Unofficial proxmox-backup-client packages for RPM, Arch, Alpine and Debian

Proxmox's own statically linked Proxmox Backup Server client, checked against Proxmox's signed index and republished, without recompiling, as signed packages for Fedora, RHEL, Rocky, Alma, Arch, Alpine, Debian and Ubuntu, on amd64 and arm64.

Unofficial repository, not affiliated with or endorsed by Proxmox Server Solutions GmbH. Proxmox is a registered trademark of Proxmox Server Solutions GmbH. The repository is run by RDEM Systems (NimbusBackup).

Repackaging only: the binaries are Proxmox's

This repository does not build, patch or fork the Proxmox Backup Server client. It only repackages Proxmox's own binaries for the distributions Proxmox does not ship packages for:

Download Proxmox's official, statically linked build (proxmox-backup-client-static) from download.proxmox.com, and check it against Proxmox's signed repository index.
Repackage that binary, unchanged, as RPM, Arch and APK packages. Debian and Ubuntu get Proxmox's .deb byte for byte.
Sign and deploy the packages on our own servers, as a repository your package manager can use.

No line of Proxmox code is changed or recompiled. The only thing our RPM, Arch and APK packages add is two certificate symlinks, explained below.

What the packages contain

proxmox-backup-client and pxar, with their man pages and their bash and zsh completions: the files of Proxmox's static package, as they are.

proxmox-file-restore is not included, for three reasons:

Proxmox publishes no static build of it. The official package is dynamically linked against libc6, libssl3, libzstd1, libacl1 and libuuid1. Those libraries exist neither on Alpine, which uses musl, nor on RHEL under the same sonames: the binary would not start.
Shipping it would mean compiling it. That would be a different project from this one, and it would break the only promise that matters here: the binary you install is Proxmox's, not ours.
It needs more than itself. Restoring a file from a VM disk image goes through a dedicated virtual machine: Proxmox's restore image (kernel and initramfs) and QEMU, neither of which is portable outside Debian. For a host backup, file-level restore is already covered by the client's catalog shell and restore --pattern.

If Proxmox ever publishes a static proxmox-file-restore in its client repository, we will package it like the rest, without recompiling it.

Current versions

The versions, checksums and signing key fingerprint of every package are listed in index.json. The pipeline checks Proxmox's repository every day; each new version is published once its installation tests pass.

Install

All repository metadata is signed. Never add --nogpgcheck or --allow-untrusted; compare the key fingerprint your package manager shows with the one above. Commands run as root.

Fedora, RHEL, Rocky, Alma (dnf)

dnf

curl -fsSL -o /etc/yum.repos.d/unofficial-repository-proxmox-backup-client.repo \
  https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/rpm/unofficial-repository-proxmox-backup-client.repo
dnf install proxmox-backup-client

Arch Linux (pacman)

pacman

curl -fsSL -o /tmp/upc.asc https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/keys/unofficial-repository-proxmox-backup-client.asc
gpg --show-keys /tmp/upc.asc      # compare with the fingerprint above
pacman-key --add /tmp/upc.asc
pacman-key --lsign-key "$(gpg --with-colons --show-keys /tmp/upc.asc | awk -F: '/^fpr:/{print $10; exit}')"
printf '\n[unofficial-repository-proxmox-backup-client]\nServer = https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/arch/$arch\n' >> /etc/pacman.conf
pacman -Syu proxmox-backup-client

Alpine (apk)

apk

wget -O /etc/apk/keys/unofficial-repository-proxmox-backup-client.rsa.pub \
  https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/keys/unofficial-repository-proxmox-backup-client.rsa.pub
echo "https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/alpine" >> /etc/apk/repositories
apk add proxmox-backup-client

Debian, Ubuntu (apt)

The apt repository serves Proxmox's .deb unmodified (same SHA256 as upstream). On Debian, Proxmox's own pbs-client repository is the official alternative.

apt

install -d /etc/apt/keyrings
curl -fsSL -o /etc/apt/keyrings/unofficial-repository-proxmox-backup-client.asc https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/keys/unofficial-repository-proxmox-backup-client.asc
echo "deb [signed-by=/etc/apt/keyrings/unofficial-repository-proxmox-backup-client.asc] https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/deb stable main" \
  > /etc/apt/sources.list.d/unofficial-repository-proxmox-backup-client.list
apt update && apt install proxmox-backup-client-static

Manual variant, without downloading our configuration file

The commands above write a repository file downloaded from us. If you would rather fetch only the key, check its fingerprint and write the configuration yourself, here is the exact equivalent. The repository is then declared with a local key: no configuration file is pulled from our servers at all.

1. the key, checked before it is installed (RPM, pacman, apt)

curl -fsSL -o upc.asc https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/keys/unofficial-repository-proxmox-backup-client.asc
gpg --show-keys --with-fingerprint upc.asc
# must print: 827D EFD8 FDAD 5EE6 4080  5C30 904E B81A 1243 150F

2a. dnf — local key, .repo file written by hand

install -Dm644 upc.asc /etc/pki/rpm-gpg/RPM-GPG-KEY-unofficial-repository-proxmox-backup-client
cat > /etc/yum.repos.d/unofficial-repository-proxmox-backup-client.repo <<'EOF'
[unofficial-repository-proxmox-backup-client]
name=Unofficial proxmox-backup-client (RDEM Systems)
baseurl=https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/rpm/$basearch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-unofficial-repository-proxmox-backup-client
EOF
dnf install proxmox-backup-client

2b. apt — deb822 format, local key

install -Dm644 upc.asc /etc/apt/keyrings/unofficial-repository-proxmox-backup-client.asc
cat > /etc/apt/sources.list.d/unofficial-repository-proxmox-backup-client.sources <<'EOF'
Types: deb
URIs: https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/deb
Suites: stable
Components: main
Signed-By: /etc/apt/keyrings/unofficial-repository-proxmox-backup-client.asc
EOF
apt update && apt install proxmox-backup-client-static

2c. pacman — block to append to /etc/pacman.conf

pacman-key --add upc.asc
pacman-key --lsign-key 827DEFD8FDAD5EE640805C30904EB81A1243150F

# then, at the end of /etc/pacman.conf:
[unofficial-repository-proxmox-backup-client]
SigLevel = Required DatabaseRequired
Server = https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/arch/$arch

2d. apk — the APK key is an RSA key, checked by its SHA256

wget -O upc.rsa.pub https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/keys/unofficial-repository-proxmox-backup-client.rsa.pub
sha256sum upc.rsa.pub        # compare with keys/FINGERPRINTS.txt
install -Dm644 upc.rsa.pub /etc/apk/keys/unofficial-repository-proxmox-backup-client.rsa.pub

# then, at the end of /etc/apk/repositories:
https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/alpine

Then connect it to a Proxmox Backup Server, encrypt, schedule and restore: step-by-step guide.

Proxmox does not ship a Windows client either. We maintain a graphical client for Windows, whose code went upstream to tizbac, the author of the original Go client — and is published on GitHub.

Why a repository, and not a binary dropped on the server

The advice to download the static binary and copy it into /usr/local/bin gets around a lot. It works on day one, and that is the whole problem: the binary leaves patch management. A package, on the other hand:

is upgraded with the rest of the machine, by dnf upgrade or apt upgrade;
shows up in the inventory — rpm -q, dpkg -l, apk info -v and pacman -Qi answer "which version runs here";
can be checked after installation (rpm -V) and uninstalls cleanly, certificate symlinks included.

Proxmox ships roughly one release a month. A hand-copied binary quickly becomes the oldest piece of software on the estate, and the one nobody can locate on audit day.

Keeping this repository, signing it, testing it in 27 containers and following upstream every day costs us time — far more than publishing a download link. That is a choice: your backup client should be managed like the rest of your servers.

The one change we make

The static binary was built with Debian's OpenSSL directory, /usr/lib/ssl, compiled in. Outside Debian and Ubuntu that directory does not exist, so the client rejects valid certificates and asks for a fingerprint: certificate validation failed - Certificate fingerprint was not confirmed. We reproduced it on Alpine 3.24 and Fedora 43.

Our RPM, Arch and Alpine packages therefore add two symlinks, /usr/lib/ssl/cert.pem and /usr/lib/ssl/certs, pointing to the distribution's CA bundle. Only those two: linking the whole directory would also make the static OpenSSL read the distribution's openssl.cnf. Binaries, man pages and shell completions are the upstream files. The .deb files are served unmodified.

Provenance and verification

Proxmox's InRelease is verified against a pinned copy of Proxmox's archive keyring.
The Packages index is checked against the SHA256 listed in that signed file.
Each .deb is checked against the SHA256 and size listed in Packages, then unpacked.
Packages are built with nfpm and signed. The amd64 packages are installed from the signed repository in 27 containers — CentOS 7, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Fedora 42/43/44, Arch, Alpine 3.20 to 3.24, Debian 10 to 13, testing and sid, Ubuntu 20.04, 22.04, 24.04, 25.10 and 26.04 (every supported release, plus at least the last one out of support) — and a release is published, by hand, only once those tests pass. The arm64 packages are built and signed the same way but not install-tested yet.

Our CI runs on our Proxmox infrastructure, and we had to change one setting to create this repository. If you want other distributions, let us know, and tell us why.

index.json records, for every file, the upstream version, the Proxmox component it comes from, the SHA256 of the upstream .deb and the SHA256 of our package. SHA256SUMS, signed with the same key (SHA256SUMS.asc), covers every file of the release: our web server checks it before serving a new release.

We are not the first

Other unofficial packaging efforts came before this one, maintained on volunteered time, and they deserve the credit:

pbs-client by Ciro Iriarte, built on the openSUSE Build Service: it rebuilds the client from source for openSUSE, Rocky Linux, Ubuntu and Debian, and also packages pxar and proxmox-file-restore. The opposite approach to ours, which recompiles nothing — and a complementary one, since it covers openSUSE and we do not.
The AUR for Arch Linux, and several COPR projects for Fedora and RHEL.

What we do differently: the upstream check is daily and automated, every version passes the install tests before it is published, and the metadata is signed. On 16 September 2026, upstream was at 4.2.5-1 while the AUR and COPR packages listed above sat between 4.0.16 and 4.2.2. That is a dated observation, not a criticism: following an upstream that ships a release a month takes an automated pipeline, and that is exactly what we built.

Source code and licenses

proxmox-backup-client: Copyright Proxmox Server Solutions GmbH, GNU AGPL v3 or later. Every release publishes, under source/, a zip of Proxmox's source at the commit "bump version to X" the binary was built from. Upstream: git.proxmox.com.
Build scripts and pipeline: MIT, github.com/rdemsystems/unofficial-proxmox-backup-client.
arm64: Proxmox publishes its official aarch64 static build in the test component of its client repository. We package that build as is, and label it.

Found a problem, or a security issue with the repository? Contact us.

Your client is installed. It needs an offsite target.

NimbusBackup runs managed Proxmox Backup Servers, billed per usable TB, with a token that cannot delete, so a stolen machine cannot delete its own backups itself.

A full use case, tested with this client: backing up MariaDB to Proxmox Backup Server (dumps, binlogs, point-in-time recovery).

Managed PBS plans

Not sure about the volume or the level of protection yet? Choose my backup asks a few questions and points you at the matching plan.