A uback backup (default extension: .ubkp) consists of
a plaintext magic header, a plaintext options line, and a payload.
For encrypted backups, the payload consists of an age stream containing a verification hash followed by the compressed backup generated by the source.
For unencrypted backups, the payload consists of the compressed backup.
The magic header is the constant github.com/sloonz/uback/v0\n (where
\n represents the newline character).
The options line consists of a set of key-value pairs of options,
followed by a newline (\n) character. Current options are type,
which indicates what source created the backup, compression, which is
currently fixed to zstd, and an optional option plain which defaults
to 0, and is set to 1 for unencrypted backups.
For encrypted backups, the magic header and the options line, including their newline characters, are hashed using SHA-256. The first 32 bytes of the age encrypted stream consists of this hash, to prevent header tempering.
Uncompressed backups are planned but not yet implemented.