recreate: do not recreate protected archives

src/borg/archiver/recreate_cmd.py

@@ -37,8 +37,9 @@ def do_recreate(self, args, repository, manifest, cache):
             dry_run=args.dry_run,
             timestamp=args.timestamp,
         )
-
-        for archive_info in manifest.archives.list_considering(args):
+        archive_infos = manifest.archives.list_considering(args)
+        archive_infos = [ai for ai in archive_infos if "@PROT" not in ai.tags]
+        for archive_info in archive_infos:
             if recreater.is_temporary_archive(archive_info.name):
                 continue
             name, hex_id = archive_info.name, bin_to_hex(archive_info.id)

src/borg/testsuite/archiver/recreate_cmd_test.py

@@ -274,3 +274,18 @@ def test_comment(archivers, request):
     assert "Comment: modified comment" in cmd(archiver, "info", "-a", "test2")
     assert "Comment: " + os.linesep in cmd(archiver, "info", "-a", "test3")
     assert "Comment: preserved comment" in cmd(archiver, "info", "-a", "test4")
+
+
+def test_recreate_ignore_protected(archivers, request):
+    archiver = request.getfixturevalue(archivers)
+    create_test_files(archiver.input_path)
+    create_regular_file(archiver.input_path, "file1", size=1024)
+    create_regular_file(archiver.input_path, "file2", size=1024)
+    cmd(archiver, "repo-create", RK_ENCRYPTION)
+    cmd(archiver, "create", "archive", "input")
+    cmd(archiver, "tag", "--add=@PROT", "archive")
+    cmd(archiver, "recreate", "archive", "-e", "input")  # this would normally remove all from archive
+    listing = cmd(archiver, "list", "archive", "--short")
+    # archive was protected, so recreate ignored it:
+    assert "file1" in listing
+    assert "file2" in listing