borgbase/vykar v0.19.1

on GitHub

A macOS-only patch release. Nothing changes for Linux or Windows users.

macOS

• The CLI now ships inside Vykar Backup.app. macOS identifies privacy-permission clients by bundle identifier, which a bare binary on PATH does not have — a Full Disk Access grant made to /usr/local/bin/vykar is keyed by path and code hash instead, and quietly stops applying when the binary is replaced. Scheduled backups should invoke /Applications/Vykar Backup.app/Contents/MacOS/vykar and grant Full Disk Access to the app, which survives updates.

• launchd setup is documented, with a complete LaunchAgent example — see Daemon Mode — launchd (macOS). Note that cron cannot work for scheduled backups on macOS: the system attributes a cron job's file access to /usr/sbin/cron rather than to the program it runs, so granting Full Disk Access to vykar has no effect there.

• The installer verifies the code signature and refuses to install a binary whose signature does not validate, instead of leaving you to discover it when macOS kills the process with Killed: 9. If you have worked around that with codesign --sign -, reinstall rather than re-signing: ad-hoc signing replaces vykar's stable signing identity with one that changes on every update, and that is what breaks Full Disk Access for scheduled runs.

• Updates install atomically. The installer stages the new binary and renames it into place rather than writing over the destination, so an interrupted update cannot leave an unrunnable binary behind.

• Releases can no longer ship unsigned macOS binaries. The build now fails if signing credentials are unavailable, notarization must report Accepted before artifacts are published, and nested code in the app bundle is signed inside-out rather than with Apple's deprecated --deep.

• The com.apple.security.cs.allow-unsigned-executable-memory hardened-runtime entitlement has been removed. Nothing in vykar needed it.

Updating

To update to the latest version, run:

curl -fsSL https://vykar.borgbase.com/install.sh | sh

See the quickstart guide for other install options.

macOS users who run backups on a schedule should additionally install the app bundle:

tar xzf vykar-v0.19.1-aarch64-apple-darwin.tar.gz
sudo cp -R "Vykar Backup.app" /Applications/

Then grant Full Disk Access to /Applications/Vykar Backup.app and point your LaunchAgent at /Applications/Vykar Backup.app/Contents/MacOS/vykar.

Downloads

SHA256 checksums are attached to this release.