Re: [PATCH proxmox-backup v3 19/30] fix #7251: api: push: encrypt snapshots using configured encryption key

Michael Köppl
2026-04-15T14:49:38Z

On Tue Apr 14, 2026 at 2:59 PM CEST, Christian Ebner wrote:

[snip]

> let mut encrypt_using_key = None;
> + if params.crypt_config.is_some() {
> + // Check if snapshot is fully encrypted or not encrypted at all:
> + // refuse progress otherwise to upload partially unencrypted contents or mix encryption key.
> + let files = source_manifest.files();
> + let all_unencrypted = files
> + .iter()
> + .all(|f| f.chunk_crypt_mode() == CryptMode::None);
> + let any_unencrypted = files
> + .iter()
> + .any(|f| f.chunk_crypt_mode() == CryptMode::None);
> +
> + if all_unencrypted {
> + encrypt_using_key = params.crypt_config.clone();
> + info!("Encrypt and push unencrypted snapshot '{snapshot}'");

nit: Might just be me, but to me this reads like it would encrypt the
snapshot and then just push the unencrypted one. Perhaps something like
"Encrypt and push previously unencrypted snapshot"?

> + } else if any_unencrypted {
> + warn!("Encountered partially encrypted snapshot '{snapshot}', refuse to re-encrypt and skip");
> + return Ok(stats);
> + } else {
> + info!("Pushing already encrypted snapshot '{snapshot}' without re-encryption");
> + }
> + }

[snip]