Re: [meta-virtualization][PATCH 2/2] libvirt: add secrets PACKAGECONFIG

On Sat, Apr 11, 2026 at 6:18 AM Zhixiong Chi via lists.yoctoproject.org
<[email protected]> wrote:

> After being upgraded to v12.1.0, the new
> virt-secret-init-encryption.service
> has been introduced, and it requires systemd to add openssl to
> PACKAGECONFIG.
> Because systemd-creds encrypt command will be executed in the service file.
>
> Meanwhile this service was added into the dependency chain of the main
> service
> libvirtd.service.
>
> In systemd recipe, the openssl PACKAGECONFIG is disabled at default.
> Finally
> the service file virt-secret-init-encryption.service and libvirtd will be
> failed.
>

Considering it didn't exist before, then yes, it is disabled by default.
But that
we can see from the patch.

If the new service was introduced by the uprev, is it enabled by default by
libvirt itself, or is it doing some sort of build time detection ? We need
to
document that in the commit message. That is what your commit message
already implies, I just want it to be clearly stated.

We should also be capturing what the user would see in the system logs,
on the console, or wherever if this service is enabled. Is it an error ? is
it functional ?



>
> So add secrets PACKAGECONFIG for libvirt and conditional removal the new
> virt-secret-init-encryption in the libvirt.service.
>
> Signed-off-by: Zhixiong Chi <[email protected]>
> ---
>  recipes-extended/libvirt/libvirt_git.bb | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>
> diff --git a/recipes-extended/libvirt/libvirt_git.bb
> b/recipes-extended/libvirt/libvirt_git.bb
> index fbee9c5b..3075149b 100644
> --- a/recipes-extended/libvirt/libvirt_git.bb
> +++ b/recipes-extended/libvirt/libvirt_git.bb
> @@ -177,6 +177,8 @@ PACKAGECONFIG[firewalld] = "-Dfirewalld=enabled,
> -Dfirewalld=disabled,"
>  PACKAGECONFIG[libpcap] = "-Dlibpcap=enabled,
> -Dlibpcap=disabled,libpcap,libpcap"
>  PACKAGECONFIG[numad] = "-Dnumad=enabled, -Dnumad=disabled,"
>  PACKAGECONFIG[nftables] = ""
> +# Require systemd to add openssl to PACKAGECONFIG, so disable it at
> default.
> +PACKAGECONFIG[secrets] = "-Ddriver_secrets=enabled,
> -Ddriver_secrets=disabled,"
>
>  # Enable the Python tool support
>  require libvirt-python.inc
> @@ -225,6 +227,15 @@ do_install:append() {
>                  mv ${D}${prefix}/lib/systemd/system/*
> ${D}${systemd_system_unitdir}
>                  rmdir ${D}${prefix}/lib/systemd/system
> ${D}${prefix}/lib/systemd
>              fi
> +
>

We need a comment above those sed expressions to indicate the final result.
i.e. service is completely removed.

But again, back to my first comments. If libvirt is enabling this by
default, and it
isn't doing some sort of runtime/buildtime detection, is this really the
only way that
libvirt has to disable it ?

Bruce



> +            if ! ${@bb.utils.contains('PACKAGECONFIG', 'secrets', 'true',
> 'false', d)}; then
> +                sed -i \
> +                    -e '/^Requires=virt-secret-init-encryption.service/d'
> \
> +                    -e '/^After=virt-secret-init-encryption.service/d' \
> +                    -e '/^Environment=SECRETS_ENCRYPTION_KEY=/d' \
> +                    -e '/^LoadCredentialEncrypted=/d' \
> +                    ${D}${systemd_system_unitdir}/libvirtd.service
> +            fi
>         fi
>
>         # The /run/libvirt directories created by the Makefile are
> --
> 2.49.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#9692):
> https://lists.yoctoproject.org/g/meta-virtualization/message/9692
> Mute This Topic: https://lists.yoctoproject.org/mt/118773077/1050810
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [
> [email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II