diff --git a/src/borg/archive.py b/src/borg/archive.py index 5907f0be3..418a7072e 100644 --- a/src/borg/archive.py +++ b/src/borg/archive.py @@ -336,6 +336,7 @@ class Archive: self.name = name # overwritten later with name from archive metadata self.name_in_manifest = name # can differ from .name later (if borg check fixed duplicate archive names) self.comment = None + self.tam_verified = False self.checkpoint_interval = checkpoint_interval self.numeric_owner = numeric_owner self.noatime = noatime @@ -378,7 +379,9 @@ class Archive: def _load_meta(self, id): data = self.key.decrypt(id, self.repository.get(id)) - metadata = ArchiveItem(internal_dict=msgpack.unpackb(data, unicode_errors='surrogateescape')) + # we do not require TAM for archives, otherwise we can not even borg list a repo with old archives. + archive, self.tam_verified = self.key.unpack_and_verify_archive(data, force_tam_not_required=True) + metadata = ArchiveItem(internal_dict=archive) if metadata.version != 1: raise Exception('Unknown archive metadata version') return metadata diff --git a/src/borg/crypto/key.py b/src/borg/crypto/key.py index 782b8a5cb..797e22725 100644 --- a/src/borg/crypto/key.py +++ b/src/borg/crypto/key.py @@ -284,7 +284,9 @@ class KeyBase: """Unpack msgpacked *data* and return (object, did_verify).""" tam_required = self.tam_required if force_tam_not_required and tam_required: - logger.warning('Archive authentication DISABLED.') + # for a long time, borg only checked manifest for "tam_required" and + # people might have archives without TAM, so don't be too annoyingly loud here: + logger.debug('Archive authentication DISABLED.') tam_required = False data = bytearray(data) unpacker = get_limited_unpacker('archive') diff --git a/src/borg/helpers.py b/src/borg/helpers.py index c00563345..e932b951b 100644 --- a/src/borg/helpers.py +++ b/src/borg/helpers.py @@ -1815,9 +1815,10 @@ class ArchiveFormatter(BaseFormatter): 'id': 'internal ID of the archive', 'hostname': 'hostname of host on which this archive was created', 'username': 'username of user who created this archive', + 'tam': 'TAM authentication state of this archive', } KEY_GROUPS = ( - ('archive', 'name', 'barchive', 'comment', 'bcomment', 'id'), + ('archive', 'name', 'barchive', 'comment', 'bcomment', 'id', 'tam'), ('start', 'time', 'end', 'command_line'), ('hostname', 'username'), ) @@ -1868,6 +1869,7 @@ class ArchiveFormatter(BaseFormatter): 'bcomment': partial(self.get_meta, 'comment', rs=False), 'end': self.get_ts_end, 'command_line': self.get_cmdline, + 'tam': self.get_tam, } self.used_call_keys = set(self.call_keys) & self.format_keys if self.json: @@ -1918,6 +1920,9 @@ class ArchiveFormatter(BaseFormatter): def get_ts_end(self): return self.format_time(self.archive.ts_end) + def get_tam(self): + return 'verified' if self.archive.tam_verified else 'none' + def format_time(self, ts): return OutputTimestamp(ts)