From beb966e84df011f8039df61f24d941345164a2a3 Mon Sep 17 00:00:00 2001 From: Bruce Ashfield Date: Fri, 5 Jun 2026 20:10:42 +0000 Subject: libvirt: disable secrets encryption for embedded environments Libvirt v12 added encrypted secrets storage using systemd-creds. The build-time virt-secret-init-encryption.service generates an encrypted credential via 'systemd-creds encrypt' tied to the build host's TPM or machine key. At runtime in a QEMU VM (or any different machine), the credential cannot be decrypted, causing libvirtd to fail with "Invalid encryption key for the secret" and refuse to start. Set encrypt_data = 0 in secret.conf and remove the stale build-time encrypted key file. Embedded and QEMU-based environments do not have persistent machine credentials needed for this feature. Signed-off-by: Bruce Ashfield --- recipes-extended/libvirt/libvirt_git.bb | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'recipes-extended') diff --git a/recipes-extended/libvirt/libvirt_git.bb b/recipes-extended/libvirt/libvirt_git.bb index f2fa7321..40b3f31a 100644 --- a/recipes-extended/libvirt/libvirt_git.bb +++ b/recipes-extended/libvirt/libvirt_git.bb @@ -217,6 +217,16 @@ do_install:append() { install -m 0644 ${UNPACKDIR}/libvirtd.conf ${D}/etc/libvirt/libvirtd.conf install -m 0644 ${UNPACKDIR}/libvirt-qemu.conf ${D}${nonarch_libdir}/sysusers.d/libvirt-qemu.conf + # Disable secrets encryption — requires systemd-creds with TPM or + # persistent host key that embedded/QEMU environments do not have. + # The encrypted credential generated at build time cannot be decrypted + # at runtime on a different machine, causing libvirtd to fail with + # "Invalid encryption key for the secret". + sed -i 's/^#encrypt_data = 1/encrypt_data = 0/' ${D}${sysconfdir}/libvirt/secret.conf + # Remove the stale build-time encrypted key so the init service + # does not skip regeneration on first boot + rm -f ${D}${localstatedir}/lib/libvirt/secrets/secrets-encryption-key + if ${@bb.utils.contains('DISTRO_FEATURES','sysvinit','true','false',d)}; then # This will wind up in the libvirtd package, but will NOT be invoked by default. # -- cgit v1.2.3-54-g00ecf