[Bug]: Public Shares broken for encrypted nextcloud instance for both up- and download

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Nextcloud instance (31.0.4) with encryption module enabled is unable to share via public link and unable to receive files via public shared link.
Error message in both cases from the log:
Hint":"Fehlende Signatur"},"message":"Verschl\u00fcsselung nicht bereit: Missing Signature","exception":{},"CustomMessage":"Verschl\u00fcsselung nicht bereit: Missing Signature

Steps to reproduce

Expected behavior

Using public shares should work as before version 31.

Nextcloud Server version

31

Operating system

Other

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

"dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "UTC",
        "installed": true,
        "mail_smtpmode": "smtp",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "maintenance": false,
        "loglevel": 3,
        "theme": "",
        "share_folder": "\/Shared",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_smtpauthtype": "PLAIN",
        "mail_smtpport": "25",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "encryption.legacy_format_support": false,
        "encryption.key_storage_migrated": false,
        "default_phone_region": "DE",
        "maintenance_window_start": 1,
        "app_install_overwrite": [
            "metadata",
            "files_markdown",
            "maps",
            "otpmanager",
            "radio",
            "files_rightclick",
            "files_trackdownloads"
        ]
    }
}

List of activated Apps

Enabled:
  - activity: 4.0.0
  - admin_audit: 1.21.0
  - app_api: 5.0.2
  - audioplayer: 3.4.1
  - bookmarks: 15.1.0
  - bruteforcesettings: 4.0.0
  - calendar: 5.2.2
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contacts: 7.0.6
  - cookbook: 0.11.3
  - cospend: 3.0.11
  - dashboard: 7.11.0
  - dav: 1.33.0
  - deck: 1.15.1
  - encryption: 2.19.0
  - external: 6.0.2
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_accesscontrol: 2.0.0
  - files_automatedtagging: 2.0.0
  - files_downloadlimit: 4.0.0
  - files_external: 1.23.0
  - files_markdown: 2.4.1
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_retention: 2.0.1
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - forms: 5.1.0
  - gpxpod: 7.0.4
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - maps: 1.5.0
  - metadata: 0.22.0
  - news: 25.3.1
  - nextcloud_announcements: 3.0.0
  - notes: 4.12.0
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - otpmanager: 0.5.4
  - password_policy: 3.0.0
  - passwords: 2025.4.20
  - photos: 4.0.0-dev.1
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - quota_warning: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - support: 3.0.0
  - survey_client: 3.0.0
  - suspicious_login: 9.0.1
  - systemtags: 1.21.1
  - tasks: 0.16.1
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - updatenotification: 1.21.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Disabled:
  - contactsinteraction: 1.12.0 (installed 1.9.0)
  - files_rightclick: 0.15.1 (installed 0.15.1)
  - files_trackdownloads: 1.11.0 (installed 1.11.0)
  - mail: 5.0.3 (installed 5.0.3)
  - radio: 1.0.3 (installed 1.0.3)
  - user_ldap: 1.22.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"MwzmwInTDbR3iXqmL9Pi","level":3,"time":"2025-05-04T10:31:33+00:00","remoteAddr":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","user":false,"app":"webdav","method":"GET","url":"/public.php/dav/files/XXXXXXXXXXXXXXXXXXXXXXXXXX","message":"Verschl\u00fcsselung nicht bereit: Missing Signature","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0","version":"31.0.4.1","exception":{"Exception":"Sabre\\DAV\\Exception\\ServiceUnavailable","Message":"Verschl\u00fcsselung nicht bereit: Missing Signature","Code":0,"Trace":[{"file":"/usr/local/www/nextcloud/apps/dav/lib/Connector/Sabre/File.php","line":460,"function":"convertToSabreException","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":85,"function":"get","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpGet","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php","line":49,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/apps/dav/appinfo/v2/publicremote.php","line":151,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/public.php","line":82,"args":["/usr/local/www/nextcloud/apps/dav/appinfo/v2/publicremote.php"],"function":"require_once"}],"File":"/usr/local/www/nextcloud/apps/dav/lib/Connector/Sabre/File.php","Line":589,"Previous":{"Exception":"OCP\\Encryption\\Exceptions\\GenericEncryptionException","Message":"Missing Signature","Code":0,"Trace":[{"file":"/usr/local/www/nextcloud/apps/encryption/lib/Crypto/Crypt.php","line":492,"function":"hasSignature","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->"},{"file":"/usr/local/www/nextcloud/apps/encryption/lib/Crypto/Crypt.php","line":426,"function":"splitMetaData","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->"},{"file":"/usr/local/www/nextcloud/apps/encryption/lib/Crypto/Crypt.php","line":377,"function":"symmetricDecryptFileContent","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/usr/local/www/nextcloud/apps/encryption/lib/KeyManager.php","line":381,"function":"decryptPrivateKey","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/usr/local/www/nextcloud/apps/encryption/lib/Crypto/Encryption.php","line":130,"function":"getFileKey","class":"OCA\\Encryption\\KeyManager","type":"->"},{"file":"/usr/local/www/nextcloud/lib/private/Files/Stream/Encryption.php","line":228,"function":"begin","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->"},{"function":"stream_open","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"file":"/usr/local/www/nextcloud/lib/private/Files/Stream/Encryption.php","line":156,"function":"fopen"},{"file":"/usr/local/www/nextcloud/lib/private/Files/Stream/Encryption.php","line":131,"function":"wrapSource","class":"OC\\Files\\Stream\\Encryption","type":"::"},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Encryption.php","line":351,"function":"wrap","class":"OC\\Files\\Stream\\Encryption","type":"::"},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":142,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Encryption","type":"->"},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":142,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/usr/local/www/nextcloud/apps/files_accesscontrol/lib/StorageWrapper.php","line":221,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/usr/local/www/nextcloud/lib/private/Files/View.php","line":1208,"function":"fopen","class":"OCA\\FilesAccessControl\\StorageWrapper","type":"->"},{"file":"/usr/local/www/nextcloud/lib/private/Files/View.php","line":1036,"function":"basicOperation","class":"OC\\Files\\View","type":"->"},{"file":"/usr/local/www/nextcloud/apps/dav/lib/Connector/Sabre/File.php","line":458,"function":"fopen","class":"OC\\Files\\View","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":85,"function":"get","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpGet","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php","line":49,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/apps/dav/appinfo/v2/publicremote.php","line":151,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/usr/local/www/nextcloud/public.php","line":82,"args":["/usr/local/www/nextcloud/apps/dav/appinfo/v2/publicremote.php"],"function":"require_once"}],"File":"/usr/local/www/nextcloud/apps/encryption/lib/Crypto/Crypt.php","Line":526,"Hint":"Fehlende Signatur"},"message":"Verschl\u00fcsselung nicht bereit: Missing Signature","exception":{},"CustomMessage":"Verschl\u00fcsselung nicht bereit: Missing Signature"}}

Additional info

OS: FreeBSD

Start by reading apps/dav/lib/Connector/Sabre/File.php around lines 458-460 and apps/encryption/lib/Crypto/Crypt.php around lines 377-492, then reproduce a public-link upload and download with encryption enabled. Trace the Missing Signature path through apps/dav/appinfo/v2/publicremote.php and verify that both public share directions work without the logged encryption error.