sync fails when encryption settings provider returns write mode b2sdk.v2.SSE_NONE

[titus8]

Good Day to All.

I'm using b2sdk-1.24.1. I've found a synchronization failure when an encryption settings provider returns write mode b2sdk.v2.SSE_NONE.

A repro script is attached.
bug.txt

A traceback is attached.
traceback.txt

It looks like the server is complaining.

Thanks for your attention.

titus8

[titus8]

I think this is an old issue. In b2sdk-1.24.1/b2sdk/encryption/setting.py, in add_to_upload_headers(), I see

if self.mode == EncryptionMode.NONE:
    # as of 2021-03-16, server always fails it
    headers['X-Bz-Server-Side-Encryption'] = self.mode.name

[jsuchan-reef]

Hi,
thanks for the report and the provided code/traceback. I'm not sure what is the behaviour you expect, but note that SSE_NONE is not supported encryption for sync. So the current behaviour is expected, but the error should be definitely handled more gracefully. We'll look into it.

[titus8]

It seems reasonable to expect that SSE_NONE would cause a local file to be stored on the server as plaintext, regardless of the server default setting. I'm not sure why SSE_NONE exists if it can't be used for sync. Please point me to the documentation, so that I might discover anything else I missed.

Thanks.

[jsuchan-reef]

The command sync uses b2_upload_file behind the scene, which shows that when encryption is explicitly requested, it will either use SSE_C or SSE_B2 based on the combination of X-Bz-Server-Side-Encryption-* headers, there's no way how to explicitly request SSE_NONE from the API. The best what can be done in the SDK is to make this fail loudly before hitting the API.

Sync without encryption can be achieved when the bucket encryption is disabled & get_setting_for_upload() will return None, in which case the bucket's encryption settings will be used (ie. no encryption).

[titus8]

The command sync uses b2_upload_file behind the scene, which shows that when encryption is explicitly requested, it will either use SSE_C or SSE_B2 based on the combination of X-Bz-Server-Side-Encryption-* headers, there's no way how to explicitly request SSE_NONE from the API. The best what can be done in the API is to make this fail loudly before hitting the API.

That's nice documentation, thank you. Is it possible that the absence of all X-Bz-Server-Side-Encryption-* headers implies plaintext?

Sync without encryption can be achieved when the bucket encryption is disabled & get_setting_for_upload() will return None, in which case the bucket's encryption settings will be used (ie. no encryption).

Yes, this was clear.

[jsuchan-reef]

That's nice documentation, thank you. Is it possible that the absence of all X-Bz-Server-Side-Encryption-* headers implies plaintext?

Not really - when the bucket has encryption enabled, omitting the encryption headers works as "use the encryption settings matching the bucket"

[titus8]

Fair enough. Thanks for your attention.

[titus8]

Questions answered. Thanks again!