[PATCH proxmox-backup] sync: push: preserve sign-only and possibly future crypt-mode variants

[PATCH proxmox-backup] sync: push: preserve sign-only and possibly future crypt-mode variants

[Christian Ebner]

When adding a file to a manifest, the crypt mode of the file is one of
3 variants: None, SignOnly or Encrypt. For push sync jobs the
FileInfo::chunk_crypt_mode() was used if not doing server-side
encryption, which however reduces this to 2 variants (None and
Encrypt) only, no longer reflecting the correct mode for signed only
archives.

Fix this by actually using the crypt mode as specified in the source
manifest when adding the archive to the target manifest, keeping the
exception when doing server-side encryption.

Do not change the crypt mode for the source chunk readers, as these
must always reflect the one specified in the source manifest, but
pass in the original mode and let the chunk reader do the mapping
internally so this is not performed twice.

Reported-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/server/push.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/server/push.rs b/src/server/push.rs
index 18f8a6f0f..f634c6b84 100644
--- a/src/server/push.rs
+++ b/src/server/push.rs
@@ -1234,7 +1234,7 @@ pub(crate) async fn push_snapshot(
             let archive_prefix = format!("{prefix}/{archive_name}");
             let crypt_mode = match &encrypt_using_key {
                 Some(_) => CryptMode::Encrypt,
-                None => entry.chunk_crypt_mode(),
+                None => entry.crypt_mode,
             };
 
             load_previous_snapshot_known_chunks(
@@ -1291,7 +1291,7 @@ pub(crate) async fn push_snapshot(
                     let index =
                         DynamicIndexReader::open(&path).with_context(|| prefix.to_string())?;
                     let chunk_reader = reader
-                        .chunk_reader(None, entry.chunk_crypt_mode())
+                        .chunk_reader(None, entry.crypt_mode)
                         .context("failed to get chunk reader")?;
                     let upload_stats = push_index(
                         &archive_name,
@@ -1337,7 +1337,7 @@ pub(crate) async fn push_snapshot(
                     let index =
                         FixedIndexReader::open(&path).with_context(|| prefix.to_string())?;
                     let chunk_reader = reader
-                        .chunk_reader(None, entry.chunk_crypt_mode())
+                        .chunk_reader(None, entry.crypt_mode)
                         .context("failed to get chunk reader")
                         .with_context(|| archive_prefix.clone())?;
                     let size = index.index_bytes();
-- 
2.47.3

applied: [PATCH proxmox-backup] sync: push: preserve sign-only and possibly future crypt-mode variants

[Fabian Grünbichler]

On Mon, 03 Aug 2026 14:29:00 +0200, Christian Ebner wrote:
> When adding a file to a manifest, the crypt mode of the file is one of
> 3 variants: None, SignOnly or Encrypt. For push sync jobs the
> FileInfo::chunk_crypt_mode() was used if not doing server-side
> encryption, which however reduces this to 2 variants (None and
> Encrypt) only, no longer reflecting the correct mode for signed only
> archives.
> 
> [...]

Applied with two small follow-ups to make the handling of crypt mode a bit
easier to read/follow along, thanks!

[1/1] sync: push: preserve sign-only and possibly future crypt-mode variants
      commit: 52c73fb3ad71ad99f6f58ca8c747e0defc068766

Best regards,
-- 
Fabian Grünbichler <f.gruenbichler@proxmox.com>