Re: [PATCH proxmox-backup v3 19/30] fix #7251: api: push: encrypt snapshots using configured encryption key

[Christian Ebner <c.ebner@proxmox.com>]

On 4/15/26 4:47 PM, Michael Köppl wrote:
> On Tue Apr 14, 2026 at 2:59 PM CEST, Christian Ebner wrote:
> 
> [snip]
> 
>>       let mut encrypt_using_key = None;
>> +    if params.crypt_config.is_some() {
>> +        // Check if snapshot is fully encrypted or not encrypted at all:
>> +        // refuse progress otherwise to upload partially unencrypted contents or mix encryption key.
>> +        let files = source_manifest.files();
>> +        let all_unencrypted = files
>> +            .iter()
>> +            .all(|f| f.chunk_crypt_mode() == CryptMode::None);
>> +        let any_unencrypted = files
>> +            .iter()
>> +            .any(|f| f.chunk_crypt_mode() == CryptMode::None);
>> +
>> +        if all_unencrypted {
>> +            encrypt_using_key = params.crypt_config.clone();
>> +            info!("Encrypt and push unencrypted snapshot '{snapshot}'");
> 
> nit: Might just be me, but to me this reads like it would encrypt the
> snapshot and then just push the unencrypted one. Perhaps something like
> "Encrypt and push previously unencrypted snapshot"?

True, now that you mention it I cannot unsee it. But maybe even better:
"Encrypt source snapshot '{}' on the fly while pushing to remote"?

> 
>> +        } else if any_unencrypted {
>> +            warn!("Encountered partially encrypted snapshot '{snapshot}', refuse to re-encrypt and skip");
>> +            return Ok(stats);
>> +        } else {
>> +            info!("Pushing already encrypted snapshot '{snapshot}' without re-encryption");
>> +        }
>> +    }
> 
> [snip]