# Archives and recovery

An Open Print archive is one portable JSON file containing:

- public issuer records;
- signed certificates;
- the complete registry event chain;
- signed registry checkpoints;
- a digest covering the complete archive contents.

Private signing keys are never part of the archive.

## Verify before copying

```bash
open-print-archive verify ./open-print-archive.json
```

Verification checks the archive digest, record schemas, certificate signatures,
event chain, issuer keys, checkpoint chain, and the links between certificates
and their issuance events.

## Restore

```bash
open-print-archive restore \
  ./open-print-archive.json \
  ./restored-open-print
```

Restore writes the complete archive plus separate `issuers`, `certificates`,
`checkpoints`, and `registry.json` paths. It verifies the restored archive
before making the directory visible and refuses to overwrite an existing
target.

The resulting directory is intentionally simple enough to inspect, copy to
offline media, or commit to a private preservation repository.

## Backup routine

Keep more than one dated archive copy and periodically test a restore in a
clean directory. Store at least one copy separately from the machine that runs
issuance.

Back up private keys through the protected key procedure described in
`KEY_MANAGEMENT.md`, never by adding them to an issuer archive. Public records
and private signing material should not share the same backup policy.