Re: [meta-virtualization][PATCH 2/2] libvirt: add secrets PACKAGECONFIG

On 4/13/26 22:16, Bruce Ashfield wrote:
> **
> *CAUTION: This email comes from a non Wind River email account!*
> Do not click links or open attachments unless you recognize the sender 
> and know the content is safe.
>
>
> On Sat, Apr 11, 2026 at 6:18 AM Zhixiong Chi via 
> lists.yoctoproject.org 
> <https://urldefense.com/v3/__http://lists.yoctoproject.org__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0scglZdegA$> 
> <[email protected]> wrote:
>
>     After being upgraded to v12.1.0, the new
>     virt-secret-init-encryption.service
>     has been introduced, and it requires systemd to add openssl to
>     PACKAGECONFIG.
>     Because systemd-creds encrypt command will be executed in the
>     service file.
>
>     Meanwhile this service was added into the dependency chain of the
>     main service
>     libvirtd.service.
>
>     In systemd recipe, the openssl PACKAGECONFIG is disabled at
>     default. Finally
>     the service file virt-secret-init-encryption.service and libvirtd
>     will be
>     failed.
>
>
> Considering it didn't exist before, then yes, it is disabled by 
> default.  But that
> we can see from the patch.
>
> If the new service was introduced by the uprev, is it enabled by 
> default by
> libvirt itself, or is it doing some sort of build time detection ? We 
> need to
> document that in the commit message. That is what your commit message
> already implies, I just want it to be clearly stated.
>
> We should also be capturing what the user would see in the system logs,
> on the console, or wherever if this service is enabled. Is it an error 
> ? is
> it functional ?
>
Updated the comments in V2 patch including the services status when 
secret service is enabled .
>
>
>     So add secrets PACKAGECONFIG for libvirt and conditional removal
>     the new
>     virt-secret-init-encryption in the libvirt.service.
>
>     Signed-off-by: Zhixiong Chi <[email protected]>
>     ---
>      recipes-extended/libvirt/libvirt_git.bb
>     <https://urldefense.com/v3/__http://libvirt_git.bb__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0seih9UXkA$>
>     | 11 +++++++++++
>      1 file changed, 11 insertions(+)
>
>     diff --git a/recipes-extended/libvirt/libvirt_git.bb
>     <https://urldefense.com/v3/__http://libvirt_git.bb__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0seih9UXkA$>
>     b/recipes-extended/libvirt/libvirt_git.bb
>     <https://urldefense.com/v3/__http://libvirt_git.bb__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0seih9UXkA$>
>     index fbee9c5b..3075149b 100644
>     --- a/recipes-extended/libvirt/libvirt_git.bb
>     <https://urldefense.com/v3/__http://libvirt_git.bb__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0seih9UXkA$>
>     +++ b/recipes-extended/libvirt/libvirt_git.bb
>     <https://urldefense.com/v3/__http://libvirt_git.bb__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0seih9UXkA$>
>     @@ -177,6 +177,8 @@ PACKAGECONFIG[firewalld] =
>     "-Dfirewalld=enabled, -Dfirewalld=disabled,"
>      PACKAGECONFIG[libpcap] = "-Dlibpcap=enabled,
>     -Dlibpcap=disabled,libpcap,libpcap"
>      PACKAGECONFIG[numad] = "-Dnumad=enabled, -Dnumad=disabled,"
>      PACKAGECONFIG[nftables] = ""
>     +# Require systemd to add openssl to PACKAGECONFIG, so disable it
>     at default.
>     +PACKAGECONFIG[secrets] = "-Ddriver_secrets=enabled,
>     -Ddriver_secrets=disabled,"
>
>      # Enable the Python tool support
>      require libvirt-python.inc
>     <https://urldefense.com/v3/__http://libvirt-python.inc__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0scd3pMLYg$>
>     @@ -225,6 +227,15 @@ do_install:append() {
>                      mv ${D}${prefix}/lib/systemd/system/*
>     ${D}${systemd_system_unitdir}
>                      rmdir ${D}${prefix}/lib/systemd/system
>     ${D}${prefix}/lib/systemd
>                  fi
>     +
>
>
> We need a comment above those sed expressions to indicate the final 
> result.
> i.e. service is completely removed.
Done in V2.
>
> But again, back to my first comments. If libvirt is enabling this by 
> default, and it
> isn't doing some sort of runtime/buildtime detection, is this really 
> the only way that
> libvirt has to disable it ?

Add the benefit description about this approach in v2.
Provide the opportunity to choose the specific configurations they wish 
to activate,
thereby avoiding potential PACKAGECONFIG conflicts between packages.

>
> Bruce
>
>     +            if ! ${@bb.utils.contains('PACKAGECONFIG', 'secrets',
>     'true', 'false', d)}; then
>     +                sed -i \
>     +                    -e
>     '/^Requires=virt-secret-init-encryption.service/d' \
>     +                    -e
>     '/^After=virt-secret-init-encryption.service/d' \
>     +                    -e '/^Environment=SECRETS_ENCRYPTION_KEY=/d' \
>     +                    -e '/^LoadCredentialEncrypted=/d' \
>     + ${D}${systemd_system_unitdir}/libvirtd.service
>     +            fi
>             fi
>
>             # The /run/libvirt directories created by the Makefile are
>     -- 
>     2.49.0
>
>
>     -=-=-=-=-=-=-=-=-=-=-=-
>     Links: You receive all messages sent to this group.
>     View/Reply Online (#9692):
>     https://lists.yoctoproject.org/g/meta-virtualization/message/9692
>     <https://urldefense.com/v3/__https://lists.yoctoproject.org/g/meta-virtualization/message/9692__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0seQbx4qdw$>
>     Mute This Topic:
>     https://lists.yoctoproject.org/mt/118773077/1050810
>     <https://urldefense.com/v3/__https://lists.yoctoproject.org/mt/118773077/1050810__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0sdUIwrPoQ$>
>     Group Owner: [email protected]
>     <mailto:meta-virtualization%[email protected]>
>     Unsubscribe:
>     https://lists.yoctoproject.org/g/meta-virtualization/unsub
>     <https://urldefense.com/v3/__https://lists.yoctoproject.org/g/meta-virtualization/unsub__;!!AjveYdw8EvQ!Y975dNSriLr4qezC-a4SpzjKfSb321z98fJvfsD2uPXGyVgpxiwy3UgwyX7V2hTcxDpEKATrBh1p0-RmGBSG0sd8XqPZXg$>
>     [[email protected]]
>     -=-=-=-=-=-=-=-=-=-=-=-
>
>
>
> -- 
> - Thou shalt not follow the NULL pointer, for chaos and madness await 
> thee at its end
> - "Use the force Harry" - Gandalf, Star Trek II
>