Re: [PATCH 02/13] qcrypto-luks: implement encryption key management

[Daniel P . Berrangé]

On Thu, Feb 06, 2020 at 02:20:11PM +0100, Markus Armbruster wrote:
> One more question regarding the array in
> 
>     { 'struct': 'QCryptoBlockAmendOptionsLUKS',
>       'data' : {
>                 'keys': ['LUKSKeyslotUpdate'],
>                  '*unlock-secret' : 'str' } }
> 
> Why an array?  Do we really need multiple keyslot updates in one amend
> operation?

I think it it is unlikely we'd use this in libvirt. In the case of wanting
to *change* a key, it is safer to do a sequence of "add key" and then
"remove key". If you combine them into the same operation, and you get
an error back, it is hard to know /where/ it failed ? was the new key
added or not ?

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|