[PATCH proxmox-backup] fix #7878: reuse manifest on non-encrypting push with matching key

[Christian Ebner <c.ebner@proxmox.com>]

This fixes a regression for push sync jobs with pre-encrypted
snapshots no longer reusing chunks, even if the previous backup
snapshot was encrypted using the same key.

Previous to commit bb3a5fdfc ("sync: push: gracefully handle previous
manifest signature mismatches") the it was possible to reuse the
manifest of a previous backup snapshot even if not matched by the
key fingerprint. The newly introduced check restricted this, did
however not take into account that for pre-encrypted snapshots the
crypt config on the push is not present, therefore acting like a
regular (non-encrypting) push. In that case, there is no encryption
key with matching fingerprint to check, so the job did not allow to
reuse chunks from that manifest, resulting in prolonged sync runs.

Fix this by also checking the source manifest fingerprint against the
previous snapshot manifest if no server side key is being used and
allow re-using chunks if they did match.

Fixes: bb3a5fdfc ("sync: push: gracefully handle previous manifest signature mismatches")
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/server/push.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/server/push.rs b/src/server/push.rs
index 5cc794a68..18f8a6f0f 100644
--- a/src/server/push.rs
+++ b/src/server/push.rs
@@ -1144,6 +1144,18 @@ pub(crate) async fn push_snapshot(
                     if signed_only {
                         return Ok(Arc::new(manifest));
                     }
+
+                    // allow reuse for client side encrypted snapshots with matching key
+                    if let Some(source_key_fp) = source_manifest
+                        .fingerprint()
+                        .context("failed getting fingerprint on source")?
+                    {
+                        if manifest_key_fp == source_key_fp {
+                            return Ok(Arc::new(manifest));
+                        }
+                        bail!("previous snapshot encrypted using different key");
+                    };
+
                     bail!("previous snapshot encrypted but no encryption key configured");
                 };
 
-- 
2.47.3