Well… it pauses the scheduler. So you should be able to run the list-broken-files and purge-broken-files commands as they bypass the scheduler.
You are correct that there is nothing directly insecure about inherited permissions. However, the permissions can change at any time and needs to be verified. My worry is that we will create holes or bugs if we start to attempt a full parsing and validation of all inherited permissions.
I usually try to write both, but I see I forgot in the release notes.
Maybe that should have had another read. Previous versions would “adopt” existing an datafolder by setting permissions on it. This version no longer does this and will not “adopt” (or accept) an existing folder with incorrect permissions.
Next version will feature a --quiet option.
Good catch. The configure tool will use --datafolder going forward.
Thanks for reporting, it is fixed in source.
Yes, that is exactly it. When reading the remote file, Duplicati will compare the local (default) settings to the settings recorded in the manifest. If these do not agree you get an exception message saying “invalid manifest”.
For the next version, the manifests are fully ignored when restoring the configurations.
I think your setup is launching the TrayIcon with --server-datafolder=... ?
If you prefer that, then you need to add --allow-insecure-datafolder to both the TrayIcon and the service. (Alternatively run TrayIcon as Administrator which is a hassle).
The reason for this is that you need two different accounts to access the folder, which is something we do not currently have a secure way of doing. The alternative is to remove the --server-datafolder argument from the TrayIcon and then rely on the default credential manager. When you do this, the TrayIcon will start up in a disconnected state, and you can right click it to set the password. If you choose to save it, it will be stored in the Windows Credential Manager, and remembered for the next startup.
If you prefer the datafolder approach, the next release will allow you to place the previous insecure-permissions.txt file into the Duplicati install folder, so it automatically applies to both server and TrayIcon.