Add version for 0.17.3

doc: Polish changelogs before release

.dockerignore

@@ -1,12 +0,0 @@
-# Folders
-.git/
-.github/
-changelog/
-doc/
-docker/
-helpers/
-
-# Files
-.gitignore
-.golangci.yml
-*.md

.github/ISSUE_TEMPLATE/Bug.md

@@ -32,23 +32,30 @@ Output of `restic version`
 --------------------------
 
 
-How did you run restic exactly?
--------------------------------
+
+What backend/service did you use to store the repository?
+---------------------------------------------------------
+
+
+
+Problem description / Steps to reproduce
+----------------------------------------
 
 <!--
 This section should include at least:
 
+ * A description of the problem you are having with restic.
+
  * The complete command line and any environment variables you used to
    configure restic's backend access. Make sure to replace sensitive values!
 
  * The output of the commands, what restic prints gives may give us much
    information to diagnose the problem!
+
+ * The more time you spend describing an easy way to reproduce the behavior (if
+   this is possible), the easier it is for the project developers to fix it!
 -->
 
-What backend/server/service did you use to store the repository?
-----------------------------------------------------------------
-
-
 
 Expected behavior
 -----------------
@@ -65,22 +72,12 @@ In this section, please try to concentrate on observations, so only describe
 what you observed directly.
 -->
 
-Steps to reproduce the behavior
--------------------------------
-
-<!--
-The more time you spend describing an easy way to reproduce the behavior (if
-this is possible), the easier it is for the project developers to fix it!
--->
-
 Do you have any idea what may have caused this?
 -----------------------------------------------
 
-
-
-Do you have an idea how to solve the issue?
--------------------------------------------
-
+<!--
+Did something noteworthy happen on your system, Internet connection, backend services, etc?
+-->
 
 
 Did restic help you today? Did it make you happy in any way?

.github/dependabot.yml

@@ -4,10 +4,10 @@ updates:
   - package-ecosystem: "gomod"
     directory: "/" # Location of package manifests
     schedule:
-      interval: "weekly"
+      interval: "monthly"
 
   # Dependencies listed in .github/workflows/*.yml
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"

.github/workflows/docker.yml

@@ -0,0 +1,66 @@
+
+name: Create and publish a Docker image
+
+on:
+  push:
+    tags:
+      - 'v*'
+    branches:
+      - 'master'
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    if: github.repository == 'restic/restic'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20
+
+      - name: Ensure consistent binaries
+        run: |
+          echo "removing git directory for consistency with release binaries"
+          rm -rf .git
+        # remove VCS information from release builds, keep VCS for nightly builds on master
+        if: github.ref != 'refs/heads/master'
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@15560696de535e4014efeff63c48f16952e52dd1
+        with:
+          push: true
+          context: .
+          file: docker/Dockerfile.release
+          platforms: linux/386,linux/amd64,linux/arm,linux/arm64
+          pull: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/tests.yml

@@ -7,9 +7,13 @@ on:
 
   # run tests for all pull requests
   pull_request:
+  merge_group:
+
+permissions:
+  contents: read
 
 env:
-  latest_go: "1.19.x"
+  latest_go: "1.22.x"
   GO111MODULE: on
 
 jobs:
@@ -19,29 +23,39 @@ jobs:
         # list of jobs to run:
         include:
           - job_name: Windows
-            go: 1.19.x
+            go: 1.22.x
             os: windows-latest
 
           - job_name: macOS
-            go: 1.19.x
+            go: 1.22.x
             os: macOS-latest
             test_fuse: false
 
           - job_name: Linux
-            go: 1.19.x
+            go: 1.22.x
             os: ubuntu-latest
             test_cloud_backends: true
             test_fuse: true
             check_changelog: true
 
           - job_name: Linux (race)
-            go: 1.19.x
+            go: 1.22.x
             os: ubuntu-latest
             test_fuse: true
             test_opts: "-race"
 
           - job_name: Linux
-            go: 1.18.x
+            go: 1.21.x
+            os: ubuntu-latest
+            test_fuse: true
+
+          - job_name: Linux
+            go: 1.20.x
+            os: ubuntu-latest
+            test_fuse: true
+
+          - job_name: Linux
+            go: 1.19.x
             os: ubuntu-latest
             test_fuse: true
 
@@ -52,15 +66,18 @@ jobs:
       GOPROXY: https://proxy.golang.org
 
     steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
       - name: Set up Go ${{ matrix.go }}
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.go }}
 
       - name: Get programs (Linux/macOS)
         run: |
           echo "build Go tools"
-          go install github.com/restic/rest-server/cmd/rest-server@latest
+          go install github.com/restic/rest-server/cmd/rest-server@master
 
           echo "install minio server"
           mkdir $HOME/bin
@@ -92,7 +109,7 @@ jobs:
           $ProgressPreference = 'SilentlyContinue'
 
           echo "build Go tools"
-          go install github.com/restic/rest-server/...
+          go install github.com/restic/rest-server/cmd/rest-server@master
 
           echo "install minio server"
           mkdir $Env:USERPROFILE/bin
@@ -125,13 +142,18 @@ jobs:
           echo $Env:USERPROFILE\tar\bin >> $Env:GITHUB_PATH
         if: matrix.os == 'windows-latest'
 
-      - name: Check out code
-        uses: actions/checkout@v3
-
       - name: Build with build.go
         run: |
           go run build.go
 
+      - name: Minimal test
+        run: |
+          ./restic init
+          ./restic backup .
+        env:
+          RESTIC_REPOSITORY: ../testrepo
+          RESTIC_PASSWORD: password
+
       - name: Run local Tests
         env:
           RESTIC_TEST_FUSE: ${{ matrix.test_fuse }}
@@ -179,7 +201,7 @@ jobs:
         # own repo, otherwise the secrets are not available
         # Skip for Dependabot pull requests as these are run without secrets
         # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#responding-to-events
-        if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && (github.actor != 'dependabot[bot]') && matrix.test_cloud_backends
+        if: ((github.repository == 'restic/restic' && github.event_name == 'push') || github.event.pull_request.head.repo.full_name == github.repository) && (github.actor != 'dependabot[bot]') && matrix.test_cloud_backends
 
       - name: Check changelog files with calens
         run: |
@@ -193,69 +215,56 @@ jobs:
   cross_compile:
     strategy:
 
-      # ATTENTION: the list of architectures must be in sync with helpers/build-release-binaries/main.go!
       matrix:
         # run cross-compile in three batches parallel so the overall tests run faster
-        targets:
-          - "linux/386 linux/amd64 linux/arm linux/arm64 linux/ppc64le linux/mips linux/mipsle linux/mips64 linux/mips64le linux/riscv64 linux/s390x"
-
-          - "openbsd/386 openbsd/amd64 \
-            freebsd/386 freebsd/amd64 freebsd/arm \
-            aix/ppc64 \
-            darwin/amd64 darwin/arm64"
-
-          - "netbsd/386 netbsd/amd64 \
-            windows/386 windows/amd64 \
-            solaris/amd64"
+        subset:
+          - "0/3"
+          - "1/3"
+          - "2/3"
 
     env:
       GOPROXY: https://proxy.golang.org
 
     runs-on: ubuntu-latest
 
-    name: Cross Compile for ${{ matrix.targets }}
+    name: Cross Compile for subset ${{ matrix.subset }}
 
     steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
       - name: Set up Go ${{ env.latest_go }}
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ env.latest_go }}
 
-      - name: Install gox
+      - name: Cross-compile for subset ${{ matrix.subset }}
         run: |
-          go install github.com/mitchellh/gox@latest
-
-      - name: Check out code
-        uses: actions/checkout@v3
-
-      - name: Cross-compile with gox for ${{ matrix.targets }}
-        env:
-          GOFLAGS: "-trimpath"
-          GOX_ARCHS: "${{ matrix.targets }}"
-        run: |
-          mkdir build-output
-          gox -parallel 2 -verbose -osarch "$GOX_ARCHS" -output "build-output/{{.Dir}}_{{.OS}}_{{.Arch}}" ./cmd/restic
-          gox -parallel 2 -verbose -osarch "$GOX_ARCHS" -tags debug -output "build-output/{{.Dir}}_{{.OS}}_{{.Arch}}_debug" ./cmd/restic
+          mkdir build-output build-output-debug
+          go run ./helpers/build-release-binaries/main.go -o build-output -s . --platform-subset ${{ matrix.subset }}
+          go run ./helpers/build-release-binaries/main.go -o build-output-debug -s . --platform-subset ${{ matrix.subset }} --tags debug
 
   lint:
     name: lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # allow annotating code in the PR
+      checks: write
     steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
       - name: Set up Go ${{ env.latest_go }}
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ env.latest_go }}
 
-      - name: Check out code
-        uses: actions/checkout@v3
-
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v6
         with:
           # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
-          version: v1.49
-          # Optional: show only new issues if it's a pull request. The default value is `false`.
-          only-new-issues: true
+          version: v1.57.1
           args: --verbose --timeout 5m
 
         # only run golangci-lint for pull requests, otherwise ALL hints get
@@ -269,16 +278,31 @@ jobs:
           go mod tidy
           git diff --exit-code go.mod go.sum
 
+  analyze:
+    name: Analyze results
+    needs: [test, cross_compile, lint]
+    if: always()
+
+    permissions: # no need to access code
+      contents: none
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Decide whether the needed jobs succeeded or failed
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
+        with:
+          jobs: ${{ toJSON(needs) }}
+
   docker:
     name: docker
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           # list of Docker images to use as base name for tags
           images: |
@@ -294,14 +318,14 @@ jobs:
             type=sha
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Build and push
         id: docker_build
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           push: false
           context: .

.gitignore

@@ -1,3 +1,5 @@
+/.idea
 /restic
+/restic.exe
 /.vagrant
 /.vscode

.golangci.yml

@@ -10,13 +10,10 @@ linters:
     # make sure all errors returned by functions are handled
     - errcheck
 
-    # find unused code
-    - deadcode
-
     # show how code can be simplified
     - gosimple
 
-    # # make sure code is formatted
+    # make sure code is formatted
     - gofmt
 
     # examine code and report suspicious constructs, such as Printf calls whose
@@ -35,15 +32,14 @@ linters:
     # find unused variables, functions, structs, types, etc.
     - unused
 
-    # find unused struct fields
-    - structcheck
-
-    # find unused global variables
-    - varcheck
-
     # parse and typecheck code
     - typecheck
 
+    # ensure that http response bodies are closed
+    - bodyclose
+
+    - importas
+
 issues:
   # don't use the default exclude rules, this hides (among others) ignored
   # errors from Close() calls
@@ -57,3 +53,17 @@ issues:
     - don't use ALL_CAPS in Go names; use CamelCase
     # revive: lots of packages don't have such a comment
     - "package-comments: should have a package comment"
+    # staticcheck: there's no easy way to replace these packages
+    - "SA1019: \"golang.org/x/crypto/poly1305\" is deprecated"
+    - "SA1019: \"golang.org/x/crypto/openpgp\" is deprecated"
+
+  exclude-rules:
+    # revive: ignore unused parameters in tests
+    - path: (_test\.go|testing\.go|backend/.*/tests\.go)
+      text: "unused-parameter:"
+
+linters-settings:
+  importas:
+    alias:
+      - pkg: github.com/restic/restic/internal/test
+        alias: rtest

.readthedocs.yaml

@@ -0,0 +1,22 @@
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+version: 2
+
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "3.11"
+
+# Build HTMLZip
+formats:
+  - htmlzip
+
+# Build documentation in the docs/ directory with Sphinx
+sphinx:
+  configuration: doc/conf.py
+
+# https://docs.readthedocs.io/en/stable/guides/reproducible-builds.html
+python:
+  install:
+  - requirements: doc/requirements.txt

CONTRIBUTING.md

@@ -6,7 +6,8 @@ Ways to Help Out
 Thank you for your contribution! Please **open an issue first** (or add a
 comment to an existing issue) if you plan to work on any code or add a new
 feature. This way, duplicate work is prevented and we can discuss your ideas
-and design first.
+and design first. Small bugfixes are an exception to this rule, just open a
+pull request in this case.
 
 There are several ways you can help us out. First of all code contributions and
 bug fixes are most welcome. However even "minor" details as fixing spelling
@@ -58,6 +59,19 @@ Please be aware that the debug log file will contain potentially sensitive
 things like file and directory names, so please either redact it before
 uploading it somewhere or post only the parts that are really relevant.
 
+If restic gets stuck, please also include a stacktrace in the description.
+On non-Windows systems, you can send a SIGQUIT signal to restic or press
+`Ctrl-\` to achieve the same result. This causes restic to print a stacktrace
+and then exit immediately. This will not damage your repository, however,
+it might be necessary to manually clean up stale lock files using
+`restic unlock`.
+
+On Windows, please set the environment variable `RESTIC_DEBUG_STACKTRACE_SIGINT`
+to `true` and press `Ctrl-C` to create a stacktrace.
+
+If you think restic uses too much memory or a too large cache directory, then
+please include the output of `restic stats --mode debug`.
+
 
 Development Environment
 =======================
@@ -78,10 +92,40 @@ Then use the `go` tool to build restic:
     $ ./restic version
     restic 0.14.0-dev (compiled manually) compiled with go1.19 on linux/amd64
 
+To create a debug build use:
+
+    $ go build -tags debug ./cmd/restic
+
 You can run all tests with the following command:
 
     $ go test ./...
 
+
+Performance and Memory Usage Issues
+===================================
+
+Debug builds of restic support the `--block-profile`, `--cpu-profile`,
+`--mem-profile`, and `--trace-profile` options which collect performance data
+that later on can be analyzed using the go tools:
+
+    $ restic --cpu-profile . [...]
+    $ go tool pprof -http localhost:12345 cpu.pprof
+
+To analyze a trace profile use `go tool trace -http=localhost:12345 trace.out`.
+
+As the memory usage of restic changes over time, it may be useful to capture a
+snapshot of the current heap. This is possible using then `--listen-profile`
+option. Then while restic runs you can query and afterwards analyze the heap statistics.
+
+    $ restic --listen-profile localhost:12345 [...]
+    $ curl http://localhost:12345/debug/pprof/heap -o heap.pprof
+    $ go tool pprof -http localhost:12345 heap.pprof
+
+Further useful tools are setting the environment variable `GODEBUG=gctrace=1`,
+which provides information about garbage collector runs. For a graphical variant
+combine this with gcvis.
+
+
 Providing Patches
 =================
 

README.md

@@ -10,8 +10,7 @@ For detailed usage and installation instructions check out the [documentation](h
 
 You can ask questions in our [Discourse forum](https://forum.restic.net).
 
-Quick start
------------
+## Quick start
 
 Once you've [installed](https://restic.readthedocs.io/en/latest/020_installation.html) restic, start
 off with creating a repository for your backups:
@@ -59,7 +58,7 @@ Therefore, restic supports the following backends for storing backups natively:
 Restic is a program that does backups right and was designed with the
 following principles in mind:
 
--  **Easy:** Doing backups should be a frictionless process, otherwise
+-  **Easy**: Doing backups should be a frictionless process, otherwise
    you might be tempted to skip it. Restic should be easy to configure
    and use, so that, in the event of a data loss, you can just restore
    it. Likewise, restoring data should not be complicated.
@@ -92,20 +91,17 @@ reproduce a byte identical version from the source code for that
 release. Instructions on how to do that are contained in the
 [builder repository](https://github.com/restic/builder).
 
-News
-----
+## News
 
-You can follow the restic project on Twitter [@resticbackup](https://twitter.com/resticbackup) or by subscribing to
+You can follow the restic project on Mastodon [@resticbackup](https://fosstodon.org/@restic) or subscribe to
 the [project blog](https://restic.net/blog/).
 
-License
--------
+## License
 
 Restic is licensed under [BSD 2-Clause License](https://opensource.org/licenses/BSD-2-Clause). You can find the
-complete text in [``LICENSE``](LICENSE).
+complete text in [`LICENSE`](LICENSE).
 
-Sponsorship
------------
+## Sponsorship
 
 Backend integration tests for Google Cloud Storage and Microsoft Azure Blob
 Storage are sponsored by [AppsCode](https://appscode.com)!

VERSION

@@ -1 +1 @@
-0.15.2
+0.17.3

build.go

@@ -380,6 +380,12 @@ func main() {
 		}
 	}
 
+	solarisMinVersion := GoVersion{Major: 1, Minor: 20, Patch: 0}
+	if env["GOARCH"] == "solaris" && !goVersion.AtLeast(solarisMinVersion) {
+		fmt.Fprintf(os.Stderr, "Detected version %s is too old, restic requires at least %s for Solaris\n", goVersion, solarisMinVersion)
+		os.Exit(1)
+	}
+
 	verbosePrintf("detected Go version %v\n", goVersion)
 
 	preserveSymbols := false

changelog/0.10.0_2020-09-19/pull-2195

@@ -10,7 +10,7 @@ https://github.com/restic/restic/issues/2244
 
 NOTE: This new implementation does not guarantee order in which blobs
 are written to the target files and, for example, the last blob of a
-file can be written to the file before any of the preceeding file blobs.
+file can be written to the file before any of the preceding file blobs.
 It is therefore possible to have gaps in the data written to the target
 files if restore fails or interrupted by the user.
 

changelog/0.10.0_2020-09-19/pull-2668

@@ -1,6 +1,6 @@
 Bugfix: Don't abort the stats command when data blobs are missing
 
-Runing the stats command in the blobs-per-file mode on a repository with
+Running the stats command in the blobs-per-file mode on a repository with
 missing data blobs previously resulted in a crash.
 
 https://github.com/restic/restic/pull/2668

changelog/0.11.0_2020-11-05/issue-1756

@@ -1,6 +1,6 @@
 Bugfix: Mark repository files as read-only when using the local backend
 
-Files stored in a local repository were marked as writeable on the
+Files stored in a local repository were marked as writable on the
 filesystem for non-Windows systems, which did not prevent accidental file
 modifications outside of restic. In addition, the local backend did not work
 with certain filesystems and network mounts which do not permit modifications

changelog/0.11.0_2020-11-05/issue-340

@@ -5,7 +5,7 @@ another process using an exclusive lock through a filesystem snapshot. Restic
 was unable to backup those files before. This update enables backing up these
 files.
 
-This needs to be enabled explicitely using the --use-fs-snapshot option of the
+This needs to be enabled explicitly using the --use-fs-snapshot option of the
 backup command.
 
 https://github.com/restic/restic/issues/340

changelog/0.12.0_2021-02-14/issue-3232

@@ -1,7 +1,7 @@
-Bugfix: Correct statistics for overlapping targets
+Bugfix: Correct statistics for overlapping backup sources
 
 A user reported that restic's statistics and progress information during backup
-was not correctly calculated when the backup targets (files/dirs to save)
+was not correctly calculated when the backup sources (files/dirs to save)
 overlap. For example, consider a directory `foo` which contains (among others)
 a file `foo/bar`. When `restic backup foo foo/bar` was run, restic counted the
 size of the file `foo/bar` twice, so the completeness percentage as well as the

changelog/0.12.0_2021-02-14/pull-3106

@@ -2,7 +2,7 @@ Enhancement: Parallelize scan of snapshot content in `copy` and `prune`
 
 The `copy` and `prune` commands used to traverse the directories of
 snapshots one by one to find used data. This snapshot traversal is
-now parallized which can speed up this step several times.
+now parallelized which can speed up this step several times.
 
 In addition the `check` command now reports how many snapshots have
 already been processed.

changelog/0.14.0_2022-08-25/pull-3475

@@ -3,7 +3,7 @@ Enhancement: Allow limiting IO concurrency for local and SFTP backend
 Restic did not support limiting the IO concurrency / number of connections for
 accessing repositories stored using the local or SFTP backends. The number of
 connections is now limited as for other backends, and can be configured via the
-the `-o local.connections=2` and `-o sftp.connections=5` options. This ensures
-that restic does not overwhelm the backend with concurrent IO operations.
+`-o local.connections=2` and `-o sftp.connections=5` options. This ensures that
+restic does not overwhelm the backend with concurrent IO operations.
 
 https://github.com/restic/restic/pull/3475

changelog/0.16.0_2023-07-31/issue-1495

@@ -0,0 +1,7 @@
+Enhancement: Sort snapshots by timestamp in `restic find`
+
+The `find` command used to print snapshots in an arbitrary order. Restic now
+prints snapshots sorted by timestamp.
+
+https://github.com/restic/restic/issues/1495
+https://github.com/restic/restic/pull/4409

changelog/0.16.0_2023-07-31/issue-1759

@@ -0,0 +1,21 @@
+Enhancement: Add `repair index` and `repair snapshots` commands
+
+The `rebuild-index` command has been renamed to `repair index`. The old name
+will still work, but is deprecated.
+
+When a snapshot was damaged, the only option up to now was to completely forget
+the snapshot, even if only some unimportant files in it were damaged and other
+files were still fine.
+
+Restic now has a `repair snapshots` command, which can salvage any non-damaged
+files and parts of files in the snapshots by removing damaged directories and
+missing file contents. Please note that the damaged data may still be lost
+and see the "Troubleshooting" section in the documentation for more details.
+
+https://github.com/restic/restic/issues/1759
+https://github.com/restic/restic/issues/1714
+https://github.com/restic/restic/issues/1798
+https://github.com/restic/restic/issues/2334
+https://github.com/restic/restic/pull/2876
+https://forum.restic.net/t/corrupted-repo-how-to-repair/799
+https://forum.restic.net/t/recovery-options-for-damaged-repositories/1571

changelog/0.16.0_2023-07-31/issue-1926

@@ -0,0 +1,8 @@
+Enhancement: Allow certificate paths to be passed through environment variables
+
+Restic will now read paths to certificates from the environment variables
+`RESTIC_CACERT` or `RESTIC_TLS_CLIENT_CERT` if `--cacert` or `--tls-client-cert`
+are not specified. 
+
+https://github.com/restic/restic/issues/1926  
+https://github.com/restic/restic/pull/4384

changelog/0.16.0_2023-07-31/issue-2359

@@ -0,0 +1,11 @@
+Enhancement: Provide multi-platform Docker images
+
+The official Docker images are now built for the architectures linux/386,
+linux/amd64, linux/arm and linux/arm64.
+
+As an alternative to the Docker Hub, the Docker images are also
+available on ghcr.io, the GitHub Container Registry.
+
+https://github.com/restic/restic/issues/2359
+https://github.com/restic/restic/issues/4269
+https://github.com/restic/restic/pull/4364

changelog/0.16.0_2023-07-31/issue-2468

@@ -0,0 +1,10 @@
+Enhancement: Add support for non-global Azure clouds
+
+The `azure` backend previously only supported storages using the global domain
+`core.windows.net`. This meant that backups to other domains such as Azure
+China (`core.chinacloudapi.cn`) or Azure Germany (`core.cloudapi.de`) were
+not supported. Restic now allows overriding the global domain using the 
+environment variable `AZURE_ENDPOINT_SUFFIX`.
+
+https://github.com/restic/restic/issues/2468
+https://github.com/restic/restic/pull/4387

changelog/0.16.0_2023-07-31/issue-2565

@@ -0,0 +1,10 @@
+Bugfix: Support "unlimited" in `forget --keep-*` options
+
+Restic would previously forget snapshots that should have been kept when a
+negative value was passed to the `--keep-*` options. Negative values are now
+forbidden. To keep all snapshots, the special value `unlimited` is now
+supported. For example, `--keep-monthly unlimited` will keep all monthly
+snapshots.
+
+https://github.com/restic/restic/issues/2565
+https://github.com/restic/restic/pull/4234

changelog/0.16.0_2023-07-31/issue-3311

@@ -0,0 +1,12 @@
+Bugfix: Support non-UTF8 paths as symlink target
+
+Earlier restic versions did not correctly `backup` and `restore` symlinks that
+contain a non-UTF8 target. Note that this only affected systems that still use
+a non-Unicode encoding for filesystem paths.
+
+The repository format is now extended to add support for such symlinks. Please
+note that snapshots must have been created with at least restic version 0.16.0
+for `restore` to correctly handle non-UTF8 symlink targets when restoring them.
+
+https://github.com/restic/restic/issues/3311
+https://github.com/restic/restic/pull/3802

changelog/0.16.0_2023-07-31/issue-3328

@@ -0,0 +1,9 @@
+Enhancement: Reduce memory usage by up to 25%
+
+The in-memory index has been optimized to be more garbage collection friendly.
+Restic now defaults to `GOGC=50` to run the Go garbage collector more
+frequently.
+
+https://github.com/restic/restic/issues/3328
+https://github.com/restic/restic/pull/4352
+https://github.com/restic/restic/pull/4353

changelog/0.16.0_2023-07-31/issue-3397

@@ -0,0 +1,11 @@
+Enhancement: Improve accuracy of ETA displayed during backup
+
+Restic's `backup` command displayed an ETA that did not adapt when the rate of
+progress made during the backup changed during the course of the backup.
+
+Restic now uses recent progress when computing the ETA. It is important to
+realize that the estimate may still be wrong, because restic cannot predict
+the future, but the hope is that the ETA will be more accurate in most cases.
+
+https://github.com/restic/restic/issues/3397
+https://github.com/restic/restic/pull/3563

changelog/0.16.0_2023-07-31/issue-3624

@@ -0,0 +1,9 @@
+Enhancement: Keep oldest snapshot when there are not enough snapshots
+
+The `forget` command now additionally preserves the oldest snapshot if fewer
+snapshots than allowed by the `--keep-*` parameters would otherwise be kept.
+This maximizes the amount of history kept within the specified limits.
+
+https://github.com/restic/restic/issues/3624
+https://github.com/restic/restic/pull/4366
+https://forum.restic.net/t/keeping-yearly-snapshots-policy-when-backup-began-during-the-year/4670/2

changelog/0.16.0_2023-07-31/issue-3698

@@ -0,0 +1,8 @@
+Enhancement: Add support for Managed / Workload Identity to `azure` backend
+
+Restic now additionally supports authenticating to Azure using Workload
+Identity or Managed Identity credentials, which are automatically injected in
+several environments such as a managed Kubernetes cluster.
+
+https://github.com/restic/restic/issues/3698
+https://github.com/restic/restic/pull/4029

changelog/0.16.0_2023-07-31/issue-3871

@@ -0,0 +1,22 @@
+Enhancement: Support `<snapshot>:<subfolder>` syntax to select subfolders
+
+Commands like `diff` or `restore` always worked with the full snapshot. This
+did not allow comparing only a specific subfolder or only restoring that folder
+(`restore --include subfolder` filters the restored files, but still creates the
+directories included in `subfolder`).
+
+The commands `diff`, `dump`, `ls` and `restore` now support the
+`<snapshot>:<subfolder>` syntax, where `snapshot` is the ID of a snapshot (or
+the string `latest`) and `subfolder` is a path within the snapshot. The
+commands will then only work with the specified path of the snapshot. The
+`subfolder` must be a path to a folder as returned by `ls`. Two examples:
+
+`restic restore -t target latest:/some/path`
+`restic diff 12345678:/some/path 90abcef:/some/path`
+
+For debugging purposes, the `cat` command now supports `cat tree
+<snapshot>:<subfolder>` to return the directory metadata for the given
+subfolder.
+
+https://github.com/restic/restic/issues/3871
+https://github.com/restic/restic/pull/4334

changelog/0.16.0_2023-07-31/issue-3941

@@ -0,0 +1,17 @@
+Enhancement: Support `--group-by` for backup parent selection
+
+Previously, the `backup` command by default selected the parent snapshot based
+on the hostname and the backup paths. When the backup path list changed, the
+`backup` command was unable to determine a suitable parent snapshot and had to
+read all files again.
+
+The new `--group-by` option for the `backup` command allows filtering snapshots
+for the parent selection by `host`, `paths` and `tags`. It defaults to
+`host,paths` which selects the latest snapshot with hostname and paths matching
+those of the backup run. This matches the behavior of prior restic versions.
+
+The new `--group-by` option should be set to the same value as passed to
+`forget --group-by`.
+
+https://github.com/restic/restic/issues/3941
+https://github.com/restic/restic/pull/4081

changelog/0.16.0_2023-07-31/issue-4130

@@ -0,0 +1,9 @@
+Enhancement: Cancel current command if cache becomes unusable
+
+If the cache directory was removed or ran out of space while restic was
+running, this would previously cause further caching attempts to fail and
+thereby drastically slow down the command execution. Now, the currently running
+command is instead canceled.
+
+https://github.com/restic/restic/issues/4130
+https://github.com/restic/restic/pull/4166

changelog/0.16.0_2023-07-31/issue-4159

@@ -0,0 +1,12 @@
+Enhancement: Add `--human-readable` option to `ls` and `find` commands
+
+Previously, when using the `-l` option with the `ls` and `find` commands, the
+displayed size was always in bytes, without an option for a more human readable
+format such as MiB or GiB.
+
+The new `--human-readable` option will convert longer size values into more 
+human friendly values with an appropriate suffix depending on the output size.
+For example, a size of `14680064` will be shown as `14.000 MiB`.
+
+https://github.com/restic/restic/issues/4159
+https://github.com/restic/restic/pull/4351

changelog/0.16.0_2023-07-31/issue-4188

@@ -0,0 +1,8 @@
+Enhancement: Include restic version in snapshot metadata
+
+The restic version used to backup a snapshot is now included in its metadata
+and shown when inspecting a snapshot using `restic cat snapshot <snapshotID>`
+or `restic snapshots --json`.
+
+https://github.com/restic/restic/issues/4188
+https://github.com/restic/restic/pull/4378

changelog/0.16.0_2023-07-31/issue-4199

@@ -0,0 +1,9 @@
+Bugfix: Avoid lock refresh issues on slow network connections
+
+On network connections with a low upload speed, backups and other operations
+could fail with the error message `Fatal: failed to refresh lock in time`.
+
+This has now been fixed by reworking the lock refresh handling.
+
+https://github.com/restic/restic/issues/4199
+https://github.com/restic/restic/pull/4304

changelog/0.16.0_2023-07-31/issue-426

@@ -0,0 +1,14 @@
+Enhancement: Show progress bar during restore
+
+The `restore` command now shows a progress report while restoring files.
+
+Example: `[0:42]  5.76%  23 files 12.98 MiB, total 3456 files 23.54 GiB`
+
+JSON output is now also supported.
+
+https://github.com/restic/restic/issues/426
+https://github.com/restic/restic/issues/3413
+https://github.com/restic/restic/issues/3627
+https://github.com/restic/restic/pull/3991
+https://github.com/restic/restic/pull/4314
+https://forum.restic.net/t/progress-bar-for-restore/5210

changelog/0.16.0_2023-07-31/issue-4274

@@ -0,0 +1,11 @@
+Bugfix: Improve lock refresh handling after standby
+
+If the restic process was stopped or the host running restic entered standby
+during a long running operation such as a backup, this previously resulted in
+the operation failing with `Fatal: failed to refresh lock in time`.
+
+This has now been fixed such that restic first checks whether it is safe to
+continue the current operation and only throws an error if not.
+
+https://github.com/restic/restic/issues/4274
+https://github.com/restic/restic/pull/4374

changelog/0.16.0_2023-07-31/issue-4375

@@ -0,0 +1,8 @@
+Enhancement: Add support for extended attributes on symlinks
+
+Restic now supports extended attributes on symlinks when backing up,
+restoring, or FUSE-mounting snapshots. This includes, for example, the
+`security.selinux` xattr on Linux distributions that use SELinux.
+
+https://github.com/restic/restic/issues/4375
+https://github.com/restic/restic/pull/4379

changelog/0.16.0_2023-07-31/issue-719

@@ -0,0 +1,8 @@
+Enhancement: Add `--retry-lock` option
+
+This option allows specifying a duration for which restic will wait if the
+repository is already locked.
+
+https://github.com/restic/restic/issues/719
+https://github.com/restic/restic/pull/2214
+https://github.com/restic/restic/pull/4107

changelog/0.16.0_2023-07-31/pull-3261

@@ -0,0 +1,8 @@
+Enhancement: Reduce file fragmentation for local backend
+
+Before this change, local backend files could become fragmented.
+Now restic will try to preallocate space for pack files to avoid
+their fragmentation.
+
+https://github.com/restic/restic/issues/2679
+https://github.com/restic/restic/pull/3261

changelog/0.16.0_2023-07-31/pull-4176

@@ -0,0 +1,7 @@
+Change: Fix JSON message type of `scan_finished` for the `backup` command
+
+Restic incorrectly set the `message_type` of the `scan_finished` message to
+`status` instead of `verbose_status`. This has now been corrected so that
+the messages report the correct type.
+
+https://github.com/restic/restic/pull/4176

changelog/0.16.0_2023-07-31/pull-4201

@@ -0,0 +1,7 @@
+Change: Require Go 1.20 for Solaris builds
+
+Building restic on Solaris now requires Go 1.20, as the library used to access
+Azure uses the mmap syscall, which is only available on Solaris starting from
+Go 1.20. All other platforms however continue to build with Go 1.18.
+
+https://github.com/restic/restic/pull/4201

changelog/0.16.0_2023-07-31/pull-4220

@@ -0,0 +1,6 @@
+Enhancement: Add `jq` binary to Docker image
+
+The Docker image now contains `jq`, which can be useful to process JSON data
+output by restic.
+
+https://github.com/restic/restic/pull/4220

changelog/0.16.0_2023-07-31/pull-4226

@@ -0,0 +1,7 @@
+Enhancement: Allow specifying region of new buckets in the `gs` backend
+
+Previously, buckets used by the Google Cloud Storage backend would always get
+created in the "us" region. It is now possible to specify the region where a
+bucket should be created by using the `-o gs.region=us` option.
+
+https://github.com/restic/restic/pull/4226

changelog/0.16.0_2023-07-31/pull-4318

@@ -0,0 +1,8 @@
+Bugfix: Correctly clean up status bar output of the `backup` command
+
+Due to a regression in restic 0.15.2, the status bar of the `backup` command
+could leave some output behind. This happened if filenames were printed that
+are wider than the current terminal width. This has now been fixed.
+
+https://github.com/restic/restic/issues/4319
+https://github.com/restic/restic/pull/4318

changelog/0.16.0_2023-07-31/pull-4333

@@ -0,0 +1,3 @@
+Bugfix: `generate` and `init` no longer silently ignore unexpected arguments
+
+https://github.com/restic/restic/pull/4333

changelog/0.16.0_2023-07-31/pull-4400

@@ -0,0 +1,8 @@
+Bugfix: Ignore missing folders in `rest` backend
+
+If a repository accessed via the REST backend was missing folders, then restic
+would fail with an error while trying to list the data in the repository. This
+has been now fixed.
+
+https://github.com/restic/restic/pull/4400
+https://github.com/restic/rest-server/issues/235

changelog/0.16.1_2023-10-24/issue-4128

@@ -0,0 +1,9 @@
+Enhancement: Automatically set `GOMAXPROCS` in resource-constrained containers
+
+When running restic in a Linux container with CPU-usage limits, restic now
+automatically adjusts `GOMAXPROCS`. This helps to reduce the memory consumption
+on hosts with many CPU cores.
+
+https://github.com/restic/restic/issues/4128
+https://github.com/restic/restic/pull/4485
+https://github.com/restic/restic/pull/4531

changelog/0.16.1_2023-10-24/issue-4513

@@ -0,0 +1,8 @@
+Bugfix: Make `key list` command honor `--no-lock`
+
+The `key list` command now supports the `--no-lock` options. This allows
+determining which keys a repo can be accessed by without the need for having
+write access (e.g., read-only sftp access, filesystem snapshot).
+
+https://github.com/restic/restic/issues/4513
+https://github.com/restic/restic/pull/4514

changelog/0.16.1_2023-10-24/issue-4516

@@ -0,0 +1,8 @@
+Bugfix: Do not try to load password on command line autocomplete
+
+The command line autocompletion previously tried to load the repository
+password. This could cause the autocompletion not to work. Now, this step gets
+skipped.
+
+https://github.com/restic/restic/issues/4516
+https://github.com/restic/restic/pull/4526

changelog/0.16.1_2023-10-24/issue-4523

@@ -0,0 +1,22 @@
+Bugfix: Update zstd library to fix possible data corruption at max. compression
+
+In restic 0.16.0, backups where the compression level was set to `max` (using
+`--compression max`) could in rare and very specific circumstances result in
+data corruption due to a bug in the library used for compressing data.
+
+Restic now uses the latest version of the library used to compress data, which
+includes a fix for this issue. Please note that the `auto` compression level
+(which restic uses by default) was never affected, and even if you used `max`
+compression, chances of being affected by this issue were very small.
+
+To check a repository for any corruption, run `restic check --read-data`. This
+will download and verify the whole repository and can be used at any time to
+completely verify the integrity of a repository. If the `check` command detects
+anomalies, follow the suggested steps.
+
+To simplify any needed repository repair and minimize data loss, there is also
+a new and experimental `repair packs` command that salvages all valid data from
+the affected pack files (see `restic help repair packs` for more information).
+
+https://github.com/restic/restic/issues/4523
+https://github.com/restic/restic/pull/4530

changelog/0.16.1_2023-10-24/pull-299

@@ -0,0 +1,7 @@
+Enhancement: Show progress bar while loading the index
+
+Restic did not provide any feedback while loading index files. Now, there is a
+progress bar that shows the index loading progress.
+
+https://github.com/restic/restic/issues/229
+https://github.com/restic/restic/pull/4419

changelog/0.16.1_2023-10-24/pull-4480

@@ -0,0 +1,11 @@
+Enhancement: Allow setting REST password and username via environment variables
+
+Previously, it was only possible to specify the REST-server username and
+password in the repository URL, or by using the `--repository-file` option.
+This meant it was not possible to use authentication in contexts where the
+repository URL is stored in publicly accessible way.
+
+Restic now allows setting the username and password using the
+`RESTIC_REST_USERNAME` and `RESTIC_REST_PASSWORD` variables.
+
+https://github.com/restic/restic/pull/4480

changelog/0.16.1_2023-10-24/pull-4511

@@ -0,0 +1,7 @@
+Enhancement: Include inode numbers in JSON output for `find` and `ls` commands
+
+Restic used to omit the inode numbers in the JSON messages emitted for nodes by
+the `ls` command as well as for matches by the `find` command. It now includes
+those values whenever they are available.
+
+https://github.com/restic/restic/pull/4511

changelog/0.16.1_2023-10-24/pull-4519

@@ -0,0 +1,12 @@
+Enhancement: Add config option to set SFTP command arguments
+
+When using the `sftp` backend, scenarios where a custom identity file was
+needed for the SSH connection, required the full command to be specified:
+`-o sftp.command='ssh user@host:port -i /ssh/my_private_key -s sftp'`
+
+Now, the `-o sftp.args=...` option can be passed to restic to specify
+custom arguments for the SSH command executed by the SFTP backend.
+This simplifies the above example to `-o sftp.args='-i /ssh/my_private_key'`.
+
+https://github.com/restic/restic/pull/4519
+https://github.com/restic/restic/issues/4241

changelog/0.16.1_2023-10-24/pull-4532

@@ -0,0 +1,8 @@
+Change: Update dependencies and require Go 1.19 or newer
+
+We have updated all dependencies. Since some libraries require newer Go
+standard library features, support for Go 1.18 has been dropped, which means
+that restic now requires at least Go 1.19 to build.
+
+https://github.com/restic/restic/pull/4532
+https://github.com/restic/restic/pull/4533

changelog/0.16.2_2023-10-29/issue-4540

@@ -0,0 +1,9 @@
+Bugfix: Restore ARMv5 support for ARM binaries
+
+The official release binaries for restic 0.16.1 were accidentally built to
+require ARMv7. The build process is now updated to restore support for ARMv5.
+
+Please note that restic 0.17.0 will drop support for ARMv5 and require at least
+ARMv6.
+
+https://github.com/restic/restic/issues/4540

changelog/0.16.2_2023-10-29/pull-4545

@@ -0,0 +1,8 @@
+Bugfix: Repair documentation build on Read the Docs
+
+For restic 0.16.1, no documentation was available at
+https://restic.readthedocs.io/ .
+
+The documentation build process is now updated to work again.
+
+https://github.com/restic/restic/pull/4545

changelog/0.16.3_2024-01-14/issue-4560

@@ -0,0 +1,14 @@
+Bugfix: Improve errors for irregular files on Windows
+
+Since Go 1.21, most filesystem reparse points on Windows are considered to be
+irregular files. This caused restic to show an `error: invalid node type ""`
+error message for those files.
+
+This error message has now been improved and includes the relevant file path:
+`error: nodeFromFileInfo path/to/file: unsupported file type "irregular"`.
+As irregular files are not required to behave like regular files, it is not
+possible to provide a generic way to back up those files.
+
+https://github.com/restic/restic/issues/4560
+https://github.com/restic/restic/pull/4620
+https://forum.restic.net/t/windows-backup-error-invalid-node-type/6875

changelog/0.16.3_2024-01-14/issue-4574

@@ -0,0 +1,11 @@
+Bugfix: Support backup of deduplicated files on Windows again
+
+With the official release builds of restic 0.16.1 and 0.16.2, it was not
+possible to back up files that were deduplicated by the corresponding
+Windows Server feature. This also applied to restic versions built using
+Go 1.21.0-1.21.4.
+
+The Go version used to build restic has now been updated to fix this.
+
+https://github.com/restic/restic/issues/4574
+https://github.com/restic/restic/pull/4621

changelog/0.16.3_2024-01-14/issue-4612

@@ -0,0 +1,11 @@
+Bugfix: Improve error handling for `rclone` backend
+
+Since restic 0.16.0, if rclone encountered an error while listing files,
+this could in rare circumstances cause restic to assume that there are no
+files. Although unlikely, this situation could result in data loss if it
+were to happen right when the `prune` command is listing existing snapshots.
+
+Error handling has now been improved to detect and work around this case.
+
+https://github.com/restic/restic/issues/4612
+https://github.com/restic/restic/pull/4618

changelog/0.16.3_2024-01-14/pull-4624

@@ -0,0 +1,11 @@
+Bugfix: Correct `restore` progress information if an error occurs
+
+If an error occurred while restoring a snapshot, this could cause the `restore`
+progress bar to show incorrect information. In addition, if a data file could
+not be loaded completely, then errors would also be reported for some already
+restored files.
+
+Error reporting of the `restore` command has now been made more accurate.
+
+https://github.com/restic/restic/pull/4624
+https://forum.restic.net/t/errors-restoring-with-restic-on-windows-server-s3/6943

changelog/0.16.3_2024-01-14/pull-4626

@@ -0,0 +1,11 @@
+Bugfix: Improve reliability of restoring large files
+
+In some cases restic failed to restore large files that frequently contain the
+same file chunk. In combination with certain backends, this could result in
+network connection timeouts that caused incomplete restores.
+
+Restic now includes special handling for such file chunks to ensure reliable
+restores.
+
+https://github.com/restic/restic/pull/4626
+https://forum.restic.net/t/errors-restoring-with-restic-on-windows-server-s3/6943

changelog/0.16.4_2024-02-04/issue-4529

@@ -0,0 +1,18 @@
+Enhancement: Add extra verification of data integrity before upload
+
+Hardware issues, or a bug in restic or its dependencies, could previously cause
+corruption in the files restic created and stored in the repository. Detecting
+such corruption previously required explicitly running the `check --read-data`
+or `check --read-data-subset` commands.
+
+To further ensure data integrity, even in the case of hardware issues or
+software bugs, restic now performs additional verification of the files about
+to be uploaded to the repository.
+
+These extra checks will increase CPU usage during backups. They can therefore,
+if absolutely necessary, be disabled using the `--no-extra-verify` global
+option. Please note that this should be combined with more active checking
+using the previously mentioned check commands.
+
+https://github.com/restic/restic/issues/4529
+https://github.com/restic/restic/pull/4681

changelog/0.16.4_2024-02-04/issue-4677

@@ -0,0 +1,19 @@
+Bugfix: Downgrade zstd library to fix rare data corruption at max. compression
+
+In restic 0.16.3, backups where the compression level was set to `max` (using
+`--compression max`) could in rare and very specific circumstances result in
+data corruption due to a bug in the library used for compressing data. Restic
+0.16.1 and 0.16.2 were not affected.
+
+Restic now uses the previous version of the library used to compress data, the
+same version used by restic 0.16.2. Please note that the `auto` compression
+level (which restic uses by default) was never affected, and even if you used
+`max` compression, chances of being affected by this issue are small.
+
+To check a repository for any corruption, run `restic check --read-data`. This
+will download and verify the whole repository and can be used at any time to
+completely verify the integrity of a repository. If the `check` command detects
+anomalies, follow the suggested steps.
+
+https://github.com/restic/restic/issues/4677
+https://github.com/restic/restic/pull/4679

changelog/0.16.5_2024-07-01/issue-4873

@@ -0,0 +1,6 @@
+Enhancement: Update dependencies
+
+A few potentially vulnerable dependencies were updated.
+
+https://github.com/restic/restic/issues/4873
+https://github.com/restic/restic/pull/4878

changelog/0.16.5_2024-07-01/pull-4799

@@ -0,0 +1,5 @@
+Enhancement: Add option to force use of Azure CLI credential
+
+A new environment variable `AZURE_FORCE_CLI_CREDENTIAL=true` allows forcing the use of Azure CLI credential, ignoring other credentials like managed identity.
+
+https://github.com/restic/restic/pull/4799

changelog/0.17.0_2024-07-26/issue-1786

@@ -0,0 +1,20 @@
+Enhancement: Support repositories with empty password
+
+Restic previously required a password to create or operate on repositories.
+Using the new option `--insecure-no-password` it is now possible to disable
+this requirement. Restic will not prompt for a password when using this option.
+
+For security reasons, the option must always be specified when operating on
+repositories with an empty password, and specifying `--insecure-no-password`
+while also passing a password to restic via a CLI option or environment
+variable results in an error.
+
+The `init` and `copy` commands add the related `--from-insecure-no-password`
+option, which applies to the source repository. The `key add` and `key passwd`
+commands add the `--new-insecure-no-password` option to add or set an empty
+password.
+
+https://github.com/restic/restic/issues/1786
+https://github.com/restic/restic/issues/4326
+https://github.com/restic/restic/pull/4698
+https://github.com/restic/restic/pull/4808

changelog/0.17.0_2024-07-26/issue-2348

@@ -0,0 +1,12 @@
+Enhancement: Add `--delete` option to `restore` command
+
+The `restore` command now supports a `--delete` option that allows removing
+files and directories from the target directory that do not exist in the
+snapshot. This option also allows files in the snapshot to replace non-empty
+directories having the same name.
+
+To check that only expected files are deleted, add the `--dry-run --verbose=2`
+options.
+
+https://github.com/restic/restic/issues/2348
+https://github.com/restic/restic/pull/4881

changelog/0.17.0_2024-07-26/issue-3600

@@ -0,0 +1,11 @@
+Bugfix: Handle unreadable xattrs in folders above `backup` source
+
+When backup sources are specified using absolute paths, `backup` also includes
+information about the parent folders of the backup sources in the snapshot.
+
+If the extended attributes for some of these folders could not be read due to
+missing permissions, this caused the backup to fail. This has now been fixed.
+
+https://github.com/restic/restic/issues/3600
+https://github.com/restic/restic/pull/4668
+https://forum.restic.net/t/parent-directories-above-the-snapshot-source-path-fatal-error-permission-denied/7216

changelog/0.17.0_2024-07-26/issue-3806

@@ -0,0 +1,12 @@
+Enhancement: Optimize and make `prune` command resumable
+
+Previously, if the `prune` command was interrupted, a later `prune` run would
+start repacking pack files from the start, as `prune` did not update the index
+while repacking.
+
+The `prune` command now supports resuming interrupted prune runs. The update
+of the repository index has also been optimized to use less memory and only
+rewrite parts of the index that have changed.
+
+https://github.com/restic/restic/issues/3806
+https://github.com/restic/restic/pull/4812

changelog/0.17.0_2024-07-26/issue-4048

@@ -0,0 +1,6 @@
+Enhancement: Add support for FUSE-T with `mount` on macOS
+
+The restic `mount` command now supports creating FUSE mounts using FUSE-T on macOS.
+
+https://github.com/restic/restic/issues/4048
+https://github.com/restic/restic/pull/4825

changelog/0.17.0_2024-07-26/issue-4209

@@ -0,0 +1,7 @@
+Bugfix: Fix slow SFTP upload performance
+
+Since restic 0.12.1, the upload speed of the sftp backend to a remote server
+has regressed significantly. This has now been fixed.
+
+https://github.com/restic/restic/issues/4209
+https://github.com/restic/restic/pull/4782

changelog/0.17.0_2024-07-26/issue-4251

@@ -0,0 +1,16 @@
+Enhancement: Support reading backup from a command's standard output
+
+The `backup` command now supports the `--stdin-from-command` option. When using
+this option, the arguments to `backup` are interpreted as a command instead of
+paths to back up. `backup` then executes the given command and stores the
+standard output from it in the backup, similar to the what the `--stdin` option
+does. This also enables restic to verify that the command completes with exit
+code zero. A non-zero exit code causes the backup to fail.
+
+Note that the `--stdin` option does not have to be specified at the same time,
+and that the `--stdin-filename` option also applies to `--stdin-from-command`.
+
+Example: `restic backup --stdin-from-command --stdin-filename dump.sql mysqldump [...]`
+
+https://github.com/restic/restic/issues/4251
+https://github.com/restic/restic/pull/4410

changelog/0.17.0_2024-07-26/issue-4287

@@ -0,0 +1,12 @@
+Enhancement: Support connection to rest-server using unix socket
+
+Restic now supports using a unix socket to connect to a rest-server
+version 0.13.0 or later. This allows running restic as follows:
+
+```
+rest-server --listen unix:/tmp/rest.socket --data /path/to/data &
+restic -r rest:http+unix:///tmp/rest.socket:/my_backup_repo/ [...]
+```
+
+https://github.com/restic/restic/issues/4287
+https://github.com/restic/restic/pull/4655

changelog/0.17.0_2024-07-26/issue-4437

@@ -0,0 +1,11 @@
+Enhancement: Make `check` command create non-existent cache directory
+
+Previously, if a custom cache directory was specified for the `check` command,
+but the directory did not exist, `check` continued with the cache disabled.
+
+The `check` command now attempts to create the cache directory before
+initializing the cache.
+
+https://github.com/restic/restic/issues/4437
+https://github.com/restic/restic/pull/4805
+https://github.com/restic/restic/pull/4883

changelog/0.17.0_2024-07-26/issue-4472

@@ -0,0 +1,18 @@
+Enhancement: Support AWS Assume Role for S3 backend
+
+Previously only credentials discovered via the Minio discovery methods
+were used to authenticate.
+
+However, there are many circumstances where the discovered credentials have
+lower permissions and need to assume a specific role. This is now possible
+using the following new environment variables:
+
+- RESTIC_AWS_ASSUME_ROLE_ARN
+- RESTIC_AWS_ASSUME_ROLE_SESSION_NAME
+- RESTIC_AWS_ASSUME_ROLE_EXTERNAL_ID
+- RESTIC_AWS_ASSUME_ROLE_REGION (defaults to us-east-1)
+- RESTIC_AWS_ASSUME_ROLE_POLICY
+- RESTIC_AWS_ASSUME_ROLE_STS_ENDPOINT
+
+https://github.com/restic/restic/issues/4472
+https://github.com/restic/restic/pull/4474

changelog/0.17.0_2024-07-26/issue-4540

@@ -0,0 +1,7 @@
+Change: Require at least ARMv6 for ARM binaries
+
+The official release binaries of restic now require
+at least ARMv6 support for ARM platforms.
+
+https://github.com/restic/restic/issues/4540
+https://github.com/restic/restic/pull/4542

changelog/0.17.0_2024-07-26/issue-4547

@@ -0,0 +1,7 @@
+Enhancement: Add `--json` option to `version` command
+
+Restic now supports outputting restic version along with the Go version, OS
+and architecture used to build restic in JSON format using `version --json`.
+
+https://github.com/restic/restic/issues/4547
+https://github.com/restic/restic/pull/4553

changelog/0.17.0_2024-07-26/issue-4549

@@ -0,0 +1,11 @@
+Enhancement: Add `--ncdu` option to `ls` command
+
+NCDU (NCurses Disk Usage) is a tool to analyse disk usage of directories. It has
+an option to save a directory tree and analyse it later.
+
+The `ls` command now supports outputting snapshot information in the NCDU format
+using the `--ncdu` option. Example usage: `restic ls latest --ncdu | ncdu -f -`
+
+https://github.com/restic/restic/issues/4549
+https://github.com/restic/restic/pull/4550
+https://github.com/restic/restic/pull/4911

changelog/0.17.0_2024-07-26/issue-4568

@@ -0,0 +1,16 @@
+Bugfix: Prevent `forget --keep-tags <invalid>` from deleting all snapshots
+
+Running `forget --keep-tags <invalid>`, where `<invalid>` is a tag that does
+not exist in the repository, would remove all snapshots. This is especially
+problematic if the tag name contains a typo.
+
+The `forget` command now fails with an error if all snapshots in a snapshot
+group would be deleted. This prevents the above example from deleting all
+snapshots.
+
+It is possible to temporarily disable the new check by setting the environment
+variable `RESTIC_FEATURES=safe-forget-keep-tags=false`. Note that this feature
+flag will be removed in the next minor restic version.
+
+https://github.com/restic/restic/pull/4568
+https://github.com/restic/restic/pull/4764

changelog/0.17.0_2024-07-26/issue-4583

@@ -0,0 +1,13 @@
+Enhancement: Ignore `s3.storage-class` archive tiers for metadata
+
+Restic used to store all files on S3 using the specified `s3.storage-class`.
+
+Now, restic will only use non-archive storage tiers for metadata, to avoid
+problems when accessing a repository. To restore any data, it is still
+necessary to manually warm up the required data beforehand.
+
+NOTE: There is no official cold storage support in restic, use this option at
+your own risk.
+
+https://github.com/restic/restic/issues/4583
+https://github.com/restic/restic/pull/4584

changelog/0.17.0_2024-07-26/issue-4601

@@ -0,0 +1,9 @@
+Enhancement: Add support for feature flags
+
+Restic now supports feature flags that can be used to enable and disable
+experimental features. The flags can be set using the environment variable
+`RESTIC_FEATURES`. To get a list of currently supported feature flags, use
+the `features` command.
+
+https://github.com/restic/restic/issues/4601
+https://github.com/restic/restic/pull/4666

changelog/0.17.0_2024-07-26/issue-4602

@@ -0,0 +1,22 @@
+Change: Deprecate legacy index format and `s3legacy` repository layout
+
+Support for the legacy index format used by restic before version 0.2.0 has
+been deprecated and will be removed in the next minor restic version. You can
+use `restic repair index` to update the index to the current format.
+
+It is possible to temporarily reenable support for the legacy index format by
+setting the environment variable `RESTIC_FEATURES=deprecate-legacy-index=false`.
+Note that this feature flag will be removed in the next minor restic version.
+
+Support for the `s3legacy` repository layout used for the S3 backend before
+restic 0.7.0 has been deprecated and will be removed in the next minor restic
+version. You can migrate your S3 repository to the current layout using
+`RESTIC_FEATURES=deprecate-s3-legacy-layout=false restic migrate s3_layout`.
+
+It is possible to temporarily reenable support for the `s3legacy` layout by
+setting the environment variable `RESTIC_FEATURES=deprecate-s3-legacy-layout=false`.
+Note that this feature flag will be removed in the next minor restic version.
+
+https://github.com/restic/restic/issues/4602
+https://github.com/restic/restic/pull/4724
+https://github.com/restic/restic/pull/4743

changelog/0.17.0_2024-07-26/issue-4627

@@ -0,0 +1,33 @@
+Change: Redesign backend error handling to improve reliability
+
+Restic now downloads pack files in large chunks instead of using a streaming
+download. This prevents failures due to interrupted streams. The `restore`
+command now also retries downloading individual blobs that could not be
+retrieved.
+
+HTTP requests that are stuck for more than two minutes while uploading or
+downloading are now forcibly interrupted. This ensures that stuck requests are
+retried after a short timeout.
+
+Attempts to access a missing or truncated file will no longer be retried. This
+avoids unnecessary retries in those cases. All other backend requests are
+retried for up to 15 minutes. This ensures that temporarily interrupted network
+connections can be tolerated.
+
+If a download yields a corrupt file or blob, then the download will be retried
+once.
+
+Most parts of the new backend error handling can temporarily be disabled by
+setting the environment variable `RESTIC_FEATURES=backend-error-redesign=false`.
+Note that this feature flag will be removed in the next minor restic version.
+
+https://github.com/restic/restic/issues/4627
+https://github.com/restic/restic/issues/4193
+https://github.com/restic/restic/pull/4605
+https://github.com/restic/restic/pull/4792
+https://github.com/restic/restic/issues/4515
+https://github.com/restic/restic/issues/1523
+https://github.com/restic/restic/pull/4520
+https://github.com/restic/restic/pull/4800
+https://github.com/restic/restic/pull/4784
+https://github.com/restic/restic/pull/4844

changelog/0.17.0_2024-07-26/issue-4656

@@ -0,0 +1,7 @@
+Bugfix: Properly report ID of newly added keys
+
+`restic key add` now reports the ID of the newly added key. This simplifies
+selecting a specific key using the `--key-hint key` option.
+
+https://github.com/restic/restic/issues/4656
+https://github.com/restic/restic/pull/4657

changelog/0.17.0_2024-07-26/issue-4676

@@ -0,0 +1,8 @@
+Enhancement: Make `key` command's actions separate sub-commands
+
+Each of the `add`, `list`, `remove` and `passwd` actions provided by the `key`
+command is now a separate sub-command and have its own documentation which can
+be invoked using `restic key <add|list|remove|passwd> --help`.
+
+https://github.com/restic/restic/issues/4676
+https://github.com/restic/restic/pull/4685

changelog/0.17.0_2024-07-26/issue-4678

@@ -0,0 +1,8 @@
+Enhancement: Add `--target` option to the `dump` command
+
+Restic `dump` always printed to the standard output. It now supports specifying
+a `--target` file to write its output to.
+
+https://github.com/restic/restic/issues/4678
+https://github.com/restic/restic/pull/4682
+https://github.com/restic/restic/pull/4692

changelog/0.17.0_2024-07-26/issue-4707

@@ -0,0 +1,14 @@
+Change: Disable S3 anonymous authentication by default
+
+When using the S3 backend with anonymous authentication, it continuously
+tried to retrieve new authentication credentials, causing bad performance.
+
+Now, to use anonymous authentication, it is necessary to pass the extended
+option `-o s3.unsafe-anonymous-auth=true` to restic.
+
+It is possible to temporarily revert to the old behavior by setting the
+environment variable `RESTIC_FEATURES=explicit-s3-anonymous-auth=false`. Note
+that this feature flag will be removed in the next minor restic version.
+
+https://github.com/restic/restic/issues/4707
+https://github.com/restic/restic/pull/4908

changelog/0.17.0_2024-07-26/issue-4733

@@ -0,0 +1,12 @@
+Enhancement: Allow specifying `--host` via environment variable
+
+Restic commands that operate on snapshots, such as `restic backup` and
+`restic snapshots`, support the `--host` option to specify the hostname
+for grouping snapshots.
+
+Such commands now also support specifying the hostname via the environment
+variable `RESTIC_HOST`. Note that `--host` still takes precedence over the
+environment variable.
+
+https://github.com/restic/restic/issues/4733
+https://github.com/restic/restic/pull/4734

changelog/0.17.0_2024-07-26/issue-4744

@@ -0,0 +1,9 @@
+Change: Include full key ID in JSON output of `key list`
+
+The JSON output of the `key list` command has changed to include the full key
+ID instead of just a shortened version of the ID, as the latter can be ambiguous
+in some rare cases. To derive the short ID, please truncate the full ID down to
+eight characters.
+
+https://github.com/restic/restic/issues/4744
+https://github.com/restic/restic/pull/4745

changelog/0.17.0_2024-07-26/issue-4760

@@ -0,0 +1,8 @@
+Bugfix: Fix possible error on concurrent cache cleanup
+
+If multiple restic processes concurrently cleaned up no longer existing files
+from the cache, this could cause some of the processes to fail with an `no such
+file or directory` error. This has now been fixed.
+
+https://github.com/restic/restic/issues/4760
+https://github.com/restic/restic/pull/4761

changelog/0.17.0_2024-07-26/issue-4768

@@ -0,0 +1,8 @@
+Enhancement: Allow specifying custom User-Agent for outgoing requests
+
+Restic now supports setting a custom `User-Agent` for outgoing HTTP requests
+using the global option `--http-user-agent` or the `RESTIC_HTTP_USER_AGENT`
+environment variable.
+
+https://github.com/restic/restic/issues/4768
+https://github.com/restic/restic/pull/4810

changelog/0.17.0_2024-07-26/issue-4781

@@ -0,0 +1,8 @@
+Enhancement: Add `restore` options to read include/exclude patterns from files
+
+Restic now supports reading include and exclude patterns from files using the 
+`--include-file`, `--exclude-file`, `--iinclude-file` and `--iexclude-file` 
+options of the `restore` command.
+
+https://github.com/restic/restic/issues/4781
+https://github.com/restic/restic/pull/4811

changelog/0.17.0_2024-07-26/issue-4817

@@ -0,0 +1,26 @@
+Enhancement: Make overwrite behavior of `restore` customizable
+
+The `restore` command now supports an `--overwrite` option to configure whether
+already existing files are overwritten. The overwrite behavior can be configured
+using the following option values:
+
+- `--overwrite always` (default): Always overwrites already existing files.
+  The `restore` command will verify the existing file content and only restore
+  mismatching parts to minimize downloads. Updates the metadata of all files.
+- `--overwrite if-changed`: Like `always`, but speeds up the file content check
+  by assuming that files with matching size and modification time (mtime) are
+  already up to date. In case of a mismatch, the full file content is verified
+  like with `always`. Updates the metadata of all files.
+- `--overwrite if-newer`: Like `always`, but only overwrites existing files
+  when the file in the snapshot has a newer modification time (mtime) than the
+  existing file.
+- `--overwrite never`: Never overwrites existing files.
+
+https://github.com/restic/restic/issues/4817
+https://github.com/restic/restic/issues/200
+https://github.com/restic/restic/issues/407
+https://github.com/restic/restic/issues/2662
+https://github.com/restic/restic/pull/4837
+https://github.com/restic/restic/pull/4838
+https://github.com/restic/restic/pull/4864
+https://github.com/restic/restic/pull/4921

changelog/0.17.0_2024-07-26/issue-4850

@@ -0,0 +1,8 @@
+Bugfix: Handle UTF-16 password files in `key` command correctly
+
+Previously, `key add` and `key passwd` did not properly decode UTF-16
+encoded passwords read from a password file. This has now been fixed
+to correctly match the encoding when opening a repository.
+
+https://github.com/restic/restic/issues/4850
+https://github.com/restic/restic/pull/4851

changelog/0.17.0_2024-07-26/issue-4902

@@ -0,0 +1,8 @@
+Bugfix: Update snapshot summary on `rewrite`
+
+Restic previously did not recalculate the total number of files and bytes
+processed when files were excluded from a snapshot by the `rewrite` command.
+This has now been fixed.
+
+https://github.com/restic/restic/issues/4902
+https://github.com/restic/restic/pull/4905

changelog/0.17.0_2024-07-26/issue-662

@@ -0,0 +1,11 @@
+Enhancement: Optionally skip snapshot creation if nothing changed
+
+The `backup` command always created a snapshot even if nothing in the
+backup set changed compared to the parent snapshot.
+
+Restic now supports the `--skip-if-unchanged` option for the `backup`
+command, which omits creating a snapshot if the new snapshot's content
+would be identical to that of the parent snapshot.
+
+https://github.com/restic/restic/issues/662
+https://github.com/restic/restic/pull/4816