On Mon, Nov 11, 2019 at 05:58:20PM +0200, Maxim Levitsky wrote: > I will try to explain the interface with bunch of examples:
I want to fill in equiv examples from cryptsetup for sake of comparison > # adds a new password, defined by qemu secret 'sec0' to first unused slot > # give user a error if all keyslots are occupied > qemu-img amend --secret ... -o key-secret=sec1 image.luks cryptsetup luksAddKey --key-file currentkey.txt \ --new-key-file newkey.txt \ /dev/mapper/foo > # erases all keyslots that can be opened by password that is contained in a > qemu secret 'sec0' > # active=off means that the given password/keyslot won't be active after the > operation > qemu-img amend --secret ... -o key-secret=sec0,active=off image.luks cryptsetup luksRemoveKey --key-file currentkey.txt \ /dev/mapper/foo > # erase the slot 5 (this is more low level command, less expected to be used) > qemu-img amend --secret ... -o slot=5,active=off image.luks cryptsetup luksKillSlot /dev/mapper/foo 5 > # add new secret to slot 5 (will fail if the slot is already marked as active) > qemu-img amend --secret ... -o slot=5,key-secret=sec1 image.luks cryptsetup luksAddKey --key-file currentkey.txt \ --new-key-file newkey.txt \ --key-slot 5 \ /dev/mapper/foo They look very different in syntax because they are taking two differnet approaches. The cryptsetup approach is functional, where the user states what action they want performed. The qemu-img amend approach is declarative, where the user expresses what end state they want the image to be in. The challenge is that the qemu-img proposal isn't fully declarative as we are only partially expressing the end state, attempting to leave other slots unspecified. This is good as it means we don't have to specify a huge amount of data on the CLI. This is bad as makes it less obvious what actual effects of the commands will be and I feel users will end up needing to read the manual every time to re-learn it. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|