Re: [PATCH proxmox-backup v2 12/27] api: config: allow encryption key manipulation for sync job

Thomas Lamprecht
2026-04-11T08:51:39Z

Am 10.04.26 um 18:54 schrieb Christian Ebner:
> diff --git a/src/api2/config/sync.rs b/src/api2/config/sync.rs
> @@ -490,6 +511,16 @@ pub fn update_sync_job(
>
> + DeletableProperty::ActiveEncryptionKey => {
> + allow_remove_associated = data.active_encryption_key.is_none();
> + keep_previous_key_as_associated(&data, &mut update.associated_key);
> + data.active_encryption_key = None;
> + }
> + DeletableProperty::AssociatedKey => {
> + if allow_remove_associated {
> + data.associated_key = None;
> + }
> + }

nit: the silent drop of AssociatedKey deletion when ActiveEncryptionKey is also
being deleted in the same request could trip people up. At least worth a code
comment explaining the rationale.

btw/nit: nice idea that the previous active key gets auto-promoted to
associated on rotation, but the user receives zero feedback about that - maybe
log it so users can more easily see what happened.