restic — Dependencies#

Module info#

• Module: github.com/restic/restic
• Go version: 1.24.0
• Direct dependencies: 34
• Indirect dependencies: ~59 (go.sum has 336 lines ≈ 168 unique modules resolved)

Dependency categories#

Core infrastructure#

• github.com/spf13/cobra v1.10.2 — CLI framework powering all subcommands (backup, restore, snapshots, etc.)
• github.com/spf13/pflag v1.0.10 — cobra’s flag library; pulled in directly as well
• github.com/cenkalti/backoff/v4 v4.3.0 — exponential backoff for retrying transient backend errors
• github.com/hashicorp/golang-lru/v2 v2.0.7 — LRU cache used in the repository/index layer to avoid redundant pack lookups
• github.com/cespare/xxhash/v2 v2.3.0 — fast non-cryptographic hashing (used in cache keys and index structures)
• go.uber.org/automaxprocs v1.6.0 — automatically sets GOMAXPROCS from container CPU quota; a deliberate opt-in for container-aware scheduling
• github.com/pkg/errors v0.9.1 — legacy error wrapping; coexists with stdlib errors/fmt.Errorf %w in newer code
• github.com/pkg/profile v1.7.0 — CPU/memory profiling triggered by --no-lock debug flag

Cryptography#

• golang.org/x/crypto v0.47.0 — provides poly1305 (MAC for AES-256-CTR+Poly1305 encryption in internal/crypto), scrypt (KDF for repository key derivation in internal/crypto/kdf.go), and openpgp (signature verification for restic self-update)
• github.com/elithrar/simple-scrypt v1.4.0 — scrypt wrapper used for repository password hashing; supplements the raw x/crypto/scrypt usage

Networking / HTTP#

• golang.org/x/net v0.49.0 — HTTP/2, network utilities; indirect dependency for several backends
• golang.org/x/oauth2 v0.34.0 — OAuth2 token management for Google Cloud Storage authentication
• github.com/peterbourgon/unixtransport v0.0.7 — HTTP transport over Unix sockets; used by the rclone backend to communicate with a locally spawned rclone serve restic subprocess

Storage backends (cloud / protocol)#

• cloud.google.com/go/storage v1.59.2 — Google Cloud Storage backend (internal/backend/gcs)
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 — Azure SDK core runtime
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 — Azure credential management
• github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4 — Azure Blob Storage backend (internal/backend/azure)
• github.com/Backblaze/blazer v0.7.2 — Backblaze B2 backend (internal/backend/b2)
• github.com/minio/minio-go/v7 v7.0.98 — S3-compatible backend (internal/backend/s3); used for AWS S3, MinIO, and any S3-compatible service
• github.com/ncw/swift/v2 v2.0.5 — OpenStack Swift backend (internal/backend/swift)
• github.com/pkg/sftp v1.13.10 — SFTP backend (internal/backend/sftp)
• google.golang.org/api v0.256.0 — Google API client library; supports GCS auth and discovery

Compression / chunking#

• github.com/restic/chunker v0.4.0 — content-defined chunking (CDC / Rabin fingerprinting) extracted from restic into a standalone module; this is the algorithmic heart of deduplication
• github.com/klauspost/compress v1.18.3 — zstd, gzip, snappy, s2 compression; pack files in repository format v2 use zstd

Filesystem / OS#

• github.com/anacrolix/fuse v0.3.1 — FUSE filesystem binding for restic mount; allows browsing snapshots as a virtual directory tree
• github.com/Microsoft/go-winio v0.6.2 — Windows named pipes, extended security (ACLs), extended attributes; enables full-fidelity Windows backup
• github.com/go-ole/go-ole v1.3.0 — Windows OLE/COM bindings; used to interface with VSS (Volume Shadow Copy Service) for consistent Windows backups
• github.com/pkg/xattr v0.4.12 — cross-platform extended file attributes (macOS, Linux, FreeBSD); restic preserves xattrs during backup/restore
• golang.org/x/sys v0.40.0 — low-level syscall wrappers; used in internal/fs for platform-specific stat fields and filesystem metadata
• golang.org/x/term v0.39.0 — terminal detection and secure password input (reads repository password without echo)

Concurrency / flow control#

• golang.org/x/sync v0.19.0 — errgroup for parallel backup workers, semaphore for concurrency limiting in pack operations
• golang.org/x/time v0.14.0 — token bucket rate limiter; the --limit-upload/--limit-download bandwidth throttling feature
• golang.org/x/text v0.33.0 — Unicode normalization for filename handling across platforms

Testing#

• github.com/google/go-cmp v0.7.0 — deep equality comparison in tests; used where reflect.DeepEqual is too coarse

Stdlib reliance#

Restic is heavily stdlib-oriented. Import frequency across internal/ (non-test files):

The io.Reader/io.Writer interfaces are used pervasively throughout the backend abstraction layer. There is no structured logging library — restic uses a minimal internal/debug package that compiles conditionally. HTTP clients use the stdlib net/http package; restic does not serve HTTP itself.

Shared dependencies#

Dependencies also commonly seen across the 50-project set:

• github.com/spf13/cobra — ubiquitous in Go CLI tools (kubectl, helm, hugo, etc.)
• golang.org/x/crypto, x/sync, x/sys — near-universal in non-trivial Go projects
• github.com/klauspost/compress — shared with etcd, minio, and other data-intensive projects
• github.com/google/go-cmp — standard test utility across the ecosystem
• github.com/pkg/errors — legacy dependency found in projects that predate Go 1.13 %w wrapping
• github.com/hashicorp/golang-lru/v2 — shared with consul, vault, and other HashiCorp projects

Vendoring#

No vendor/ directory. Restic relies on Go modules with go.sum for reproducibility. This is consistent with a project that already enforces reproducible binary builds (via goreleaser + checksums.txt signing) — the module system’s checksum database provides the equivalent guarantee at source level.

Notable dependency decisions#

1. github.com/restic/chunker is a separate maintained module. The CDC algorithm was extracted from the main tree and published as a standalone package. This is architecturally significant: it decouples the core deduplication algorithm from the application, allows independent testing and versioning, and enables third-party tools to reuse the chunker without importing all of restic. It is the clearest example of domain logic extraction in the project.

2. Three Azure SDK packages as direct dependencies. Azure Blob Storage requires azcore + azidentity + azblob separately — Azure’s modular SDK design forces this. This adds 5+ indirect dependencies but keeps unused Azure services out of the binary.

3. The GCS dependency drives most of the indirect bloat. cloud.google.com/go/storage pulls in google.golang.org/grpc, OpenTelemetry (9 packages), Envoy control plane types, protobuf, and more. The 59 indirect dependencies and ~168 modules in go.sum are almost entirely attributable to the GCS + Google API client chains.

4. No logging library. Unlike most Go projects of this size, restic has no structured logger (no zap, zerolog, logrus). Output is via fmt and the custom internal/debug (compile-time gated). This reduces binary size and eliminates a common third-party dependency.

5. go.uber.org/automaxprocs as a direct dep. This is an unusual but deliberate choice for a backup tool commonly run in containers. By importing it in main.go, restic automatically respects container CPU limits without user configuration — a subtle performance optimization.

6. peterbourgon/unixtransport for rclone IPC. Rather than shelling out and parsing output, the rclone backend spawns rclone serve restic and communicates over its REST API via Unix sockets. This tiny transport library enables that pattern cleanly and is a sign of careful interface design: rclone is treated as just another REST backend, not a subprocess to parse.