Backup And Restore Concept

Trustpoint backups are intentionally split into two artifacts:

  • the database payload, currently the PostgreSQL dump produced by django-dbbackup/trustpointbackup as .dump.gz;

  • a manifest sidecar named <backup>.manifest.json.

The payload remains compatible with the existing dbrestore command. The manifest records the Trustpoint version, database engine, active crypto backend kind, active app-secret backend kind, payload format, creation timestamp, and a SHA-256 digest of the exact payload bytes.

Restore Contract

Restore always restores the database payload first. When a manifest sidecar is available, it must verify before restore proceeds:

  • the manifest version is supported;

  • the backup payload exists;

  • the manifest contains a payload SHA-256 digest;

  • the digest matches the payload bytes.

The setup wizard can still accept raw PostgreSQL dumps for compatibility, but Trustpoint-created backups should include the sidecar. CI verifies the manifest before restoring the payload.

Out Of Scope

The sidecar does not encrypt the backup. Password-protected backup archives are handled separately by the restore wizard’s GPG decrypt path. Future backup packages may bundle the payload and manifest into a single archive, but the sidecar format keeps the current dbbackup/dbrestore workflow stable.