On Fri, Nov 20, 2015 at 03:15:27PM -0700, Eric Blake wrote: > On 11/20/2015 11:04 AM, Daniel P. Berrange wrote: > > Add a 'keyid' parameter that refers to the ID of a > > QCryptoSecret instance that provides the encryption key. > > > > $QEMU \ > > -object secret,id=sec0,filename=/home/berrange/encrypted.pw \ > > -drive file=/home/berrange/encrypted.qcow2,keyid=sec0 > > > > Signed-off-by: Daniel P. Berrange <berra...@redhat.com> > > --- > > block/qcow2.c | 80 > > +++++++++++++++++++++++++++++++++++++--------------- > > block/qcow2.h | 1 + > > qapi/block-core.json | 8 ++++-- > > 3 files changed, 64 insertions(+), 25 deletions(-) > > > +++ b/qapi/block-core.json > > @@ -1698,7 +1698,7 @@ > > # Driver specific block device options for qcow. > > # > > # @keyid: #optional ID of the "secret" object providing the > > -# AES decryption key. > > +# AES decryption key (since 2.5) > > # > > # Since: 2.5 > > I already pointed this out on the previous post, but this hunk is wrong > (since the entire BlockdevOptionsQcow struct is new); it instead belongs... > > > ## > > @@ -1742,6 +1742,9 @@ > > # caches. The interval is in seconds. The default > > value > > # is 0 and it disables this feature (since 2.5) > > # > > +# @keyid: #optional ID of the "secret" object providing the > > +# AES decryption key. > > ...here as part of BlockdevOptionsQcow2. Also, I wonder if inheriting > from BlockdevOptionsQcow is any easier here than just declaring keyid > directly.
When I fully integrate LUKS support in qcow2, there will be several more parameters added to this struct, which I won't be adding to qcow, since I don't fancy doing any work on qcow code to improve its encryption, since its essentially obsolte. So on this basis, I don't think inheriting BlockdevOptionsQcow will have tangible benefit. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
