Meeting 27/05/2026

[ansasaki]

Keylime Community Meeting - May 27, 2026

Attendees

• @ansasaki
• @aplanas
• @deeglaze
• @edwards-n
• @ematery
• @galmasi
• @husky-parul
• @Isaac-Matthews
• @kkaarreell
• @maugustosilva
• @mayaCostantini
• @marcostork
• @mdrocco
• @mbestavros
• @mheese
• @mruffin
• @mpeters
• Niteesh Dubey
• @ruocco
• @stringlytyped
• @stefanberger
• @THS-on
• @tpletcher-hpe
• @tylerfanelli
• @ueno
• @sarroutbi
• @sergio-correia
• @gnurugs
• Shiva Dasari
• Christian Schilling

Time: 27/05/2026 14:00 UTC (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20260527T14)

Keylime community meeting
Google Meet joining info
Video call link: https://meet.google.com/nos-bkdi-cnn
Or dial: (DE) +49 30 300195060 PIN: 607 390 654 8381#
More phone numbers: https://tel.meet/nos-bkdi-cnn?pin=6073906548381
Or join via SIP: sip:6073906548381@gmeet.redhat.com

Topics

• Current stable releases:

  • Keylime v7.14.2
  • Agent v0.2.9

• New release - Keylime v7.14.2 (2026-05-06):

  • Bundles all the stability and bug-fix work from the past cycle

• Verifier stability & bug fixes:

  • Fixed TOCTOU race where process_agent() could overwrite a TERMINATED state
    • #1902 - verifier: Prevent process_agent() from overwriting TERMINATED state (TOCTOU race)
  • SyncManager socket now falls back to temp directory when /run/keylime is unavailable; also fixes cleanup logging
    • #1890 - Fall back to temp directory for SyncManager socket and fix cleanup logging
  • Deprecated /var/run paths replaced with /run
    • #1905 - Replace deprecated /var/run with /run

• Configuration:

  • New max_workers config option caps the number of verifier worker processes
    • #1907 - server: Add max_workers config to cap worker process count

• Push-Attestation:

  • Fixed agent status tracking across restarts and recovery in PUSH mode
    • #1889 - Fix PUSH mode agent status tracking across restarts and recovery
  • Rust agent now caches UEFI event log bytes at startup to avoid post-privilege-drop read failures
    • #1223 - fix push-mode: cache UEFI event log bytes at startup to avoid post-privilege-drop failures

• TPM / IAK Certification:

  • Qualifying data is now hashed in TPM2_Certify for IAK-based AK certification (both verifier and agent)
    • #1911 - tpm: Hash qualifying data in TPM2_Certify for IAK-based AK certification
    • #1239 - tpm: Hash qualifying data in TPM2_Certify for IAK-based AK certification

• Documentation:

  • Attestation status fields in the verifier REST API are now documented
    • #1899 - Document attestation status fields in verifier REST API
  • Wildcard bind address behaviour documented for the verifier
    • #1897 - Document verifier wildcard bind address

• Keylime and Post-Quantum Cryptography:

  • Enhancement proposal for dual certification on all server components
  • Proposal #129: Dual TLS certification and crypto agility enhancements#130

• Mentorship project CMW, EAT in collaboration with Veraison:

  • Veraison Mentorship: Harmonizing Open-Source Verifiers with RATS Standards veraison/.github#6

• Enhancements:

  • #130 - Dual TLS certification and crypto agility
  • #120 - Multiple addresses for server
  • #93 - Optional Paths Proposal

• Open PRs:

  • keylime/keylime:
    • #1912 - [CI] Split e2e CI testing to fast and full
    • #1881 - docs: Fix verifier REST API docs and add undocumented endpoints
    • #1879 - tpm: use only policy's relevant PCRs for event log verification
    • #1878 - elparsing: check tpm2_eventlog exit code instead of stderr
    • #1812 - Removed sphinx prompt from conf file because it caused build issues
    • #1777 - Add support for CMW evidence format - server side
    • #1668 - Add support for EK Certificate Chain
    • #1545 - Add support for a reject list in runtime policy
  • keylime/rust-keylime:
    • #1104 - Make compilation to fail on warnings
    • #1051 - add support for CMW evidence format - agent side
    • #986 - Update rust-config to 0.15
    • #658 - Remove deprecated zmq revocation notification feature

Action Items

• Follow up on Post-Quantum Cryptography enhancement proposal
• Add support for CMW evidence format - agent side
• Define policy on which versions receive upstream security fixes (suggested: latest 2 stable releases)

Next Meeting

Next meeting: 24/06/2026 14:00 UTC