Plakar

Security

• Signing in from the Plakar UI now presents the confirmation code introduced in v1.1.6 for plakar login, so both sign-in paths use the same hardened flow.

New

• The fs exporter accepts new skip_ownership, skip_permissions, skip_times and skip_root_perms_and_time options.
• The UI shows sync progress.
• Deleting several snapshots at once takes a single state write.

Fixes

• Malformed sign-in requests to the API (bad body, invalid email, invalid poll ID) return 400 instead of 500. An expired sign-in returns 404.
• plakar login handles HTTP 429 (too many requests) from the backend correctly.
• backup lock handling is more robust:
  • Lock refresh errors are no longer dropped silently. Plakar retries, then aborts the backup, so a lock can no longer go stale unnoticed.
  • Unlocking waits for the lock to be deleted, so slow storage is not left with a stale lock.
  • A transient lock read failure no longer aborts the backup early.
  • Stale lock detection skips the backup’s own lock.
• A race that could crash Plakar at the end of a restore is fixed.
• On Windows, the / entry of snapshots made with the fs integration is fixed. Snapshots already affected can be browsed and maintained again.
• On Windows, the fs importer applies exclusions correctly and names the C:\ entry correctly.
• Package installation on Windows is fixed.

Security

• plakar login authenticates through a hardened flow. The confirmation page served by the Plakar API displays a code that has to be typed into the terminal the login was started from, so an authentication request can only be approved by whoever holds that terminal. This closes phishing attacks that rely on someone else approving the confirmation.

Security

• Plakar refuses to open an unencrypted Kloset store unless PLAKAR_INSECURE_PLAINTEXT is set in the environment.
• Plugins are signature-checked at install time. Pass plakar pkg add -allow-unsigned to opt out.
• sync no longer hands the peer passphrase down to the peer store connector.
• The fs exporter confines restores to the target directory.
• The HTTP store now requires insecure=true before it will send auth_token over plaintext HTTP, and it rejects https to http redirects. Assorted other protocol hardening landed alongside it.
• ptar over HTTP was hardened.

New

• plakar server -token requires clients to present an Authorization: Bearer token. Requests are now logged.
• plakar pkg add and plakar pkg show accept -devel to use the integration devel tree.
• The http and https stores accept new auth_token, insecure, timeout and tls_no_verify options, documented in plakar-store(1).

Fixes

• backup reports the real cause of a failure when a packfile temporary file cannot be created, a full /tmp for instance, instead of a bare cancellation.
• The fs importer opens files with O_NONBLOCK, so a FIFO no longer stalls a backup.
• The fs exporter restores file permissions, and hardlink restoration is fixed.
• The tar exporter no longer hands hard-link names over as symlink targets.
• ls displays the uid and gid recorded in the snapshot instead of resolving them against the local system.
• mount sets a valid modification time on the root directory.
• config rejects invalid configuration names.
• The UI browses cold-storage (Glacier) repositories again, and flags unreadable entries as such.
• The UI reports login rate limiting from the auth API as a 429.
• Removing the disabled-security-check cookie no longer fails when it is not there.
• The gRPC integration reports errors correctly in Import() and Export(), serializes the context Flags field on the wire, and supports custom metadata.
• make install installs the manpages correctly.