[PATCH proxmox-backup] fix #7878: reuse manifest on non-encrypting push with matching key

[PATCH proxmox-backup] fix #7878: reuse manifest on non-encrypting push with matching key

[Christian Ebner]

This fixes a regression for push sync jobs with pre-encrypted
snapshots no longer reusing chunks, even if the previous backup
snapshot was encrypted using the same key.

Previous to commit bb3a5fdfc ("sync: push: gracefully handle previous
manifest signature mismatches") the it was possible to reuse the
manifest of a previous backup snapshot even if not matched by the
key fingerprint. The newly introduced check restricted this, did
however not take into account that for pre-encrypted snapshots the
crypt config on the push is not present, therefore acting like a
regular (non-encrypting) push. In that case, there is no encryption
key with matching fingerprint to check, so the job did not allow to
reuse chunks from that manifest, resulting in prolonged sync runs.

Fix this by also checking the source manifest fingerprint against the
previous snapshot manifest if no server side key is being used and
allow re-using chunks if they did match.

Fixes: bb3a5fdfc ("sync: push: gracefully handle previous manifest signature mismatches")
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/server/push.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/server/push.rs b/src/server/push.rs
index 5cc794a68..18f8a6f0f 100644
--- a/src/server/push.rs
+++ b/src/server/push.rs
@@ -1144,6 +1144,18 @@ pub(crate) async fn push_snapshot(
                     if signed_only {
                         return Ok(Arc::new(manifest));
                     }
+
+                    // allow reuse for client side encrypted snapshots with matching key
+                    if let Some(source_key_fp) = source_manifest
+                        .fingerprint()
+                        .context("failed getting fingerprint on source")?
+                    {
+                        if manifest_key_fp == source_key_fp {
+                            return Ok(Arc::new(manifest));
+                        }
+                        bail!("previous snapshot encrypted using different key");
+                    };
+
                     bail!("previous snapshot encrypted but no encryption key configured");
                 };
 
-- 
2.47.3

applied: [PATCH proxmox-backup] fix #7878: reuse manifest on non-encrypting push with matching key

[Fabian Grünbichler]

On Mon, 03 Aug 2026 12:24:57 +0200, Christian Ebner wrote:
> This fixes a regression for push sync jobs with pre-encrypted
> snapshots no longer reusing chunks, even if the previous backup
> snapshot was encrypted using the same key.
> 
> Previous to commit bb3a5fdfc ("sync: push: gracefully handle previous
> manifest signature mismatches") the it was possible to reuse the
> manifest of a previous backup snapshot even if not matched by the
> key fingerprint. The newly introduced check restricted this, did
> however not take into account that for pre-encrypted snapshots the
> crypt config on the push is not present, therefore acting like a
> regular (non-encrypting) push. In that case, there is no encryption
> key with matching fingerprint to check, so the job did not allow to
> reuse chunks from that manifest, resulting in prolonged sync runs.
> 
> [...]

Applied, thanks for the fast fix!

[1/1] fix #7878: reuse manifest on non-encrypting push with matching key
      commit: d42f77babadedafaec66dcca680ceca91e8dd389

Best regards,
-- 
Fabian Grünbichler <f.gruenbichler@proxmox.com>