check: always require the key - #10385

borg check now loads the key before it checks anything, in every mode, and aborts if it can not.

Before

• borg check --repository-only (without --repair) needed no key at all.
• A check without --repair swallowed RepositoryKeyInfoMissing and carried on without a key: the archives check then rebuilt the chunk index without an object validator and only failed at its second attempt to load the key.
• Only --repair really required the key (borg2: index rebuild trusts pack headers #9901).

Now

• do_check calls key_factory(repository) right after the argument validation. Every borg 2 repository has a borg key (remove the none-sha256 and none-blake3 encryption modes #10381) and the key class comes from the repository config (repository: single config/config text object (repo version 5) #10377), so loading the key reads no repository object. The passphrase is still asked for before a repository check that can take hours (ux: borg check asks for passphrase very late #1931).
• Repository.check() always gets the object validator. It uses it for the index rebuild, which only a repair does, so a non-repair repository check verifies the same things as before.
• ArchiveChecker.check() has no path without a key any more, so its chunk index rebuild always validates the object headers it walks. It still loads the key itself if the caller did not set .key (several tests use it that way).

User-visible consequences

• borg check --repository-only can not be run without the key / passphrase any more, e.g. on a repository server that does not have them.
• A repository without key info in its config (created via the Python API, Repository(..., create=True)) fails every check with rc 54 (RepositoryKeyInfoMissing); a wrong passphrase fails with rc 52, before anything is checked.

Tests

• test_check_without_key_aborts_on_a_corrupt_pack_header is removed: a check without the key does not exist any more.
• New: test_check_aborts_on_wrong_passphrase and test_check_aborts_without_key_info, each for the full, the --repository-only and the --archives-only check. The --repository-only cases fail on master.

Docs

• The check epilog says that check always needs the key, --repository-only included; the repair-only sentence about it is gone.
• docs/internals/packs.rst no longer describes a repair that walks the packs without the key (stale since borg2: index rebuild trusts pack headers #9901).
• Usage docs / man pages are not regenerated.

🤖 Generated with Claude Code