Skip to content

[stable34] fix(encryption): keep the encrypted version the copy was written with - #64605

Merged
susnux merged 1 commit into
stable34from
backport/64378/stable34
Sep 22, 2026
Merged

susnux merged 1 commit into
stable34from
backport/64378/stable34

Conversation

@backportbot

@backportbot backportbot Bot commented Sep 20, 2026

Copy link
Copy Markdown

Backport of PR #64378

A copy re-encrypts the target, so the signature of its blocks is keyed on
the version of the target - the version of the file it overwrites plus one -
and not on the version of the source. Two writers overwrite that value after
the stream recorded it: updateEncryptedVersion() resets it to 1 for every
copy, and Cache::copyFromCache() then puts the source's version on the
target. Reading the copy back fails with "Bad Signature" whenever those
differ, which is the case for every copy of a file that was written more
than once and for every copy onto an existing file.

Take the version the stream recorded for the target instead of resetting it,
and let it win over the source's version when the cache entry of the copy is
written.

Assisted-by: ClaudeCode:claude-opus-5
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
@backportbot
backportbot Bot requested a review from a team as a code owner September 20, 2026 22:28
@backportbot
backportbot Bot requested review from Altahrim, GhassenKefi, come-nc, icewind1991, provokateurin, salmart-dev and susnux and removed request for a team September 20, 2026 22:28
@backportbot backportbot Bot added this to the Nextcloud 34.0.5 milestone Sep 20, 2026
@susnux
susnux merged commit ca64f89 into stable34 Sep 22, 2026
197 of 203 checks passed
@susnux
susnux deleted the backport/64378/stable34 branch September 22, 2026 09:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants