cli-backup 0.1.0__py3-none-any.whl

cli_backup/storage.py

@@ -0,0 +1,386 @@
+"""Manifest-last backup storage."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import secrets
+import shutil
+import stat
+import sys
+import tempfile
+from dataclasses import asdict, dataclass
+from datetime import datetime
+from pathlib import Path
+from typing import BinaryIO
+from .config import validate_project
+
+_NAME = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.-]{0,127}\Z")
+MULTIPART_THRESHOLD = 5 * 1024**3
+MULTIPART_PART_SIZE = 64 * 1024**2
+S3_RANGE_SIZE = 64 * 1024**2
+
+
+def valid_name(value: str) -> str:
+    if not _NAME.fullmatch(value) or value in (".", ".."):
+        raise ValueError("invalid artifact name")
+    return value
+
+
+def digest(stream: BinaryIO) -> tuple[str, int]:
+    h = hashlib.sha256()
+    size = 0
+    while data := stream.read(1024 * 1024):
+        size += len(data)
+        h.update(data)
+    return h.hexdigest(), size
+
+
+@dataclass(frozen=True)
+class Manifest:
+    version: int
+    project: str
+    source: str
+    artifact: str
+    timestamp: str
+    size: int
+    sha256: str
+    object_counts: str | None = None
+
+    def validate(self) -> None:
+        if type(self.version) is not int or self.version != 1:
+            raise ValueError("unsupported manifest version")
+        validate_project(self.project)
+        valid_name(self.source)
+        valid_name(self.artifact)
+        if type(self.size) is not int or self.size < 0 or not isinstance(self.sha256, str) or not re.fullmatch(r"[0-9a-f]{64}", self.sha256):
+            raise ValueError("invalid manifest checksum or size")
+        if self.object_counts is not None and (not isinstance(self.object_counts, str) or not re.fullmatch(r'\d+(?:\s+\d+){4}', self.object_counts)):
+            raise ValueError("invalid object counts")
+        if not isinstance(self.timestamp, str):
+            raise ValueError("invalid manifest timestamp")
+        try:
+            timestamp = datetime.fromisoformat(self.timestamp.replace('Z', '+00:00'))
+        except ValueError as exc:
+            raise ValueError("invalid manifest timestamp") from exc
+        if timestamp.utcoffset() is None:
+            raise ValueError("manifest timestamp must include a timezone")
+
+    def encode(self) -> bytes:
+        self.validate()
+        return json.dumps(asdict(self), sort_keys=True).encode() + b"\n"
+
+    @classmethod
+    def decode(cls, data: bytes) -> Manifest:
+        if len(data) > 65536:
+            raise ValueError("manifest too large")
+        try:
+            obj = cls(**json.loads(data))
+            obj.validate()
+            return obj
+        except (TypeError, json.JSONDecodeError) as exc:
+            raise ValueError("invalid manifest") from exc
+
+
+def make_manifest(path: Path, project: str, source: str, name: str, timestamp: str, object_counts: str | None = None) -> Manifest:
+    with path.open("rb") as stream:
+        sha, size = digest(stream)
+    result = Manifest(1, project, source, name, timestamp, size, sha, object_counts)
+    result.validate()
+    return result
+
+
+class LocalStorage:
+    def __init__(self, root: Path):
+        self.root = root
+
+    def directory(self, manifest: Manifest) -> Path:
+        manifest.validate()
+        return self.root / manifest.project / manifest.source
+
+    def put(self, path: Path, manifest: Manifest) -> None:
+        folder = self.directory(manifest)
+        folder.mkdir(parents=True, exist_ok=True, mode=0o700)
+        dest = folder / manifest.artifact
+        metadata = folder / (manifest.artifact + ".json")
+        if dest.exists() or metadata.exists():
+            raise FileExistsError(dest)
+        fd, temp = tempfile.mkstemp(prefix=".partial-", dir=folder)
+        try:
+            with os.fdopen(fd, "wb") as out, path.open("rb") as source:
+                shutil.copyfileobj(source, out)
+                out.flush()
+                os.fsync(out.fileno())
+            with open(temp, "rb") as source:
+                if digest(source) != (manifest.sha256, manifest.size):
+                    raise ValueError("artifact changed during copy")
+            os.link(temp, dest)
+            meta_fd, meta_temp = tempfile.mkstemp(prefix=".manifest-", dir=folder)
+            try:
+                with os.fdopen(meta_fd, "wb") as out:
+                    out.write(manifest.encode())
+                    out.flush()
+                    os.fsync(out.fileno())
+                os.link(meta_temp, metadata)
+            finally:
+                os.unlink(meta_temp)
+        finally:
+            os.unlink(temp)
+
+    def list(self, project: str, source: str) -> list[Manifest]:
+        folder = self.root / validate_project(project) / valid_name(source)
+        if not folder.exists():
+            return []
+        manifests = []
+        for path in folder.glob("*.json"):
+            try:
+                m = Manifest.decode(path.read_bytes())
+                if m.project == project and m.source == source and path.name == m.artifact + ".json" and (folder / m.artifact).is_file():
+                    manifests.append(m)
+            except (OSError, ValueError):
+                continue
+        return sorted(manifests, key=lambda m: datetime.fromisoformat(m.timestamp.replace('Z', '+00:00')))
+
+    def verify(self, manifest: Manifest) -> bool:
+        with (self.directory(manifest) / manifest.artifact).open("rb") as stream:
+            return digest(stream) == (manifest.sha256, manifest.size)
+
+
+class S3Storage:
+    def __init__(self, client, bucket: str, prefix: str = ""):
+        self.client, self.bucket, self.prefix = client, bucket, prefix.strip("/")
+
+    def key(self, manifest: Manifest) -> str:
+        manifest.validate()
+        return "/".join(part for part in (self.prefix, manifest.project, manifest.source, manifest.artifact) if part)
+
+    def put(self, path: Path, manifest: Manifest) -> None:
+        key = self.key(manifest)
+        with path.open("rb") as data:
+            if digest(data) != (manifest.sha256, manifest.size):
+                raise ValueError("artifact changed before upload")
+            data.seek(0)
+            if manifest.size <= MULTIPART_THRESHOLD:
+                self.client.put_object(Bucket=self.bucket, Key=key, Body=data, IfNoneMatch="*")
+            else:
+                self._multipart_upload(data, key)
+        if not self.verify(manifest):
+            raise ValueError("S3 verification failed")
+        self.client.put_object(Bucket=self.bucket, Key=key + ".json", Body=manifest.encode(), IfNoneMatch="*")
+
+    def _multipart_upload(self, data: BinaryIO, key: str) -> None:
+        upload = self.client.create_multipart_upload(Bucket=self.bucket, Key=key)['UploadId']
+        parts = []
+        try:
+            while chunk := data.read(MULTIPART_PART_SIZE):
+                number = len(parts) + 1
+                if number > 10000:
+                    raise ValueError('backup is too large for multipart upload')
+                response = self.client.upload_part(Bucket=self.bucket, Key=key, UploadId=upload,
+                                                   PartNumber=number, Body=chunk)
+                parts.append({'PartNumber': number, 'ETag': response['ETag']})
+            self.client.complete_multipart_upload(Bucket=self.bucket, Key=key, UploadId=upload,
+                                                  MultipartUpload={'Parts': parts}, IfNoneMatch='*')
+        except Exception:
+            try:
+                self.client.abort_multipart_upload(Bucket=self.bucket, Key=key, UploadId=upload)
+            except Exception:
+                pass
+            raise
+
+    def verify(self, manifest: Manifest) -> bool:
+        if manifest.size > MULTIPART_THRESHOLD:
+            try:
+                s3_get_ranges(self, manifest)
+                return True
+            except ValueError:
+                return False
+        stream = self.client.get_object(Bucket=self.bucket, Key=self.key(manifest))["Body"]
+        try:
+            return digest(stream) == (manifest.sha256, manifest.size)
+        finally:
+            stream.close()
+
+
+def copy_verified(stream: BinaryIO, target: BinaryIO, manifest: Manifest) -> None:
+    """Copy a stream and reject incomplete or altered data before use."""
+    checksum = hashlib.sha256()
+    size = 0
+    while chunk := stream.read(1024 * 1024):
+        target.write(chunk)
+        checksum.update(chunk)
+        size += len(chunk)
+    if (checksum.hexdigest(), size) != (manifest.sha256, manifest.size):
+        raise ValueError("backup checksum or size mismatch")
+
+
+def local_get(store: LocalStorage, manifest: Manifest, target: BinaryIO) -> None:
+    with (store.directory(manifest) / manifest.artifact).open("rb") as stream:
+        copy_verified(stream, target, manifest)
+
+
+def s3_list(store: S3Storage, project: str, source: str) -> list[Manifest]:
+    project, source = validate_project(project), valid_name(source)
+    prefix = "/".join(p for p in (store.prefix, project, source, "") if p) + "/"
+    found = []
+    for page in store.client.get_paginator("list_objects_v2").paginate(Bucket=store.bucket, Prefix=prefix):
+        for item in page.get("Contents", []):
+            key = item["Key"]
+            if not key.endswith(".json") or "/" in key[len(prefix):]:
+                continue
+            body = store.client.get_object(Bucket=store.bucket, Key=key)["Body"]
+            try:
+                manifest = Manifest.decode(body.read(65537))
+            except (ValueError, TypeError, UnicodeError):
+                continue
+            finally:
+                body.close()
+            if manifest.project == project and manifest.source == source and store.key(manifest) + ".json" == key:
+                from botocore.exceptions import ClientError
+                try:
+                    info = store.client.head_object(Bucket=store.bucket, Key=store.key(manifest))
+                except ClientError as exc:
+                    if exc.response.get('Error', {}).get('Code') not in ('404', 'NoSuchKey', 'NotFound'):
+                        raise
+                    print(f'incomplete backup: {manifest.artifact} (data missing)', file=sys.stderr)
+                    continue
+                if info.get('ContentLength') != manifest.size:
+                    print(f'incomplete backup: {manifest.artifact} (size mismatch)', file=sys.stderr)
+                    continue
+                found.append(manifest)
+    return sorted(found, key=lambda m: datetime.fromisoformat(m.timestamp.replace('Z', '+00:00')))
+
+
+def s3_get_ranges(store: S3Storage, manifest: Manifest, target: BinaryIO | None = None) -> None:
+    """Read bounded ranges; retry a failed range without publishing partial bytes."""
+    manifest.validate()
+    checksum = hashlib.sha256()
+    for offset in range(0, manifest.size, S3_RANGE_SIZE):
+        end = min(offset + S3_RANGE_SIZE, manifest.size) - 1
+        for attempt in range(3):
+            try:
+                response = store.client.get_object(Bucket=store.bucket, Key=store.key(manifest),
+                                                   Range=f'bytes={offset}-{end}')
+                stream = response['Body']
+                try:
+                    data = stream.read(end - offset + 2)
+                finally:
+                    stream.close()
+                if response.get('ContentRange') != f'bytes {offset}-{end}/{manifest.size}' or len(data) != end - offset + 1:
+                    raise ValueError('invalid S3 range response')
+                break
+            except Exception:
+                if attempt == 2:
+                    raise
+        checksum.update(data)
+        if target is not None:
+            target.write(data)
+    if checksum.hexdigest() != manifest.sha256:
+        raise ValueError('artifact checksum mismatch')
+
+
+def s3_get(store: S3Storage, manifest: Manifest, target: BinaryIO) -> None:
+    if manifest.size > MULTIPART_THRESHOLD:
+        s3_get_ranges(store, manifest, target)
+        return
+    stream = store.client.get_object(Bucket=store.bucket, Key=store.key(manifest))["Body"]
+    try:
+        copy_verified(stream, target, manifest)
+    finally:
+        stream.close()
+
+
+def prune_local(store: LocalStorage, project: str, source: str, days: int, now) -> int:
+    """Remove indexed expired local copies without following directory symlinks."""
+    from datetime import datetime, timedelta, timezone
+    if days < 1:
+        raise ValueError('local retention days must be positive')
+    cutoff = now.astimezone(timezone.utc) - timedelta(days=days)
+    folder = (store.root / validate_project(project) / valid_name(source)).absolute()
+    fd = os.open('/', os.O_RDONLY | os.O_DIRECTORY)
+    try:
+        for part in folder.parts[1:]:
+            child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=fd)
+            os.close(fd)
+            fd = child
+        removed = 0
+        for name in os.listdir(fd):
+            if not name.endswith('.json'):
+                continue
+            try:
+                valid_name(name[:-5])
+                meta_fd = os.open(name, os.O_RDONLY | os.O_NOFOLLOW, dir_fd=fd)
+                with os.fdopen(meta_fd, 'rb') as metadata:
+                    if not stat.S_ISREG(os.fstat(metadata.fileno()).st_mode):
+                        continue
+                    manifest = Manifest.decode(metadata.read(65537))
+                if (manifest.project, manifest.source, manifest.artifact + '.json') != (project, source, name):
+                    continue
+                created = datetime.fromisoformat(manifest.timestamp.replace('Z', '+00:00'))
+                if created.tzinfo is None or created >= cutoff:
+                    continue
+                artifact_stat = os.stat(manifest.artifact, dir_fd=fd, follow_symlinks=False)
+                if not stat.S_ISREG(artifact_stat.st_mode):
+                    raise ValueError('refusing to remove non-regular backup')
+                os.unlink(name, dir_fd=fd)
+                os.unlink(manifest.artifact, dir_fd=fd)
+                removed += 1
+            except (FileNotFoundError, ValueError, TypeError):
+                continue
+        return removed
+    finally:
+        os.close(fd)
+
+
+def write_private_copy(source: BinaryIO, destination: Path) -> None:
+    """Publish verified bytes privately through a pinned destination directory."""
+    parent = destination.parent
+    if destination.name in ('', '.', '..'):
+        raise ValueError('invalid destination name')
+    before = os.lstat(parent)
+    dirfd = os.open(parent, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW | os.O_CLOEXEC)
+    temp = '.cli-backup-download-' + secrets.token_hex(16)
+    created = False
+    published = False
+    try:
+        pinned = os.fstat(dirfd)
+        if (before.st_dev, before.st_ino) != (pinned.st_dev, pinned.st_ino):
+            raise OSError('destination directory changed')
+        writable_by_others = pinned.st_mode & (stat.S_IWGRP | stat.S_IWOTH)
+        if pinned.st_uid not in (os.geteuid(), 0) or (writable_by_others and not pinned.st_mode & stat.S_ISVTX):
+            raise OSError('destination directory is not protected from other users')
+        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW | os.O_CLOEXEC
+        fd = os.open(temp, flags, 0o600, dir_fd=dirfd)
+        created = True
+        with os.fdopen(fd, 'wb') as target:
+            os.fchmod(target.fileno(), 0o600)
+            info = os.fstat(target.fileno())
+            if not stat.S_ISREG(info.st_mode) or info.st_uid != os.geteuid() or stat.S_IMODE(info.st_mode) != 0o600:
+                raise OSError('invalid temporary file')
+            shutil.copyfileobj(source, target)
+            target.flush()
+            os.fsync(target.fileno())
+            os.link(temp, destination.name, src_dir_fd=dirfd, dst_dir_fd=dirfd, follow_symlinks=False)
+            published = True
+            linked = os.stat(destination.name, dir_fd=dirfd, follow_symlinks=False)
+            if (linked.st_dev, linked.st_ino) != (info.st_dev, info.st_ino):
+                raise OSError('temporary file changed during publication')
+        current = os.lstat(parent)
+        if (current.st_dev, current.st_ino) != (pinned.st_dev, pinned.st_ino):
+            raise OSError('destination directory changed')
+        os.fsync(dirfd)
+    except Exception:
+        if published:
+            try:
+                os.unlink(destination.name, dir_fd=dirfd)
+                os.fsync(dirfd)
+            except OSError:
+                pass
+        raise
+    finally:
+        try:
+            if created:
+                os.unlink(temp, dir_fd=dirfd)
+        finally:
+            os.close(dirfd)

cli_backup-0.1.0.dist-info/METADATA

@@ -0,0 +1,119 @@
+Metadata-Version: 2.4
+Name: cli-backup
+Version: 0.1.0
+Summary: Host backup CLI for database snapshots and directory archives
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/XakkiDev/cli-backup
+Project-URL: Issues, https://github.com/XakkiDev/cli-backup/issues
+Keywords: backup,mysql,mariadb,sqlite,s3
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: boto3==1.43.127
+Provides-Extra: dev
+Requires-Dist: ruff==0.6.9; extra == "dev"
+Dynamic: license-file
+
+# cli-backup
+
+A Python command-line tool for full database backups and directory archives, stored locally, in S3-compatible object storage, or both. Use it directly or include the shared Makefile in multiple projects on the same host.
+
+[![CI](https://github.com/XakkiDev/cli-backup/actions/workflows/ci.yml/badge.svg)](https://github.com/XakkiDev/cli-backup/actions/workflows/ci.yml) · [MIT license](LICENSE)
+
+## Capabilities
+
+| Interface | Sources | Features |
+| --- | --- | --- |
+| `scheduled` and `share.Makefile` | MariaDB, MySQL, SQLite | Date-based daily, weekly and monthly snapshots; Docker or Podman containers, TCP, or SQLite online backup |
+| Generic commands | MariaDB/MySQL, Redis, directories | Full dumps, Redis RDB snapshots, gzip tar archives and exclusion patterns |
+
+The CLI runs on the host, supports rootless Docker and Podman for scheduled database backups, and does not require a separate backup service in a project's Compose file. Scheduled Compose targets are discovered from container labels. PostgreSQL, MongoDB and incremental backups are not implemented.
+
+**Protect backup data and credentials.** Backups are not encrypted by this tool. Use private local paths, protected environment files and encrypted transport. Backups are not a substitute for an authorized recovery exercise. This CLI does not create buckets, change lifecycle policies, or schedule jobs.
+
+## Installation
+
+Python 3.11+ on a POSIX host is required. Client binaries are required for direct database or Redis connections. The selected Docker/Podman runtime is required for container sources.
+
+```sh
+git clone https://github.com/XakkiDev/cli-backup.git
+cd cli-backup
+make venv install
+.venv/bin/cli-backup --help
+.venv/bin/cli-backup scheduled --help
+```
+
+For a user-wide executable, `pipx install .` installs from the checkout. `share.Makefile` is supplied in the repository checkout rather than the Python wheel: keep or download a trusted checkout to use the shared Make targets. On systems without `ensurepip`, install the matching Python venv package first.
+
+The Composer package `xakki/cli-backup` distributes the source tree and agent skills for Composer-based projects. Composer does not install Python dependencies or provide a ready-to-run CLI: after `composer require xakki/cli-backup`, install the Python project from `vendor/xakki/cli-backup` with `pip` or `pipx` and include `vendor/xakki/cli-backup/share.Makefile` when needed. The `extra.skills.source` metadata identifies the agent skills for compatible Composer skill managers.
+
+
+## Scheduled database backups
+
+Include `share.Makefile` from your checkout. For a Compose service:
+
+```make
+CLI_BACKUP_COMPOSE_PROJECT_NAME := example
+CLI_BACKUP_DB_CONTAINER := mariadb
+include /path/to/cli-backup/share.Makefile
+export CLI_BACKUP_COMPOSE_PROJECT_NAME CLI_BACKUP_DB_CONTAINER
+```
+
+Set `CLI_BACKUP_PROJECT_NAME` if the storage namespace should differ from the Compose project. For a standalone container, set `CLI_BACKUP_PROJECT_NAME` and `CLI_BACKUP_DB_CONTAINER` to its name or ID. Set `CLI_BACKUP_CONTAINER_RUNTIME=podman` to use local rootless Podman; Docker is the default and uses the selected Docker context. For TCP use `CLI_BACKUP_PROJECT_NAME`, `CLI_BACKUP_DB_HOST`, optionally `CLI_BACKUP_DB_PORT`, `CLI_BACKUP_DB_NAME`, `CLI_BACKUP_DB_USER` and `CLI_BACKUP_DB_PASSWORD`.
+
+Container mode defaults to root, using `MARIADB_ROOT_PASSWORD` and `MARIADB_DATABASE` from the container; MySQL equivalents are also supported. Set a user and password together to override root. `CLI_BACKUP_DB_NAME` accepts comma-separated database names; each database produces a separate file. Credentials must be supplied in the environment or a protected project file, never as command-line arguments.
+
+For SQLite, set `CLI_BACKUP_PROJECT_NAME`, `CLI_BACKUP_DB_SERVICE_NAME=sqlite`, and an absolute `CLI_BACKUP_DB_PATH`. Do not set container, host or Compose variables. The SQLite online backup API includes committed WAL transactions without stopping the writer. Automatic SQLite restoration is not implemented.
+
+```sh
+make cli-backup@config-check
+make cli-backup@backup
+make cli-backup@list path=daily where=local
+make cli-backup@verify path=daily where=local file=2026-01-01.example.sql.gz
+```
+
+Additional targets `cli-backup@restore-test` and `cli-backup@restore` exist for MariaDB/MySQL. A live restore is destructive, requires an explicit file and interactive confirmation, and must target the correct stopped-writer environment. A restore rehearsal creates a disposable isolated container and should run only with appropriate authorization. For an unavailable source container, set `CLI_BACKUP_TEST_MYSQL_IMAGE` to an appropriate disposable test image before a rehearsal. Use `db=<name>` to filter when needed. Source-independent `list` and `verify` work with a stopped database container.
+
+### Storage and schedule
+
+Set `CLI_BACKUP_LOCAL_ROOT` for local storage and/or the S3 variables `CLI_BACKUP_S3_BUCKET`, `CLI_BACKUP_S3_ENDPOINT`, `CLI_BACKUP_S3_REGION`, `CLI_BACKUP_S3_KEY`, `CLI_BACKUP_S3_SECRET`, and optionally `CLI_BACKUP_S3_PREFIX`. Project environment values override global environment values; explicit scheduled CLI options override project values. `--project-env` accepts literal assignments and does not execute shell code. Period keys are relative to the optional S3 prefix:
+
+```text
+daily/<project>/<source>/YYYY-MM-DD.<database>.sql.gz
+weekly/<project>/<source>/YYYY-MM-DD.<database>.sql.gz
+monthly/<project>/<source>/YYYY-MM-DD.<database>.sql.gz
+.state/<project>/<source>/...  # schedule metadata
+```
+
+SQLite uses `.sqlite.gz`. `CLI_BACKUP_PERIOD_DAILY` and `CLI_BACKUP_PERIOD_MONTHLY` default to `true`; `CLI_BACKUP_PERIOD_WEEKLY` defaults to `false`. With daily enabled, beginning on Wednesday or the third day of the month, the latest eligible daily copy from the preceding week or month is copied to the relevant period if missing. When both select the same Sunday, weekly chooses an earlier snapshot. With daily disabled, a new weekly or monthly snapshot is created on or after the threshold if the current period is missing. Run the command from an external scheduler, normally daily, so missed attempts can be retried. A completed period may not create a new snapshot on a repeated invocation.
+
+`CLI_BACKUP_LOCAL_DAYS` sets local retention, with minimum retention for period selection and idempotency. The object storage service controls S3 retention. Required destinations are attempted independently, and errors cause a nonzero exit. S3 publishing reads and verifies the complete uploaded object before publishing its manifest. The default CPU scheduling priority is `nice 10` for the CLI and container dump client; configure `CLI_BACKUP_CPU_NICE` from 0 to 19. This does not limit the database server's CPU or I/O.
+
+## Generic CLI
+
+Run `cli-backup --help` for global options and commands. Generic CLI options precede the subcommand. Its configuration uses `CLI_BACKUP_PROJECT` and `CLI_BACKUP_DB_MODE` (`compose`, `container`, or `tcp`), which are distinct from the scheduled interface's project and connection variables.
+
+```sh
+cli-backup backup mysql
+cli-backup backup redis
+cli-backup backup files --directory /srv/example --exclude '*.tmp' --exclude 'cache/*'
+cli-backup list files --storage local
+cli-backup verify files --storage local --file NAME
+```
+
+Directory archives are full scans, not point-in-time filesystem snapshots. Exclusion patterns use Python `fnmatch` relative to the source; `*` can match `/`. Symlinks are archived without following them, hard links are archived separately, and unsafe escaping links or special files must be excluded. Extraction requires a new absolute destination and rejects unsafe paths; permissions are restored without setuid/setgid bits, and ownership is not restored. See `cli-backup restore --help` before recovery.
+
+MariaDB/MySQL dumps use `--single-transaction`; coordinate schema changes and nontransactional tables. Object-count comparisons do not prove row-level equivalence. The local and S3 files are sensitive; ensure sufficient free temporary space and protect the destination.
+
+## Development and AI agent skills
+
+```sh
+make venv install
+make test lint
+```
+
+CI runs unit tests on Python 3.11–3.13, lint, build and installed-wheel smoke tests. `make test-integration` requires explicitly selected disposable images and may perform database restoration; run it only when authorized. Project-portable skills for agents are in [`.agents/skills/`](.agents/skills/): `cli-backup-setup` covers integration and `cli-backup-develop` covers implementation and testing. They do not authorize storage administration, schedule changes, or restoration.
+
+## License
+
+[MIT](LICENSE)

cli_backup-0.1.0.dist-info/RECORD

@@ -0,0 +1,16 @@
+cli_backup/__init__.py,sha256=hN9Q0GdHR-ffScFi5OYQw4sOX_ZDpdMDGa_rFX1cpc8,18
+cli_backup/cli.py,sha256=SCp_BSjEmEBvEu_Yd3lbDNzUD_mTkvB3groZ9lh3DmM,11861
+cli_backup/config.py,sha256=oVwJZekCk01OHwrKSvaJ0jmYKaNSKEEAEbQQMUb53lg,2664
+cli_backup/cpu_priority.py,sha256=SapxQ-mqNEGpmskBSeZ5OrYXUmnD2mmHlaKX33yQHR4,687
+cli_backup/files.py,sha256=68IPkK_osehcubXWAk1P7inRQDQ8tNh0X5CSNllLwDo,9573
+cli_backup/mysql.py,sha256=03zk-clPJJwG7hAGpKosioLpHVuAU6Op-OkmNC-xTdo,5197
+cli_backup/redis_backup.py,sha256=YNRgHytK9jHn7CXMzWUSEvwrOdRZ39Vu6H-qRcKJY8A,1090
+cli_backup/rehearsal.py,sha256=My0DWB4QL9DaI2hJwZpfv4o-deTMMvgPKwUV73Gw5M8,4093
+cli_backup/scheduled.py,sha256=WxTTqJU3xI8zch9ftQUChFZsmy7WYly48cHKFDxTDU8,31206
+cli_backup/storage.py,sha256=1EaPyBa5evUtVaWCcLDQr7iOkPeYzaEFYO6jFOi1p38,16534
+cli_backup-0.1.0.dist-info/licenses/LICENSE,sha256=LT_FggPDXG8pHihapLDPf5IkZoAXBYdF28hrxxf7sCI,1080
+cli_backup-0.1.0.dist-info/METADATA,sha256=KRhjKZlilfKETVWMzcOX2YFh3vjXPypnnNdl_ZnQ9qA,9239
+cli_backup-0.1.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+cli_backup-0.1.0.dist-info/entry_points.txt,sha256=IA3yRKrINolVcMFD4_8RB6crrNBWaO1GbCvQ2Pni1Ig,51
+cli_backup-0.1.0.dist-info/top_level.txt,sha256=e45rnGwSfR33PilMDehreTSxQv4vO30aPPO5AS3U-SY,11
+cli_backup-0.1.0.dist-info/RECORD,,

cli_backup-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

cli_backup-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+cli-backup = cli_backup.cli:main

cli_backup-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 cli-backup contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

cli_backup-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+cli_backup