "Jan 2017" "generated by \fBrestic generate\fR" ""
 
 .SH NAME
 .PP
@@ -23,11 +23,11 @@ The full documentation can be found at https://restic.readthedocs.io/ .
 .SH OPTIONS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+	\fBfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
-	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+	set the cache \fBdirectory\fR\&. (default: use system default cache directory)
 
 .PP
 \fB--cleanup-cache\fP[=false]
@@ -51,15 +51,15 @@ The full documentation can be found at https://restic.readthedocs.io/ .
 
 .PP
 \fB--key-hint\fP=""
-	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+	\fBkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
 
 .PP
 \fB--limit-download\fP=0
-	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits downloads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--limit-upload\fP=0
-	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+	limits uploads to a maximum \fBrate\fR in KiB/s. (default: unlimited)
 
 .PP
 \fB--no-cache\fP[=false]
@@ -71,19 +71,19 @@ The full documentation can be found at https://restic.readthedocs.io/ .
 
 .PP
 \fB-o\fP, \fB--option\fP=[]
-	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+	set extended option (\fBkey=value\fR, can be specified multiple times)
 
 .PP
 \fB--pack-size\fP=0
-	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+	set target pack \fBsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
 
 .PP
 \fB--password-command\fP=""
-	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+	shell \fBcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
 
 .PP
 \fB-p\fP, \fB--password-file\fP=""
-	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+	\fBfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
 
 .PP
 \fB-q\fP, \fB--quiet\fP[=false]
@@ -91,11 +91,11 @@ The full documentation can be found at https://restic.readthedocs.io/ .
 
 .PP
 \fB-r\fP, \fB--repo\fP=""
-	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+	\fBrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
 
 .PP
 \fB--repository-file\fP=""
-	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+	\fBfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
 .PP
 \fB--retry-lock\fP=0s
@@ -103,7 +103,7 @@ The full documentation can be found at https://restic.readthedocs.io/ .
 
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+	path to a \fBfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]

docker/Dockerfile

@@ -11,7 +11,7 @@ RUN go run build.go
 
 FROM alpine:latest AS restic
 
-RUN apk add --update --no-cache ca-certificates fuse openssh-client tzdata jq
+RUN apk add --no-cache ca-certificates fuse openssh-client tzdata jq
 
 COPY --from=builder /go/src/github.com/restic/restic/restic /usr/bin
 

docker/Dockerfile.release

@@ -13,6 +13,6 @@ RUN mv /output/restic_${TARGETOS}_${TARGETARCH} /output/restic
 FROM alpine:latest
 
 COPY --from=helper /output/restic /usr/bin
-RUN apk add --update --no-cache ca-certificates fuse openssh-client tzdata jq
+RUN apk add --no-cache ca-certificates fuse openssh-client tzdata jq
 
 ENTRYPOINT ["/usr/bin/restic"]

go.mod

@@ -1,62 +1,64 @@
 module github.com/restic/restic
 
 require (
-	cloud.google.com/go/storage v1.31.0
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0
+	cloud.google.com/go/storage v1.33.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.8.0
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.2.0
+	github.com/Backblaze/blazer v0.6.1
 	github.com/anacrolix/fuse v0.2.0
 	github.com/cenkalti/backoff/v4 v4.2.1
 	github.com/cespare/xxhash/v2 v2.2.0
 	github.com/elithrar/simple-scrypt v1.3.0
-	github.com/go-ole/go-ole v1.2.6
-	github.com/google/go-cmp v0.5.9
-	github.com/hashicorp/golang-lru/v2 v2.0.4
-	github.com/juju/ratelimit v1.0.2
-	github.com/klauspost/compress v1.16.7
-	github.com/kurin/blazer v0.5.4-0.20230113224640-3887e1ec64b5
-	github.com/minio/minio-go/v7 v7.0.61
+	github.com/go-ole/go-ole v1.3.0
+	github.com/google/go-cmp v0.6.0
+	github.com/hashicorp/golang-lru/v2 v2.0.7
+	github.com/klauspost/compress v1.17.2
+	github.com/minio/minio-go/v7 v7.0.63
 	github.com/minio/sha256-simd v1.0.1
 	github.com/ncw/swift/v2 v2.0.2
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/profile v1.7.0
-	github.com/pkg/sftp v1.13.5
+	github.com/pkg/sftp v1.13.6
 	github.com/pkg/xattr v0.4.10-0.20221120235825-35026bbbd013
 	github.com/restic/chunker v0.4.0
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
-	golang.org/x/crypto v0.11.0
-	golang.org/x/net v0.12.0
-	golang.org/x/oauth2 v0.10.0
-	golang.org/x/sync v0.3.0
-	golang.org/x/sys v0.10.0
-	golang.org/x/term v0.10.0
-	golang.org/x/text v0.11.0
-	google.golang.org/api v0.134.0
+	go.uber.org/automaxprocs v1.5.3
+	golang.org/x/crypto v0.14.0
+	golang.org/x/net v0.17.0
+	golang.org/x/oauth2 v0.13.0
+	golang.org/x/sync v0.4.0
+	golang.org/x/sys v0.13.0
+	golang.org/x/term v0.13.0
+	golang.org/x/text v0.13.0
+	golang.org/x/time v0.3.0
+	google.golang.org/api v0.148.0
 )
 
 require (
-	cloud.google.com/go v0.110.6 // indirect
-	cloud.google.com/go/compute v1.23.0 // indirect
+	cloud.google.com/go v0.110.9 // indirect
+	cloud.google.com/go/compute v1.23.1 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	cloud.google.com/go/iam v1.1.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	cloud.google.com/go/iam v1.1.3 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.4.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/felixge/fgprof v0.9.3 // indirect
-	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
+	github.com/golang-jwt/jwt/v5 v5.0.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8 // indirect
-	github.com/google/s2a-go v0.1.4 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
+	github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 // indirect
+	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/google/uuid v1.3.1 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.1 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
 	github.com/kr/fs v0.1.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -66,15 +68,15 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230726155614-23370e0ffb3e // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230726155614-23370e0ffb3e // indirect
-	google.golang.org/grpc v1.57.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b // indirect
+	google.golang.org/grpc v1.59.0 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-go 1.18
+go 1.19

go.sum

@@ -1,35 +1,34 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.110.6 h1:8uYAkj3YHTP/1iwReuHPxLSbdcyc+dSBbzFMrVwDR6Q=
-cloud.google.com/go v0.110.6/go.mod h1:+EYjdK8e5RME/VY/qLCAtuyALQ9q67dvuum8i+H5xsI=
-cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY=
-cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
+cloud.google.com/go v0.110.9 h1:e7ITSqGFFk4rbz/JFIqZh3G4VEHguhAL4BQcFlWtU68=
+cloud.google.com/go v0.110.9/go.mod h1:rpxevX/0Lqvlbc88b7Sc1SPNdyK1riNBTUU6JXhYNpM=
+cloud.google.com/go/compute v1.23.1 h1:V97tBoDaZHb6leicZ1G6DLK2BAaZLJ/7+9BB/En3hR0=
+cloud.google.com/go/compute v1.23.1/go.mod h1:CqB3xpmPKKt3OJpW2ndFIXnA9A4xAy/F3Xp1ixncW78=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/iam v1.1.1 h1:lW7fzj15aVIXYHREOqjRBV9PsH0Z6u8Y46a1YGvQP4Y=
-cloud.google.com/go/iam v1.1.1/go.mod h1:A5avdyVL2tCppe4unb0951eI9jreack+RJ0/d+KUZOU=
-cloud.google.com/go/storage v1.31.0 h1:+S3LjjEN2zZ+L5hOwj4+1OkGCsLVe0NzpXKQ1pSdTCI=
-cloud.google.com/go/storage v1.31.0/go.mod h1:81ams1PrhW16L4kF7qg+4mTq7SRs5HsbDTM0bWvrwJ0=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0 h1:8q4SaHjFsClSvuVne0ID/5Ka8u3fcIHyqkLjcFpNRHQ=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 h1:vcYCAze6p19qBW7MhZybIsqD8sMV8js0NyQM8JDnVtg=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0/go.mod h1:OQeznEEkTZ9OrhHJoDD8ZDq51FHgXjqtP9z6bEwBq9U=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 h1:sXr+ck84g/ZlZUOZiNELInmMgOsuGwdjjVkEIde0OtY=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0/go.mod h1:okt5dMMTOFjX/aovMlrjvvXoPMBVSPzk9185BT0+eZM=
+cloud.google.com/go/iam v1.1.3 h1:18tKG7DzydKWUnLjonWcJO6wjSCAtzh4GcRKlH/Hrzc=
+cloud.google.com/go/iam v1.1.3/go.mod h1:3khUlaBXfPKKe7huYgEpDn6FtgRyMEqbkvBxrQyY5SE=
+cloud.google.com/go/storage v1.33.0 h1:PVrDOkIC8qQVa1P3SXGpQvfuJhN2LHOoyZvWs8D2X5M=
+cloud.google.com/go/storage v1.33.0/go.mod h1:Hhh/dogNRGca7IWv1RC2YqEn0c0G77ctA/OxflYkiD8=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.8.0 h1:9kDVnTz3vbfweTqAUmk/a/pH5pWFCHtvRpHYC0G/dcA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.8.0/go.mod h1:3Ug6Qzto9anB6mGlEdgYMDF5zHQ+wwhEaYR4s17PHMw=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0 h1:BMAjVKJM0U/CYF27gA0ZMmXGkOcvfFtD0oHVZ1TIPRI=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0/go.mod h1:1fXstnBMas5kzG+S3q8UoJcmyU6nUeunJcMDHcRYHhs=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.4.0 h1:TuEMD+E+1aTjjLICGQOW6vLe8UWES7kopac9mUXL56Y=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.4.0/go.mod h1:s4kgfzA0covAXNicZHDMN58jExvcng2mC/DepXiF1EI=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.2.0 h1:Ma67P/GGprNwsslzEH6+Kb8nybI8jpDTm4Wmzu2ReK8=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0 h1:nVocQV40OQne5613EeLayJiRAJuKlBGy+m22qWG+WRg=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0/go.mod h1:7QJP7dr2wznCMeqIrhMgWGf7XpAQnVrJqDm9nvV3Cu4=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 h1:OBhqkivkhkMqLPymWEppkm7vgPQY2XsHoEkaMQ0AdZY=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0/go.mod h1:kgDmCTgBzIEPFElEF+FK0SdjAor06dRq2Go927dnQ6o=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.2.0 h1:gggzg0SUMs6SQbEw+3LoSsYf9YMjkupeAnHMX8O9mmY=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.2.0/go.mod h1:+6KLcKIVgxoBDMqMO/Nvy7bZ9a0nbU3I1DtFQK3YvB4=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.0 h1:hVeq+yCyUi+MsoO/CU95yqCIcdzra5ovzk8Q2BBpV2M=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.0/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/Backblaze/blazer v0.6.1 h1:xC9HyC7OcxRzzmtfRiikIEvq4HZYWjU6caFwX2EXw1s=
+github.com/Backblaze/blazer v0.6.1/go.mod h1:7/jrGx4O6OKOto6av+hLwelPR8rwZ+PLxQ5ZOiYAjwY=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/Julusian/godocdown v0.0.0-20170816220326-6d19f8ff2df8/go.mod h1:INZr5t32rG59/5xeltqoCJoNY7e5x/3xoY9WSWVWg74=
 github.com/anacrolix/fuse v0.2.0 h1:pc+To78kI2d/WUjIyrsdqeJQAesuwpGxlI3h1nAv3Do=
 github.com/anacrolix/fuse v0.2.0/go.mod h1:Kfu02xBwnySDpH3N23BmrP3MDfwAQGRLUCj6XyeOvBQ=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
@@ -37,13 +36,10 @@ github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5P
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -57,32 +53,26 @@ github.com/elithrar/simple-scrypt v1.3.0/go.mod h1:U2XQRI95XHY0St410VE3UjT7vuKb1
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
 github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
-github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
+github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
+github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE=
+github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
@@ -95,47 +85,45 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
 github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
-github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8 h1:n6vlPhxsA+BW/XsS5+uqi7GyzaLa5MH7qlSLBZtRdiA=
-github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8/go.mod h1:Jh3hGz2jkYak8qXPD19ryItVnUgpgeqzdkY/D0EaeuA=
-github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
-github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
+github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 h1:pUa4ghanp6q4IJHwE9RwLgmVFfReJN+KbQ8ExNEUUoQ=
+github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
+github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5 h1:UR4rDjcgpgEnqpIEvkiqTYKBCKLNmlge2eVjoZfySzM=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.1 h1:SBWmZhjUDRorQxrN0nwzf+AHBxnbFjViHQS4P0yVpmQ=
+github.com/googleapis/enterprise-certificate-proxy v0.3.1/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
 github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/golang-lru/v2 v2.0.4 h1:7GHuZcgid37q8o5i3QI9KMT4nCWQQ3Kx3Ov6bb9MfK0=
-github.com/hashicorp/golang-lru/v2 v2.0.4/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/ianlancetaylor/demangle v0.0.0-20210905161508-09a460cdf81d/go.mod h1:aYm2/VgdVmcIU8iMfdMvDMsRAQjcfZSKFby6HOFvi/w=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
-github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
-github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
-github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.17.2 h1:RlWWUY/Dr4fL8qk9YG7DTZ7PDgME2V4csBXA8L/ixi4=
+github.com/klauspost/compress v1.17.2/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
 github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kurin/blazer v0.5.4-0.20230113224640-3887e1ec64b5 h1:OUlGa6AAolmjyPtILbMJ8vHayz5wd4wBUloheGcMhfA=
-github.com/kurin/blazer v0.5.4-0.20230113224640-3887e1ec64b5/go.mod h1:4FCXMUWo9DllR2Do4TtBd377ezyAJ51vB5uTBjt0pGU=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.61 h1:87c+x8J3jxQ5VUGimV9oHdpjsAvy3fhneEBKuoKEVUI=
-github.com/minio/minio-go/v7 v7.0.61/go.mod h1:BTu8FcrEw+HidY0zd/0eny43QnVNkXRPXrLXFuQBHXg=
+github.com/minio/minio-go/v7 v7.0.63 h1:GbZ2oCvaUdgT5640WJOpyDhhDxvknAJU2/T3yurwcbQ=
+github.com/minio/minio-go/v7 v7.0.63/go.mod h1:Q6X7Qjb7WMhvG65qKf4gUgA5XaiSox74kR1uAEjxRS4=
 github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
 github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -151,17 +139,17 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
 github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
-github.com/pkg/sftp v1.13.5 h1:a3RLUqkyjYRtBTZJZ1VRrKbN3zhuPLlUc3sphVz81go=
-github.com/pkg/sftp v1.13.5/go.mod h1:wHDZ0IZX6JcBYRK1TH9bcVq8G7TLpVHYIGJRFnmPfxg=
+github.com/pkg/sftp v1.13.6 h1:JFZT4XbOU7l77xGSpOdW+pwIMqP044IyjXX6FGyEKFo=
+github.com/pkg/sftp v1.13.6/go.mod h1:tz1ryNURKu77RL+GuCzmoJYxQczL3wLNNpPWagdg4Qk=
 github.com/pkg/xattr v0.4.10-0.20221120235825-35026bbbd013 h1:aqByeeNnF7NiEbXCi7nBxZ272+6f6FUBmj/dUzWCdvc=
 github.com/pkg/xattr v0.4.10-0.20221120235825-35026bbbd013/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/restic/chunker v0.4.0 h1:YUPYCUn70MYP7VO4yllypp2SjmsRhRJaad3xKu1QFRw=
 github.com/restic/chunker v0.4.0/go.mod h1:z0cH2BejpW636LXw0R/BGyv+Ey8+m9QGiOanDHItzyw=
 github.com/robertkrimen/godocdown v0.0.0-20130622164427-0bfa04905481/go.mod h1:C9WhFzY47SzYBIvzFqSvHIR6ROgDo4TtdTuRaOMjF/s=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
 github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
@@ -177,27 +165,26 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c h1:u6SKchux2yDvFQnDHS3lPnIRmfVJ5Sxy3ao2SIdysLQ=
 github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c/go.mod h1:hzIxponao9Kjc7aWznkXaL4U4TWaDSs8zcsY4Ka08nM=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
+go.uber.org/automaxprocs v1.5.3 h1:kWazyxZUrS3Gs4qUpbwo5kEIMGe/DAvi5Z4tl2NW4j8=
+go.uber.org/automaxprocs v1.5.3/go.mod h1:eRbA25aqJrxAbsLO0xy5jVwPt7FQnRgjW+efnwa1WM0=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
-golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
+golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -206,64 +193,58 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
-golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
+golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
-golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
+golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
+golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
+golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191210023423-ac6580df4449/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
-golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c=
-golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
+golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
-golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -275,35 +256,30 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-google.golang.org/api v0.134.0 h1:ktL4Goua+UBgoP1eL1/60LwZJqa1sIzkLmvoR3hR6Gw=
-google.golang.org/api v0.134.0/go.mod h1:sjRL3UnjTx5UqNQS9EWr9N8p7xbHpy1k0XGRLCf3Spk=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+google.golang.org/api v0.148.0 h1:HBq4TZlN4/1pNcu0geJZ/Q50vIwIXT532UIMYoo0vOs=
+google.golang.org/api v0.148.0/go.mod h1:8/TBgwaKjfqTdacOJrOv2+2Q6fBDU1uHKK06oGSkxzU=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20230726155614-23370e0ffb3e h1:xIXmWJ303kJCuogpj0bHq+dcjcZHU+XFyc1I0Yl9cRg=
-google.golang.org/genproto v0.0.0-20230726155614-23370e0ffb3e/go.mod h1:0ggbjUrZYpy1q+ANUS30SEoGZ53cdfwtbuG7Ptgy108=
-google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e h1:z3vDksarJxsAKM5dmEGv0GHwE2hKJ096wZra71Vs4sw=
-google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e/go.mod h1:rsr7RhLuwsDKL7RmgDDCUc6yaGr1iqceVb5Wv6f6YvQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230726155614-23370e0ffb3e h1:S83+ibolgyZ0bqz7KEsUOPErxcv4VzlszxY+31OfB/E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230726155614-23370e0ffb3e/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
+google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b h1:+YaDE2r2OG8t/z5qmsh7Y+XXwCbvadxxZ0YY6mTdrVA=
+google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:CgAqfJo+Xmu0GwA0411Ht3OU3OntXwsGmrmjI8ioGXI=
+google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b h1:CIC2YMXmIhYw6evmhPxBKJ4fmLbOFtXQN/GV3XOZR8k=
+google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:IBQ646DjkDkvUIsVq/cc03FUFQ9wbZu7yE396YcL870=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b h1:ZlWIi1wSK56/8hn4QcBp/j9M7Gt3U/3hZw3mC7vDICo=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:swOH3j0KzcDDgGUWr+SNpyTen5YrXjS3eyPzFYKc6lc=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
-google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -317,12 +293,10 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

helpers/build-release-binaries/main.go

@@ -125,6 +125,9 @@ func build(sourceDir, outputDir, goos, goarch string) (filename string) {
 		"GOOS="+goos,
 		"GOARCH="+goarch,
 	)
+	if goarch == "arm" {
+		c.Env = append(c.Env, "GOARM=5")
+	}
 	verbose("run %v %v in %v", "go", c.Args, c.Dir)
 
 	err := c.Run()

helpers/verify-release-binaries.sh

@@ -0,0 +1,136 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ $# -lt 2 ]]; then
+    echo "Usage: $0 restic_version go_version"
+    exit 1
+fi
+
+restic_version="$1"
+go_version="$2"
+
+# invalid if zero
+is_valid=1
+set_invalid() {
+    echo $1
+    is_valid=0
+}
+
+tmpdir="$(mktemp -d -p .)"
+cd "${tmpdir}"
+echo -e "Running checks in ${tmpdir}\n"
+
+highlight() {
+    echo "@@${1//?/@}@@"
+    echo "@ ${1} @"
+    echo "@@${1//?/@}@@"
+}
+
+
+highlight "Verifying release self-consistency"
+
+curl -OLSs https://github.com/restic/restic/releases/download/v${restic_version}/restic-${restic_version}.tar.gz.asc
+# tarball is downloaded while processing the SHA256SUMS
+curl -OLSs https://github.com/restic/restic/releases/download/v${restic_version}/SHA256SUMS.asc
+curl -OLSs https://github.com/restic/restic/releases/download/v${restic_version}/SHA256SUMS
+
+export GNUPGHOME=$PWD/gnupg
+mkdir -p 700 $GNUPGHOME
+curl -OLSs https://restic.net/gpg-key-alex.asc
+gpg --import gpg-key-alex.asc
+gpg --verify SHA256SUMS.asc SHA256SUMS
+
+for i in $(cat SHA256SUMS | cut -d " "  -f 3 ) ; do
+    echo "Downloading $i"
+    curl -OLSs https://github.com/restic/restic/releases/download/v${restic_version}/"$i"
+done
+shasum -a256 -c SHA256SUMS || set_invalid "WARNING: RELEASE BINARIES DO NOT MATCH SHA256SUMS!"
+gpg --verify restic-${restic_version}.tar.gz.asc restic-${restic_version}.tar.gz
+# TODO verify that the release does not contain any unexpected files
+
+
+highlight "Verifying tarball matches tagged commit"
+
+tar xzf "restic-${restic_version}.tar.gz"
+git clone -b "v${restic_version}" https://github.com/restic/restic.git
+rm -rf restic/.git
+diff -r restic restic-${restic_version}
+
+
+highlight "Regenerating builder container"
+
+git clone https://github.com/restic/builder.git
+docker pull debian:stable
+docker build --no-cache -t restic/builder:tmp --build-arg GO_VERSION=${go_version} builder
+
+
+highlight "Reproducing release binaries"
+
+mkdir output
+docker run --rm \
+    --volume "$PWD/restic-${restic_version}:/restic" \
+    --volume "$PWD/output:/output" \
+    restic/builder:tmp \
+    go run helpers/build-release-binaries/main.go --version "${restic_version}"
+
+cp "restic-${restic_version}.tar.gz" output
+cp SHA256SUMS output
+
+# check that all release binaries have been reproduced successfully
+(cd output && shasum -a256 -c SHA256SUMS) || set_invalid "WARNING: REPRODUCED BINARIES DO NOT MATCH RELEASE BINARIES!"
+# and that the SHA256SUMS files does not miss binaries
+for i in output/restic* ; do grep "$(basename "$i")" SHA256SUMS > /dev/null || set_invalid "WARNING: $i MISSING FROM RELEASE SHA256SUMS FILE!" ; done
+
+
+extract_docker() {
+    image=$1
+    docker_platform=$2
+    restic_platform=$3
+    out=restic_${restic_version}_linux_${restic_platform}.bz2
+
+    docker image pull --platform "linux/${docker_platform}" ${image}:${restic_version} > /dev/null
+    docker image save ${image}:${restic_version} -o docker.tar
+
+    mkdir img
+    tar xvf docker.tar -C img --wildcards \*/layer.tar > /dev/null
+    rm docker.tar
+    for i in img/*/layer.tar; do
+        tar -xvf "$i" -C img usr/bin/restic 2> /dev/null 1>&2 || true
+        if [[ -f img/usr/bin/restic ]]; then
+            if [[ -f restic-docker ]]; then
+                set_invalid "WARNING: CONTAINER CONTAINS MULTIPLE RESTIC BINARIES"
+            fi
+            mv img/usr/bin/restic restic-docker
+        fi
+    done
+    
+    rm -rf img
+    bzip2 restic-docker
+    mv restic-docker.bz2 docker/${out}
+    grep ${out} SHA256SUMS >> docker/SHA256SUMS
+}
+
+ctr=0
+for img in restic/restic ghcr.io/restic/restic; do
+    highlight "Verifying binaries in docker containers from $img"
+    mkdir docker
+
+    extract_docker "$img" arm/v7 arm
+    extract_docker "$img" arm64 arm64
+    extract_docker "$img" 386 386
+    extract_docker "$img" amd64 amd64
+
+    (cd docker && shasum -a256 -c SHA256SUMS) || set_invalid "WARNING: DOCKER CONTAINER DOES NOT CONTAIN RELEASE BINARIES!"
+
+    mv docker docker-$(( ctr++ ))
+done
+
+
+if [[ $is_valid -ne 1 ]]; then
+    highlight "Failed to reproduce some binaries, check the script output for details"
+    exit 1
+else
+    cd ..
+    rm -rf "${tmpdir}"
+fi

internal/backend/b2/b2.go

@@ -16,8 +16,8 @@ import (
 	"github.com/restic/restic/internal/errors"
 	"github.com/restic/restic/internal/restic"
 
-	"github.com/kurin/blazer/b2"
-	"github.com/kurin/blazer/base"
+	"github.com/Backblaze/blazer/b2"
+	"github.com/Backblaze/blazer/base"
 )
 
 // b2Backend is a backend which stores its data on Backblaze B2.

internal/backend/limiter/static_limiter.go

@@ -1,15 +1,16 @@
 package limiter
 
 import (
+	"context"
 	"io"
 	"net/http"
 
-	"github.com/juju/ratelimit"
+	"golang.org/x/time/rate"
 )
 
 type staticLimiter struct {
-	upstream   *ratelimit.Bucket
-	downstream *ratelimit.Bucket
+	upstream   *rate.Limiter
+	downstream *rate.Limiter
 }
 
 // Limits represents static upload and download limits.
@@ -23,16 +24,16 @@ type Limits struct {
 // download rate cap
 func NewStaticLimiter(l Limits) Limiter {
 	var (
-		upstreamBucket   *ratelimit.Bucket
-		downstreamBucket *ratelimit.Bucket
+		upstreamBucket   *rate.Limiter
+		downstreamBucket *rate.Limiter
 	)
 
 	if l.UploadKb > 0 {
-		upstreamBucket = ratelimit.NewBucketWithRate(toByteRate(l.UploadKb), int64(toByteRate(l.UploadKb)))
+		upstreamBucket = rate.NewLimiter(rate.Limit(toByteRate(l.UploadKb)), int(toByteRate(l.UploadKb)))
 	}
 
 	if l.DownloadKb > 0 {
-		downstreamBucket = ratelimit.NewBucketWithRate(toByteRate(l.DownloadKb), int64(toByteRate(l.DownloadKb)))
+		downstreamBucket = rate.NewLimiter(rate.Limit(toByteRate(l.DownloadKb)), int(toByteRate(l.DownloadKb)))
 	}
 
 	return staticLimiter{
@@ -95,18 +96,55 @@ func (l staticLimiter) Transport(rt http.RoundTripper) http.RoundTripper {
 	})
 }
 
-func (l staticLimiter) limitReader(r io.Reader, b *ratelimit.Bucket) io.Reader {
+func (l staticLimiter) limitReader(r io.Reader, b *rate.Limiter) io.Reader {
 	if b == nil {
 		return r
 	}
-	return ratelimit.Reader(r, b)
+	return &rateLimitedReader{r, b}
 }
 
-func (l staticLimiter) limitWriter(w io.Writer, b *ratelimit.Bucket) io.Writer {
+type rateLimitedReader struct {
+	reader io.Reader
+	bucket *rate.Limiter
+}
+
+func (r *rateLimitedReader) Read(p []byte) (int, error) {
+	n, err := r.reader.Read(p)
+	if err := consumeTokens(n, r.bucket); err != nil {
+		return n, err
+	}
+	return n, err
+}
+
+func (l staticLimiter) limitWriter(w io.Writer, b *rate.Limiter) io.Writer {
 	if b == nil {
 		return w
 	}
-	return ratelimit.Writer(w, b)
+	return &rateLimitedWriter{w, b}
+}
+
+type rateLimitedWriter struct {
+	writer io.Writer
+	bucket *rate.Limiter
+}
+
+func (w *rateLimitedWriter) Write(buf []byte) (int, error) {
+	if err := consumeTokens(len(buf), w.bucket); err != nil {
+		return 0, err
+	}
+	return w.writer.Write(buf)
+}
+
+func consumeTokens(tokens int, bucket *rate.Limiter) error {
+	// bucket allows waiting for at most Burst() tokens at once
+	maxWait := bucket.Burst()
+	for tokens > maxWait {
+		if err := bucket.WaitN(context.Background(), maxWait); err != nil {
+			return err
+		}
+		tokens -= maxWait
+	}
+	return bucket.WaitN(context.Background(), tokens)
 }
 
 func toByteRate(val int) float64 {

internal/backend/limiter/static_limiter_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/restic/restic/internal/test"
+	"golang.org/x/time/rate"
 )
 
 func TestLimiterWrapping(t *testing.T) {
@@ -33,6 +34,38 @@ func TestLimiterWrapping(t *testing.T) {
 	}
 }
 
+func TestReadLimiter(t *testing.T) {
+	reader := bytes.NewReader(make([]byte, 300))
+	limiter := rate.NewLimiter(rate.Limit(10000), int(100))
+	limReader := rateLimitedReader{reader, limiter}
+
+	n, err := limReader.Read([]byte{})
+	test.OK(t, err)
+	test.Equals(t, n, 0)
+
+	n, err = limReader.Read(make([]byte, 300))
+	test.OK(t, err)
+	test.Equals(t, n, 300)
+
+	n, err = limReader.Read([]byte{})
+	test.Equals(t, err, io.EOF)
+	test.Equals(t, n, 0)
+}
+
+func TestWriteLimiter(t *testing.T) {
+	writer := &bytes.Buffer{}
+	limiter := rate.NewLimiter(rate.Limit(10000), int(100))
+	limReader := rateLimitedWriter{writer, limiter}
+
+	n, err := limReader.Write([]byte{})
+	test.OK(t, err)
+	test.Equals(t, n, 0)
+
+	n, err = limReader.Write(make([]byte, 300))
+	test.OK(t, err)
+	test.Equals(t, n, 300)
+}
+
 type tracedReadCloser struct {
 	io.Reader
 	Closed bool

internal/backend/rest/config.go

@@ -2,10 +2,12 @@ package rest
 
 import (
 	"net/url"
+	"os"
 	"strings"
 
 	"github.com/restic/restic/internal/errors"
 	"github.com/restic/restic/internal/options"
+	"github.com/restic/restic/internal/restic"
 )
 
 // Config contains all configuration necessary to connect to a REST server.
@@ -70,3 +72,19 @@ func prepareURL(s string) string {
 	}
 	return s
 }
+
+var _ restic.ApplyEnvironmenter = &Config{}
+
+// ApplyEnvironment saves values from the environment to the config.
+func (cfg *Config) ApplyEnvironment(prefix string) {
+	username := cfg.URL.User.Username()
+	_, pwdSet := cfg.URL.User.Password()
+
+	// Only apply env variable values if neither username nor password are provided.
+	if username == "" && !pwdSet {
+		envName := os.Getenv(prefix + "RESTIC_REST_USERNAME")
+		envPwd := os.Getenv(prefix + "RESTIC_REST_PASSWORD")
+
+		cfg.URL.User = url.UserPassword(envName, envPwd)
+	}
+}

internal/backend/sftp/config.go

@@ -13,8 +13,9 @@ import (
 type Config struct {
 	User, Host, Port, Path string
 
-	Layout  string `option:"layout" help:"use this backend directory layout (default: auto-detect)"`
+	Layout  string `option:"layout"  help:"use this backend directory layout (default: auto-detect)"`
 	Command string `option:"command" help:"specify command to create sftp connection"`
+	Args    string `option:"args"    help:"specify arguments for ssh"`
 
 	Connections uint `option:"connections" help:"set a limit for the number of concurrent connections (default: 5)"`
 }

internal/backend/sftp/sftp.go

@@ -213,6 +213,9 @@ func buildSSHCommand(cfg Config) (cmd string, args []string, err error) {
 		if err != nil {
 			return "", nil, err
 		}
+		if cfg.Args != "" {
+			return "", nil, errors.New("cannot specify both sftp.command and sftp.args options")
+		}
 
 		return args[0], args[1:], nil
 	}
@@ -226,11 +229,19 @@ func buildSSHCommand(cfg Config) (cmd string, args []string, err error) {
 		args = append(args, "-p", port)
 	}
 	if cfg.User != "" {
-		args = append(args, "-l")
-		args = append(args, cfg.User)
+		args = append(args, "-l", cfg.User)
 	}
-	args = append(args, "-s")
-	args = append(args, "sftp")
+
+	if cfg.Args != "" {
+		a, err := backend.SplitShellStrings(cfg.Args)
+		if err != nil {
+			return "", nil, err
+		}
+
+		args = append(args, a...)
+	}
+
+	args = append(args, "-s", "sftp")
 	return cmd, args, nil
 }
 

internal/backend/sftp/sshcmd_test.go

@@ -9,38 +9,57 @@ var sshcmdTests = []struct {
 	cfg  Config
 	cmd  string
 	args []string
+	err  string
 }{
 	{
 		Config{User: "user", Host: "host", Path: "dir/subdir"},
 		"ssh",
 		[]string{"host", "-l", "user", "-s", "sftp"},
+		"",
 	},
 	{
 		Config{Host: "host", Path: "dir/subdir"},
 		"ssh",
 		[]string{"host", "-s", "sftp"},
+		"",
 	},
 	{
 		Config{Host: "host", Port: "10022", Path: "/dir/subdir"},
 		"ssh",
 		[]string{"host", "-p", "10022", "-s", "sftp"},
+		"",
 	},
 	{
 		Config{User: "user", Host: "host", Port: "10022", Path: "/dir/subdir"},
 		"ssh",
 		[]string{"host", "-p", "10022", "-l", "user", "-s", "sftp"},
+		"",
+	},
+	{
+		Config{User: "user", Host: "host", Port: "10022", Path: "/dir/subdir", Args: "-i /path/to/id_rsa"},
+		"ssh",
+		[]string{"host", "-p", "10022", "-l", "user", "-i", "/path/to/id_rsa", "-s", "sftp"},
+		"",
+	},
+	{
+		Config{Command: "ssh something", Args: "-i /path/to/id_rsa"},
+		"",
+		nil,
+		"cannot specify both sftp.command and sftp.args options",
 	},
 	{
 		// IPv6 address.
 		Config{User: "user", Host: "::1", Path: "dir"},
 		"ssh",
 		[]string{"::1", "-l", "user", "-s", "sftp"},
+		"",
 	},
 	{
 		// IPv6 address with zone and port.
 		Config{User: "user", Host: "::1%lo0", Port: "22", Path: "dir"},
 		"ssh",
 		[]string{"::1%lo0", "-p", "22", "-l", "user", "-s", "sftp"},
+		"",
 	},
 }
 
@@ -48,8 +67,14 @@ func TestBuildSSHCommand(t *testing.T) {
 	for i, test := range sshcmdTests {
 		t.Run("", func(t *testing.T) {
 			cmd, args, err := buildSSHCommand(test.cfg)
-			if err != nil {
-				t.Fatalf("%v in test %d", err, i)
+			if test.err != "" {
+				if err.Error() != test.err {
+					t.Fatalf("expected error %v got %v", test.err, err.Error())
+				}
+			} else {
+				if err != nil {
+					t.Fatalf("%v in test %d", err, i)
+				}
 			}
 
 			if cmd != test.cmd {