The complete format is in docs/store-format.txt. In short:
B.1 Objects and packs#
All objects are immutable and content-addressed. A BLOB is a chunk, a TREE a list of references (manifest segments, run root). The ID is the ID hash (id_hash in store.json) over the content, for encrypted stores with a key derived from the key (HMAC-SHA256, keyed BLAKE3 or XXH3 with secret). Every object is compressed and possibly encrypted; on reading it is always checked against its ID. TREEs carry their references in plain text so that prune, mirror and export work without a key; only structure and sizes are visible in this, never contents. Packs (packs/<xx>/<pack>.pack) contain objects one after the other, each with a header and CRC32C, and an index at the end of the pack.
B.2 Runs and manifests#
A run (runs/<time>-<uuid>.run) is a JSON file that is written atomically as the last thing (commit point). A block snapshot describes the source in segments of 1 GiB; every segment is a list of extents (chunk or hole). Chunk boundaries: FastCDC with a fixed gear table, parameters min/avg/max from store.json. A VM run (kind: vm, Proxmox/Xen) has a root with the configuration and one block snapshot per disk. An archive (.cba) contains a run with all necessary objects in restore order, index and SHA-256 at the end; it can be read from front to back (tape, pipe).
B.3 Network protocol#
Frames with CRC32C over TLS (protocol version 4). HELLO with API key; OBJ_OPEN opens or creates a store; OBJ_HAVE asks which objects are already there; OBJ_PUT/OBJ_GET transfer records over any number of frames; OBJ_COMMIT writes the run, OBJ_LIST_RUNS lists the runs, OBJ_FLUSH has the data so far confirmed; OBJ_TYPES/OBJ_AUX serve mirroring. Holding: a server with the capability BKP_CAP_HOLD accepts OBJ_HOLD, with which the client reports a held run before the last OBJ_FLUSH (the end of the connection without commit is then not an error). If the target administrator holds a backup, the server attaches a hold block (continuation time, distribution, kind, by whom, reason) to OBJ_PUT_ACK or PONG for a client with BKP_CAP_CLIENT_HOLD; if the client does not follow within 120 seconds, the server closes the connection. It answers a renewed opening of a held backup with BKP_ERR_HELD. An agent or server of version 1 is refused when the connection is set up.