From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 76F4B1FF0F0 for ; Mon, 03 Aug 2026 14:29:17 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 2671D21347; Mon, 03 Aug 2026 14:29:17 +0200 (CEST) From: Christian Ebner To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup] sync: push: preserve sign-only and possibly future crypt-mode variants Date: Mon, 3 Aug 2026 14:29:00 +0200 Message-ID: <20260803122900.547807-1-c.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1785760143199 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.127 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: B7DEXQZ6IX2UKA7AYHLTAZBBFZGUR7XS X-Message-ID-Hash: B7DEXQZ6IX2UKA7AYHLTAZBBFZGUR7XS X-MailFrom: c.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: When adding a file to a manifest, the crypt mode of the file is one of 3 variants: None, SignOnly or Encrypt. For push sync jobs the FileInfo::chunk_crypt_mode() was used if not doing server-side encryption, which however reduces this to 2 variants (None and Encrypt) only, no longer reflecting the correct mode for signed only archives. Fix this by actually using the crypt mode as specified in the source manifest when adding the archive to the target manifest, keeping the exception when doing server-side encryption. Do not change the crypt mode for the source chunk readers, as these must always reflect the one specified in the source manifest, but pass in the original mode and let the chunk reader do the mapping internally so this is not performed twice. Reported-by: Fabian Grünbichler Signed-off-by: Christian Ebner --- src/server/push.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/server/push.rs b/src/server/push.rs index 18f8a6f0f..f634c6b84 100644 --- a/src/server/push.rs +++ b/src/server/push.rs @@ -1234,7 +1234,7 @@ pub(crate) async fn push_snapshot( let archive_prefix = format!("{prefix}/{archive_name}"); let crypt_mode = match &encrypt_using_key { Some(_) => CryptMode::Encrypt, - None => entry.chunk_crypt_mode(), + None => entry.crypt_mode, }; load_previous_snapshot_known_chunks( @@ -1291,7 +1291,7 @@ pub(crate) async fn push_snapshot( let index = DynamicIndexReader::open(&path).with_context(|| prefix.to_string())?; let chunk_reader = reader - .chunk_reader(None, entry.chunk_crypt_mode()) + .chunk_reader(None, entry.crypt_mode) .context("failed to get chunk reader")?; let upload_stats = push_index( &archive_name, @@ -1337,7 +1337,7 @@ pub(crate) async fn push_snapshot( let index = FixedIndexReader::open(&path).with_context(|| prefix.to_string())?; let chunk_reader = reader - .chunk_reader(None, entry.chunk_crypt_mode()) + .chunk_reader(None, entry.crypt_mode) .context("failed to get chunk reader") .with_context(|| archive_prefix.clone())?; let size = index.index_bytes(); -- 2.47.3