3-2-1 (rule) — Three copies, on two different media, one of them offsite. Vault tracks it through the T1, T2 and T3 tiers of storage media.
AES-256-GCM — Authenticated encryption algorithm used for encrypted archives: it prevents reading the content without the key and detects any modification.
Altered — State of a file read in full whose fingerprint is no longer the one from the import.
.obf archive — Package holding the whole folder of a project (compressed, optionally encrypted), its manifest and its signature. Obscura Flow 2.0.8 format.
Incremental archive — Revision holding only the files changed since a previous revision. Vault creates them on request (Incremental at creation, see Incremental revisions), and reads, verifies and restores them with their whole chain of revisions (Obscura Flow’s included).
Fixity audit — Complete re-reading of the files of the library or of a project, and comparison of each fingerprint with the one from the import.
Library — The folder where Vault keeps its database, archives, backups and certificates.
Preservation certificate — Signed PDF/A document that attests the state of an archive or a file at a given date.
Trusted key — Public key of another installation (Obscura Flow, another Mac) whose archive signatures Vault accepts.
Offsite destination — S3 or compatible storage, or remote folder, where Vault copies archives.
Ed25519 — Digital signature algorithm used for archives and certificates.
Fingerprint (SHA-256) — String of 64 characters computed from a file’s content. The slightest change to the content changes the fingerprint.
Issuer — The one who attests in a certificate: their name is printed and signed.
Fixity — The fact that a file has not changed. The fixity journal keeps every check.
RFC 3161 timestamp — Token issued by a timestamp authority, attesting that a signature existed at a given date.
Never Checked — State of a file for which no check is recorded.
Audit log — Dated list of the actions performed on the library.
Preservation journal — The history of a project: imports, archives, verifications, restores, certificates.
Manifest — Signed inventory of an archive (manifest.json) or of a certificate: it lists what is attested and the fingerprints.
Failed — Verdict of an archive that was read and whose signature or fingerprint does not match.
Unverifiable — Nothing could be proven: file or archive not found, or unreadable. Neither good nor bad.
Catalog package — Folder (or ZIP archive) written by Obscura Catalog to hand a library over to Vault: its backup, its export and the list of its originals by fingerprint. See Receive a Catalog package.
PDF/A — Variant of PDF intended for long-term archiving. Certificates are PDF/A-2b.
Project — A folder on your disk that Vault preserves, with the fingerprint of each of its files.
Rescan — Re-reading a project’s folder to add new files and report those that changed or disappeared.
Reissue — Issuing a new version of a certificate, under the same number.
Revision — Each archive of the same project: v1, v2…
Revoke — Declaring that a certificate must no longer be trusted, with a reason.
Storage medium — Disk, tape, NAS or online space holding copies, with its commissioning date and replacement deadline.
Keychain — The macOS vault where Vault keeps its keys and access keys.
Verified — State of a file read in full whose fingerprint is the one from the import; verdict of an archive whose signature and content fingerprint match. An archive, an offsite copy or a copy on a medium is said to be verified. It is Vault’s only word for this verdict: not “intact”, “sound” or “matching”.