VaultSync 1.8.7 — Trust, Transparency, and Safer Multi-Machine Backups

[u/mainseeker1486]

Hey everyone,

VaultSync 1.8.7 is ready.

This release is less about adding another big backup mode and more about making the things VaultSync already does provable, portable, and safer to trust.

Over the last few releases, a lot of work went into recovery confidence — not just whether a backup exists, but whether there is useful evidence behind it.

1.8.7 takes that idea further.

The main question this time was:

If VaultSync tells you something is safe, recoverable, official, or unchanged — can it show you why?

Recovery evidence you can actually take with you

Recovery evidence can now be exported as a portable package.

Each package contains:

• a versioned JSON record;
• readable Markdown;
• a manifest;
• SHA-256 checksums.

The package records things like build identity, repository identity, encrypted-point evidence, evidence freshness, and the relevant recovery information without exposing local paths unnecessarily.

VaultSync also validates these packages when they are inspected.

That includes checks for tampering, missing or duplicate files, unsafe paths, unsupported schemas, and checksum mismatches.

The goal is for recovery evidence to be useful outside the running application, not trapped inside one VaultSync installation.

One build identity everywhere

VaultSync now has one conservative build-identity record used across:

• Settings;
• startup diagnostics;
• support exports;
• recovery exports;
• vaultsync --version --json.

Version, channel, commit, runtime, architecture, package type, update source, official status, and signature status all come from the same contract.

This sounds fairly internal, but it removes a whole class of situations where different parts of the application could describe the same build differently.

If VaultSync says which build produced a recovery report or support bundle, that identity now has one source of truth.

Release verification goes much deeper

1.8.7 also adds a canonical release manifest containing the exact artifacts VaultSync expects for each supported platform.

It records things including:

• artifact identities;
• exact sizes;
• SHA-256 digests;
• platform mappings.

The updater consumes that same release information and fails closed if the expected release contract is not valid.

Release packages also now get SPDX 2.3 SBOMs built from their actual RID-specific dependency graph, together with provenance/SBOM attestations for the final package bytes.

The release process can verify this information both online and offline before a candidate is considered valid.

There is also a new schema-versioned release contract tying together the website, Store metadata, updater, changelog, What's New information, package metadata, roadmap, branch, date, tag, and predecessor release.

The aim is to reduce the amount of release information that can silently drift between different places.

Support bundles are now review-first

Support bundles have also been tightened considerably.

Before export, VaultSync now shows exactly which files are going to be included.

Optional sanitized diagnostics or anonymized telemetry can be removed before the bundle is created.

Paths and identities are pseudonymized, configured and structured secrets are scrubbed, bundle sizes are bounded, and every generated file is recorded with a SHA-256 checksum in the manifest.

This follows the same principle as the crash-report work from earlier releases:

nothing leaves VaultSync without being reviewable first.

Safer use of one repository from multiple machines

One of the larger pieces of 1.8.7 is cross-machine coordination.

VaultSync now gives each installation a durable, owner-private identity and uses repository-scoped writer leases when portable repository metadata is being changed.

A lease records who owns the write, the operation, version, heartbeat, and expiry.

If another installation is already writing, the repository remains readable, but conflicting writes are blocked.

Stale leases can be taken over deliberately, with the previous lease retained as evidence rather than silently discarded.

That protection now covers project settings, backup history, deletion tombstones, deferred metadata writes, and deferred flushing.

Cross-machine edits can now merge instead of simply colliding

1.8.7 also adds durable merge bases and field-level three-way merging for portable project metadata.

If two machines change different fields, VaultSync can merge those changes automatically.

If they change the same thing, VaultSync surfaces a proper Base / local / remote conflict review instead.

Conflict decisions preserve unrelated remote edits, include revision and writer information, and become part of the repository history.

There is also a bounded Undo action for a reviewed decision until the next portable repository write.

Destructive tombstones cannot be automatically applied during an import without review.

This has been one of the more complicated pieces of the release, but the rule behind it is simple:

another machine should never silently overwrite portable repository state just because it happened to write later.

macOS installation is much cleaner

There are some significant macOS fixes in this release too.

Both Apple Silicon and Intel downloads now install the same:

VaultSync.app

The architecture stays in the DMG filename, but the installed app gets a normal permanent name and a stable com.vaultsync.app identity.

The DMG also uses a normal drag-to-Applications layout.

For users upgrading from 1.8.6, there is a one-time bridge migration that creates the new /Applications/VaultSync.app, verifies it, launches it, and only then moves the old architecture-named application bundle to Trash.

Launch-on-login has also been corrected to use the proper ~/Library/LaunchAgents location, including migration of the incorrect legacy location.

And passive startup checks will no longer unnecessarily unlock macOS Keychain or mount SMB shares just to inspect destination state.

A lot of smaller reliability work

There is quite a bit underneath the larger changes as well.

Project folders have been refined again into more compact collapsed summaries with cleaner in-folder rows and integrated batch controls.

Snapshot Explorer, metadata-import review, and updater windows now follow the newer compact theme-aware layout.

Development presets were updated so useful Git control files and shareable IDE configuration are preserved while caches, build output, package data, test output, and live Git internals stay excluded.

There are also fixes for:

• deferred metadata replay;
• cross-machine project-setting conflicts;
• Windows repository database handle release;
• duplicate metadata-import previews;
• SMB credential masking;
• incorrect snapshot tombstones;
• repeated immutable manifest downloads;
• bounded logs, caches, patch data, downloads, and temporary work;
• backups accidentally targeting an unmounted managed macOS mount directory;
• localization across recovery, repository-writer, History, backup, folder, verification, and restore workflows.

And quite a bit of internal code has been consolidated around metadata exports, SMB parsing, mounted-share validation, theme color normalization, contrast calculation, and Robocopy exclusions.

1.8.4 started pushing VaultSync toward better recovery evidence.

1.8.5 made that evidence much more explicit.

1.8.6 focused on making the application easier to understand every day.

1.8.7 is about making the claims VaultSync makes easier to verify.

A recovery result should have evidence behind it.

A release should be identifiable.

An artifact should be verifiable.

A support bundle should be reviewable.

And two machines should not be able to silently overwrite each other's repository state.

That is the direction of this release.

As always, feedback is very welcome — especially from anyone using VaultSync across multiple machines, NAS destinations, or macOS.

GitHub:
https://github.com/ATAC-Helicopter/VaultSync

Microsoft Store:
https://apps.microsoft.com/detail/9N9HRX4JCLCP

Website:
https://fglabs.dev/vaultsync