🚀 v0.3.0 — Stability, Security & Reliability Update

This release introduces major stability, security, and consistency improvements across all modules.
It focuses on safe process handling, input sanitization, dependency validation, and robust backup synchronization.

🧩 Core Libraries

/lib/utils_counting.sh

Fixes

• 🧹 Fixed nested quote syntax errors in error messages.
• 🔒 Resolved compression extension pattern matching and prevented regex injection during backup counting.

/lib/utils.sh

Fixes

• 🧠 Replaced command substitution with explicit if/else for path verification.
• 🔢 Fixed compression ratio formatting (removed tilde and percent symbols).
• 🔐 Removed command injection vulnerabilities in file search utilities.

Added

• 🧩 Moved missing formatting utilities from metrics.sh to restore full dependency chain.

/lib/storage.sh

Fixes

• 🧱 Replaced pipefail usage with subshell isolation for sync uploads.

Added

• ⚙️ Added pipefail and progress logging to async upload functions.
• 🧭 Enhanced rclone failure detection in upload routines.

/lib/security.sh

Fixes

• 🧩 Fixed false error return in install_missing_packages.
• 🛑 check_dependencies now stops correctly when dependency installation fails.

Added

• 🚨 Full completion check for safety controls — script now issues a crash warning if errors occur.

/lib/notify.sh

Fixes

• 🧠 Added missing status variable in create_email_body.
• 🔗 Telegram messages now use correct URL encoding.

/lib/metrics_collect.sh

Fixes

• 📈 Corrected file path extraction for calculating log age averages.

/lib/metrics.sh

Fixes

• 🧮 report_metrics_error now increments counters correctly.
• 🧩 validate_metrics_dependencies now correctly populates missing_optional.
• 🧾 Fixed divide-by-zero error in calculate_compression_ratio.

Added

• 🔒 Unified lock mechanism for process synchronization.
• 🧱 Moved formatting utilities to utils.sh for consistency.

/lib/log.sh

Fixes

• 🚫 Prevented unbound variable errors with set -u.
• 🧹 Removed unsafe trap and redundant debug initialization.
• ⚙️ Updated setup_logging() and start_logging() for safer initialization.

Added

• 🧩 Introduced guard blocks protecting debug() and trace() functions.

/lib/core.sh

Fixes

• 📝 Updated debug level documentation.
• 🧹 Removed redundant set -euo pipefail.
• ⚠️ Introduced CRITICAL error state for unrecoverable conditions.
• 🧼 Replaced rm -rf with safe_cleanup_temp_dir().

Added

• 🛡️ Added safe_cleanup_temp_dir() with five safety guardrails.

/lib/backup_verify.sh

Fixes

• 🎯 Corrected exit code tracking for critical_errors and sample_errors.
• 🧩 Fixed mktemp usage for rclone temporary directories.

/lib/manager.sh

Fixes

• 🔒 Fixed non-shared lock file race conditions.
• 🧮 Prevented PID truncation (values >255).
• 🧩 Fixed lost and mis-checked exit codes.
• 🧹 Ensured cloud_storage lock release on errors.

/lib/backup_create.sh

Fixes

• 🧭 Fixed working directory corruption after find execution.

/lib/backup_collect.sh

Fixes

• 🌀 Wrapped find loops in subshells and removed unsafe cd /tmp.

Added

• 🪶 Added .proxmox-backup-marker creation in setup_temp_dir().
• 💾 Added save/restore of DEBUG_LEVEL in check_env_file().

/lib/backup_collect_pbspve.sh

Fixes

• 🔐 Improved sanitize_input() to preserve valid filesystem characters.
• 🧩 Fixed quote escaping and exit code tracking in rclone calls.
• 🧮 Added detailed data quality notes and documentation.

Added

• 🧰 Introduced helper functions:
  safe_command(), safe_mkdir(), safe_stat_size(), validate_output_file().

/lib/environment.sh

Fixes

• 🧩 Ensured lock directory creation before acquiring metrics lock.

Added

• 🪶 Added .proxmox-backup-marker after mkdir TEMP_DIR.
• 💾 Added save/restore of DEBUG_LEVEL in check_env_file().

⚙️ Main Script

/script/proxmox-backup.sh

Fixes

• 🔒 Improved lock cleanup with flock validation and orphan recovery.
• 🧹 Replaced rm -rf with safe_cleanup_temp_dir().
• 🧠 Improved dependency and lock handling with strict set -e.

Added

• 🔄 Added flush operation in cleanup_handler.

🔒 Standalone Script — security-check.sh

Fixes

• 🧩 Improved safety checks, reliable hash validation, and parent-script detection.
• 🔍 Hardened kernel, port, and file scans for better accuracy and input handling.

Added

• 🗂️ Added $BASE_DIR/lock directory validation.
• ⚙️ Added IPv6 filtering, outbound monitoring, and configurable suspicious port lists.
• 🧾 Implemented whitelist and associative map for safe filtering.
• 🧠 Modernized detection with ss support and improved debug levels.

🧰 Standalone Script — install.sh

Fixes

• 🧭 Forced switching to a safe directory before cloning or copying files to prevent
  fatal: Unable to read current working directory errors.

Added

• 🧩 Applied chmod 744 to install.sh and new-install.sh immediately after cloning.

🧰 Standalone Script — fix-permissions.sh

Added

• 🔧 Included both installers in the maintenance routine.
• 🛠️ Ensured both stay at permission level 744 during updates and repairs.

✅ Overall Improvements

• Stronger process and lock synchronization.
• Hardened temporary directory handling and cleanup.
• Safer input, quote, and command validation.
• Enhanced dependency and metrics management.
• More accurate backup verification and reporting.
• Improved fault tolerance in standalone security tools.
• Added safe install and permission maintenance scripts.

✨ Result: The system is now significantly more stable, secure, and resilient under all runtime conditions.

Compatibility: PVE and PBS
Installation: bash -c "$(curl -fsSL https://raw.githubusercontent.com/tis24dev/proxmox-backup/main/install.sh)"