Unofficial proxmox-backup-client packages for RPM, Arch, Alpine and Debian

Proxmox's own statically linked Proxmox Backup Server client, checked against Proxmox's signed index and republished, without recompiling, as signed packages for Fedora, RHEL, Rocky, Alma, Arch, Alpine, Debian and Ubuntu, on amd64 and arm64.

Unofficial repository, not affiliated with or endorsed by Proxmox Server Solutions GmbH. Proxmox is a registered trademark of Proxmox Server Solutions GmbH. The repository is run by RDEM Systems (NimbusBackup).

Repackaging only: the binaries are Proxmox's

This repository does not build, patch or fork the Proxmox Backup Server client. It only repackages Proxmox's own binaries for the distributions Proxmox does not ship packages for:

Download Proxmox's official, statically linked build (proxmox-backup-client-static) from download.proxmox.com, and check it against Proxmox's signed repository index.
Repackage that binary, unchanged, as RPM, Arch and APK packages. Debian and Ubuntu get Proxmox's .deb byte for byte.
Sign and deploy the packages on our own servers, as a repository your package manager can use.

No line of Proxmox code is changed or recompiled. The only thing our RPM, Arch and APK packages add is two certificate symlinks, explained below.

Current versions

The versions, checksums and signing key fingerprint of every package are listed in index.json. The pipeline checks Proxmox's repository every day; each new version is published once its installation tests pass.

Install

All repository metadata is signed. Never add --nogpgcheck or --allow-untrusted; compare the key fingerprint your package manager shows with the one above. Commands run as root.

Fedora, RHEL, Rocky, Alma (dnf)

dnf

curl -fsSL -o /etc/yum.repos.d/unofficial-repository-proxmox-backup-client.repo \
  https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/rpm/unofficial-repository-proxmox-backup-client.repo
dnf install proxmox-backup-client

Arch Linux (pacman)

pacman

curl -fsSL -o /tmp/upc.asc https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/keys/unofficial-repository-proxmox-backup-client.asc
gpg --show-keys /tmp/upc.asc      # compare with the fingerprint above
pacman-key --add /tmp/upc.asc
pacman-key --lsign-key "$(gpg --with-colons --show-keys /tmp/upc.asc | awk -F: '/^fpr:/{print $10; exit}')"
printf '\n[unofficial-repository-proxmox-backup-client]\nServer = https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/arch/$arch\n' >> /etc/pacman.conf
pacman -Syu proxmox-backup-client

Alpine (apk)

apk

wget -O /etc/apk/keys/unofficial-repository-proxmox-backup-client.rsa.pub \
  https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/keys/unofficial-repository-proxmox-backup-client.rsa.pub
echo "https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/alpine" >> /etc/apk/repositories
apk add proxmox-backup-client

Debian, Ubuntu (apt)

The apt repository serves Proxmox's .deb unmodified (same SHA256 as upstream). On Debian, Proxmox's own pbs-client repository is the official alternative.

apt

install -d /etc/apt/keyrings
curl -fsSL -o /etc/apt/keyrings/unofficial-repository-proxmox-backup-client.asc https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/keys/unofficial-repository-proxmox-backup-client.asc
echo "deb [signed-by=/etc/apt/keyrings/unofficial-repository-proxmox-backup-client.asc] https://nimbus.rdem-systems.com/unofficial-repository-proxmox-backup-client/deb stable main" \
  > /etc/apt/sources.list.d/unofficial-repository-proxmox-backup-client.list
apt update && apt install proxmox-backup-client-static

Then connect it to a Proxmox Backup Server, encrypt, schedule and restore: step-by-step guide.

The one change we make

The static binary was built with Debian's OpenSSL directory, /usr/lib/ssl, compiled in. Outside Debian and Ubuntu that directory does not exist, so the client rejects valid certificates and asks for a fingerprint: certificate validation failed - Certificate fingerprint was not confirmed. We reproduced it on Alpine 3.24 and Fedora 43.

Our RPM, Arch and Alpine packages therefore add two symlinks, /usr/lib/ssl/cert.pem and /usr/lib/ssl/certs, pointing to the distribution's CA bundle. Only those two: linking the whole directory would also make the static OpenSSL read the distribution's openssl.cnf. Binaries, man pages and shell completions are the upstream files. The .deb files are served unmodified.

Provenance and verification

Proxmox's InRelease is verified against a pinned copy of Proxmox's archive keyring.
The Packages index is checked against the SHA256 listed in that signed file.
Each .deb is checked against the SHA256 and size listed in Packages, then unpacked.
Packages are built with nfpm and signed. The amd64 packages are installed from the signed repository in 27 containers — CentOS 7, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Fedora 42/43/44, Arch, Alpine 3.20 to 3.24, Debian 10 to 13, testing and sid, Ubuntu 20.04, 22.04, 24.04, 25.10 and 26.04 (every supported release, plus at least the last one out of support) — and a release is published, by hand, only once those tests pass. The arm64 packages are built and signed the same way but not install-tested yet.

Our CI runs on our Proxmox infrastructure, and we had to change one setting to create this repository. If you want other distributions, let us know, and tell us why.

index.json records, for every file, the upstream version, the Proxmox component it comes from, the SHA256 of the upstream .deb and the SHA256 of our package. SHA256SUMS, signed with the same key (SHA256SUMS.asc), covers every file of the release: our web server checks it before serving a new release.

Source code and licenses

proxmox-backup-client: Copyright Proxmox Server Solutions GmbH, GNU AGPL v3 or later. Every release publishes, under source/, a zip of Proxmox's source at the commit "bump version to X" the binary was built from. Upstream: git.proxmox.com.
Build scripts and pipeline: MIT, github.com/rdemsystems/unofficial-proxmox-backup-client.
arm64: Proxmox publishes its official aarch64 static build in the test component of its client repository. We package that build as is, and label it.

Found a problem, or a security issue with the repository? Contact us.

Your client is installed. It needs an offsite target.

NimbusBackup runs managed Proxmox Backup Servers, billed per usable TB, with a token that cannot delete, so a stolen machine cannot erase its own backups.

Managed PBS plans