Hi， I used 'virsh snapshot-create' create an encrypted external snapshot, when I try to use 'qemu-img check' top file, found no entrance to pass backing-file's secret-id 1、Version centos-release-8.2-2.2004.0.1.el8.x86_64 libvirt.x86_64 6.0.0-17.el8 qemu-kvm.x86_64 15:4.2.0-19.el82、Reproduce Steps 1)Create an encrypted qcow2 qemu-img create --object secret,id=sec0,data=123456 -f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 first.qcow2 1G 2)Create external snapshot with 'encrypted' xml # cat snap.xml <domainsnapshot> <disks> <disk name='hdc' snapshot='no'/> <disk name='vdb' snapshot='external'> <source file='/root/first-snapshot.qcow2'> <encryption format='luks'> <secret type='passphrase' uuid='f52a81b2-424e-490c-823d-6bd4235bc572'/> </encryption> </source> </disk> </disks> </domainsnapshot> # virsh dumpxml test-vm | awk '/<disk/,/<\/disk/' <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/root/first-snapshot.qcow2' index='5'/> <backingStore type='file' index='2'> <format type='qcow2'/> <source file='/root/first.qcow2'> <encryption format='luks'> <secret type='passphrase' uuid='f981dd17-143f-45bc-88e6-222222222222'/> </encryption> </source> <backingStore/> </backingStore> <target dev='vdb' bus='virtio'/> <encryption format='luks'> <secret type='passphrase' uuid='f52a81b2-424e-490c-823d-6bd4235bc572'/> </encryption> <alias name='virtio-disk1'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/> </disk> 3)try to qemu-img check top qcow2 file Note: The secid of the backing file is not recorded, so when I use qemu-img check/etc.. how to pass the secret to qemu of backing files # qemu-img info -U first-snapshot.qcow2 image: first-snapshot.qcow2 file format: qcow2 virtual size: 1 GiB (1073741824 bytes) disk size: 544 KiB encrypted: yes cluster_size: 65536 backing file: /root/first.qcow2 ### backing file: json:{"encrypt.format": "luks", "encrypt.key-secret": "secrete-id"} backing file format: luks Format specific information: compat: 1.1 lazy refcounts: false refcount bits: 16 encrypt: ivgen alg: plain64 hash alg: sha256 cipher alg: aes-256 uuid: e4158089-26e4-433f-990e-1d1d0723feee format: luks cipher mode: xts slots: [0]: active: true iters: 1257888 key offset: 4096 stripes: 4000 [1]: active: false key offset: 262144 [2]: active: false key offset: 520192 [3]: active: false key offset: 778240 [4]: active: false key offset: 1036288 [5]: active: false key offset: 1294336 [6]: active: false key offset: 1552384 [7]: active: false key offset: 1810432 payload offset: 2068480 master key iters: 300073 corrupt: false # qemu-img check -U --object secret,id=sec_1,file=/etc/libvirt/secrets/f52a81b2-424e-490c-823d-6bd4235bc572.base64,format=base64 --image-opts encrypt.format=luks,encrypt.key-secret=sec_1,file.filename=first-snapshot.qcow2 --object secret,id=sec_2,file=/etc/libvirt/secrets/f981dd17-143f-45bc-88e6-222222222222.base64,format=base64 qemu-img: Could not open 'encrypt.format=luks,encrypt.key-secret=sec_1,file.filename=first-snapshot.qcow2': Could not open backing file: Parameter 'key-secret' is required for cipher yaohua.wu(a)zstack.io