borg-key-export-related-secrets(1)

Name
borg-key-export-related-secrets - Export secrets for creating related repositories

SYNOPSIS

borg [common options] key export-related-secrets [options] [REPOSITORY] [PATH]

DESCRIPTION

This command exports the deduplication secrets (id_key and chunk_seed) of a repository. These secrets can be used to initialize a related repository.

Related repositories share the same deduplication metadata but have their own independent encryption keys. This is useful for:

    1.  Creating independent backup targets that still benefit from being "compatible" for future archive transfers.

    2.  Preparing for a migration to Borg 2.0, where archives can be transferred between related repositories using borg transfer.

The exported secrets are stored in a JSON file. This file contains sensitive information and should be deleted immediately after usage.

Examples:

            # Export secrets from an existing repository
            $ borg key export-related-secrets /path/to/repo1 secrets.json

            # Initialize a new related repository using these secrets
            $ borg init --import-related-secrets=secrets.json --encryption=repokey /path/to/repo2
            $ rm secrets.json

Important:
        When initializing a related repository using borg init --import-related-secrets, the new repository must use the same ID hash algorithm (either both HMAC-SHA256 or both BLAKE2) as the original repository.

            •   HMAC-SHA256: repokey, keyfile, authenticated

            •   BLAKE2: repokey-blake2, keyfile-blake2, authenticated-blake2

Warning:
        Please note that future Borg 2.0 versions might remove support for BLAKE2 in new repositories (see #8867).

OPTIONS

See borg-common(1) for common options of Borg commands.

  arguments

REPOSITORY

    PATH
        where to store the secrets

SEE ALSO

borg-common(1)

Author
The Borg Collective