Skip to content

Remove selected backup snapshots without breaking retained restores - #78

Merged
wesm merged 3 commits into
mainfrom
feat/backup-forget
Sep 5, 2026
Merged

Remove selected backup snapshots without breaking retained restores#78
wesm merged 3 commits into
mainfrom
feat/backup-forget

Conversation

@wesm

@wesm wesm commented Sep 5, 2026

Copy link
Copy Markdown
Member

Applications can remove selected backup recovery points, with a dry run to preview the removal. Kit refuses to delete the last snapshot without explicit permission or an older snapshot that a retained incremental backup still needs.

Dependent snapshots are removed before their parents, with each deletion synced before the next. The operation works from the backup repository alone; the original application data is not required.

This removes snapshot records, not the packed content. Reclaiming unused disk space is a separate follow-up.

wesm and others added 2 commits September 5, 2026 07:37
The hook-install test checks that an existing file keeps mode 0640, but
creating it under a restrictive umask produces mode 0600. Set the fixture
mode before installation so the test checks preservation, not the shell's
default creation mask.

Generated with Codex
Co-authored-by: Codex <noreply@openai.com>
Applications need to expire backup recovery points without deleting a
parent that a retained incremental backup still needs. Add explicit
snapshot removal with a preview and a separate last-snapshot override.

Delete children durably before parents so an interrupted operation leaves
the remaining dependency chains intact. Keep packs and indexes unchanged;
reclaiming their unused bytes is a separate operation.

Generated with Codex
Co-authored-by: Codex <noreply@openai.com>
@roborev-ci

roborev-ci Bot commented Sep 5, 2026

Copy link
Copy Markdown

roborev: Combined Review (c2aa2ee)

Review Summary: Changes Required

  • Highbackup/forget.go:70: Forget can delete files outside the repository through a symlinked snapshots directory. Refuse symlinked repository subdirectories and use descriptor-confined operations for enumeration and removal.

  • Mediumbackup/forget.go:52: Forget acquires its exclusive lock through a non-context-aware API, so cancellation is ignored while waiting behind a shared lock. Use context-aware lock acquisition.


Reviewers: 2 done | Synthesis: codex, 6s | Total: 10m11s

A symlinked snapshots directory could redirect removal into another
repository. Refuse that layout and keep manifest reads, deletion, and
directory syncing bound to the same validated directory handle.

Cancellation also needs to stop an exclusive-lock attempt waiting for
active readers. Release only that attempt's claim when canceled so the
reader can continue and later operations are not blocked.

Generated with Codex
Co-authored-by: Codex <noreply@openai.com>
@roborev-ci

roborev-ci Bot commented Sep 5, 2026

Copy link
Copy Markdown

roborev: Combined Review (8e4a7bb)

No issues found.


Reviewers: 2 done | Synthesis: codex | Total: 6m27s

@wesm
wesm merged commit 9b57444 into main Sep 5, 2026
10 checks passed
@wesm
wesm deleted the feat/backup-forget branch September 5, 2026 13:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant