move pbs_config::key_config to pbs-key-config

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

Cargo.toml

@@ -34,6 +34,7 @@ members = [
     "pbs-config",
     "pbs-datastore",
     "pbs-fuse-loop",
+    "pbs-key-config",
     "pbs-pxar-fuse",
     "pbs-tape",
     "pbs-tools",
@@ -89,6 +90,7 @@ pbs-client = { path = "pbs-client" }
 pbs-config = { path = "pbs-config" }
 pbs-datastore = { path = "pbs-datastore" }
 pbs-fuse-loop = { path = "pbs-fuse-loop" }
+pbs-key-config = { path = "pbs-key-config" }
 pbs-pxar-fuse = { path = "pbs-pxar-fuse" }
 pbs-tape = { path = "pbs-tape" }
 pbs-tools = { path = "pbs-tools" }
@@ -225,6 +227,7 @@ pbs-buildcfg.workspace = true
 pbs-client.workspace = true
 pbs-config.workspace = true
 pbs-datastore.workspace = true
+pbs-key-config.workspace = true
 pbs-tape.workspace = true
 pbs-tools.workspace = true
 proxmox-rrd.workspace = true

pbs-config/Cargo.toml

@@ -17,16 +17,15 @@ regex.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 
-proxmox-lang.workspace=true
 proxmox-metrics.workspace = true
 proxmox-router = { workspace = true, default-features = false }
 proxmox-schema.workspace = true
 proxmox-section-config.workspace = true
-proxmox-serde.workspace = true
 proxmox-shared-memory.workspace = true
 proxmox-sys = { workspace = true, features = [ "acl", "crypt", "timer" ] }
 proxmox-time.workspace = true
 
 pbs-api-types.workspace = true
 pbs-buildcfg.workspace = true
+pbs-key-config.workspace = true
 pbs-tools.workspace = true

pbs-config/src/lib.rs

@@ -4,7 +4,6 @@ pub use cached_user_info::CachedUserInfo;
 pub mod datastore;
 pub mod domains;
 pub mod drive;
-pub mod key_config;
 pub mod media_pool;
 pub mod metrics;
 pub mod network;

pbs-config/src/tape_encryption_keys.rs

@@ -16,9 +16,9 @@ use anyhow::{bail, Error};
 use serde::{Deserialize, Serialize};
 
 use pbs_api_types::Fingerprint;
+use pbs_key_config::KeyConfig;
 use proxmox_sys::fs::file_read_optional_string;
 
-use crate::key_config::KeyConfig;
 use crate::{open_backup_lockfile, replace_backup_config, replace_secret_config};
 
 mod hex_key {

pbs-datastore/Cargo.toml

@@ -38,4 +38,5 @@ proxmox-sys.workspace = true
 pbs-api-types.workspace = true
 pbs-buildcfg.workspace = true
 pbs-config.workspace = true
+pbs-key-config.workspace = true
 pbs-tools.workspace = true

pbs-datastore/src/manifest.rs

@@ -266,7 +266,7 @@ impl TryFrom<super::DataBlob> for BackupManifest {
 
 #[test]
 fn test_manifest_signature() -> Result<(), Error> {
-    use pbs_config::key_config::KeyDerivationConfig;
+    use pbs_key_config::KeyDerivationConfig;
 
     let pw = b"test";
 

pbs-datastore/src/paperkey.rs

@@ -6,7 +6,7 @@ use serde::{Deserialize, Serialize};
 
 use proxmox_schema::api;
 
-use pbs_config::key_config::KeyConfig;
+use pbs_key_config::KeyConfig;
 
 #[api()]
 #[derive(Debug, Serialize, Deserialize)]

pbs-key-config/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "pbs-key-config"
+version = "0.1.0"
+authors.workspace = true
+edition.workspace = true
+description = "Encryption key configuration and usage for PBS clients"
+
+[dependencies]
+anyhow.workspace = true
+nix.workspace = true
+openssl.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+
+proxmox-lang.workspace = true
+proxmox-serde.workspace = true
+proxmox-sys.workspace = true
+proxmox-time.workspace = true
+
+pbs-api-types.workspace = true
+pbs-tools.workspace = true

proxmox-backup-client/Cargo.toml

@@ -37,5 +37,6 @@ pbs-client.workspace = true
 pbs-config.workspace = true
 pbs-datastore.workspace = true
 pbs-fuse-loop.workspace = true
+pbs-key-config.workspace = true
 pbs-pxar-fuse.workspace = true
 pbs-tools.workspace = true

proxmox-backup-client/src/benchmark.rs

@@ -17,8 +17,8 @@ use proxmox_schema::{api, ApiType, ReturnType};
 use pbs_api_types::{BackupNamespace, BackupType};
 use pbs_client::tools::key_source::get_encryption_key_password;
 use pbs_client::{BackupRepository, BackupWriter};
-use pbs_config::key_config::{load_and_decrypt_key, KeyDerivationConfig};
 use pbs_datastore::data_blob::{DataBlob, DataChunkBuilder};
+use pbs_key_config::{load_and_decrypt_key, KeyDerivationConfig};
 use pbs_tools::crypt_config::CryptConfig;
 
 use crate::{

proxmox-backup-client/src/key.rs

@@ -17,8 +17,8 @@ use pbs_client::tools::key_source::{
     find_default_encryption_key, find_default_master_pubkey, get_encryption_key_password,
     place_default_encryption_key, place_default_master_pubkey,
 };
-use pbs_config::key_config::{rsa_decrypt_key_config, KeyConfig};
 use pbs_datastore::paperkey::{generate_paper_key, PaperkeyFormat};
+use pbs_key_config::{rsa_decrypt_key_config, KeyConfig};
 
 #[api]
 #[derive(Deserialize, Serialize)]

proxmox-backup-client/src/main.rs

@@ -46,7 +46,6 @@ use pbs_client::{
     FixedChunkStream, HttpClient, PxarBackupStream, RemoteChunkReader, UploadOptions,
     BACKUP_SOURCE_SCHEMA,
 };
-use pbs_config::key_config::{decrypt_key, rsa_encrypt_key_config, KeyConfig};
 use pbs_datastore::catalog::{BackupCatalogWriter, CatalogReader, CatalogWriter};
 use pbs_datastore::chunk_store::verify_chunk_size;
 use pbs_datastore::dynamic_index::{BufferedDynamicReader, DynamicIndexReader};
@@ -57,6 +56,7 @@ use pbs_datastore::manifest::{
 };
 use pbs_datastore::read_chunk::AsyncReadChunk;
 use pbs_datastore::CATALOG_NAME;
+use pbs_key_config::{decrypt_key, rsa_encrypt_key_config, KeyConfig};
 use pbs_tools::crypt_config::CryptConfig;
 use pbs_tools::json;
 

proxmox-backup-client/src/mount.rs

@@ -20,10 +20,10 @@ use proxmox_sys::sortable;
 use pbs_api_types::BackupNamespace;
 use pbs_client::tools::key_source::get_encryption_key_password;
 use pbs_client::{BackupReader, RemoteChunkReader};
-use pbs_config::key_config::load_and_decrypt_key;
 use pbs_datastore::cached_chunk_reader::CachedChunkReader;
 use pbs_datastore::dynamic_index::BufferedDynamicReader;
 use pbs_datastore::index::IndexFile;
+use pbs_key_config::load_and_decrypt_key;
 use pbs_tools::crypt_config::CryptConfig;
 use pbs_tools::json::required_string_param;
 

proxmox-backup-client/src/snapshot.rs

@@ -9,8 +9,8 @@ use proxmox_sys::fs::file_get_contents;
 
 use pbs_api_types::{BackupGroup, BackupNamespace, CryptMode, SnapshotListItem};
 use pbs_client::tools::key_source::get_encryption_key_password;
-use pbs_config::key_config::decrypt_key;
 use pbs_datastore::DataBlob;
+use pbs_key_config::decrypt_key;
 use pbs_tools::crypt_config::CryptConfig;
 use pbs_tools::json::required_string_param;
 

proxmox-file-restore/Cargo.toml

@@ -32,4 +32,5 @@ pbs-buildcfg.workspace = true
 pbs-client.workspace = true
 pbs-config.workspace = true
 pbs-datastore.workspace = true
+pbs-key-config.workspace = true
 pbs-tools.workspace = true

proxmox-file-restore/src/main.rs

@@ -31,11 +31,11 @@ use pbs_client::tools::{
     REPO_URL_SCHEMA,
 };
 use pbs_client::{BackupReader, BackupRepository, RemoteChunkReader};
-use pbs_config::key_config::decrypt_key;
 use pbs_datastore::catalog::{ArchiveEntry, CatalogReader, DirEntryAttribute};
 use pbs_datastore::dynamic_index::{BufferedDynamicReader, LocalDynamicReadAt};
 use pbs_datastore::index::IndexFile;
 use pbs_datastore::CATALOG_NAME;
+use pbs_key_config::decrypt_key;
 use pbs_tools::crypt_config::CryptConfig;
 
 pub mod block_driver;

src/api2/config/tape_encryption_keys.rs

@@ -12,11 +12,11 @@ use pbs_api_types::{
 
 use pbs_config::CachedUserInfo;
 
-use pbs_config::key_config::KeyConfig;
 use pbs_config::open_backup_lockfile;
 use pbs_config::tape_encryption_keys::{
     insert_key, load_key_configs, load_keys, save_key_configs, save_keys, TAPE_KEYS_LOCKFILE,
 };
+use pbs_key_config::KeyConfig;
 
 #[api(
     input: {

src/bin/proxmox_backup_debug/diff.rs

@@ -21,9 +21,9 @@ use pbs_client::tools::{
     REPO_URL_SCHEMA,
 };
 use pbs_client::{BackupReader, BackupRepository, RemoteChunkReader};
-use pbs_config::key_config::decrypt_key;
 use pbs_datastore::dynamic_index::{BufferedDynamicReader, DynamicIndexReader, LocalDynamicReadAt};
 use pbs_datastore::index::IndexFile;
+use pbs_key_config::decrypt_key;
 use pbs_tools::crypt_config::CryptConfig;
 use pxar::accessor::ReadAt;
 use pxar::EntryKind;

src/bin/proxmox_backup_debug/inspect.rs

@@ -15,7 +15,6 @@ use proxmox_router::cli::{
 use proxmox_schema::api;
 
 use pbs_client::tools::key_source::get_encryption_key_password;
-use pbs_config::key_config::load_and_decrypt_key;
 use pbs_datastore::dynamic_index::DynamicIndexReader;
 use pbs_datastore::file_formats::{
     COMPRESSED_BLOB_MAGIC_1_0, DYNAMIC_SIZED_CHUNK_INDEX_1_0, ENCRYPTED_BLOB_MAGIC_1_0,
@@ -24,6 +23,7 @@ use pbs_datastore::file_formats::{
 use pbs_datastore::fixed_index::FixedIndexReader;
 use pbs_datastore::index::IndexFile;
 use pbs_datastore::DataBlob;
+use pbs_key_config::load_and_decrypt_key;
 use pbs_tools::crypt_config::CryptConfig;
 
 /// Decodes a blob and writes its content either to stdout or into a file

src/bin/proxmox_backup_debug/recover.rs

@@ -8,12 +8,12 @@ use proxmox_router::cli::{CliCommand, CliCommandMap, CommandLineInterface};
 use proxmox_schema::api;
 
 use pbs_client::tools::key_source::get_encryption_key_password;
-use pbs_config::key_config::load_and_decrypt_key;
 use pbs_datastore::dynamic_index::DynamicIndexReader;
 use pbs_datastore::file_formats::{DYNAMIC_SIZED_CHUNK_INDEX_1_0, FIXED_SIZED_CHUNK_INDEX_1_0};
 use pbs_datastore::fixed_index::FixedIndexReader;
 use pbs_datastore::index::IndexFile;
 use pbs_datastore::DataBlob;
+use pbs_key_config::load_and_decrypt_key;
 use pbs_tools::crypt_config::CryptConfig;
 
 #[api(

src/bin/proxmox_tape/encryption_key.rs

@@ -10,9 +10,9 @@ use pbs_api_types::{
     TAPE_ENCRYPTION_KEY_FINGERPRINT_SCHEMA,
 };
 
-use pbs_config::key_config::KeyConfig;
 use pbs_config::tape_encryption_keys::{complete_key_fingerprint, load_key_configs};
 use pbs_datastore::paperkey::{generate_paper_key, PaperkeyFormat};
+use pbs_key_config::KeyConfig;
 
 use proxmox_backup::api2;
 

src/tape/drive/lto/mod.rs

@@ -21,7 +21,7 @@ use proxmox_uuid::Uuid;
 use pbs_api_types::{
     Fingerprint, Lp17VolumeStatistics, LtoDriveAndMediaStatus, LtoTapeDrive, MamAttribute,
 };
-use pbs_config::key_config::KeyConfig;
+use pbs_key_config::KeyConfig;
 use pbs_tape::{
     linux_list_drives::open_lto_tape_device,
     sg_tape::{SgTape, TapeAlertFlags},

src/tape/drive/mod.rs

@@ -23,7 +23,7 @@ use proxmox_sys::{task_log, WorkerTaskContext};
 use proxmox_uuid::Uuid;
 
 use pbs_api_types::{Fingerprint, LtoTapeDrive, VirtualTapeDrive};
-use pbs_config::key_config::KeyConfig;
+use pbs_key_config::KeyConfig;
 
 use pbs_tape::{sg_tape::TapeAlertFlags, BlockReadError, MediaContentHeader, TapeRead, TapeWrite};
 

src/tape/drive/virtual_tape.rs

@@ -8,7 +8,7 @@ use serde::{Deserialize, Serialize};
 
 use proxmox_sys::fs::{replace_file, CreateOptions};
 
-use pbs_config::key_config::KeyConfig;
+use pbs_key_config::KeyConfig;
 use pbs_tape::{
     BlockReadError, BlockedReader, BlockedWriter, DriveStatus, ElementStatus, EmulateTapeReader,
     EmulateTapeWriter, MediaContentHeader, MtxStatus, StorageElementStatus, TapeRead, TapeWrite,