Salvanza for Proxmox Backup Server 2.0: release notes

Version 2.0 is the first release under the new name: Salvanza for Proxmox Backup Server (Salvanza for short), formerly Proxmox Backup Client. Project site: salvanza.org; source, releases and issues: github.com/salvanza/salvanza_client.

Version 2.0 merges a large body of work on the GUI, the background service and the backup engine into the project. The app now has Backup Sets with several schedules each, incremental folder backups with the official client's change detection, machine backups that skip free space and can leave partitions out, several backups at once, speed limits, Undelete and Roll back, client-side encryption with keys you can keep, a guided bare-metal restore ISO that also restores into a virtual machine (P2V), and 18 interface languages. With the background service installed, the computer's PBS servers and Backup Sets belong to the service, and the app connects to it with administrator rights. The command line is one program, salvanza-cli, with the commands backup-folder, backup-disk and attach-nbd. The README lists what is new; CHANGELOG.md has every change.

Downloads

All files are on the releases page, with SHA256SUMS.txt and a build provenance attestation (verifying a download). The Windows programs are not yet Authenticode-signed.

To build a Linux package yourself, use make deb, make pkgfedora or make pkgarch (BUILD.md).

Upgrading

From Proxmox Backup Client. The upgrade is automatic. The Salvanza MSI removes an installed Proxmox Backup Client (and a Nimbus Backup or Etitech Backup install) as it would an older version of itself, and the Linux package salvanza replaces the proxmoxbackupclient and pbsgo packages. The earlier background service is removed. The first time Salvanza starts, it moves the earlier settings over once, from C:\ProgramData\ProxmoxBackupClient, %APPDATA%\ProxmoxBackupClient, ~/.proxmox-backup-guardian or /var/lib/proxmoxbackupclient, to C:\ProgramData\Salvanza, %APPDATA%\Salvanza, ~/.salvanza or /var/lib/salvanza, and keeps a dated copy of the settings files there, in pre-salvanza-<date>. The PBS servers, keys, Backup Sets and history carry on, and nothing changes on PBS.

The earlier command line names still work: the Linux packages install them as links to salvanza-cli, and the MSI as .cmd files beside it, so scripts and scheduled tasks keep running (command line manual). Nimbus Backup and Etitech Backup now have their own program names (nimbusbackup-gui, etitechbackup-gui, ...) and settings folders (NimbusBackup, EtitechBackup, ~/.nimbusbackup, ~/.etitechbackup). The Acme Backup demonstration brand is gone.

From 1.2.0-rc. Install the 2.0 MSI or package over it: it upgrades in place and keeps the settings and Backup Sets, with each set's PBS server, Proxmox VE VM type and weekly or monthly schedule. On Linux the package is now called salvanza and replaces pbsgo; the service takes over the pbsgo settings when it has none of its own.

From 1.1.x. Version 1.1 had the command-line tools only; 2.0 adds the app and the background service beside them. The machine backup (now salvanza-cli backup-disk) sends its e-mail report and exits with code 3 when some sectors could not be read, and on Windows the commands print errors instead of showing message boxes. See the command line manual.

The background service. The installers set up the background service and start it (an upgrade of a Linux package keeps a service you turned off, off). With the service, only the service reads the computer's settings folder (C:\ProgramData\Salvanza, /var/lib/salvanza), and the app asks once for administrator rights to connect to it: UAC on Windows, your password through pkexec on Linux, or an administrator's name and password on a standard account. Schedules run whether or not anyone is signed in. A user who cannot answer the prompt can choose Use my own settings and keep their own servers and Backup Sets, which run only while the app is open or in the tray; Connect later offers to copy them to the computer's. See section 15 of the GUI manual.

Change detection. Before switching a Backup Set to Data or Metadata change detection, update every machine that restores from it to 2.0: earlier versions show the folders of a split archive without their files (section 7 of the GUI manual).

Passwords on Windows. PBS tokens and passwords in config.json are encrypted for the computer the first time 2.0 starts. Going back to an earlier version afterwards means entering them again.

More

• CHANGELOG.md: every change in 2.0, and the history of the GUI before it.
• GUI manual, command line manual and bare-metal restore manual; the same manuals are in the app (Help, F1).
• installer/DEPLOYMENT.md: deploying the MSI to many computers.

SHA-256 checksums

Verify a download with Get-FileHash <file> -Algorithm SHA256 (PowerShell) or sha256sum -c SHA256SUMS.txt. The command line archives from the cross-platform build are in checksums.txt.

1908c7a3c2186d7be1ecb5f50335169da69fd6fb46edfef0fc3d2883a6f97bd7  EtitechBackup-2.0.0-x64.msi
e09556d6ede036e26c10f6cc166f839555aaf2f3790db6e579f434576a9d736e  NimbusBackup-2.0.0-x64.msi
513f6a40293f85b3f0f11b089d958661af33bb47c8f9d8fbb7925c15ee48ace9  Salvanza-2.0.0-x64.msi
06723ba63301f5a7c3d57e750ac31dae4b3263cdfb41291d50c46f18c1e6e4b3  salvanza-2.0.0-1-x86_64.pkg.tar.zst
45325a2159d626802cf23f98f2bb4dcfea4b60cb4d8d9b571c26fa37cadc6f91  salvanza-2.0.0-1.fc44.aarch64.rpm
467c1f78d22840b17f609d765ff8f636b6193f3fbaa8f1a477dbd3b360521b1e  salvanza-2.0.0-1.fc44.x86_64.rpm
102a5c35f9787ca24d51fe926f69aae1510bd60f3ce0bc090a17f95ca242f3e7  salvanza-cli-v2.0.0-linux.tar.gz
d57933f74d3d71f407ab596c1994e2a5f5b2bda0336816f90e238c2a7488a99f  salvanza-cli-v2.0.0-macos.tar.gz
72ddcbdd58f5a88a2c29a2ad61304173ac7770f27e21845ef85ce27d61988579  salvanza-cli-v2.0.0-windows.zip
7a2d7e6aa0e0499e47e26aaae8005e9200bd814c89814e1895b86da03266771b  salvanza_2.0.0_amd64.deb
4ff4373f6a66f42ffff5902fd675dc3ce44c78fcfeae7a97a5ec386016318d1c  salvanza_2.0.0_arm64.deb

Everything that changed since v1.1.3

v1.1.3 (2 May 2026) shipped only the command-line tools. 2.0.0 is more than 1,400 commits later across 968 files (about 770 commits since the v1.2.0-rc.1 prerelease): the 1.2 line first, then the 2.0 work, including the merge of the reworked GUI, background service and backup engine. Both sets of changes are listed below.

2.0.0

This release merges the reworked GUI (RDEM Systems' Nimbus Backup GUI, reworked and extended by mjb-is), its background service and its backup engine into the project: Backup Sets with several schedules each, incremental folder backups that reuse unchanged files (Metadata change detection), machine backups that skip free space, several backups at once with pause and resume, Undelete and Roll back, physical-to-virtual and bare-metal restore, client-side encryption, the background service on Windows and Linux, and an 18-language interface. The project's own work since 1.2.0-rc.1 is kept alongside it. The GUI's test builds before the merge are listed under History of the GUI before 2.0.

Added

• New name: Salvanza for Proxmox Backup Server (Salvanza for short), in place of Proxmox Backup Client, following Proxmox's trademark guidance that its marks are not used in product names. Project site https://salvanza.org/, repository https://github.com/salvanza/salvanza_client (links to issues and pull requests on the old repository redirect). The version stays 2.0.0.

  • Programs. The app is salvanza-gui (salvanza-gui.exe), the background service salvanza-svc (salvanza-svc.exe; Windows service salvanza-svc, display name "Salvanza for Proxmox Backup Server Service"; Linux unit salvanza.service, program /usr/libexec/salvanza/salvanza-svc, app /usr/lib/salvanza/salvanza-gui with the launchers /usr/bin/salvanza-gui and /usr/bin/salvanza-gui-root).
  • One command line, salvanza-cli, with a subcommand for each of the three tools it replaces: salvanza-cli backup-folder (was proxmoxbackup-directory), salvanza-cli backup-disk (was proxmoxbackup-machine) and salvanza-cli attach-nbd (was proxmoxbackup-nbd, Linux only), plus salvanza-cli version and salvanza-cli help; salvanza-cli <command> -help lists a command's options, which are unchanged. The earlier names (proxmoxbackup-directory, pbsdirectorybackup, directorybackup, proxmoxbackup-machine, pbsmachinebackup, machinebackup, proxmoxbackup-nbd, pbsnbd) still run the matching command: the Linux packages install them as links, and the MSI installs salvanza-cli.exe with .cmd files under those names, its folder on the system PATH. The Windows installer now includes the command line, which it did not before.
  • Folders. Windows: C:\Program Files\Salvanza, C:\ProgramData\Salvanza (the service's settings), %APPDATA%\Salvanza, %LOCALAPPDATA%\Salvanza\Logs and %USERPROFILE%\.salvanza (each user's). Linux: /var/lib/salvanza, /var/log/salvanza, ~/.salvanza and ~/.local/state/salvanza.
  • Packages. The MSI is Salvanza-<version>-x64.msi; the Linux package is salvanza, which replaces the proxmoxbackupclient and pbsgo packages. The bare-metal restore ISO is Salvanza-BMR-<version>.iso.
  • Local API. The token header is X-Salvanza-Token, and the environment variables are SALVANZA_API_TOKEN, SALVANZA_TOKEN_ROTATION and SALVANZA_TOKEN_GRACE. The earlier X-Proxmox-Client-Token, PBSGO_API_TOKEN, PBSGO_TOKEN_ROTATION and PBSGO_TOKEN_GRACE are still accepted for now. The port, 18765, is unchanged.
  • Automatic upgrade. Installing Salvanza (the MSI or the package) removes an installed Proxmox Backup Client and its background service, and the other brands' installs too. The first time it starts, Salvanza moves the earlier settings over once: C:\ProgramData\ProxmoxBackupClient, %APPDATA%\ProxmoxBackupClient, %LOCALAPPDATA%\ProxmoxBackupClient, ~/.proxmox-backup-guardian and /var/lib/proxmoxbackupclient (and /var/lib/pbsgo) become the new folders, only when the new folder has no settings yet, and a copy of the settings files is kept in a pre-salvanza-<date> folder in the new one. PBS servers, keys, Backup Sets and history carry on; nothing changes on PBS. The services of earlier installs (ProxmoxBackupClientSVC, ProxmoxBackupClient, NimbusBackupSVC, EtitechBackupSVC) are stopped and removed when the new service starts, also those installed without an MSI, and the start-at-sign-in choice carries over.
  • Branded builds. Nimbus Backup and Etitech Backup have their own program names (nimbusbackup-gui, nimbusbackup-svc, etitechbackup-gui, etitechbackup-svc) and their own folders (NimbusBackup, EtitechBackup, ~/.nimbusbackup, ~/.etitechbackup) instead of sharing Proxmox Backup Client's, so two brands never share settings. Every brand installs the same salvanza-cli. For now each brand's installer replaces any other brand. The Acme Backup demonstration brand is removed.

• Several backups at once. A long first backup of a large set (a day or more for terabytes) no longer holds up every other backup on the computer: up to three backups and restores now run side by side (Preferences > Backup Options > Maximum Concurrent Backups, 1 to 8; 1 runs them one after another as before), so an hourly set of documents keeps its hourly runs and a machine backup runs at its time. One machine backup and one restore run at a time, nothing runs beside another run of the same PBS backup group (a set never twice at once, nor a restore of it), and Undelete and Roll back run alone. Whatever has to wait does so in the order it was started, listed under the progress card with a Stop button; a set still running or waiting is not started again by its schedule. Each run has its own snapshot (VSS) and its own log file, Pause and Stop. The progress card shows one run in full, ‹ 1/3 › steps through the others, Also running lists them with their own Pause and Stop, and the card moves on when its run ends. The background service runs backups side by side the same way, and a window shows each of its runs. Closing the app or shutting down after a set waits for the runs already going beside it. Tested against a PBS on a Windows and a Linux test machine: a small set's run went through in 38 s while a 3 GB first backup read another 1.1 GB beside it (VSS on both), a second run of the same set waited for the first, a second machine backup for the first, a run stopped while waiting ended at once, every run kept its own log, and every snapshot restored byte for byte; in the app, a C:\Windows first backup (14.6 GB) ran while a set every 5 minutes and a machine set every 15 kept their scheduled runs.

• Speed limits. Preferences > Backup Options > Speed limits sets three optional limits in MB/s: Upload to PBS (everything sent to the server), Download from PBS (restores, browsing, Undelete and Roll back) and Disk read (the files a folder backup reads and the disks a machine backup reads). Empty or 0 is no limit, the default. Each limit is one budget shared by every backup and restore running at the same time, not a limit per run, and a change applies at once, also to runs already going. The background service applies them to every run it makes. The hint and the manual explain how they combine: a backup goes no faster than the lower of Disk read and Upload, and a mostly unchanged backup is held back by Disk read, since unchanged data is read but not uploaded. All 18 languages.

• Compression. Preferences > Backup Options > Compression sets how hard backup data is compressed before it goes to PBS, which stores it as sent: Fastest, Default (zstd level 3), Better or Best, for every backup the computer makes; the background service applies its own setting to its runs. It affects only data PBS does not have yet, so it can be changed at any time. Folder backups used Fastest and machine backups Default before, with no choice; both now use Default unless changed. A Backup Set's own compression field, which the editor never showed, is no longer read; a run started through the service API can still name a level. All 18 languages. The command-line tools take -compression (or "compression" in the config file), default when left out.

• View Full Logs. The log files can be read in the app: View Full Logs in the side menu (under Message Log) and on the Help and View menus lists every log, newest first (each backup run's own log, the backup and restore log, the app and schedules log, the background service's too), and shows the one picked a page at a time, with Show only lines containing…, Hide chunk lines (on to begin with: a run's log is mostly "New chunk" lines), Show more lines, errors in red and warnings in amber, compressed logs read as they are. A Reports entry's 📄 View log opens that run's own log, and each Message Log line's 📄 opens the log at that message, with its line highlighted. Prompted by a Backup Set run saying "3 files skipped, see the log" with no way to see it from the app.

• Disable and enable a Backup Set. The set editor has an Enabled switch under the set's name, and the card's More > Disable and More > Enable do the same. A disabled set stays out of its schedule without losing its settings; its card shows DISABLED and "Next run: disabled", and Run Now still works. Enabling it puts it back on its schedule from the next due time, without running the ones it missed. The setting already existed in the saved sets and the scheduler obeyed it, but nothing in the app showed or changed it, so a set disabled outside the app still said "Next run: due now".

• A warning on save when a Backup Set would not run as saved: it is disabled, no schedule is on, Use snapshots is off without the override, no snapshot module is loaded, the app cannot read the disks and the service is not running, or some of its disks are not connected. Save anyway or Go back.

• Leave partitions out of a machine backup. Under each ticked disk, a machine Backup Set lists its partitions with a tick box each. An unticked partition is not read or snapshotted and goes into the image as zeros: the partition table is kept, so a restore gives it back in its place and at its size, empty and unformatted. The editor warns when it is a partition the restored disk needs to start. On the command line: proxmoxbackup-machine -skippartition <disk>:<number> (repeat it for several), or "skippartitions" in a config file (#132, #64).

• Machine Backup Sets pin their disks by identity (serial number, GPT disk GUID or MBR signature on Windows; the /dev/disk/by-id name on Linux). A disk that gets a new number after a hardware change is still the one backed up, and the set is saved with its new number; a disk that is not connected fails the run instead of backing up whichever disk has its number now. Disks pinned by 1.2.0-rc are kept.

• Each user has their own colour theme (Preferences > Theme), kept with their own settings like the language, instead of one theme for the whole computer. Until a user chooses, it is the theme the computer had. This is for the unbranded app only: a branded app keeps its brand's colours.

• Linux machine Backup Sets can turn snapshots off. With Use snapshots unticked and "Run without a snapshot: I accept the backup may be inconsistent" ticked, mounted disks are read live, with a warning in the log; without the second box every run stops and says why. The machine backup screen says which snapshot module is loaded (or that none is), and when the app must be restarted as administrator to read the disks.

• A guide to installing elastio-snap or dattobd in the GUI manual (section 2), tested on Linux Mint 21.3 and Fedora 44: Datto's dattobd packages or elastio-snap from source, both through DKMS so the module is rebuilt after kernel updates, loading it at every start, Secure Boot (enrolling the DKMS signing key), checks and common problems. The machine backup screen's "No snapshot module loaded" box has a How to install button that opens it in Help.

• Install it for me: the snapshot module from the app (Linux). The machine backup screen's "No snapshot module loaded" box has Install it for me, and the command line sudo salvanza-cli install-snapshot-module. Both run the installer the .deb, the .rpm and the Arch package now bring, /usr/share/salvanza/elastio-snap/install-elastio-snap.sh, with Axcient's elastio-snap source at the tested commit beside it: after an administrator's password it installs the build tools and kernel headers with apt, dnf or pacman, builds the module through DKMS with the kernel 7 patch, and loads it now and at every start, its output showing as it runs. With Secure Boot on it asks first for a one-time password, enrols the key DKMS signed the module with (mokutil --import), and gives the steps for the blue screen at the next restart, where the key is approved; until then the box shows those steps (on computers that start through shim; Secure Boot with the owner's own keys, as sbctl sets up, is refused with an explanation before anything is built). Debian, Ubuntu, Linux Mint, Fedora, the RHEL family and Arch Linux (with Manjaro and EndeavourOS, where it installs the headers of every installed kernel). make pkgarch builds from an untagged tree again (its version is the app's, as for the .rpm). All 18 languages.

• The window says when the background service is not running. With the service installed but stopped, the window no longer offers Connect (which failed with "the background service did not take the token (status 0)") but says that the service is not running, so this computer's Backup Sets do not run, with Start the service: one administrator prompt starts it and connects the app. The app notices a stop or a start within a few seconds, a program other than the service on its port counts as not running, and on Windows the tray tooltip says so too. All 18 languages.

• elastio-snap on kernel 7 (Fedora 44). packaging/linux/elastio-snap/install-elastio-snap.sh builds Axcient's elastio-snap at a tested commit through DKMS with the project's kernel 7 patch (kernel 7 removed strncpy), and loads it now and at every start. It skips the patch when the chosen version already has the fix and stops, changing nothing, when the patch no longer fits. Tested on Fedora 44 (kernel 7.2) and Linux Mint 21.3 (kernel 5.15). The fix is offered to Axcient as pull request 138; the .deb now suggests dattobd-dkms, which Datto publishes, instead of elastio-snap-dkms, which nobody does.

• The command-line tools retry as the app does (#59). A chunk upload, the index's assignments and close, the manifest and the session's finish are each tried again, up to 5 times, when they fail in a way that passes (a timeout, a reset, HTTP 502, 503, 504 or 429). A lost connection, which ends the PBS session, no longer ends the run: proxmoxbackup-directory backs the folder up again with a new session 25 minutes later (once; not a backup of standard input), and proxmoxbackup-machine starts again after 2, 5, 10 and 15 minutes. Each retry and wait is printed. Tested by cutting the connection part way through a live backup: both tools started again and finished.

• proxmoxbackup-machine -systray says it does nothing. The tray icon was taken out of the command-line tools earlier; the option, and "systray" in a config file, stay accepted so scripts keep working, and the run now says the option does nothing.

• proxmoxbackup-directory reads a network path without a snapshot, as the app does: a share (\\server\share), a drive mapped to one, or an NFS, SMB/CIFS or FUSE mount on Linux has no volume to snapshot, and the backup failed on it unless -novss was given. The run says it is reading the folder live.

• proxmoxbackup-machine -liveread reads a Linux disk's mounted partitions live, without a snapshot, as a machine Backup Set does with Use snapshots off and accepted. It was only the config file's "liveread". The message of a backup that stops for want of a snapshot now names it beside the app's setting.

• Speed limits in the command-line tools. proxmoxbackup-directory and proxmoxbackup-machine take -upload-limit, -download-limit and -disk-read-limit in MB/s (or upload-limit, download-limit and disk-read-limit in the config file; a flag overrides the file), the same three limits as the app's Preferences, charged in the same places. The run prints the limits it uses (#77).

• -shutdown-after in proxmoxbackup-directory and proxmoxbackup-machine (or "shutdown-after" in the config file) turns the computer off once the backup has run, whether it worked or not, after the e-mail, as a Backup Set's "Turn off the computer after the backup" does, and through the same code: the Windows API, with shutdown.exe as the fallback, or shutdown -h now on Linux. The exit code still says how the backup went. A run that stops before it starts (wrong options, another backup running) does not shut down. Asked for in #43 by giuseongit.

• proxmoxbackup-directory sends new chunks 8 at a time, as the app does, while it reads on, instead of one by one with the folder's reading waiting for each; each is compressed as it is sent, so that is spread over several processor cores too. The first chunk that cannot be sent stops the backup and nothing more is sent, as before, and the snapshot is not finished. -read-ahead <n> (or "read-ahead" in the config file) reads up to n files of each folder ahead in the background, 1 to 32, as the app's Multi-threaded backup reading does; off by default. The archive is the same either way.

• proxmoxbackup-directory -exclude leaves out files and folders matching a pattern, with the same patterns as a Backup Set's exclusions in the app (*.tmp, node_modules, logs/*.log, C:\Users\alice\Temp; not case sensitive). Repeat it for several, or list them as "exclude" in the config file; flags add to the file's list. The run prints each entry left out and the count, and the snapshot's status file lists them as the app's do. A malformed pattern, which would never match, stops the run before it starts (#44).

• Upload threads. How many chunks a backup sends to PBS at a time. Auto, the default, starts with one and allows one more for every 4 Mbit/s of upload speed it measures, up to 8: on a local network a backup soon sends 8 at a time, and on a slow link to a PBS elsewhere one or two, so each chunk arrives in seconds. A number from 1 to 8 overrides it: Preferences > Backup Options > Upload threads in the app (the background service's setting for its runs, applied at once), -upload-threads (or "upload-threads") in both command-line tools. Hashing and the check against the chunks PBS has always use all the workers. All 18 languages.

• Mail relays without a login. An SMTP relay that needs no user name or password (often on port 25) works in the app and in the command-line tools; an incomplete mail setup now says what is missing (#74).

• Linux packages in every release. The release workflow now builds the .deb and .rpm for amd64 and arm64 and the Arch package for x86_64, using packaging/build-linux-package.sh — the same script a developer runs locally — and publishes them with build provenance. The packages were previously built by hand, so a release often shipped Windows installers only.

Changed

• The progress card is read down each column. The left column has Started and Forecast finish, then where the backup has got to; the right column has Elapsed time and Time remaining, then the data on its way to the server (Processing, Upload, New/changed data, Data transferred, Compression ratio). A folder backup's Current file moves up under Folder. A machine backup's left column goes Disk, Partition, Blocks, Position on disk (how far through the current disk it is, which Processed showed) and the new Data read, the figure the percentage counts. A mostly empty disk at 99% used to show "Processed 80.9 / 119.2 GiB" beside it, with nothing on the card agreeing with the 99%. The box underneath also says how much goes into the image without being read (free space or partitions left out). The card is no taller.

• "Turn off the computer after the backup" uses the Windows API on Windows (InitiateSystemShutdownEx, with the shutdown privilege enabled for the call), as asked in #43, instead of running shutdown.exe, which stays as the fallback should the API call fail; the log says which was used. It is the call that works from the background service, where most sets run; ExitWindowsEx only ends the caller's own session there. As before, there is no warning period and programs are asked to close rather than forced, and Windows' System log now records it as a planned shutdown by an application. Linux still runs shutdown -h now. The command-line tools' new -shutdown-after uses the same code.

• Folder backups hash chunks on several processor cores, in the app and in proxmoxbackup-directory. Reading the folder only finds where each chunk ends; working out each chunk's SHA-256 digest, which names it, moved to the upload workers. A processor without the instructions that speed SHA-256 up (many virtual machines, older and low-power CPUs) spent about 40% of a first backup on it, on one core. On a test VM sending to PBS, 2 GB of new data went from 41.5 to 63.0 MB/s, and 1 GB of small files with read-ahead from 35.3 to 48.6 MB/s; with the sending stubbed out, reading and chunking went from 57 to 164 MB/s on 4 cores. The archive is the same either way, checked chunk for chunk against hashing in order.

• The Linux service program is now /usr/libexec/salvanza/salvanza-svc in the .deb, .rpm and Arch package (it was beside the app in /usr/lib/salvanza, where the app stays). On Fedora its file is then labelled bin_t, so SELinux runs the service as unconfined_service_t, the usual domain of a service that has no policy of its own, instead of in systemd's init_t. Nothing was refused before; this is the conventional layout. An upgrade removes the old file, reloads systemd and restarts a running service from the new place; an enabled service stays enabled. Run as Service finds the new program, and a copy of the app run from a folder still uses the service program beside it.

• Time remaining and Forecast finish change at most every 10 seconds on the backup and restore progress cards, instead of with every progress update, so they no longer flicker while the speed and counts tick over. The forecast is held as a clock time rather than recalculated against the clock each second.

• About page and storage offer follow the brand. The About page shows the brand's logo (the neutral icon for the default build) and name next to the version, and its links are the brand's own (Website, Help, Releases, Contact), then the project's source code, bug reports and licence, which stay the project's whatever the brand. A brand that sells storage shows a Buy Backup Storage button (or its own label) on the About page and in Preferences before a PBS server is added; the default build, which sells nothing, says "Download and set up your own Proxmox Backup Server, or buy backup storage" with Proxmox Backup Server as the link, in place of an "Order storage" button that went to the PBS download. The credits are the project's (Proxmox Backup Client - Go contributors and RDEM Systems, GPLv3, the warranty and non-affiliation notices) rather than the test builds' own. The header reads Proxmox Backup Client - Go over Client for Proxmox Backup Server, and a branded build's header shows that line under its name instead of its name twice. All 18 languages.

• Stop takes effect part way through a large file (folder backups), instead of after it (#117). The archive writer checks for Stop before every 64 KiB block, the classic and split (Data and Metadata mode) archives alike; chunk upload retries end on Stop, chunks still queued are not sent or counted as failed, and a Stop after the last write still drops the session before the indexes are closed, so no snapshot is kept. The card says Stopping... in all 18 languages, and the manual describes the new behaviour. The upload workers of a stopped or failed folder no longer stay behind after the run.

• The app connects to the background service with administrator rights. With the service installed, the app shows and changes the computer's settings through the service, as the project's 1.2.0-rc.1 does. It gets the service's token by asking for administrator rights once (UAC on Windows, pkexec on Linux; on a standard account, an administrator's name and password); only a small helper is elevated, and the app keeps the token in memory only, and only while its window is in use (see Security). Unlike 1.2.0-rc.1 it does not ask when it starts, which may be in the tray at sign-in: it asks the first time its window is in front of you, and whenever you click Connect; requests it makes in the background never ask. Until then, or after a decline, the window says "Not connected to the background service" with Connect and Use my own settings, and shows no settings. The service writes a new token each time it starts and every 24 hours; the window then shows Connect again and asks once more when it next comes to the front. The app already running as administrator, or as root, connects without asking. Linux needs pkexec (polkit) for this. See section 15 of the GUI manual.

• One shortcut. The installer's "Proxmox Backup Client (Administrator)" Start menu and desktop shortcuts, and the Linux "(administrator)" menu entry, are gone (an upgrade removes them): the app asks for administrator rights itself when it connects to the service, and offers Restart as administrator where an operation needs the app elevated, such as restoring permissions or into protected folders, installing the service, or machine backups without it.

• Use my own settings. A user who cannot answer the administrator prompt can work on their own PBS servers and Backup Sets in their own folder instead, as without the service. Those sets run only while the app is open or in the tray, and the window says so. Connect goes back to the computer's settings; with own sets, it first says that they will not run while connected and offers to copy them into the computer's.

• The computer's servers on your own settings. On their own settings, a user can add one of the PBS servers the computer already has with Use one of this computer's servers in Preferences: the add-server form opens filled in with its name, address, datastore, namespace and fingerprint, for the user's own API token or user name and password. The computer's login, secrets and encryption key are not shared. The list comes from a second public route, GET /servers/public, which needs no token and holds no logins (gui/api/INTEGRATION.md).

• "Run at startup" Backup Sets run when the service starts, which is when the computer starts, whether or not anyone signs in. They ran when the app started at sign-in, and the app is no longer connected to the service at that point. Without the service they still run when the app starts.

• The "Require administrator rights to add, change or delete Backup Sets" policy is gone (Preferences > Advanced, Windows). With the service, every change already needs administrator rights, through the connection. A value left in HKLM\SOFTWARE\Salvanza\Policy is ignored.

• Without the service, the app keeps its settings in your own folder, ~/.salvanza (%USERPROFILE%\.salvanza on Windows), taken over from ~/.proxmox-backup-guardian when the renamed app first starts, and each account has its own. Run as Service copies them to the service's folder if the service has no settings yet, and leaves yours as they were. The app's own logs are now in %LOCALAPPDATA%\Salvanza\Logs on Windows; View Full Logs shows the service's logs too, through the service. New encryption keys default to the service's keys folder when the service is installed.

• The default theme is Green instead of Amber on a new install. After an upgrade each user starts with the theme the computer had.

• The Windows installer can start the app in the tray when a user signs in, but only if asked: the tick box Start Proxmox Backup Client when a user signs in, on a page after the installation folder, is unticked, and AUTOSTART is 0 by default (AUTOSTART=1 for a silent install). Turned on, it applies to every user who signs in (it was only the account that ran the install, and nobody for an install by GPO or Intune). An upgrade keeps the choice of the installed version, which counts as on when that version had the sign-in entry, unless AUTOSTART is given. The installer also adds a desktop shortcut (DESKTOPSHORTCUTS), and replaces an installed test build of the reworked GUI (its 0.9 and 0.10 MSIs) instead of installing beside it.

• Linux packages are named salvanza (.deb, .rpm, and the Arch package from packaging/arch/PKGBUILD with make pkgarch), with the same files and service on each. A fresh install turns the background service on; an upgrade keeps the choice made. They replace the pbsgo package of 1.2.0-rc builds, and the service takes over /var/lib/pbsgo when it has no settings of its own. The packages need polkit (pkexec).

• Upgrading from 1.2.0-rc keeps its settings and Backup Sets. Each set keeps its PBS server, its Proxmox VE VM type and its weekly or monthly schedule (a monthly day that a short month lacks now runs on that month's last day), and the settings files 1.2.0-rc's service locked are readable again.

• The tray follows the brand: a branded build has its own tray icon and name, and starting it a second time brings its running window forward. A branded build's banner follows its own accent colour.

• While the app waits to connect to the service, Backup and Restore no longer say that no PBS server is configured, and Add New Backup Set and One-off Backup wait for the connection.

Security

• The settings and the service's token are no longer readable without elevation. With the service installed, only the service reads and writes the computer's settings folder (C:\ProgramData\Salvanza, /var/lib/salvanza) and its API token. On Windows the folder is open to SYSTEM and Administrators only: earlier builds also let each local administrator account read it, PBS secrets and token included, from an app started without UAC. On Linux it is root's alone (0700, files 0600): earlier builds let the sudo or wheel group read it. The service removes the old access when it starts. installer/DEPLOYMENT.md and packaging/debian/README.md describe the new permissions.

• The app holds the service's token only while its window is in use. While the app holds it, another program running as the same user could read it from the app's memory and use the service, which runs as SYSTEM or root (to restore into any folder, for one). Once the window has been hidden in the tray for 15 minutes, the app lets go of the token and is not connected; shown again within that time, it keeps it. When the window is next shown it asks once more, as when it first opened, and Connect asks at any time. An app running as administrator or root drops it too, and reconnects without a prompt. Meanwhile the tray reads a new public status from the service, which needs no token and says only whether the service runs, how many backups run and wait, whether a Backup Set's last run failed and when the last backup ended (no names or paths): its tooltip says, for example, "2 backups running" or "Last backup failed: open the app", and Pause backup... opens the window and asks for the token first. gui/api/INTEGRATION.md describes GET /status/public. For the same reason the installer no longer starts the app at every sign-in unless asked (see Changed).

• Restores, browsing and search get only what one operation needs. The service hands the app a fresh PBS login ticket for a server with a user name and password, or the API token for a server with a token, and the encryption key when the backup is encrypted, for that operation only and in memory only. The app no longer reads them from disk. Servers with an API token can restore and browse through the service, which 1.2.0-rc.1 does not allow.

• The app checks that it is the background service answering before it sends anything. While the service was stopped, any program on the computer could listen on 127.0.0.1:18765 and pose as it, and the app would send it the service's token and any PBS secret typed into Preferences. Now, on each new connection, the app looks up who holds the other end: on Windows it must be the service's own process, as the Service Control Manager reports it; on Linux root, for that connection and for every socket listening on the port. Anything else is refused before a byte is sent, logged in the debug log, and treated as a service that is not running. macOS is not checked yet. gui/api/INTEGRATION.md describes the check.

• Roll back's safety folder is locked down and checked. .pbs-rollback is open only to SYSTEM, the Administrators and the account that ran the roll back, and hidden (it inherited the drive root's permissions, so other users could read the files moved aside). For a folder inside a user's own profile or home it is kept in that profile, so rolling back your own files needs no administrator rights. Undo and Delete kept versions act on a record only when everything it names is inside the set's folders or its own safety folder.

• A stored PBS secret is kept only for the same token or user. Editing a server with the secret left blank kept the old secret even under a new token ID or user name; it now asks for the secret. A server switched to a user name login no longer keeps the old token's secret in config.json.

Fixed

• Backups over a slow link lost their connection. With 8 chunks in flight on a link of about 1 Mbit/s, PBS answered nothing for minutes, the connection check (an HTTP/2 PING) waited behind the chunk data already sent, and after 15 s the backup gave up a working connection ("http2: client connection lost") and never finished; the one-at-a-time client before managed the same 24 MB in 203 s. Upload threads (above) keep a slow link to one or two chunks, and the check now waits up to 5 minutes for its answer: 45 s still gave up a working connection after 75 s on a 400 kbit/s link shared with another backup. While uploads are under way a dead connection is found within about 90 s anyway, by the chunk upload watch below. Found testing with the link shaped to 1 Mbit/s and with 100 ms latency and 2% loss; both now finish.

• Every VSS snapshot left a thread and about 22 handles behind in the process (Windows), so the background service, which runs for months, kept growing: a set every 5 minutes took it from 494 handles and 21 threads to 1,917 and 92 in five hours, and hourly backups would add about 500 handles a day. The VSS library we use (go-vss) hands out each of its five asynchronous steps with an extra reference that was never released; every one holds the VSS object, so that was never freed either, with the thread VSS starts for it. Found by counting the object's references after each step. go-vss v0.4.2 fixes it (st-matskevich/go-vss#16) and the app now uses that version: 10 snapshots in a row leave nothing behind. The command-line tools were not affected in practice, as they end after each run.

• A machine backup's percentage and time remaining counted free space as if it had to be read. Free space and partitions left out go into the image as zeros at once, but the total was the whole disk, so the percentage leapt through free space and a 119 GiB disk read at about 1 MB/s said 8 hours left. Each snapshotted volume's free-space map is now read as soon as the snapshot is made, before the first block, and the percentage and the forecast follow the data actually read, as Clonezilla does; Processed still shows the whole disk. Spotted by tizbac.

• A Linux command-line backup stopped part way left its snapshot behind. Stopped with Ctrl+C or SIGTERM, it left the elastio-snap or dattobd snapshot set up and mounted under /tmp/pbs-snap-*, and every later snapshot backup of that file system then failed as "device or resource busy" until it was unmounted by hand. The backups now remove their snapshots when stopped by a signal; what a kill -9 leaves is unmounted and removed by the next backup of the file system. Two backups in different programs (two command-line runs, or one beside the service) also no longer clash over one file system: the second took the first one's live snapshot for a stale one and tried to destroy it; it now waits for it, through a lock file per device in /run. Found testing on Linux; all three cases tested live.

• Installing the .deb (or Arch package) over proxmoxbackupclient switched the service on where the old one had never been used. The app then showed the service's empty settings, and the user's own servers and Backup Sets seemed gone. An earlier install is now also recognised by the old package's record and by a user's own settings, and the service stays off as before (Preferences > Advanced > Run as Service turns it on). The .rpm was right already.

• Folders on network shares that need a login could not be backed up once the backups moved into the service (Windows). The service runs as SYSTEM, which reaches another computer as this computer's own account, and a share that needs a user name and password refuses it; when the app ran the backups, it read the share as the signed-in user. A login can now be saved per server: the app asks for one when a Backup Set or backup has a folder on a share the service cannot open, tries it on the folder before saving it, and lists the saved ones in Preferences > Network Shares (Change, Remove, Add). The password is stored encrypted with the service's other secrets and never sent back to the window. At each backup the service connects to the share with it (as net use does) and lets go afterwards; two backups of one share share the connection. A folder on a mapped drive letter, which the service does not see, is saved as the share's own path. Settings export includes the logins, their passwords only with the other secrets. Without the service, and on Linux (where a share is mounted), nothing changes.

• A network share the service cannot open was taken for a local drive (Windows). A folder on \\server\share in a set with VSS on is read without a snapshot, as VSS cannot snapshot a share, but the check asked Windows, which says "remote" only for a share it can open. For one it cannot (the service runs as SYSTEM, which reaches the network as the computer's own account), the backup tried VSS and failed with "snapshots are not supported for drive". A UNC path now always counts as a share, and such a folder fails, if it does, with the real reason (access denied). Found on a scheduled test set. Read live, that folder then failed after its archive had been started, and PBS refused the whole snapshot ("Invalid string length" on the manifest), the other folder's archive too: a folder is now checked to open before any of its archives is started, so the others are kept as a partial backup.

• Linux snapshot errors say why and what to do. A folder backup that could not take a snapshot said it needed a "full-system snapshot". It now says whether it runs as a normal user (run it as root) or no snapshot module is loaded (install elastio-snap or dattobd, with the manual section), on btrfs that elastio-snap and dattobd cannot snapshot it (instead of "invalid argument"), and on a full file system that the snapshot's copy-on-write file needs free space there; the command-line tools add that -novss reads the folder without a snapshot. The manuals now say when folder backups take a snapshot on Linux.

• Removing the app while it was open left it running. With the app open or in the tray, a removal from Programs and Features took the tray icon away but left the app running, hidden, with its program file gone, until ended in Task Manager (or a restart). Windows asks a program to close for an installer, a sign-out or a shutdown by closing its windows; the tray took its icon away and the app carried on. It now quits. Found clicking through the removal pages; the installer's "unable to automatically close all requested applications" message still shows while the background service runs (see the roadmap), and OK carries on.

• Undelete and Roll back on Linux took symbolic links for changed or deleted files. A Linux folder backup keeps each link as a link, but the snapshot's file list has no size or time for one, so every link looked changed, and a link to a folder looked deleted. Roll back then moved every link aside and put it back, Undelete offered folder links as deleted files, and Undo left the links it should have put back in the safety folder (it followed each link, which no longer led anywhere from there, and took it for gone). Links are now compared by being there, a file that became a link (or the other way round) still counts as changed, and Undo puts kept links back. The comparison also leaves Windows junctions out as a backup does, instead of listing them as files. File lists cached before this are read again.

• A restore could download a chunk twice when its read-ahead fetched the chunk at the moment the restore asked for it: the check for a chunk already being fetched came a moment after the check of the cache. Seen as the restore cache test failing about 1 run in 8.

• Multi-threaded backup reading could fill the memory. Its worker count limited how many files were read at once, not how many were held: in a folder of large files, every file (up to 128 MB each) was read ahead and kept until the backup reached it, and the reads went on after a backup stopped. A file read ahead is now let go once it is archived, at most the worker count are held per folder, and a folder's reading ahead ends with its backup. The archive is the same as before. Found in review.

• Pause, Stop and the run's log belonged to the whole app, not to a backup, which only worked while one backup ran at a time: starting a second backup stopped the first, Pause and Stop acted on whichever had started last, and every run wrote into the newest run's log file. Each run now has its own.

• Runs ending together could lose each other's records: Reports entries, Last run and the full-read count were read, changed and written back without a lock, so the second write could undo the first. They are now written one at a time.

• A scheduled run with a single (pre-multi-server) PBS server could go up unencrypted if another run, without its key's passphrase, started at the same moment: both unlocked the key into the app's own settings. Each run now works on its own copy.

• On Linux, a second snapshot of a filesystem destroyed the first (elastio-snap and dattobd allow one per device, and setting one up cleared any of ours on it). A backup now waits for the other backup's snapshot of that device to end; backups of other devices go ahead.

• A set's run that started in the same second its last run ended was refused by PBS (HTTP 400): a group's snapshots must be at least a second apart. The next run waits for the next second.

• A VSS snapshot without a device no longer backs up the live volume. Windows Server 2025 build 26100.1742 was reported giving shadow copies no device (#131): a folder backup then read the live files without saying so, and a machine backup failed. The likely cause, found in go-vss (st-matskevich/go-vss#15), is the QEMU guest agent's VSS provider (qemu-ga 110.2.1 and later), which answers the call the app used for a shadow copy's details with empty details, for any shadow copy. The app now reads them from VSS's list of shadow copies, as go-vss v0.4.2 does, and asks WMI when that has no device either; with neither the backup stops instead. Not seen on a fully updated Server 2025 (26100.33650), as Administrator or as SYSTEM, where VSS and WMI give the same device.

• Junctions were opened as files on Windows, so Windows' own deny-listed ones (Documents\My Music, My Pictures, My Videos) gave "Cannot open file ... Access is denied" and a backup of Documents ended partial with 3 read errors. Since Go 1.23 a junction is reported as an irregular entry rather than a link, and the check for links missed it. Junctions and symbolic links are recognised by their reparse tag again and left out as links (not errors, and their targets are not backed up through them); other irregular entries, such as OneDrive placeholders, are still read. Tested on a test machine with a plain junction and one deny-listed as My Music is: both left out, no read errors.

• "WARNING: System Writer has errors" on every VSS backup, with every writer healthy: the check looked for "System Writer" and "Last error" anywhere in vssadmin list writers, and every writer prints "Last error: No error". Only a writer that has failed or reports an error is named now.

• A machine backup of a Windows disk that also holds Linux on MBR failed with "failed to read partition entirely", the first number larger than the second (#114). On an MBR disk Windows lists the primary partitions first and the logical ones after them, and the disk was read in that order: with Linux in logical partitions before the recovery partition at the end of the disk, the part before Linux was never read. The partitions are now read in disk order, and a disk whose partitions overlap, or end past the end of the disk, is refused before the VSS snapshot is taken. Reproduced on a test machine with a disk laid out that way: the backup failed before and completes now, and every chunk outside the NTFS partition matches the disk.

• A Windows machine backup stored the NTFS backup boot sector as zeros. A partition with a drive letter is read through its VSS shadow copy, which covers the volume and not the partition's last sector, where NTFS keeps its backup boot sector; that sector went into the image as zeros, and ntfsfix -n on a restored image reported "alternate boot sector BAD". The end of the partition past the volume is now read from the disk itself. Checked on a test machine: the restored image's last sector matches the disk, and ntfsfix -n reports the alternate boot sector OK.

• The Backup Sets list could show an old Last run and "Next run: due now" after scheduled runs had completed, until it was next read up to 30 seconds later. It was read again only every 30 seconds while the Backup page was open, so coming back to the page from another one, or opening the window from the tray, showed the list as it was. The list is now read at once on coming to the Backup page, when the window is shown from the tray or gets the focus, and a few seconds after a backup ends (its Last run is saved just after). Checked on a test machine: away on Reports through a scheduled run, the card said "due now" with the earlier run; back on Backup it showed the new run within a second.

• proxmoxbackup-machine -config file.json ignored the file's backupdev unless -backupdev was also given, and stopped at "Missing or invalid options". -backupdev now replaces the file's device list only when it is given.

• The command-line tools say which options are missing (#55): "Missing options: -baseurl, -datastore" in place of "Missing or invalid options" and the whole list of options. An argument that is not an option is now an error, where it used to be ignored together with every option after it: a \ ending a line outside bash (the cause in #55, where only the program's name reached it) gets how PowerShell and cmd continue a line, and a value after a switch (-novss true) gets that the switch takes none. On Windows a path option with a quote in it (-backupdir "C:\" passes C:" and the rest of the line) says how to write it. A mistyped option exits 1, not 2, which means another backup job is running. proxmoxbackup-directory and proxmoxbackup-machine have -version, and -help prints what the tool does and its options on standard output.

• A disk path in capitals, \\.\PHYSICALDRIVE0 (as wmic prints it), was taken for a file and failed with "Incorrect function". Windows device names are not case-sensitive, and a disk path in any case is now a disk (#75).

• A sender with a name (Backups <backup@example.com>) got "555 5.5.2" from strict mail servers such as Gmail's. The mail envelope now uses the bare address; the headers keep the name (#63).

• On Windows a dropped connection to PBS was not retried. Windows words it "An existing connection was forcibly closed by the remote host" where Linux says "connection reset by peer", and only the Linux words counted as a failure worth retrying. A chunk upload that hit it failed the folder backup at once, and a machine backup was not started again. Both now retry as they do on Linux. Found by cutting the connection part way through a test backup.

• Machine backups printed sizes up to a whole unit low. The sizes in proxmoxbackup-machine's progress and summary, and in machine backup log lines, were divided by 1024 and cut down to a whole number under the labels MB and GB, so 3 MB sent read "2MB" and a 53.7 GB disk "50GB". They are now decimal units to one decimal place, rounded, as PBS shows sizes.

• A chunk upload could hang a backup for ever on a stalled HTTP/2 stream that the connection's pings do not catch (#59). Each upload is now watched while it goes, and given up and sent again (up to 5 times) once nothing has been sent for 90 seconds, or, once all of it is sent, PBS has not answered in that time plus the time the chunk would take at 256 kbit/s. An upload that stops on a connection PBS has also said nothing on for as long is taken as a lost connection, and the backup starts again with a new session as it does after any lost connection. A slow link that is still sending is never given up, however long a chunk takes: a first version gave each upload a fixed 5 minutes, which cut short a chunk still moving over several Wi-Fi hops shared with other backups, and as the retries shared the same 5 minutes, a stalled upload was never actually sent again. Preferences > Backup Options > Chunk timeout and -chunk-timeout (JSON chunk-timeout) change the 90 seconds, 30 s to 30 minutes.

• VSS ran in a single-threaded COM apartment, where writers' calls back wait on a message queue nothing pumps: after the February 2026 Windows update, gathering writer metadata took about 3 minutes on Server 2022. VSS now runs multithreaded, and a step still pending after its wait is asked again every half second, up to its 10 minute limit, instead of failing (#67).

• A machine Backup Set's disk picker said "No physical disks found" when the app ran without administrator rights, as it now does with the service. The service lists the disks and partitions for the app.

• A Backup Set saved after the service had replaced its token failed with "not connected to the background service". Save now asks to connect again and then saves the form as it was.

• Stopping the service's token rotation now waits for a rotation under way, so the token the service accepts and the one in its token file always agree when it stops.

• A panic in the service's run loop is written to the debug log, with its stack, before the service exits, so the service manager's restart applies and the cause is known.

• The mode badge and the VSS notices follow the service when it starts or stops after the window opened.

• Adding a PBS server with no name says the name is required (it said "ID required"), and a Backup Set saved by 1.2.0-rc with an empty folder or exclusion list opens in the editor.

• FIFOs, sockets and device nodes are skipped on every platform: on macOS and the BSDs a FIFO hung the backup, and on Windows a socket file (WSL, ssh-agent) counted as a read error.

• A restore leaves the times of the folders above the selection alone, and of folders that already existed when overwrite is off.

• Linux machine backups read a disk with nothing mounted without asking for a snapshot; a disk of unknown size no longer shows "NaN%", a malformed \\.\PhysicalDrive path is an error instead of a crash, and Stop is honoured while connecting.

• Building the bare-metal restore ISO reads the source ISO's volume ID with xorriso and finds the isohybrid MBR in /usr/lib/syslinux/bios too.

• About 1 paper key in 80 could not be imported from its own QR code picture (or a screenshot of it); every one now reads back.

• "1 day ago" showed in English in Hungarian, Turkish and Dutch.

• The Backup Set list on Undelete and Roll back no longer runs past the edge of the window with sets of many folders.

• A .deb installed again after apt remove turns the background service on, as a fresh install does.

[1.2.0-rc.1] - 2026-10-30

First prerelease of the 1.2 line (635 commits since 1.1.3). Published as a GitHub prerelease: install it on test systems, not on production ones. The MSI reports ProductVersion 1.2.0 (Windows Installer requires a numeric x.y.z), so uninstall this prerelease before installing 1.2.0 final.

Added

• Weekly and monthly scheduled jobs: the GUI can now schedule a backup on one or more weekdays, or on a specific day of each month, instead of only every day. Jobs saved before this change keep running daily, unchanged.
• Branded installers: the same binaries ship under the Proxmox Backup Client, Nimbus Backup, Acme Backup and Etitech Backup brands (exe-driven gui/brand.go catalogue, per-brand icons, WiX installers and MSI build scripts).
• Machine backup: restores in disk order, reads the tail of a VSS partition from the disk, waits while VSS is busy, and keeps (or deliberately drops) a restored Linux system's identity for bare-metal restores.
• Localized READMEs (ar, de, el, es, fa, fr, it, ja, ro, ru, sv, zh).

Fixed

• pxar: a read error part way through a file no longer ends the backup, and FIFOs/sockets/device nodes are skipped instead of opened.
• Restore: says which key an encrypted snapshot needs; restores protected DACLs correctly.
• Backups: previous-index corruption no longer panics chunk dedup; failed folders release their backup-group lock instead of failing the rest of the run; more transient PBS failures are retried.
• Builds: version handling unified on the git tag across MSI, deb, rpm, arch and Docker; the MSI is built with candle/light under Wine in Docker.
• CI/release: the goreleaser config was migrated to schema v2 (goreleaser ≥ v2.19 rejects v1 configs), prerelease tags such as v1.2.0-rc.1 no longer feed a non-numeric version to WiX, and provenance is now attested with actions/attest-build-provenance instead of the failing SLSA generator workflow.

Packaging

• Windows downloads are MSI installers only: one per brand (ProxmoxBackupClient, NimbusBackup, AcmeBackup, EtitechBackup), all built from the same binaries. The stand-alone .exe and the unversioned MSI are no longer published; every MSI file name carries the release version.