Meeting 25/06/2025

[ansasaki]

Attendees

• @ansasaki
• @aplanas
• @deeglaze
• @edwards-n
• @ematery
• @galmasi
• @husky-parul
• @Isaac-Matthews
• @kkaarreell
• @maugustosilva
• @mayaCostantini
• @marcostork
• @mdrocco
• @mbestavros
• @mheese
• @mruffin
• @mpeters
• Niteesh Dubey
• @ruocco
• @stringlytyped
• @stefanberger
• @THS-on
• @tpletcher-hpe
• @tylerfanelli
• @ueno
• @sarroutbi
• @sergio-correia
• @gnurugs
• Shiva Dasari
• Christian Schilling

Time: 25/06/2025 15:00 UTC (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20250625T15)

Google Meet joining info
Video call link: https://meet.google.com/nos-bkdi-cnn
Or dial: ‪(DE) +49 30 300195060‬ PIN: ‪607 390 654 8381‬#
More phone numbers: https://tel.meet/nos-bkdi-cnn?pin=6073906548381
Or join via SIP: sip:6073906548381@gmeet.redhat.com

Topics

• Push model updates
  • #keylime-push-attestation channel on CNCF Slack
  • Publicly accessible project: Agent-driven attestation
  • We are working on the configuration and TPM quote gathering.
• Mentorship project CMW, EAT in collaboration with Veraison
  • Veraison Mentorship: Harmonizing Open-Source Verifiers with RATS Standards veraison/.github#6
• Enhancements:
  • One shot attestation: Create enhancement #121 - Verification API enhancements#122
    • Enhancement merged, implementation proposed #1753
  • TEE Boot Attestation: TEE Boot Attestation proposal enhancements#108
    • Closed as it became stale. A new related en hancement proposal was created
  • 123_verifier_evidence_types123_verifier_evidence_types enhancements#124
    • Newly open, about supporting other evidences types in the one-shot
      attestation endpoint
  • Adding enhancement #98 for SPIRE integrationAdding enhancement #98 for SPIRE integration enhancements#100
    • Merged, implementation in https://github.com/keylime/spire-keylime-plugin
• Open PRs:
  • keylime/keylime
    • #1762 - Add CMW wrapper for Evidence in Keylime
      • Still open - CMW mentorship
    • #1759 - Tenant should validate action list
      • I'll ask the author if he wants to continue working on this or if we should close it
    • #1753 - Initial version of verify evidence enhancement
      • Still open, needs review and linting fixes
    • #1731 - Push authentication
      • Still open - push model
    • #1715 - Allow separate CA and logging configurations for components
    • #1693 - Add agent-driven (push) attestation protocol
      • Still open - push model
    • #1670 - Add webhook for receiving and modifying registrar identity trust decisions
      • Still open - push model
    • #1668 - Add support for EK Certificate Chain, resolves #1552
      • A rebase and fixes to pass linting are needed
    • #1545 - Add support for a reject list in runtime policy
  • keylime/rust-keylime
    • #1027 - build(deps): bump pest from 2.8.0 to 2.8.1
      • Not present in Fedora yet
    • #1025 - build(deps): bump actix-web from 4.10.2 to 4.11.0
      • Not present in Fedora yet
    • #1024 - build(deps): bump clap from 4.5.39 to 4.5.40
      • Not present in Fedora yet
    • #1023 - build(deps): bump cfg-if from 1.0.0 to 1.0.1
      • Not present in Fedora yet
    • #1015 - build(deps): bump openssl from 0.10.72 to 0.10.73
      • Not present in Fedora yet
    • #986 - Update rust-config to 0.15
      • Rebased but will probably hold until the next release so that we can make an update in Fedora before that
    • #658 - Remove deprecated zmq revocation notification feature
      • Probably stale, will close after confirming. The zmq removal should happen on next major release