mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-11 19:47:12 +03:00
61 lines
2.0 KiB
Bash
Executable File
61 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Bounded read-only repository verification. Does not alter retention or delete data.
|
|
set -euo pipefail
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Usage: scripts/restic-verify.sh [--repo REPOSITORY] [--password-file PATH]
|
|
[--read-data-subset PERCENT] [--full-data]
|
|
|
|
Runs `restic check` against an existing repository. By default it checks metadata.
|
|
--read-data-subset accepts restic syntax such as 5% or 500M. --full-data reads all
|
|
repository data and can be expensive. Repository/password environment variables are
|
|
used when corresponding flags are omitted. Secret values are never printed.
|
|
EOF
|
|
}
|
|
|
|
repo="${RESTIC_REPOSITORY:-}"
|
|
password_file="${RESTIC_PASSWORD_FILE:-}"
|
|
read_subset=""
|
|
full_data=false
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--repo) repo=${2:?ERROR: --repo needs a value}; shift 2 ;;
|
|
--password-file) password_file=${2:?ERROR: --password-file needs a value}; shift 2 ;;
|
|
--read-data-subset) read_subset=${2:?ERROR: --read-data-subset needs a value}; shift 2 ;;
|
|
--full-data) full_data=true; shift ;;
|
|
--help) usage; exit 0 ;;
|
|
*) printf 'ERROR: unknown argument: %s\n' "$1" >&2; usage >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
if ! command -v restic >/dev/null 2>&1; then
|
|
printf 'ERROR: restic is not on PATH.\n' >&2
|
|
exit 127
|
|
fi
|
|
if [[ -z $repo ]]; then
|
|
printf 'ERROR: repository missing. Use --repo or RESTIC_REPOSITORY.\n' >&2
|
|
exit 2
|
|
fi
|
|
if [[ -n $read_subset && $full_data == true ]]; then
|
|
printf 'ERROR: choose either --read-data-subset or --full-data.\n' >&2
|
|
exit 2
|
|
fi
|
|
|
|
args=(--repo "$repo")
|
|
if [[ -n $password_file ]]; then
|
|
args+=(--password-file "$password_file")
|
|
fi
|
|
args+=(check)
|
|
if [[ $full_data == true ]]; then
|
|
args+=(--read-data)
|
|
elif [[ -n $read_subset ]]; then
|
|
args+=(--read-data-subset "$read_subset")
|
|
fi
|
|
|
|
printf 'Running read-only restic check (%s).\n' \
|
|
"$([[ $full_data == true ]] && printf 'full data' || [[ -n $read_subset ]] && printf 'sample %s' "$read_subset" || printf 'metadata')"
|
|
restic "${args[@]}"
|
|
printf 'PASS: restic check completed. Run a separate restore drill for recovery evidence.\n'
|