[PATCH proxmox-backup 2/2] sync: push: gracefully handle previous manifest signature mismatches

[Christian Ebner <c.ebner@proxmox.com>]

During push sync jobs with a given active encryption key, the key is
loaded for the backup writer, used to encrypt the source snapshot on
the fly. As optimization, the backup writer deduplicates chunks
already present in the previous snapshot by loading them from the
index files.

If the previous backup snapshot in the same group (on the remote
target) is however encrypted or signed using a different key, the
signature check will fail, logging a rather alerting signature
mismatch, which is however benign.

Improve the logging behaviour by loading the manifest without
implicit signature check, check it on the call site and log
a more telling `Skip chunk deduplication from previous manifest`,
as that is the intended behaviour for this case.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/server/push.rs | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/server/push.rs b/src/server/push.rs
index dac62c84a..f4b68701d 100644
--- a/src/server/push.rs
+++ b/src/server/push.rs
@@ -1131,8 +1131,28 @@ pub(crate) async fn push_snapshot(
     let mut previous_manifest = None;
     // Use manifest of previous snapshots in group on target for chunk upload deduplication
     if fetch_previous_manifest {
-        match backup_writer.download_previous_manifest().await {
-            Ok(manifest) => previous_manifest = Some(Arc::new(manifest)),
+        match backup_writer
+            .download_previous_manifest_without_signature_check()
+            .await
+        {
+            Ok(manifest) => {
+                if let Some((_id, crypt_config)) = &encrypt_using_key {
+                    if manifest.check_signature(crypt_config).is_ok() {
+                        previous_manifest = Some(Arc::new(manifest));
+                    } else {
+                        log_sender
+                            .log(
+                                Level::INFO,
+                                format!(
+                                    "{prefix}: Skip chunk deduplication from previous manifest"
+                                ),
+                            )
+                            .await?
+                    }
+                } else {
+                    previous_manifest = Some(Arc::new(manifest));
+                }
+            }
             Err(err) => {
                 log_sender
                     .log(
-- 
2.47.3