[Bug]: 3.12.3 Cannot sync E2EE files. Encrypted metadata setup error!

[Eric-Sparks]

⚠️ Before submitting, please verify the following: ⚠️

• This is a bug, not a question or a configuration issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server and Desktop Client are up to date. See Server Maintenance and Release Schedule and Desktop Releases for supported versions.
• I agree to follow Nextcloud's Code of Conduct

Bug description

In version 3.12.3, I'm not able to sync E2EE files. In fact, right now some of the E2EE files are showing up in their encrypted form on my client. I've verified the encryption mnemonic is the same.

Steps to reproduce

1. Add files to E2EE folder.
2. See the Nextcloud client fail with a red X icon.
3. See error message "Server replied with an error while reading directory "x" : Encrypted metadata setup error!"

Expected behavior

Files sync as expected.

Which files are affected by this bug

2024-01-26-Eric-Thrift_Savings_Plan_statement.pdf

Operating system

Linux

Which version of the operating system you are running.

Both the packaged version in the Fedora 39 repo and the flatpak version.

Package

Distro package manager

Nextcloud Server version

28.0.5

Nextcloud Desktop Client version

3.12.3

Is this bug present after an update or on a fresh install?

Updated from a minor version (ex. 3.4.2 to 3.4.4)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

Are you using an external user-backend?

• Default internal user-backend
• LDAP/ Active Directory
• SSO - SAML
• Other

Nextcloud Server logs

{"reqId":"9acBM5KcfqcHMHcn79bI","level":3,"time":"April 29, 2024 23:29:59","remoteAddr":"2601:14b:4780:beb1:c921:8815:955a:5c06","user":"USER","app":"webdav","method":"PUT","url":"/remote.php/dav/files/USER/Family_Files/Financial/2024-01-26-Eric-Thrift_Savings_Plan_statement.pdf","message":"Write access to end-to-end encrypted folder requires token - no token sent","userAgent":"Mozilla/5.0 (Linux) mirall/3.9.3git (Nextcloud, fedora-6.8.7-200.fc39.x86_64 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"28.0.5.1","exception":{"Exception":"OCA\\DAV\\Connector\\Sabre\\Exception\\Forbidden","Message":"Write access to end-to-end encrypted folder requires token - no token sent","Code":0,"Trace":[{"file":"/usr/local/www/nextcloud/apps/end_to_end_encryption/lib/Connector/Sabre/LockPlugin.php","line":148,"function":"verifyTokenOnWriteAccess","class":"OCA\\EndToEndEncryption\\Connector\\Sabre\\LockPlugin","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"checkLock","class":"OCA\\EndToEndEncryption\\Connector\\Sabre\\LockPlugin","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":456,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":253,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":321,"function":"start","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/apps/dav/lib/Server.php","line":373,"function":"exec","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/remote.php","line":172,"args":["/usr/local/www/nextcloud/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/usr/local/www/nextcloud/apps/end_to_end_encryption/lib/Connector/Sabre/LockPlugin.php","Line":164,"message":"Write access to end-to-end encrypted folder requires token - no token sent","exception":{},"CustomMessage":"Write access to end-to-end encrypted folder requires token - no token sent"}}

Additional info

No response
Uploading nextcloud-client-logs.zip…

[Eric-Sparks]

[toniQva]

[NC Client 3.13.0 not recognizing file renaming in Windows!!!!!!!!

The same problem described here NC Client 3.12.0 not recognizing file renaming in Windows 3 has been reintroduced in the Nextcloud-3.13.0-x64 version. I have reverted to Nextcloud-3.12.3-x64 version and it works correctly again.

[JoshuaPettus]

Can confirm the issue is effecting 3.13.0 again. Just like toniQva, reverting to 3.12.3 did alleviate the issue, though I did have to clear and redo the private key then reupload. Also NC pushes to upgrade now. OP said 3.12.3 was the problem but that wasn't my experience.

[Eric-Sparks]

Is there any additional information you need from me on this? Not being able to sync with my server is getting annoying.

[JoshuaPettus]

Idk, but they quietly continued patching the 3.12 branch in the background and it's now 3.12.5 on github. I would just switch to that.

[Eric-Sparks]

Just tried 3.12.5 and still getting the same error.

[JoshuaPettus]

I had to copy out all the unencrypted private data. Go into the user's security prefrences and remove the encrypted keys. Then redo the whole thing from scratch. For me it worked on the 3.12 branch, 3.13 just went back to the situation.

[Eric-Sparks]

I had to copy out all the unencrypted private data. Go into the user's security prefrences and remove the encrypted keys. Then redo the whole thing from scratch. For me it worked on the 3.12 branch, 3.13 just went back to the situation.

For some reason, all my E2EE files are showing as encrypted on my computer so nothing is decrypted.

[JoshuaPettus]

oh no... do you have a backup of the unencrypted data?

[Eric-Sparks]

Maybe?

[JoshuaPettus]

There is some information here on how to decrypt, but honestly I think its better to keep a backup of the files unencrypted just in case. (or at least encrypted via other means, eg restic database) Ive been burned by E2EE before.
https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html

[Eric-Sparks]

It looks like I have access to that data on my mobile device so I can recreate it from there.

I think those instructions are for server-side encryption and not E2EE.

[JoshuaPettus]

Ah you may be right...

I keep a backup of my unencrypted files by syncing the private folder to restic periodically on the local machine (borg is a good choice too).

[Eric-Sparks]

I haven't tried it, yet, but it looks like this might work: https://github.com/nextcloud/encryption-recovery-tools/tree/master/end-to-end-encryption

[JoshuaPettus]

Ah that's good that there is an emergency solution. Still I'll try not to need it in the first place. I've said it before, E2EE, while great, is kinda dangerous. It doesn't take much for it to become unhappy and have its internal keys all messed up.

[toniQva]

3.12.3 It's ok 👌