Backup

Backup writes the whole of the space you are in into a single .zip file.

Fields

Field	Description
Project	All Projects, or one project
Passphrase	The passphrase the file’s integrity stamp is derived from — required

There is nothing to select, by design

A backup includes every data type. No type selection is offered: a backup is a picture of a whole installation, optionally narrowed to one project. When you need only certain types, use Bulk Edit → Export.

The reason is what the signature means. With a type selection, the signature would say “whatever was asked for” rather than “this installation”.

A backup is not limited by your row access

The work runs as the system user, not under your own access restrictions. That is deliberate: it used to run in the taking user’s own security context, so rows restricted to an access group that user was not in never reached the file — and the short file was then signed as though it were whole. Two operators of the same installation could produce two different, both validly signed, backups, and the one missing a device said so nowhere.

This is why a backup is gated by one permission (EXPORT_METADATA) which passes the per-type authorities by: a backup missing a type is no more restorable than one missing a row.

The one thing a backup does not carry is deleted records: a deleted row is not part of the installation.

The passphrase

The passphrase derives the file’s integrity stamp (HMAC). The same passphrase is asked for on restore, and a wrong passphrase fails exactly as a modified file does — because neither can answer the same question: was this file produced from that passphrase, and has it been untouched since?

Lose the passphrase and the backup is useless

The passphrase is stored nowhere. Without it the backup cannot be restored, on this machine or any other. Keep it somewhere other than where you keep the backup.

On an installation that requires electronic signatures, a signature password is asked for as well. That is a different secret from the archive’s: one opens the file, the other names the person who performed the act.

Do not touch the file

The downloaded .zip is integrity-protected. Taking something out of it, adding something, or recompressing it makes it unrestorable — the restore notices and refuses it.

Related

• Restore — writing the file back
• Bulk Edit → Export — exporting selected types
• Backup (operations) — the secret bundle and the master key