[PATCH proxmox-backup 2/2] fix #6990: server: drop verify state on push job

[Jakob Klocker <j.klocker@proxmox.com>]

When pushing a snapshot the target manifest is recreated from the source
manifest, copying its verify_state. As with pull, this makes the pushed
snapshot appear verified on the remote without its stored copy having
been checked there.
Strip verify_state after copying the unprotected section so the pushed
snapshot is verified independently on the target.

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=6990

Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
---
 src/server/push.rs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/server/push.rs b/src/server/push.rs
index 7b3cac4cd..92d32bceb 100644
--- a/src/server/push.rs
+++ b/src/server/push.rs
@@ -1364,6 +1364,12 @@ pub(crate) async fn push_snapshot(
     // Rewrite manifest for pushed snapshot, recreating manifest from source on target,
     // needs to update all relevant info for new manifest.
     target_manifest.unprotected = source_manifest.unprotected.clone();
+
+    if let Some(unprotected) = target_manifest.unprotected.as_object_mut() {
+        unprotected.remove("verify_state");
+    } else {
+        bail!("Encountered unexpected manifest without 'unprotected' section.");
+    }
     let manifest_string = if let Some((_id, crypt_config)) = &encrypt_using_key {
         let sync_source_signature = source_manifest.signature(crypt_config)?;
         target_manifest.set_sync_source_signature(&sync_source_signature)?;
-- 
2.47.3