Module recorded 

Recorded snapshot metadata — the kopiur-meta kopia tag.

Every produced backup records the mover identity it ran as (uid/gid/fsGroup plus its provenance) as a compact JSON value under the KOPIUR_META_TAG snapshot tag, so a later restore — possibly on a rebuilt cluster where the workload no longer exists — can reproduce the identity the data expects. The catalog scan decodes the tag back into Snapshot.status.recorded.

Schema write policy

Writers emit the lowest schema number that represents the data (KOPIUR_META_SCHEMA_V1 today); the schema is bumped only for a semantic change an old reader would misinterpret, never for additive fields (readers accept unknown JSON fields). An older operator reading a newer schema degrades to recorded-absent (MetaTagDecode::UnsupportedSchema) — it never errors. This matters for shared-repository multi-cluster topologies running mixed operator versions.

Decode is graceful, always

decode_meta_tag never returns an error and never panics: the tag value is repository data, writable by anyone holding repository credentials (a foreign cluster, a NAS admin, a compromised replication peer). A malformed value must degrade to MetaTagDecode::Malformed — one aggregated per-scan count, never a poisoned catalog scan or a per-entry log line a foreign writer could amplify.

Structs

RecordedSnapshotMeta

The mover identity recorded on a kopia snapshot at backup time — the decoded value of the KOPIUR_META_TAG snapshot tag.

Enums

MetaTagDecode

What decode_meta_tag found in a snapshot’s tags map. Never an Err: a bad tag value is repository data and must degrade, not fail a scan.

RecordedSrc

Where the recorded mover identity came from — which layer of the security-context ladder pinned the effective UID this run recorded.

Constants

KOPIUR_META_SCHEMA_V1

The current (and only) kopiur-meta schema version. See the module docs for the write policy: writers emit the lowest schema representing the data.

KOPIUR_META_TAG

The kopia snapshot-tag key kopiur records its metadata under. Deliberately colon-free: kopia splits --tags on the FIRST colon, so a colon-free key is collision-proof against the legacy kopiur:config:<name> tag (stored by kopia as manifest key tag:kopiur, value config:<name>) and can never trip kopia’s duplicate-tag-key create failure.

Functions

decode_meta_tag

Decode the KOPIUR_META_TAG value out of a snapshot tags map.

encode_meta_tag

Encode recorded metadata as the compact single-line JSON value stored under the KOPIUR_META_TAG snapshot tag.

truncate_utf8

Truncate s to at most max_bytes bytes on a char boundary (never panics, never splits a multi-byte character). Shared by the catalog’s description cap and the mover’s result-wire bound — foreign-writer-controlled strings must never 4xx a CR create or inflate the result ConfigMap.