repository: single config/config text object (repo version 5)

[ThomasWaldmann]

Follow-up to #10371 .. #10374, which emptied the manifest. Opening a repository loaded four store objects: config/readme, config/version, config/id and config/manifest (only read for its key type byte). Now it loads one:

# This is a Borg Backup repository.
# See https://borgbackup.readthedocs.io/

[repository]
version = 5
id = <64 hex digits>
encryption = aes256-ocb
id_hash = sha256

The config object

• config/config is a plain text INI object (configparser), the readme text lives on as comment lines. encryption / id_hash record the crypto suite by the --encryption / --id-hash names; key_factory() selects the key class from them without reading any repository object. Both names are recorded or none: a config with one but not the other is invalid, an unsupported suite raises InvalidRepositoryConfig. Key storage (keyfile vs repokey) stays a property of each key.
• Repository version 5, only 5 accepted. No code for the old layout, no migration (betas are for new repos only): an older beta repository fails to open with "repository version 4 is not supported".

No manifest object for borg 2 repositories. Manifest is only the in-memory container for key, repo_objs, repository and archives. Removed: write() and its callers, get_manifest() / put_manifest(), the manifest checks and rebuild in borg check, borg debug dump-manifest, key_from_repository() and the ROBJ_MANIFEST type (no stored object ever had it, borg 1.x objects carry no type at all). borg 1.x repositories are still read via their manifest (legacy_key_factory), since it holds their archives list. NoManifestError stays defined (never raised) so rc 26 remains reserved.

repo-create leaves nothing behind when it fails. Repository.create() writes the config (version, id, no key info) by default, so a repository created via the Python API is an openable key/value store. borg repo-create alone uses create_config=False and writes the config once, last, after the key exists, so nothing that looks like a repository exists until it succeeds: any failure or interruption before that destroys the store and, in keyfile mode, the keyfile just written; a failure inside create() itself destroys the store as well.

A store without config (only possible after a hard kill, or a repository that lost its config):

• on open it is reported as not a valid repository (InvalidRepository); DoesNotExist is only for a missing store backend, the rest:// case from repo-info on a non-existent remote repo raises BackendDoesNotExist #10365;
• repo-create on it says what borg knows, with the new IncompleteRepository error (rc 11): no repository config, so not a borg 2 repository or the leftover of an interrupted repo-create (the store backend refuses any non-empty directory, so this is all borg can tell);
• borg repo-delete --force destroys it, but only if it looks like the leftover of an interrupted repo-create (a chunk index, but no packs and no archives), so that ssh/rest/s3 users can remove a leftover without other access to the storage, and a repository that merely lost its config is never destroyed;
• key_factory() on a config without key info raises RepositoryKeyInfoMissing (rc 54).

Cache config: the [cache]/[integrity] cross-check on the manifest id could never detect anything (every borg that can open the repository knows the integrity section) and is dropped, together with its warning and test.

Docs: a new "Repository config" section replaces the manifest section, including how to recreate a lost config by hand (check --repair can not restore it); the layout list, packs (no migration from 4 to 5 either) and security internals (where the protection against a swapped crypto suite lives: the security directory and the unknown-unencrypted prompt for swaps to a non-encrypting suite, the security directory for swaps between encrypting suites), the repo-info example, the error list (rc 11, 54) and the remaining manifest mentions are updated. Sphinx builds without warnings.

Tests: manifest-specific tests removed; new tests for the config round trip, a store without config (open: invalid, create: incomplete, repo-delete --force: destroyed only if a leftover), a repository that lost its config (invalid, not destroyed), bad configs (wrong version, no section, missing / invalid / half-present entries, not text), key_class_for over all creatable suites, repo-create failing while writing the config or inside create() leaving neither store nor keyfile behind, and a plain data directory refused by repo-create and repo-delete --force.

Full suite passes locally (FUSE mount tests deselected, macFUSE is unavailable on this machine).

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 93.03483% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.12%. Comparing base (3b905e0) to head (c7a58a1).
⚠️ Report is 35 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/borg/repository.py	93.68%	5 Missing and 1 partial ⚠️
src/borg/archiver/repo_delete_cmd.py	83.33%	2 Missing and 1 partial ⚠️
src/borg/archiver/_common.py	75.00%	1 Missing and 1 partial ⚠️
src/borg/cache.py	50.00%	1 Missing and 1 partial ⚠️
src/borg/archiver/debug_cmd.py	85.71%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10377      +/-   ##
==========================================
- Coverage   88.12%   88.12%   -0.01%     
==========================================
  Files         103      103              
  Lines       18928    18842      -86     
  Branches     2923     2921       -2     
==========================================
- Hits        16681    16604      -77     
+ Misses       1556     1552       -4     
+ Partials      691      686       -5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.