Skip to content

Restow 0.4.12

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Nov 13:35
v0.4.12
1847892
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Restow 0.4.12. Released 2026-11-04, channel beta.

Beta release. Run it alongside your existing backups, not as your only one, until
you have verified restores against your own data.

Summary

Restow 0.4.12 is a hotfix of 0.4.11: a ZIP download of folders (file shares, machines, Proxmox
VE container files) could hang now and then and never finish. No database migration, no agent
change.

Breaking Changes

None. The integration API contract stays at 1.9.0.

Added

None.

Changed

None.

Fixed

  • ZIP downloads of folders (file shares, machines, Proxmox VE container files) could hang now
    and then and never finish (#96): the reader of restic dump's tar stopped at the first zero
    block of the end marker, so the rest of restic's output stayed unread, restic's process never
    reported its end, and the download waited for it. The reader now reads the stream to its end.
    It showed in the release smoke as "a ZIP download of two folders" timing out.

Security

None.

Upgrade Notes

New images; no database migration, no new or changed environment variable, and the
docker-compose.yml of 0.4.0 stays. Pull the images of 0.4.12 and restart as for any update.

  • restow-pve and the agents need no update in this release (no change to the agents or the
    Proxmox VE plugin).
  • A download that hung before the update ended with the restart; start it again.

Known Issues

  • The known issues of 0.4.11 still apply.

Verification

Before the tag: lint and typecheck of @restow/core; the core tests of machines, restores and
Proxmox VE (580), among them the new tar test that delivers the end-of-archive marker late and
checks the stream is read to its end (it fails with the fix taken out); the release check
(scripts/ci/check-release.mjs --tag v0.4.12) and the install script's test
(deploy/install/test.sh).

Release pipeline, 2026-11-04:

Check Result Duration
1. Install: images, compose up, migrations (new install and upgrade) PASS 88s
2. Health endpoints, worker and scheduler registered PASS 0s
3. Passkey sign-in E2E with a virtual authenticator, tenant creation, i18n de/en PASS 2m 07s
4. Microsoft 365 backup and restore against the dev tenant SKIPPED 0s
5. IMAP backup and restore against Dovecot, hash comparison PASS 8s
6. Journal receipt, chain verification, export PASS 3s
7. Standalone restore with restow-restore from the storage of check 5 PASS 25s
8. Storage targets: S3 (Garage), local path, mounted directory PASS 20s
9. Image scan (Trivy) and dependency audit (pnpm audit) PASS 18s
10. Endpoint backup: the agent enrolls, backs up a folder, restores it PASS 11s
11. Mail import (folder and upload) and export (EML ZIP, MBOX), compared by hash PASS 8s
12. File share backup against Samba: back up, browse, ZIP, restore with permissions, copy job PASS 2m 18s
13. Archive capture: IMAP sync with IDLE and backfill, forwarded copies, dedupe, chain PASS 2m 09s

12 of 13 checks passed in full, 0 partly, 1 skipped, 0 failed. The full report, including the reason for every skipped or partial check, is attached to the release as smoke-report.md.

The Community images were smoke-tested on their own (smoke-report-community.md, smoke-report-community-arm64.md): amd64 PASS with gaps: 9 of 13 checks passed in full, 0 partly, 4 skipped (see the reasons below); arm64 PASS with gaps: 9 of 13 checks passed in full, 0 partly, 4 skipped (see the reasons below).

Images

Two builds of the same release. The full build is the Apache-2.0 core plus the Business and Service Provider modules (Restow Enterprise License), which stay locked until a license key is installed. The Community build is the Apache-2.0 core alone.

ghcr.io/restow-backup/restow:0.4.12
ghcr.io/restow-backup/restow-web:0.4.12
ghcr.io/restow-backup/restow-community:0.4.12
ghcr.io/restow-backup/restow-web-community:0.4.12

The digests of the multi-arch manifests (the opt-in updater verifies the pulled images against the two lines of its build):

restow: sha256:bc1c15fa93671a00a9e7f0e1a51814ca2c3017ce354c20bff77d6466c8917b73
restow-web: sha256:8926503cfe6b926be5958ceba3eab702942316ee1493b7d22c7c46701ce4dacc
restow-community: sha256:b970663d38f71182d10d3650ad23ef488bafc715a82e1fdaea1f4d501f4d0f1c
restow-web-community: sha256:9d6e67b471dfcd28be4c73d0c4007d20ef161da1d8535340098d98b06b7d0a7c

The release date the images carry (RESTOW_RELEASED_AT, the commit date of the tag). Licence keys with an update period cover the releases made up to its end; the updater reads this line to offer only those (docs/LICENSING.md):

released: 2026-11-04T13:53:03+01:00

All four images are multi-arch (linux/amd64, linux/arm64), signed with cosign (keyless) and carry an SPDX SBOM as attestation. Verify any of them with:

cosign verify ghcr.io/restow-backup/restow:0.4.12 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-web:0.4.12 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-community:0.4.12 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-web-community:0.4.12 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The public demo's own images, ghcr.io/restow-backup/restow-demo-seed:0.4.12 and ghcr.io/restow-backup/restow-demo-dovecot:0.4.12 (deploy/demo), carry the same tags, signatures and SBOMs; they are no part of an installation.

docker-compose.yml and env.example are the release stack (deploy/release/); install.sh installs it on a dedicated Linux VM (README.md, "Install with the script"; install.sh.sha256 for sha256sum -c after the download); restow-agent-THIRD_PARTY_NOTICES.txt holds the licenses of the agent binaries and of the restic they run; SHA256SUMS lists every file of this release and is signed (SHA256SUMS.sigstore.json).

Assets 31
Loading