From 75518d945c957165e425075bdaf3b3fca13137d9 Mon Sep 17 00:00:00 2001 From: Thomas Waldmann Date: Wed, 14 Jun 2023 03:45:24 +0200 Subject: [PATCH] list: support {tam} placeholder. check archive TAM. list: shows either "verified" or "none", depending on whether a TAM auth tag could be verified or was missing (old archives from borg < 1.0.9). when loading an archive, we now try to verify the archive TAM, but we do not require it. people might still have old archives in their repos and we want to be able to list such repos without fatal exceptions. --- src/borg/archive.py | 5 ++++- src/borg/crypto/key.py | 4 +++- src/borg/helpers/parseformat.py | 7 ++++++- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/src/borg/archive.py b/src/borg/archive.py index 4c16ac7c9..9e84b2b27 100644 --- a/src/borg/archive.py +++ b/src/borg/archive.py @@ -450,6 +450,7 @@ class Archive: self.name = name # overwritten later with name from archive metadata self.name_in_manifest = name # can differ from .name later (if borg check fixed duplicate archive names) self.comment = None + self.tam_verified = False self.checkpoint_interval = checkpoint_interval self.numeric_ids = numeric_ids self.noatime = noatime @@ -488,7 +489,9 @@ class Archive: def _load_meta(self, id): data = self.key.decrypt(id, self.repository.get(id)) - metadata = ArchiveItem(internal_dict=msgpack.unpackb(data)) + # we do not require TAM for archives, otherwise we can not even borg list a repo with old archives. + archive, self.tam_verified = self.key.unpack_and_verify_archive(data, force_tam_not_required=True) + metadata = ArchiveItem(internal_dict=archive) if metadata.version != 1: raise Exception('Unknown archive metadata version') return metadata diff --git a/src/borg/crypto/key.py b/src/borg/crypto/key.py index 3ec399156..f4daf932d 100644 --- a/src/borg/crypto/key.py +++ b/src/borg/crypto/key.py @@ -286,7 +286,9 @@ class KeyBase: """Unpack msgpacked *data* and return (object, did_verify).""" tam_required = self.tam_required if force_tam_not_required and tam_required: - logger.warning('Archive authentication DISABLED.') + # for a long time, borg only checked manifest for "tam_required" and + # people might have archives without TAM, so don't be too annoyingly loud here: + logger.debug('Archive authentication DISABLED.') tam_required = False data = bytearray(data) unpacker = get_limited_unpacker('archive') diff --git a/src/borg/helpers/parseformat.py b/src/borg/helpers/parseformat.py index d96637b4d..1e11ea61d 100644 --- a/src/borg/helpers/parseformat.py +++ b/src/borg/helpers/parseformat.py @@ -592,9 +592,10 @@ class ArchiveFormatter(BaseFormatter): 'id': 'internal ID of the archive', 'hostname': 'hostname of host on which this archive was created', 'username': 'username of user who created this archive', + 'tam': 'TAM authentication state of this archive', } KEY_GROUPS = ( - ('archive', 'name', 'barchive', 'comment', 'bcomment', 'id'), + ('archive', 'name', 'barchive', 'comment', 'bcomment', 'id', 'tam'), ('start', 'time', 'end', 'command_line'), ('hostname', 'username'), ) @@ -647,6 +648,7 @@ class ArchiveFormatter(BaseFormatter): 'bcomment': partial(self.get_meta, 'comment', rs=False), 'end': self.get_ts_end, 'command_line': self.get_cmdline, + 'tam': self.get_tam, } self.used_call_keys = set(self.call_keys) & self.format_keys if self.json: @@ -697,6 +699,9 @@ class ArchiveFormatter(BaseFormatter): def get_ts_end(self): return self.format_time(self.archive.ts_end) + def get_tam(self): + return 'verified' if self.archive.tam_verified else 'none' + def format_time(self, ts): return OutputTimestamp(ts)