v0.3.0

A dependency and toolchain release: age v1.3.2, and binaries built with Go
1.26.9. The on-disc format is untouched: a set written by 0.1.0, 0.1.1 or 0.2.0
reads identically here, and one written here reads on any of them. The two
readers remain interchangeable disc for disc wherever the installed age is
v1.3.2 or newer; where it is older, the exceptions are below.

Upgrade for these

• brb doctor, backup and init-key no longer print a secret key that was
  put in the recipients file by mistake. age v1.3.1 quoted a line it could not
  parse in its error, so a misplaced AGE-SECRET-KEY-… line reached the
  terminal in full; v1.3.2 gives only its line number. A secret key on the same
  line as a public key was quoted by both, and brb now names that line without
  quoting it.
• A recipients or identity file larger than 16 MiB is refused, and an identity
  file is refused as too long rather than as holding a damaged key. 0.2.0 read
  only the first 16 MiB: a recipient after that point was left out of the
  encryption without a word, though MANIFEST.txt still listed it, and an
  identity after it was never tried.
• Reading a hostile or damaged disc: the Go build refuses an age header over
  2 MiB or with more than 1024 recipient stanzas. It parses the header before it
  compares the ciphertext's checksum, and 0.2.0 held the whole header in memory
  while reading it: about three times its length for one long stanza, and more
  than thirty times for a header made of many small ones.

Refused here, accepted by 0.2.0

Which is why this is the minor and not the patch:

• recipients and identity files over 16 MiB, as above;
• when reading, an age header over 2 MiB, with more than 1024 recipient
  stanzas, or with a stanza of more than 128 arguments;
• a stray carriage return inside the short last line of an armored,
  passphrase-protected identity file. CRLF line endings are still accepted, and
  one inside a full-length line was refused before;
• building from source with Go 1.25 and no network access. Go 1.26.0 or newer
  is required; with network access, Go 1.25 fetches it by itself under its
  default settings.

The reading limits are age v1.3.2's. brb.sh never reads the recipients file,
and hands decryption to the age that is installed, so it applies them wherever
that is v1.3.2 or newer, and not where it is older.

A set encrypted to more than 1024 recipients is still written, without a
warning, but the Go build of this release cannot decrypt it, and neither can
age v1.3.2. brb 0.2.0, and brb.sh with age v1.3.1 or older, still can.
brb doctor reports such a configuration as unreadable when it can read the
identity; with a passphrase-protected or missing identity it says the round
trip was not proved. backup --verify-roundtrip refuses it after building and
encrypting the first disc.

Building from source

The source tarball rebuilds with no network access on any Go from 1.26.0, under
Go's default settings. CI now checks exactly that on every run, on the oldest Go
the module accepts.

Toolchain

The binaries are built with an upstream Go 1.26.9 and carry age v1.3.2,
filippo.io/hpke v0.4.0 and golang.org/x/crypto v0.57.0; the amd64 binary also
links golang.org/x/sys v0.48.0, which the aarch64 build does not use. Both
rebuild byte for byte from the source tarball with that toolchain. None of the standard-library
advisories fixed in Go 1.26.9 and 1.27.2 reach brb on Linux, so the 0.2.0
binaries are not affected by them either. govulncheck lists one of them,
GO-2026-6604 in os.Root, against brb's source; that advisory applies to
Windows only.

The 0.2.0 binaries were built with a distribution's Go 1.27.0, which enables the
nodwarf5 experiment and so records its version as go1.27.0-X:nodwarf5, a
string govulncheck cannot parse; scanning a 0.2.0 binary therefore silently
skips the standard library. These scan normally. The one result, the
golang.org/x/crypto openpgp notice, appears because a stripped binary cannot
show which packages it links; brb does not link openpgp.

Known limitation

Unchanged from 0.2.0: staging can still run out mid-image when an adaptive pack
ratio has pushed the raw budget well above the image budget. It is warned about
before any disc whose raw content exceeds the free space in staging, finished
discs survive it, and a resume completes once space exists.

Verifying this download

gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS

The signature is PGP key 249738C8641C3359. SHA256SUMS covers all four
artifacts; there is no second hash file, since an unsigned one beside a signed
one is a downgrade path.