From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 327DC1FF13F for ; Thu, 07 May 2026 15:02:09 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 68A0D1B871; Thu, 7 May 2026 15:02:07 +0200 (CEST) From: Christian Ebner To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup v2 4/5] client: allow skipping signature check on previous manifest fetching Date: Thu, 7 May 2026 15:01:34 +0200 Message-ID: <20260507130135.589100-5-c.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260507130135.589100-1-c.ebner@proxmox.com> References: <20260507130135.589100-1-c.ebner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1778158810340 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.070 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 55HGRFOT7C6VWKIJ42FV7WGQPPOEQZXY X-Message-ID-Hash: 55HGRFOT7C6VWKIJ42FV7WGQPPOEQZXY X-MailFrom: c.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Extends the BackupWriter method to download the previous manifest from a PBS instance, by a flag which allows skipping the signature check even if the backup writer has a crypt_config set. Silences misleading logs during encrypting push sync jobs. Signed-off-by: Christian Ebner --- pbs-client/src/backup_writer.rs | 19 ++++++++++++++----- proxmox-backup-client/src/main.rs | 2 +- src/server/push.rs | 2 +- 3 files changed, 16 insertions(+), 7 deletions(-) diff --git a/pbs-client/src/backup_writer.rs b/pbs-client/src/backup_writer.rs index 47f08840e..b60d71d3f 100644 --- a/pbs-client/src/backup_writer.rs +++ b/pbs-client/src/backup_writer.rs @@ -735,8 +735,14 @@ impl BackupWriter { }) } - /// Download backup manifest (index.json) of last backup - pub async fn download_previous_manifest(&self) -> Result { + /// Download backup manifest (index.json) of last backup. + /// + /// If `check_signature` is set and the writer stores a crypt config, + /// also checks the manifest's signature. + pub async fn download_previous_manifest( + &self, + check_signature: bool, + ) -> Result { let mut raw_data = Vec::with_capacity(64 * 1024); let param = json!({ "archive-name": MANIFEST_BLOB_NAME.to_string() }); @@ -748,10 +754,13 @@ impl BackupWriter { // manifest blobs are never encrypted and no expected digest available let data = blob.decode(None, None)?; - let manifest = - BackupManifest::from_data(&data[..], self.crypt_config.as_ref().map(Arc::as_ref))?; + let crypt_config = if check_signature { + self.crypt_config.as_ref().map(Arc::as_ref) + } else { + None + }; - Ok(manifest) + BackupManifest::from_data(&data[..], crypt_config) } // We have no `self` here for `h2` and `verbose`, the only other arg "common" with 1 other diff --git a/proxmox-backup-client/src/main.rs b/proxmox-backup-client/src/main.rs index 5e8bb5393..c96db321f 100644 --- a/proxmox-backup-client/src/main.rs +++ b/proxmox-backup-client/src/main.rs @@ -1064,7 +1064,7 @@ async fn create_backup( }; let previous_manifest = if download_previous_manifest { - match client.download_previous_manifest().await { + match client.download_previous_manifest(true).await { Ok(previous_manifest) => { match previous_manifest.check_fingerprint(crypt_config.as_ref().map(Arc::as_ref)) { Ok(()) => Some(Arc::new(previous_manifest)), diff --git a/src/server/push.rs b/src/server/push.rs index dac62c84a..afa78b751 100644 --- a/src/server/push.rs +++ b/src/server/push.rs @@ -1131,7 +1131,7 @@ pub(crate) async fn push_snapshot( let mut previous_manifest = None; // Use manifest of previous snapshots in group on target for chunk upload deduplication if fetch_previous_manifest { - match backup_writer.download_previous_manifest().await { + match backup_writer.download_previous_manifest(false).await { Ok(manifest) => previous_manifest = Some(Arc::new(manifest)), Err(err) => { log_sender -- 2.47.3