tapetools

Personal long-term backup pipeline for LTO-5 tape cartridges. Built to back up a ~7-8 TB Synology archive with end-to-end integrity guarantees, AES-256 encryption, and self-healing 10% PAR2 redundancy.

Designed for 5–10 year cold storage where the dominant risks are bitrot, tape degradation, lost passwords, and tool obsolescence.

Status

Working MVP. All 38 implementation tasks complete, 14 packages with passing tests, including E2E coverage for tamper detection, par2 recovery, multi-chunk roundtrips, Unicode/zero-byte/deep paths, and a property test that runs 10 random-tree roundtrips.

Tape acceptance procedure (docs/manual/tape-acceptance-test.md) must be run once with a real LTO drive before trusting the pipeline with production data.

Architecture

Three machines, three stages:

Synology (source)           Mini PC (Ubuntu)         Windows + LTO + LTFS
   │                              │                          │
   │ SMB/NFS mount                │                          │
   ├─────────────────────────────►│                          │
   │                       scan + hash                       │
   │                       split into ~1.27 TB chunks        │
   │                       7z (AES-256, no compression)      │
   │                       par2cmdline (10% redundancy)      │
   │                              │ external SSD             │
   │                              ├─────────────────────────►│
   │                              │           drag-drop LTFS │
   │                              │                          ▼
   │                              │                       LTO-5 tape
   │                              │           (read back to SSD)
   │                              │◄─────────────────────────┤
   │                       verify-post:                      │
   │                         par2 verify                     │
   │                         hash readback bytes             │
   │                         decrypt + sample/full compare   │
   │                              │                          │
   │ catalog ◄────────────────────┤                          │

Each tape is self-describing: it carries the encrypted archive, par2 recovery files, an encrypted per-chunk manifest, plaintext SHA-256 checksums for the archive files themselves, and a plaintext README with restoration instructions usable in 10 years with nothing but 7-Zip and par2cmdline.

Usage

A typical cycle:

# One-time per cycle: set up state directory
mkdir -p ~/tapetools/cycle-2026
cd ~/tapetools/cycle-2026
echo 'your-strong-passphrase' > .passphrase && chmod 600 .passphrase

# Build the binary
cd /path/to/tapetools && make build && make gentree

# Hash everything (~16 hours on 8 TB over GbE)
tapetools --state-dir ~/tapetools/cycle-2026 scan /mnt/synology/docs

# Plan chunk boundaries (instant)
tapetools --state-dir ~/tapetools/cycle-2026 split

# Archive + verify-pre all pending chunks (overnight job)
tapetools --state-dir ~/tapetools/cycle-2026 all \
  --output-dir /mnt/ssd/cycle-2026 \
  --cycle-id cycle-2026

# Per tape: write via Windows + LTFS, then read back to SSD
tapetools --state-dir ~/tapetools/cycle-2026 verify-post N \
  --from /mnt/ssd/readback/chunk_NN --mode smoke
tapetools --state-dir ~/tapetools/cycle-2026 register N

# Annual audit, per tape pulled from storage
tapetools --state-dir ~/tapetools/cycle-2026 audit N \
  --from /mnt/ssd/audit-readback

Full command reference: tapetools --help.

Build

Requires Go 1.22+, 7z (p7zip-full on Linux), par2cmdline.

make build          # ./bin/tapetools
make gentree        # ./bin/gentree (synthetic-tree generator for tests)
make build-all      # cross-compile for linux/amd64 and windows/amd64
make test           # all packages
make test-property  # 10-iteration random-tree roundtrip

Restoration without tapetools

The tool is an orchestrator. Tapes do not depend on the binary — every chunk includes a README.txt with full instructions using only 7-Zip and par2cmdline. See docs/superpowers/specs/2026-05-15-tapetools-lto-archival-design.md §8 for procedures.

Documentation

• Design spec: docs/superpowers/specs/2026-05-15-tapetools-lto-archival-design.md — architecture, cryptography, verification protocol, restoration procedures, long-term considerations
• Implementation plan: docs/superpowers/plans/2026-05-15-tapetools-implementation.md — 38 TDD tasks, exact file structure, test scenarios
• Tape acceptance procedure: docs/manual/tape-acceptance-test.md — one-time manual validation before trusting production data