Meeting 24/05/23

[THS-on]

Attendees

• [x] @ansasaki
• [ ] @aplanas
• [ ] @edwards-n
• [x] @galmasi
• [ ] @kkaarreell
• [ ] @lkatalin
• [ ] @lukehinds
• [x] @maugustosilva
• [x] Margie
• [x] @mdrocco
• [ ] @mbestavros
• [x] @mheese
• [x] @mpeters
• [ ] @osresearch
• [ ] @ruocco
• [x] @stringlytyped
• [x] @stefanberger
• [x] @ SimonFrost-Arm
• [x] @THS-on
• [x] @tpletcher-hpe
• [ ] @ueno
• [x] Isaac
• [x] Supreshna

Time: 24/05/23 15:30 GMT, 16:30 CET (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20230524T1530&p1=769&ah=1) Link: https://uni-kiel.zoom.us/j/65228204390?pwd=eURBMlhCT3JiWEZLcjZuNTdicWF3Zz09 Meeting ID: 652 2820 4390 Passcode: 234236

Topics

• Architecture Design Meeting
  • Some initial thoughts described here https://github.com/keylime/meetings/issues/64#issuecomment-1505845083
  • "Low-hanging fruit" items:
    • "Pluginization" of MB and IMA (already in progress)
    • Removal of tpm2-tools (already in progress) :
  • Important functionality which could be introduced without disruption
    • "Auto add" agents to verifiers (i.e., registrars run part of tenant code)
    • Attest a fixed number of times and then stop (i.e., do not fail)
    • "Confidential Computing" (basically VMs) plugin (for registrar)
  • Fundamental (breaking, yet necessary) changes, requiring broader agreement among maintainers :
    • Push model
    • IDevID and IAK support
    • Bootstrap protocol (without K -> U/V) redesign
    • Verifier main loop redesign
• Technical debt
  • Make sure Durable Attestation with MB/IMA works from any "point in time"
  • A more robust (survivable to transient failures) SQLAlchemy interface
• Make Keylime easily deployable in Kubernetes/ Openshift environments:
  • A lot of interest from both Red Hat and IBM
  • A somewhat detailed initial strategy described here https://github.com/keylime/keylime/issues/1378
• Agreement from maintainers on "stable branches" (https://github.com/keylime/keylime/issues/1362)
• Collaboration with Veraison (https://github.com/veraison)
  • Agreeing on standards: RATS, EAR, DICE
  • Discuss architectural differences, plugin architecture
  • Joining the Veraison Zulip: https://veraison.zulipchat.com/

Actions

Meeting notes