BorgShield 2.1 adds AES‑256 encryption and test‑restore for Linux backups

── What shipped ──

BorgShield 2.1.0 released on 2026‑07‑23 for Debian 11+ and Ubuntu 22.04+ (x86_64) as a single Bash script backup.sh [Dev.to]. The script drives BorgBackup with Zstandard compression level 3 [Zstandard Docs], AES‑256 encryption (repokey mode), and automatic pruning (keep‑daily 7, keep‑weekly 4, keep‑monthly 6). It collects 14 categories of system metadata—package lists, snap/flatpak inventories, systemd unit files, Git repo manifests—into a meta/ directory stored alongside each snapshot.

During the initial full backup of a 357 GB system, raw data (145 GB) compressed to 100 GB and deduplicated to 80 GB, a 1.8× deduplication ratio [BorgBackup Docs]. The full backup took 3 h 27 m on a USB 2.0 external NTFS disk; subsequent daily incrementals run 3–8 min, while the same workload on USB 3.0 would drop to 1–3 min. After each run the script executes borg check --verify-data and offers a test-restore command that validates package databases, Git histories, and configuration files without extracting the archive.

── Why it matters ──

BorgShield uniquely bundles deduplication, compression, encryption, FUSE mount, granular restore, automated metadata, test‑restore, crontab readiness, silent mode, and full‑system dump support in one CLI package. Its built‑in integrity verification eliminates the need for external checksum scripts, reducing silent corruption risk. By storing deduplicated chunks on an NTFS external disk, a 1.9 TB drive with 418 GB free can retain three years of backups under the default retention policy, making air‑gapped recovery practical.