Repository: borgbackup/borg

Issue:
people are confused by message after borg init
 

## Have you checked borgbackup docs, FAQ, and open Github issues?

Yes
## Is this a BUG / ISSUE report or a QUESTION?

BUG

## System information. For client/server mode post info for both machines.

#### Your borg version (borg -V).
borg 1.1.9

#### Operating system (distribution) and version.
Debian 10

"encryption" parameter is being ignored during repo init.
`borg init TEST --encryption=repokey`

> Enter new passphrase: 
> Enter same passphrase again: 
> Do you want your passphrase to be displayed for verification? [yN]: n
> 
> By default repositories initialized with this version will produce security
> errors if written to with an older version (up to and including Borg 1.0.8).
> 
> If you want to use these older versions, you can disable the check by running:
> borg upgrade --disable-tam TEST
> 
> See https://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability for details about the security implications.
> 
> IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo!
> Use "borg key export" to export the key, optionally in printable format.
> Write down the passphrase. Store both at safe place(s).
> 


Discussion:
So, where exactly is the problem?
Doesn't repokey mean i only need the passphrase not key and passphrase?
you always need key and passphrase.

the difference is that for `repokey` mode, the key is stored in the repo config, while for `keyfile` mode it is stored in your home directory.
"you will need both KEY AND PASSPHRASE" made it sound like the key is stored in home directory. 
you read too much between the lines. :)
as you can read in the lines below the one you quoted, it tells you that so you keep both at a safe place.

it would be a pity if you lose the key or passphrase and can't access your repo because of that.

that can also happen if the key is stored in the repo config, just think of a hardware issue or software bug.

New user here. I searched and found this issue after reading https://borgbackup.readthedocs.io/en/1.1-maint/usage/init.html and initialising my first repo with `borg init --encryption=repokey` as I was also confused/unsure.

"you will need both KEY AND PASSPHRASE to access this repo!" does seem to strongly imply that the key will need to be managed by the user separately to the remote repo (and its config). I believe it would avoid confusion if the message were tweaked based on the encryption option used, or if it were improved to more clearly cover use of both keyrepo and keyfile options.

Edit: or is the idea, even with 'keyrepo', that the user does export and the remotely-stored key? If so, is that to guard against corruption of (just) the key file on the remote, which would render the whole repo (which may otherwise still be readable) unreadable? Apologies if this is a silly question; after reading the documentation I had the idea in my head that I would only need to store the passphrase:

> If you want “passphrase-only” security, use one of the repokey modes. The key will be stored inside the repository (in its “config” file).
The "you will need..." phrase is simply a statement of a fact. The repo is encrypted with a key and the key is protected by a passphrase. So you need both of them to be able to use the repo.

This fact is totally independent of the storage location of the key (whether it is local in your home directory or in the repo directory). It also does not say that you need to do something special with the key under normal circumstances, it just tries to say that you must not lose neither the key nor the passphrase under any circumstance (except if you completely delete a repo). This implies that you make a backup and store it safely as it suggests after that phrase.

If you have a better phrase to express that shortly, I am open to suggestions.
I landed here the same as @DavidOliver.. this was also quite confusing to me. I was pretty sure the key was stored in the repo, but the message made me do a double take and led me here to verify.

Suggestion: leave the phrasing as is, but append a sentence to the effect of "If you used a repokey encryption mode, then the key is stored in the repo but you should back it up separately."
Found this issue the same way as the others, I guessed that it meant the key was stored with the repo but the message seemed ambiguous 

>If you have a better phrase to express that shortly, I am open to suggestions.

If the repo is created with a repokey encryption method, something like "This repo's key is stored with the repo, anyone with a copy of the repo can access it using the included key and your passphrase" might be less intimidating, while also giving a heads up about the implications for storing the key with the repo itself. 
Same for me, I habe been the mast hour looking for a workaround until I came here. The message is not clear. 

Worse it is a security issue as it gives a "false impression of security" which is a bad practice. People may think the key is not on the repo and only safely stored locally, which is not the case.
Thx for adding it to a milestone!

Resolving patch:
diff --git a/src/borg/archiver.py b/src/borg/archiver.py
--- a/src/borg/archiver.py
+++ b/src/borg/archiver.py
@@ -318,6 +318,7 @@ def do_init(self, args, repository):
             logger.warning(
                 '\n'
                 'IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo!\n'
+                'If you used a repokey mode, the key is stored in the repo, but you should back it up separately.\n'
                 'Use "borg key export" to export the key, optionally in printable format.\n'
                 'Write down the passphrase. Store both at safe place(s).\n')
         return self.exit_code


Test patch: