[PATCH proxmox-backup 18/20] sync: pull: decrypt blob files on pull if encryption key is configured

Christian Ebner
2026-04-01T07:56:09Z

During pull, blob files are stored in a temporary file before being
renamed to the actual blob filename as stored in the manifest.
If a decryption key is configured in the pull parameters, use the
decrypted temporary blob file after downloading it from the remote
to decrypt it and re-encode as new compressed but unencrypted blob
file. Rename the decrypted tempfile to be the new tmpfile to be
finally moved in place.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
src/server/pull.rs | 42 ++++++++++++++++++++++++++++++++++++++++--
1 file changed, 40 insertions(+), 2 deletions(-)

diff --git a/src/server/pull.rs b/src/server/pull.rs
index bc2a89f88..ccf349c92 100644
--- a/src/server/pull.rs
+++ b/src/server/pull.rs
@@ -2,7 +2,7 @@

use std::collections::hash_map::Entry;
use std::collections::{HashMap, HashSet};
-use std::io::Seek;
+use std::io::{BufReader, Read, Seek, Write};
use std::sync::atomic::{AtomicUsize, Ordering};
use std::sync::{Arc, Mutex};
use std::time::SystemTime;
@@ -26,7 +26,9 @@ use pbs_datastore::fixed_index::{FixedIndexReader, FixedIndexWriter};
use pbs_datastore::index::IndexFile;
use pbs_datastore::manifest::{BackupManifest, FileInfo};
use pbs_datastore::read_chunk::AsyncReadChunk;
-use pbs_datastore::{check_backup_owner, DataStore, DatastoreBackend, StoreProgress};
+use pbs_datastore::{
+ check_backup_owner, DataBlobReader, DataStore, DatastoreBackend, StoreProgress,
+};
use pbs_tools::sha::sha256;

use super::sync::{
@@ -398,6 +400,42 @@ async fn pull_single_archive<'a>(
tmpfile.rewind()?;
let (csum, size) = sha256(&mut tmpfile)?;
verify_archive(archive_info, &csum, size)?;
+
+ if crypt_config.is_some() {
+ let crypt_config = crypt_config.clone();
+ let tmp_path = tmp_path.clone();
+ let archive_name = archive_name.clone();
+
+ tokio::task::spawn_blocking(move || {
+ // must rewind again since after verifying cursor is at the end of the file
+ tmpfile.rewind()?;
+ let reader = DataBlobReader::new(tmpfile, crypt_config)?;
+ let mut reader = BufReader::new(reader);
+ let mut raw_data = Vec::new();
+ reader.read_to_end(&mut raw_data)?;
+
+ let blob = DataBlob::encode(&raw_data, None, true)?;
+ let raw_blob = blob.into_inner();
+
+ let mut decrypted_tmp_path = tmp_path.clone();
+ decrypted_tmp_path.set_extension("dectmp");
+ let mut decrypted_tmpfile = std::fs::OpenOptions::new()
+ .read(true)
+ .write(true)
+ .create_new(true)
+ .open(&decrypted_tmp_path)?;
+ decrypted_tmpfile.write_all(&raw_blob)?;
+ decrypted_tmpfile.flush()?;
+ decrypted_tmpfile.rewind()?;
+ let (csum, size) = sha256(&mut decrypted_tmpfile)?;
+
+ std::fs::rename(&decrypted_tmp_path, &tmp_path)?;
+
+ Ok::<(), Error>(())
+ })
+ .await?
+ .map_err(|err| format_err!("Failed when decrypting blob {path:?}: {err}"))?;
+ }
}
}
if let Err(err) = std::fs::rename(&tmp_path, &path) {
--
2.47.3