Summary
A raw target (raw:// / raw+ssh://) configured with encrypt = "gpg" or encrypt = "openssl_enc" was written unencrypted. The configuration loader dropped the encrypt / gpg_recipient / gpg_keyring / openssl_cipher settings, so the raw endpoint received no encryption method and produced plaintext stream files — with no error or warning.
Impact
Anyone who configured GPG or OpenSSL encryption for a raw target has backups stored in cleartext, potentially on offsite or untrusted destinations. A documented feature silently failed to a security downgrade.
Patches
Upgrade to 0.8.4. The loader now carries the encryption settings and threads them to the endpoint; the whole path fails closed — if encryption is requested but cannot be applied, the backup aborts with an error instead of writing plaintext. Encryption is validated at config load (gpg requires a recipient; encryption is rejected on non-raw targets). Verified end-to-end against real gpg and openssl (local and raw+ssh).
Workarounds
None prior to 0.8.4; do not rely on raw-target encryption before then.
Remediation for existing backups
The fix protects future backups only; it cannot retroactively encrypt or un-expose data already written in cleartext (it may already have been replicated, cloud-synced, or written to media that cannot be reliably wiped). Treat existing raw "encrypted" backups as cleartext and, where practical, recreate them from source with 0.8.4. A utility to encrypt existing raw backups in place is planned for a follow-up release.
Summary
A raw target (
raw:///raw+ssh://) configured withencrypt = "gpg"orencrypt = "openssl_enc"was written unencrypted. The configuration loader dropped theencrypt/gpg_recipient/gpg_keyring/openssl_ciphersettings, so the raw endpoint received no encryption method and produced plaintext stream files — with no error or warning.Impact
Anyone who configured GPG or OpenSSL encryption for a raw target has backups stored in cleartext, potentially on offsite or untrusted destinations. A documented feature silently failed to a security downgrade.
Patches
Upgrade to 0.8.4. The loader now carries the encryption settings and threads them to the endpoint; the whole path fails closed — if encryption is requested but cannot be applied, the backup aborts with an error instead of writing plaintext. Encryption is validated at config load (gpg requires a recipient; encryption is rejected on non-raw targets). Verified end-to-end against real gpg and openssl (local and
raw+ssh).Workarounds
None prior to 0.8.4; do not rely on raw-target encryption before then.
Remediation for existing backups
The fix protects future backups only; it cannot retroactively encrypt or un-expose data already written in cleartext (it may already have been replicated, cloud-synced, or written to media that cannot be reliably wiped). Treat existing raw "encrypted" backups as cleartext and, where practical, recreate them from source with 0.8.4. A utility to encrypt existing raw backups in place is planned for a follow-up release.