From a2348964380eea51bd2f993f338ade65774ace59 Mon Sep 17 00:00:00 2001
From: Greyson Parrelli <greyson@signal.org>
Date: Fri, 22 Aug 2025 09:35:18 -0400
Subject: [PATCH] Ensure that we clear incrementalMac's that will be
 invalidated during archive.

---
 .../securesms/database/AttachmentTable.kt     | 23 +++++++++++++++++++
 .../securesms/jobs/BackupMessagesJob.kt       |  3 +++
 2 files changed, 26 insertions(+)

diff --git a/app/src/main/java/org/thoughtcrime/securesms/database/AttachmentTable.kt b/app/src/main/java/org/thoughtcrime/securesms/database/AttachmentTable.kt
index 45a367a79c..5e50d005d7 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/database/AttachmentTable.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/database/AttachmentTable.kt
@@ -683,6 +683,29 @@ class AttachmentTable(
     return count
   }
 
+  /**
+   * Clears incrementalMac's for any attachments that still need to be uploaded.
+   * This is important because when we upload an attachment to the archive CDN, we'll be re-encrypting it, and so the incrementalMac will end up changing.
+   * So we want to be sure that we don't write a potentially-invalid incrementalMac in the meantime.
+   */
+  fun clearIncrementalMacsForAttachmentsThatNeedArchiveUpload(): Int {
+    return writableDatabase
+      .update(TABLE_NAME)
+      .values(
+        REMOTE_INCREMENTAL_DIGEST to null,
+        REMOTE_INCREMENTAL_DIGEST_CHUNK_SIZE to 0
+      )
+      .where(
+        """
+        $ARCHIVE_TRANSFER_STATE = ${ArchiveTransferState.NONE.value} AND
+        $DATA_FILE NOT NULL AND
+        $TRANSFER_STATE = $TRANSFER_PROGRESS_DONE AND
+        $REMOTE_INCREMENTAL_DIGEST NOT NULL
+        """
+      )
+      .run()
+  }
+
   /**
    * Similar to [getAttachmentsThatNeedArchiveUpload], but returns if the list would be non-null in a more efficient way.
    */
diff --git a/app/src/main/java/org/thoughtcrime/securesms/jobs/BackupMessagesJob.kt b/app/src/main/java/org/thoughtcrime/securesms/jobs/BackupMessagesJob.kt
index 6e87ea5c9a..63bc26490f 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/jobs/BackupMessagesJob.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/jobs/BackupMessagesJob.kt
@@ -182,6 +182,9 @@ class BackupMessagesJob private constructor(
     SignalDatabase.attachments.createRemoteKeyForAttachmentsThatNeedArchiveUpload().takeIf { it > 0 }?.let { count -> Log.w(TAG, "Needed to create $count remote keys.") }
     stopwatch.split("keygen")
 
+    SignalDatabase.attachments.clearIncrementalMacsForAttachmentsThatNeedArchiveUpload().takeIf { it > 0 }?.let { count -> Log.w(TAG, "Needed to clear $count incrementalMacs.") }
+    stopwatch.split("clear-incmac")
+
     if (isCanceled) {
       return Result.failure()
     }