Meeting 29/04/2026

[ansasaki]

Keylime Community Meeting - April 29, 2026

Attendees

• @ansasaki
• @aplanas
• @deeglaze
• @edwards-n
• @ematery
• @galmasi
• @husky-parul
• @Isaac-Matthews
• @kkaarreell
• @maugustosilva
• @mayaCostantini
• @marcostork
• @mdrocco
• @mbestavros
• @mheese
• @mruffin
• @mpeters
• Niteesh Dubey
• @ruocco
• @stringlytyped
• @stefanberger
• @THS-on
• @tpletcher-hpe
• @tylerfanelli
• @ueno
• @sarroutbi
• @sergio-correia
• @gnurugs
• Shiva Dasari
• Christian Schilling

Time: 29/04/2026 14:00 UTC (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20260429T14)

Keylime community meeting
Google Meet joining info
Video call link: https://meet.google.com/nos-bkdi-cnn
Or dial: ‪(DE) +49 30 300195060‬ PIN: ‪607 390 654 8381‬#
More phone numbers: https://tel.meet/nos-bkdi-cnn?pin=6073906548381
Or join via SIP: sip:6073906548381@gmeet.redhat.com

Topics

• Current stable releases:

  • Keylime v7.14.1
  • Agent v0.2.9

• Verifier stability and robustness:

  • Graceful shutdown implemented — pending retries are cancelled and in-flight work is drained before exit
    • #1869 - Graceful shutdown for verifier: cancel pending retries and drain in-flight work
  • Fixed race condition when deleting an agent during attestation
    • #1874 - Prevent race condition when deleting agent during attestation
  • Manager processes now ignore SIGTERM/SIGINT to prevent orphaned children
    • #1883 - shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes

• SELinux and deployment fixes:

  • SyncManager socket moved to /var/run/keylime to resolve SELinux AVC denials
    • #1886 - Move SyncManager socket to /var/run/keylime to resolve SELinux AVC denials
  • Follow-up PR adds fallback to temp directory when /var/run/keylime is unavailable
    • #1890 - Fall back to temp directory for SyncManager socket and fix cleanup logging (open)

• Bug fixes:

  • Fixed timezone handling in Unix timestamp conversion
    • #1885 - Fix timezone handling in Unix timestamp conversion
  • CA organization updated from MITLL to Keylime
    • #1876 - Switch from CA organization of MITLL to Keylime

• Testing improvements:

  • Unit tests can now run against installed packages (not just source tree)
    • #1884 - test: Support test execution for installed package
  • Rust agent test infra updated to use Express-style named params in Mockoon endpoints
    • #1222 - tests: use Express-style named params in Mockoon endpoints

• Documentation:

  • Configuration options tables added to docs
    • #1809 - docs: Add configuration options tables

• Push-Attestation:

  • Agent-side fix: cache UEFI event log bytes at startup to avoid post-privilege-drop failures
    • #1223 - fix push-mode: cache UEFI event log bytes at startup to avoid post-privilege-drop failures (open)
  • Fix PUSH mode agent status tracking across restarts and recovery
    • #1889 - Fix PUSH mode agent status tracking across restarts and recovery (open)

• Keylime and Post-Quantum Cryptography:

  • Enhancement proposal for dual certification on all server components
  • Proposal #129: Dual TLS certification and crypto agility enhancements#130

• Mentorship project CMW, EAT in collaboration with Veraison:

  • Veraison Mentorship: Harmonizing Open-Source Verifiers with RATS Standards veraison/.github#6

• Enhancements:

  • #130 - Dual TLS certification and crypto agility
  • #120 - Multiple addresses for server
  • #93 - Optional Paths Proposal

• Open PRs:

  • keylime/keylime:
    • #1899 - Document attestation status fields in verifier REST API
    • #1897 - Document verifier wildcard bind address
    • #1890 - Fall back to temp directory for SyncManager socket and fix cleanup logging
    • #1889 - Fix PUSH mode agent status tracking across restarts and recovery
    • #1881 - docs: Fix verifier REST API docs and add undocumented endpoints
    • #1879 - tpm: use only policy's relevant PCRs for event log verification
    • #1878 - elparsing: check tpm2_eventlog exit code instead of stderr
    • #1812 - Removed sphinx prompt from conf file because it caused build issues
    • #1777 - Add support for CMW evidence format - server side
    • #1668 - Add support for EK Certificate Chain
    • #1545 - Add support for a reject list in runtime policy
  • keylime/rust-keylime:
    • #1223 - fix push-mode: cache UEFI event log bytes at startup to avoid post-privilege-drop failures
    • #1104 - Make compilation to fail on warnings
    • #1051 - Add support for CMW evidence format - agent side
    • #986 - Update rust-config to 0.15
    • #658 - Remove deprecated zmq revocation notification feature

Action Items

• Follow up on Post-Quantum Cryptography enhancement proposal
• Add support for CMW evidence format - agent side
• Define policy on which versions receive upstream security fixes (suggested: latest 2 stable releases)

Next Meeting

Next meeting: 27/05/2026 16:00 UTC

[ansasaki]

Meeting closed early: no quorum

[mcr]

Meeting closed early: no quorum

How did you know, 37 minutes before the meeting started that there was no quorum?

[phaer]

@ansasaki Is it possible you got the time zones wrong? Description says 22/04/2026 16:00 UTC, but your comment was posted at 15:21 UTC.

[ansasaki]

Oops, again hit by the timezone/summer time issue, sorry about that. Let's move it exceptionally to next Wednesday 14:00 UTC

EDIT: FYI @mcr @phaer