backupcheck

DORA Art. 12 restore-test runner — extract / validate / log / jfind

v1.0.0

NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install backupcheck

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- backupcheck

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

backupcheck --help                # subcommand catalogue + flags
backupcheck --full                # extended help across every subcommand
backupcheck --about               # machine-readable attribution (JSON)
backupcheck --version             # version string

What it does

backupcheck automates the DORA Art. 12 / NIS2 Art. 21(2)(c) restore test: extract a backup archive (tar / tar.gz / zip), optionally run an operator-supplied validator command against the extraction, append the verdict + metadata to a JSONL audit log under $XDG_DATA_HOME/cli-johlem/backupcheck/runs.jsonl. Five subcommands: test (extract + validator), verify (extract-only smoke), list (recent runs), report (jfind/v1 export with --since window), schedule (print systemd-timer / cron template). Validator runs `sh -c <cmd>` with $BACKUPCHECK_DIR=<extract-dir>; exit 0 → pass, anything else → fail. No validator → skipped verdict. Refuses tar-slip / zip-slip (`..` or absolute paths). jfind/v1: asset-inventory Info for pass, asset-inventory Low for skipped, ict-incident High for fail. Pre-fills DORA Art. 12 + NIS2 Art. 21(2)(c) + ISO/IEC 27001:2022 A.8.13. Suite app: blueteam. 2 unit + 12 integration tests; zero warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Compliance crosswalk

This table lists controls where backupcheck's output may form part of the evidence set presented to an assessor. It does not claim backupcheck alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/backupcheck/compliance.json

DORA — Digital Operational Resilience Act (Reg. 2022/2554)

Ref	Name	How	Coverage
`Art. 12`	Backup policies, restoration & recovery procedures + methods	restore-test subcommand executes DORA-mandated restore drills against a chosen backup; jfind output records success + drift.	evidences

NIS2 — NIS2 Directive (Dir. 2022/2555)

Ref	Name	How	Coverage
`Art. 21 §2(c)`	Business continuity, e.g. backup management + disaster recovery	Restore-drill evidence supports the NIS2 backup / recovery control.	evidences

ISO27001 — ISO/IEC 27001:2022

Ref	Name	How	Coverage
`A.8.13`	Information backup	Restore-drill evidence covers the backup-testing sub-control.	evidences

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.

manifest.json — pinned SHA-256 + .sig URL + SBOM URL per platform
johlem-release.pub — Ed25519 public key used by signify -V (fingerprint: 4532510f…6748, pinned in jcli verify)
CHANGELOG.md — semver-tagged release notes
Security contact: security@johlem.net