How can Dart applications validate backup integrity before restoration?

Answer to the question

To guarantee that a backup can be safely restored, a Dart application should compute a cryptographic hash of the backup artifact and compare it against a pre‑stored checksum. Only if the digests match should the restoration proceed.

Confirmed facts

• The crypto package ships with a SHA‑256 implementation that works on all Dart platforms.
• For VM‑based targets (dart:io), files can be streamed with File.openRead() to avoid loading the entire backup into memory.
• On web or WASM, dart:io isn’t available; use dart:html or a cross‑platform library such as universal_io to read the file as a Uint8List.
• Storing the expected hash in a signed manifest (JSON, YAML, or a tiny database entry) is the safest approach; hard‑coding it in source code is discouraged.

Likely explanation

• Backups may be compressed or split across multiple files. In that case each component should be hashed separately, or the archive should be decompressed first before hashing the extracted content.
• Using a simple CRC32 or file size check is insufficient because it can miss silent corruption.

Step‑by‑step procedure for Dart VM / Flutter desktop

1. Read the backup file as a stream:

   final stream = File(backupPath).openRead();

2. Pipe the stream through a SHA‑256 sink:

   import 'package:crypto/crypto.dart';
   final digest = await stream.transform(sha256).first;
   final computedHash = digest.toString();

3. Retrieve the expected hash from a manifest file or CI/CD artifact store.

   final expected = await File(manifestPath).readAsString();

4. Compare the digests:

   if (computedHash != expected.trim()) {
     throw Exception('Backup integrity check failed');
   }

5. Proceed with restoration only if the hashes match.

Cross‑platform adaptation (JavaScript / WASM)

• Use dart:html's FileReader to read the file into a Uint8List and then hash it with crypto.
• Alternatively, use universal_io to abstract the file system; it falls back to dart:html on the web.

Verification in CI

1. During a CI build, generate the backup and compute its SHA‑256; store the digest in the artifact metadata.
2. When the restore job runs, fetch the artifact, compute its hash, and compare against the stored value.
3. Fail the job if the digests diverge, ensuring that only intact backups are promoted to production.

Diagnostic question

Do you have a manifest that lists checksums for each backup component, or is the checksum stored externally (e.g., in a database or CI/CD pipeline)? This will determine whether you read the expected hash from a file or query an external service.