Encrypted, signed, backups.

• tar
• age
• signify

making a backup archive:

$ cat list_of_files_to_backup | bup.sh backup_name
tar: Removing leading / from absolute path names in the archive
Enter passphrase (leave empty to autogenerate a secure one):
Using the autogenerated passphrase "palace-must-stay-muscle-achieve-edge-hub-ethics-box-rate".

the following files will have been created in the current directory:

• yyyy-mm-dd.pub - public keyfile for signature verification
• backup_name.tgz.age - encrypted archive
• backup_name.tgz.age.sig - signature of encrypted archive

decyrption:

$ bup.sh open backup_name.tgz.age yyyy-mm-dd.pub
Signature Verified
Enter passphrase:

the script will verify the signature, decrypt and extract the tgz archive all at once.

alternatively, you can just decrypt the archive itself, without extracting by passing a third argument (path to the decrypted archive):

$ bup.sh open backup_name.tgz.age yyyy-mm-dd.pub ./test.tgz
Signature Verified
Enter passphrase: