Meeting 25/03/2026

[ansasaki]

Keylime Community Meeting - March 25, 2026

Attendees

• @ansasaki
• @aplanas
• @deeglaze
• @edwards-n
• @ematery
• @galmasi
• @husky-parul
• @Isaac-Matthews
• @kkaarreell
• @maugustosilva
• @mayaCostantini
• @marcostork
• @mdrocco
• @mbestavros
• @mheese
• @mruffin
• @mpeters
• Niteesh Dubey
• @ruocco
• @stringlytyped
• @stefanberger
• @THS-on
• @tpletcher-hpe
• @tylerfanelli
• @ueno
• @sarroutbi
• @sergio-correia
• @gnurugs
• Shiva Dasari
• Christian Schilling

Time: 25/03/2026 16:00 UTC (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20260325T16)

Keylime community meeting
Google Meet joining info
Video call link: https://meet.google.com/nos-bkdi-cnn
Or dial: ‪(DE) +49 30 300195060‬ PIN: ‪607 390 654 8381‬#
More phone numbers: https://tel.meet/nos-bkdi-cnn?pin=6073906548381
Or join via SIP: sip:6073906548381@gmeet.redhat.com

Topics

• Current stable releases:

  • Keylime v7.14.1
  • Agent v0.2.9

• Push-Attestation progress:

  • Registrar v3 API routes merged, continuing work on finishing all v3 endpoints
    • #1854 - registrar: Add API version 3 routes
  • Agent fixes for push-attestation TLS connectivity
    • #1204 - push-attestation: Use correct port when registrar TLS is enabled
  • Cleanup of legacy authentication config
    • #1868 - Remove enable_authentication agent config option

• Database stability fixes:

  • Fixed memory leak caused by unbounded cache in attestation path
    • #1866 - fix(mem leak) - remove unbounded functools.cache from latest_attestation
  • Hardened DB session lifecycle to prevent connection exhaustion and fork safety issues
    • #1865 - fix: Harden DBManager session lifecycle and fork safety
    • #1863 - Close DB sessions to prevent connection exhaustion

• Build and CI improvements:

  • #1864 - fix: Align black linter configuration between tox and pre-commit
  • #1205 - Remove generate-bindings feature from tss-esapi

• Keylime and Post-Quantum Cryptography:

  • Enhancement proposal for dual certification on all server components (support different key types simultaneously for TLS, e.g. RSA and ML-DSA)
  • Proposal #129: Dual TLS certification and crypto agility enhancements#130

• Mentorship project CMW, EAT in collaboration with Veraison:

  • Veraison Mentorship: Harmonizing Open-Source Verifiers with RATS Standards veraison/.github#6

• Enhancements:

  • 98_spire_integration
    • SPIRE integration proposal
    • In progress

• Open PRs:

  • keylime/keylime:
    • #1812 - Removed sphinx prompt from conf file because it caused build issues
    • #1809 - docs: Add configuration options tables
    • #1781 - fix: resolve extreme line-too-long violations in keylime/tenant.py
    • #1777 - Add support for CMW evidence format - server side
    • #1715 - Allow separate CA and logging configurations for components
    • #1668 - Add support for EK Certificate Chain
    • #1545 - Add support for a reject list in runtime policy
  • keylime/rust-keylime:
    • #1104 - Make compilation to fail on warnings
    • #1051 - Add support for CMW evidence format - agent side
    • #986 - Update rust-config to 0.15
    • #658 - Remove deprecated zmq revocation notification feature

Action Items

• Follow up on Post-Quantum Cryptography enhancement proposal
• Add support for CMW evidence format - agent side
• Define policy on which versions receive upstream security fixes (suggested: latest 2 stable releases)

Next Meeting

Next meeting: 22/04/2026 16:00 UTC

[ansasaki]

Meeting closed early: no quorum

[mcr]

Meeting closed early: no quorum

I thought the meeting was today.
Can we establish a calendar?

[ansasaki]

Meeting closed early: no quorum

I thought the meeting was today. Can we establish a calendar?

Hello @mcr , welcome, and thank you for the interest! The community meeting happens on every fourth Wednesday of the month