libvirt: disable secrets encryption for embedded environments

Libvirt v12 added encrypted secrets storage using systemd-creds. The
build-time virt-secret-init-encryption.service generates an encrypted
credential via 'systemd-creds encrypt' tied to the build host's TPM
or machine key. At runtime in a QEMU VM (or any different machine),
the credential cannot be decrypted, causing libvirtd to fail with
"Invalid encryption key for the secret" and refuse to start.

Set encrypt_data = 0 in secret.conf and remove the stale build-time
encrypted key file. Embedded and QEMU-based environments do not have
persistent machine credentials needed for this feature.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 10 insertions, 0 deletions

diff --git a/recipes-extended/libvirt/libvirt_git.bb b/recipes-extended/libvirt/libvirt_git.bb
index f2fa7321..40b3f31a 100644
--- a/recipes-extended/libvirt/libvirt_git.bb
+++ b/recipes-extended/libvirt/libvirt_git.bb
@@ -217,6 +217,16 @@ do_install:append() {
         install -m 0644 ${UNPACKDIR}/libvirtd.conf ${D}/etc/libvirt/libvirtd.conf
         install -m 0644 ${UNPACKDIR}/libvirt-qemu.conf ${D}${nonarch_libdir}/sysusers.d/libvirt-qemu.conf
 
+        # Disable secrets encryption — requires systemd-creds with TPM or
+        # persistent host key that embedded/QEMU environments do not have.
+        # The encrypted credential generated at build time cannot be decrypted
+        # at runtime on a different machine, causing libvirtd to fail with
+        # "Invalid encryption key for the secret".
+        sed -i 's/^#encrypt_data = 1/encrypt_data = 0/' ${D}${sysconfdir}/libvirt/secret.conf
+        # Remove the stale build-time encrypted key so the init service
+        # does not skip regeneration on first boot
+        rm -f ${D}${localstatedir}/lib/libvirt/secrets/secrets-encryption-key
+
         if ${@bb.utils.contains('DISTRO_FEATURES','sysvinit','true','false',d)}; then
             # This will wind up in the libvirtd package, but will NOT be invoked by default.
             #