Restow 0.3.2

Restow 0.3.2. Released 2026-10-09, channel beta.

Beta release. Run it alongside your existing backups, not as your only one, until
you have verified restores against your own data.

Summary

Restow 0.3.2 connects a Proxmox VE node with one command and no input, and fixes
Microsoft 365 mailbox backups that stopped in the folders step with "Microsoft
refused the request" (HTTP 400). One database migration runs on update.

Breaking Changes

None.

Added

• Proxmox VE (preview): "Use an existing PVE API token instead" in Connect Proxmox VE.
  Restow keeps the token id and secret encrypted only until the node enrolled with
  them (or the enrollment token expires) and hands them to that node once.

Changed

• Proxmox VE (preview), Connect Proxmox VE: one command per node, with the enrollment
  token in it. The node installer sets up the user restow@pve, the roles and the
  restore pool itself (again on a second run without errors), creates its own API
  token restow@pve!<node>, checks its privileges before it installs anything and
  picks the thin storage for fleecing by itself. No more pveum block to paste, no
  prompts. "Command for another node" adds the next node; the dialog is wider and
  no longer scrolls sideways.
• Proxmox VE: the storage plugin reports the storage API of the running PVE (8.4 up
  to 9.1), so PVE 9 no longer warns that it "is implementing an older storage API".
• Servers & endpoints › Inventory: the "Connect Proxmox (soon)" placeholder is now a
  "Proxmox VE" button that opens VMs & containers, for the roles that may open it.

Fixed

• A Microsoft 365 mailbox backup could fail in the folders step with HTTP 400 "Request
  Id ... has to be unique in a batch": when Microsoft listed a folder twice while the
  folder list was read, Restow asked for that folder's subfolders twice in one batch
  under the same id, and Microsoft refused the whole batch. Every batch now uses ids of
  its own, and each folder is read once.

Security

None.

Upgrade Notes

New image; migrations run on start. One migration: 0032_pve_enrollment_pve_token
(adds one column; instant). Coming from 0.2.x, read the notes of 0.3.1 below first
(six migrations, the new setup notice, the new compose file).

• Proxmox VE nodes connected with 0.3.1 keep working. To get the new storage plugin
  (no more warning on PVE 9), run restow-pve update on each node.

Known Issues

• The new Proxmox VE onboarding was tested against stand-ins for pveum and pvesm,
  not yet on a Proxmox VE host.
• The known issues of 0.3.1 still apply.

Verification

Before the tag, on 2026-10-09: the packages/core suite (1978 tests, with restic 0.19.1),
including new tests for repeated batch ids and a folder listed twice that fail without
the fix; apps/api (3220 tests) and apps/web (3726 tests) with Postgres 16, the worker's
PVE and failure tests, the Go agent and restow-pve, the Perl shim tests (49), the new
node installer test against stand-ins for pveum and pvesm, typecheck, lint, shellcheck
and the installer tests. The release pipeline adds the full CI, the image builds, the release
smoke checks and the scans below.

Release pipeline, 2026-10-10:

Check	Result	Duration
1. Install: images, compose up, migrations (new install and upgrade)	PASS	81s
2. Health endpoints, worker and scheduler registered	PASS	0s
3. Passkey sign-in E2E with a virtual authenticator, tenant creation, i18n de/en	PASS	2m 03s
4. Microsoft 365 backup and restore against the dev tenant	SKIPPED	0s
5. IMAP backup and restore against Dovecot, hash comparison	PASS	8s
6. Journal receipt, chain verification, export	PASS	5s
7. Standalone restore with restow-restore from the storage of check 5	PASS	24s
8. Storage targets: S3 (Garage), local path, mounted directory	PASS	19s
9. Image scan (Trivy) and dependency audit (pnpm audit)	PASS	19s
10. Endpoint backup: the agent enrolls, backs up a folder, restores it	PASS	12s
11. Mail import (folder and upload) and export (EML ZIP, MBOX), compared by hash	PASS	10s

10 of 11 checks passed in full, 0 partly, 1 skipped, 0 failed. The full report, including the reason for every skipped or partial check, is attached to the release as smoke-report.md.

The Community images were smoke-tested on their own (smoke-report-community.md, smoke-report-community-arm64.md): amd64 PASS with gaps: 8 of 11 checks passed in full, 0 partly, 3 skipped (see the reasons below); arm64 PASS with gaps: 8 of 11 checks passed in full, 0 partly, 3 skipped (see the reasons below).

Images

Two builds of the same release. The full build is the Apache-2.0 core plus the Business and Service Provider modules (Restow Enterprise License), which stay locked until a license key is installed. The Community build is the Apache-2.0 core alone.

ghcr.io/restow-backup/restow:0.3.2
ghcr.io/restow-backup/restow-web:0.3.2
ghcr.io/restow-backup/restow-community:0.3.2
ghcr.io/restow-backup/restow-web-community:0.3.2

The digests of the multi-arch manifests (the opt-in updater verifies the pulled images against the two lines of its build):

restow: sha256:77476cf804ff5a101a8f954c728cd286c91541aeff0a40b4b2f5e1f29d1129fd
restow-web: sha256:4743eaefec41a543cc44c186ee6c07a6f2c10f01770a32ac7a02d628f3e6006c
restow-community: sha256:51bedaf63c52e450a4a2517d670ee9ff2bbcbcad7d9e8419d01e66a31c7474bb
restow-web-community: sha256:dd64b03ab61c1c9258a6bb27c32e5488e3e126d1e9e3d630b3739c3dea015bc7

All four images are multi-arch (linux/amd64, linux/arm64), signed with cosign (keyless) and carry an SPDX SBOM as attestation. Verify any of them with:

cosign verify ghcr.io/restow-backup/restow:0.3.2 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-web:0.3.2 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-community:0.3.2 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-web-community:0.3.2 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

docker-compose.yml and env.example are the release stack (deploy/release/); install.sh installs it on a dedicated Linux VM (README.md, "Install with the script"; install.sh.sha256 for sha256sum -c after the download); restow-agent-THIRD_PARTY_NOTICES.txt holds the licenses of the agent binaries and of the restic they run; SHA256SUMS lists every file of this release and is signed (SHA256SUMS.sigstore.json).