Re: [PATCH proxmox-backup v3 19/30] fix #7251: api: push: encrypt snapshots using configured encryption key

Christian Ebner
2026-04-15T15:25:21Z

On 4/15/26 4:47 PM, Michael Köppl wrote:
> On Tue Apr 14, 2026 at 2:59 PM CEST, Christian Ebner wrote:
>
> [snip]
>
>> let mut encrypt_using_key = None;
>> + if params.crypt_config.is_some() {
>> + // Check if snapshot is fully encrypted or not encrypted at all:
>> + // refuse progress otherwise to upload partially unencrypted contents or mix encryption key.
>> + let files = source_manifest.files();
>> + let all_unencrypted = files
>> + .iter()
>> + .all(|f| f.chunk_crypt_mode() == CryptMode::None);
>> + let any_unencrypted = files
>> + .iter()
>> + .any(|f| f.chunk_crypt_mode() == CryptMode::None);
>> +
>> + if all_unencrypted {
>> + encrypt_using_key = params.crypt_config.clone();
>> + info!("Encrypt and push unencrypted snapshot '{snapshot}'");
>
> nit: Might just be me, but to me this reads like it would encrypt the
> snapshot and then just push the unencrypted one. Perhaps something like
> "Encrypt and push previously unencrypted snapshot"?

True, now that you mention it I cannot unsee it. But maybe even better:
"Encrypt source snapshot '{}' on the fly while pushing to remote"?

>
>> + } else if any_unencrypted {
>> + warn!("Encountered partially encrypted snapshot '{snapshot}', refuse to re-encrypt and skip");
>> + return Ok(stats);
>> + } else {
>> + info!("Pushing already encrypted snapshot '{snapshot}' without re-encryption");
>> + }
>> + }
>
> [snip]