Meeting 24/01/24

[THS-on]

Attendees

• [x] @ansasaki
• [ ] @aplanas
• [x] @edwards-n
• [x] @galmasi
• [x] @Isaac-Matthews
• [x] @kkaarreell
• [ ] @lkatalin
• [ ] @lukehinds
• [x] @maugustosilva
• [ ] @mayaCostantini
• [ ] @mdrocco
• [x] @mbestavros
• [x] @mheese
• [x] @mruffin
• [x] @mpeters
• [ ] Niteesh Dubey
• [ ] @osresearch
• [x] @ruocco
• [x] @stringlytyped
• [ ] @stefanberger
• [x] @THS-on
• [ ] @tpletcher-hpe
• [ ] @ueno
• [x] @sergio-correia
• [x] Supreshna
• [x] Christian Schilling

Time: 24/01/24 15:30 GMT (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20240124T1530&p1=136&ah=1) Meeting link: https://uni-kiel.zoom-x.de/j/62904262234?pwd=TFVIcFhqSldENDJCV01qZWVEeDRrUT09

Meeting ID: 629 0426 2234 Passcode: 306755

Agenda

• Operator updates
  • Initial PR is merged
  • Secret management for the CI/CD pipeline needs to be addressed
  • What are the requirements for the policies?
  • Discussion on Slack for general community feedback
• IMA issue (https://github.com/keylime/keylime/issues/1515)
  • There are some limitations to IMA regarding downgrades
  • Policies would need to apply to a certain point in the IMA log
  • Initial enhancement proposal will be created at some point
• Docs: https://readthedocs.org/projects/keylime-docs/ vs https://readthedocs.org/projects/keylime/
  • Both locations stay online, but with the same content
• New version (v7.9.0)
  • @maugustosilva will release a new version this week
• Potential work on standardizing agents used for Confidential and Trusted Computing: https://lore.kernel.org/linux-coco/CAAH4kHarATWGg6S9DGA9a+yvSgLGY417xf2AZGO0ae=f2Z2aKQ@mail.gmail.com/T/#u
  • We can add our requirements for TPM based evidence
• update push model
  • Firt PR likely this week
  • Introduces new abstractions for APIs and data models first
• Keylime as verifier API for MB and IMA: https://github.com/keylime/enhancements/issues/105
  • Needs a defined API via enhancement proposal. Should be relatively simple. Proof-of-Concept is around 150 lines of code
• moving from CNCF Sandbox to Incubation - @mpeters
  • @mpeters is going forward with preparing Keylime for submission
• potential integration with Enterprise Contract @mbestavros
  • Entry point into Keylime could be done using the durable attestation API
• Discussion on bringing back TPM 1.2 support
  • Would require maintaining the entire stack (no maintained TSS library or rust bindings)
  • Heavy usage of sha1 would require it to be a very optional feature
  • Likely not going to happen

[mbestavros]

Long time no see, Keylime community!

In the time since I've moved off of Keylime, I've been contributing to Enterprise Contract: https://enterprisecontract.dev/

In essence, it's meant to be a decision engine that applies rules to metadata produced by a supply chain (so think Tekton build information, signatures, etc) to decide if artifacts and the pipelines that make them conform to a set of rules (SLSA, for example).

There has been some talk among the team of whether Keylime could be something we integrate with, and as the local Keylime alum, I thought I'd reach out! If there's room in the agenda, I'd love to get a conversation rolling.

[stringlytyped]

Happy to give an update on the push model work today, if that would be of interest. Also, we had a question about an unconventional use for Keylime so we would be grateful if we could pick your collective brain about that. Talk to you all later