Meeting 24/01/24

[THS-on]

Attendees

• @ansasaki
• @aplanas
• @edwards-n
• @galmasi
• @Isaac-Matthews
• @kkaarreell
• @lkatalin
• @lukehinds
• @maugustosilva
• @mayaCostantini
• @mdrocco
• @mbestavros
• @mheese
• @mruffin
• @mpeters
• Niteesh Dubey
• @osresearch
• @ruocco
• @stringlytyped
• @stefanberger
• @THS-on
• @tpletcher-hpe
• @ueno
• @sergio-correia
• Supreshna
• Christian Schilling

Time: 24/01/24 15:30 GMT (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20240124T1530&p1=136&ah=1)
Meeting link: https://uni-kiel.zoom-x.de/j/62904262234?pwd=TFVIcFhqSldENDJCV01qZWVEeDRrUT09

Meeting ID: 629 0426 2234
Passcode: 306755

Agenda

• Operator updates
  • Initial PR is merged
  • Secret management for the CI/CD pipeline needs to be addressed
  • What are the requirements for the policies?
    • Discussion on Slack for general community feedback
• IMA issue (IMA and Keylime in the presence of package updates keylime#1515)
  • There are some limitations to IMA regarding downgrades
  • Policies would need to apply to a certain point in the IMA log
  • Initial enhancement proposal will be created at some point
• Docs: https://readthedocs.org/projects/keylime-docs/ vs https://readthedocs.org/projects/keylime/
  • Both locations stay online, but with the same content
• New version (v7.9.0)
  • @maugustosilva will release a new version this week
• Potential work on standardizing agents used for Confidential and Trusted Computing: https://lore.kernel.org/linux-coco/CAAH4kHarATWGg6S9DGA9a+yvSgLGY417xf2AZGO0ae=f2Z2aKQ@mail.gmail.com/T/#u
  • We can add our requirements for TPM based evidence
• update push model
  • Firt PR likely this week
  • Introduces new abstractions for APIs and data models first
• Keylime as verifier API for MB and IMA: Exposing Measured Boot and IMA parsing and validation as REST API enhancements#105
  • Needs a defined API via enhancement proposal. Should be relatively simple. Proof-of-Concept is around 150 lines of code
• moving from CNCF Sandbox to Incubation - @mpeters
  • @mpeters is going forward with preparing Keylime for submission
• potential integration with Enterprise Contract @mbestavros
  • Entry point into Keylime could be done using the durable attestation API
• Discussion on bringing back TPM 1.2 support
  • Would require maintaining the entire stack (no maintained TSS library or rust bindings)
  • Heavy usage of sha1 would require it to be a very optional feature
  • Likely not going to happen

[mbestavros]

Long time no see, Keylime community!

In the time since I've moved off of Keylime, I've been contributing to Enterprise Contract: https://enterprisecontract.dev/

In essence, it's meant to be a decision engine that applies rules to metadata produced by a supply chain (so think Tekton build information, signatures, etc) to decide if artifacts and the pipelines that make them conform to a set of rules (SLSA, for example).

There has been some talk among the team of whether Keylime could be something we integrate with, and as the local Keylime alum, I thought I'd reach out! If there's room in the agenda, I'd love to get a conversation rolling.

[stringlytyped]

Happy to give an update on the push model work today, if that would be of interest. Also, we had a question about an unconventional use for Keylime so we would be grateful if we could pick your collective brain about that. Talk to you all later