CVS commit: pkgsrc/sysutils/py-borgbackup

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Oct  5 13:18:30 UTC 2026

Modified Files:
        pkgsrc/sysutils/py-borgbackup: Makefile PLIST distinfo
Removed Files:
        pkgsrc/sysutils/py-borgbackup/patches: patch-pyproject.toml
            patch-src_borg_helpers_msgpack.py

Log Message:
py-borgbackup: updated to 1.4.5

1.4.5 (2026-07-19)

For upgrade and compatibility hints, please also read the "Upgrade Notes" section
above.

New features:

- create/import-tar/delete/prune --quick-stats: faster than --stats by omitting "All archives"
  and repository chunk statistics
- prune: show total vs matching archives in output
- create --exclude-dataless: macOS: skip cloud files not materialized locally
- support BORG_HOSTNAME and BORG_USERNAME env vars to override the hostname/username stored
  in archives and used by the {hostname}/{user} placeholders
- Minimal implementation of "related repositories"

  This feature allows multiple repositories to share deduplication-relevant secrets
  (id_key and chunk_seed) while maintaining secure, independent encryption keys.

  - borg key export-related-secrets <REPO> <SPATH>
  - borg init --import-related-secrets <SPATH> <REPO>
- BORG_JSON_INDENT env var for JSON output formatting
- BORG_HOSTNAME and BORG_USERNAME env vars

Fixes:

- extract: security fixes for CVE-2026-62268 (low severity: attacker would need
  repository write access and, if the repo is encrypted, also borg key and passphrase).
- create: do not wrap repository writes in backup_io("read")
- Archive.delete: don't reuse msgpack Unpacker after an unpacking failure
- slashdot hack: fix exclusion of source directory metadata
- hashindex: fix new checks for big endian archs

- Note:

    Many of the fixed issues listed below relate to rather rare or theoretical
    issues and were found by automated code checking.

- LRUCache: resolve KeyError and memory leaks
- crypto.low_level: fix freeing of memory
- extract: resolve memory leak on abandoned async requests in RemoteRepository
  This can happen if borg fails to extract a file due to permission or other errors
  or if the archived file had all-zero replacement chunks or inconsistent size.
- Chunker fixes

  - Strictly check the return value of fd.read(n) and reject if it returns more
    bytes than requested.
  - Avoid giving len <= 0 to posix_fadvise(), which could drop the rest of the
    file from the cache.
  - buzhash: check for len == 0 edge case
  - Correctly Py_DECREF in cases of errors.
  - Check for malloc/calloc failures.
- Hashindex fixes

  - Make it possible to look up in compacted hashtables.
  - Avoid buckets_length integer overflow on 32-bit systems via huge num_buckets.
  - Deal safely with empty index: we must use num_buckets = 1 to avoid division
    by zero and sanity check in hashindex_read.
  - Always initialize min_empty and num_empty.
  - Reinitialize upper/lower limit and min_empty after compact.
  - Fix size_idx / fit_size / grow_size / shrink_size (mind array bounds).
  - Deal with growing when already at max capacity.
  - hashindex_resize: replace num_entries assertion, return an error instead.
  - Correctly free memory when header validation fails.
  - BaseIndex.clear: always stay in valid state.
    Do not free the old index before we successfully have allocated a new one.

Other changes:

- msgpack: also allow up to 1.2.1
- use F_FULLFSYNC on macOS for SyncFile data durability
- mount: drop runtime warning about symlinks and improve corresponding docs
- mount: improve error msg when uid/gid cannot be resolved
- properly handle invalid and dev versions in version parser
- tests: reset borg.output.progress logger between tests to fix flakiness
- docs


To generate a diff of this commit:
cvs rdiff -u -r1.64 -r1.65 pkgsrc/sysutils/py-borgbackup/Makefile
cvs rdiff -u -r1.18 -r1.19 pkgsrc/sysutils/py-borgbackup/PLIST
cvs rdiff -u -r1.43 -r1.44 pkgsrc/sysutils/py-borgbackup/distinfo
cvs rdiff -u -r1.3 -r0 \
    pkgsrc/sysutils/py-borgbackup/patches/patch-pyproject.toml
cvs rdiff -u -r1.7 -r0 \
    pkgsrc/sysutils/py-borgbackup/patches/patch-src_borg_helpers_msgpack.py

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/sysutils/py-borgbackup/Makefile
diff -u pkgsrc/sysutils/py-borgbackup/Makefile:1.64 pkgsrc/sysutils/py-borgbackup/Makefile:1.65
--- pkgsrc/sysutils/py-borgbackup/Makefile:1.64 Tue Jul 21 14:10:28 2026
+++ pkgsrc/sysutils/py-borgbackup/Makefile      Mon Oct  5 13:18:29 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.64 2026/07/21 14:10:28 he Exp $
+# $NetBSD: Makefile,v 1.65 2026/10/05 13:18:29 adam Exp $
 
-DISTNAME=      borgbackup-1.4.4
+DISTNAME=      borgbackup-1.4.5
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
-PKGREVISION=   1
 CATEGORIES=    sysutils python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=b/borgbackup/}
 
@@ -11,12 +10,12 @@ HOMEPAGE=   https://github.com/borgbackup/
 COMMENT=       Deduplicating backup program with compression and encryption
 LICENSE=       modified-bsd
 
-TOOL_DEPENDS+= ${PYPKGPREFIX}-pkgconfig-[0-9]*:../../devel/py-pkgconfig
+TOOL_DEPENDS+= ${PYPKGPREFIX}-pkgconfig>=0:../../devel/py-pkgconfig
 TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools>=78:../../devel/py-setuptools
 TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools_scm>=8:../../devel/py-setuptools_scm
 DEPENDS+=      ${PYPKGPREFIX}-msgpack>=1.0.3:../../devel/py-msgpack
-DEPENDS+=      ${PYPKGPREFIX}-packaging-[0-9]*:../../devel/py-packaging
-TEST_DEPENDS+= ${PYPKGPREFIX}-dateutil-[0-9]*:../../time/py-dateutil
+DEPENDS+=      ${PYPKGPREFIX}-packaging>=0:../../devel/py-packaging
+TEST_DEPENDS+= ${PYPKGPREFIX}-dateutil>=0:../../time/py-dateutil
 
 USE_LANGUAGES= c c++
 

Index: pkgsrc/sysutils/py-borgbackup/PLIST
diff -u pkgsrc/sysutils/py-borgbackup/PLIST:1.18 pkgsrc/sysutils/py-borgbackup/PLIST:1.19
--- pkgsrc/sysutils/py-borgbackup/PLIST:1.18    Mon Apr 20 18:26:59 2026
+++ pkgsrc/sysutils/py-borgbackup/PLIST Mon Oct  5 13:18:29 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.18 2026/04/20 18:26:59 adam Exp $
+@comment $NetBSD: PLIST,v 1.19 2026/10/05 13:18:29 adam Exp $
 bin/borg
 bin/borgfs
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
@@ -251,7 +251,6 @@ ${PYSITELIB}/borg/xattr.pyo
 man/man1/borg-benchmark-crud.1
 man/man1/borg-benchmark.1
 man/man1/borg-break-lock.1
-man/man1/borg-change-passphrase.1
 man/man1/borg-check.1
 man/man1/borg-common.1
 man/man1/borg-compact.1
@@ -266,6 +265,7 @@ man/man1/borg-import-tar.1
 man/man1/borg-info.1
 man/man1/borg-init.1
 man/man1/borg-key-change-passphrase.1
+man/man1/borg-key-export-related-secrets.1
 man/man1/borg-key-export.1
 man/man1/borg-key-import.1
 man/man1/borg-key-migrate-to-repokey.1

Index: pkgsrc/sysutils/py-borgbackup/distinfo
diff -u pkgsrc/sysutils/py-borgbackup/distinfo:1.43 pkgsrc/sysutils/py-borgbackup/distinfo:1.44
--- pkgsrc/sysutils/py-borgbackup/distinfo:1.43 Tue Jul 21 14:10:28 2026
+++ pkgsrc/sysutils/py-borgbackup/distinfo      Mon Oct  5 13:18:29 2026
@@ -1,7 +1,5 @@
-$NetBSD: distinfo,v 1.43 2026/07/21 14:10:28 he Exp $
+$NetBSD: distinfo,v 1.44 2026/10/05 13:18:29 adam Exp $
 
-BLAKE2s (borgbackup-1.4.4.tar.gz) = f57ab5da7812cca3b34bcc41a38f05a4f62a979ea456326b75ea795c9e4e20b6
-SHA512 (borgbackup-1.4.4.tar.gz) = a43dbfaaeb46764975bc9765731090b50e514a5a31add9236af7de6e99e7c67ac4bcf6b9869d648f9ce11c7f7d52318369f4fb7951cc1ef947aee64ac222150a
-Size (borgbackup-1.4.4.tar.gz) = 3995698 bytes
-SHA1 (patch-pyproject.toml) = 23ac9381511da38faa224e05bf23e8997c9c4bb6
-SHA1 (patch-src_borg_helpers_msgpack.py) = 8b3c13ba68118b1d68d7c8a20cf1927699ec5fdf
+BLAKE2s (borgbackup-1.4.5.tar.gz) = 285c30ac4a29e1c1eb0c012da114f2b344f2eb22d786b1cb6b09c24c4deaab83
+SHA512 (borgbackup-1.4.5.tar.gz) = 1303e334b32dd62847918920777ca47eec072974859f612d054fc516fdab56eea588d34ae2f71e9c0757486769dd5ba057d5c6bb05294f40ff52a8b41f7e5801
+Size (borgbackup-1.4.5.tar.gz) = 4034652 bytes