Meeting 26/11/2025

# Keylime Community Meeting - November 26, 2025

## Attendees

  - [ ] @ansasaki
  - [ ] @aplanas
  - [ ] @deeglaze
  - [ ] @edwards-n
  - [ ] @ematery
  - [ ] @galmasi
  - [ ] @husky-parul
  - [ ] @Isaac-Matthews
  - [ ] @kkaarreell
  - [ ] @maugustosilva
  - [ ] @mayaCostantini
  - [ ] @marcostork
  - [ ] @mdrocco
  - [ ] @mbestavros
  - [ ] @mheese
  - [ ] @mruffin
  - [ ] @mpeters
  - [ ] Niteesh Dubey
  - [ ] @ruocco
  - [ ] @stringlytyped
  - [ ] @stefanberger
  - [ ] @THS-on
  - [ ] @tpletcher-hpe
  - [ ] @tylerfanelli
  - [ ] @ueno
  - [ ] @sarroutbi
  - [ ] @sergio-correia
  - [ ] @gnurugs
  - [ ] Shiva Dasari
  - [ ] Christian Schilling

Time: 26/11/2025 16:00 UTC (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20251126T16)

Keylime Community Meeting
Wednesday, November 26 · 5:00 – 6:00pm
Time zone: Europe/Madrid
Google Meet joining info
Video call link: https://meet.google.com/ckn-povx-haz
Or dial: <202a>(ES) +34 955 25 63 98<202c> PIN: <202a>832 211 063<202c>#
More phone numbers: https://tel.meet/ckn-povx-haz?pin=2304316365525
Or join via SIP: sip:2304316365525@gmeet.redhat.com

## Topics

* Current stable releases:
    * [Keylime v7.13.0](https://github.com/keylime/keylime/releases/tag/v7.13.0)
    * [Agent v0.2.8](https://github.com/keylime/rust-keylime/releases/tag/v0.2.8)

* Push model updates and improvements
    * `#keylime-push-attestation` channel on [CNCF Slack](https://slack.cncf.io)
    * Publicly accessible project: [https://github.com/orgs/keylime/projects/5](https://github.com/orgs/keylime/projects/5)
    * Recent improvements to PUSH mode stability and monitoring:
        * Event-driven PUSH mode agent monitoring implemented
        * Fixed PUSH mode agent recovery from timeout-induced failures
        * Improved attestation status tracking with new fields (attestation_status, attestation_period)
        * Enhanced operational_state handling for PUSH mode agents
        * HTTPS requirement enforced for authentication, registration and attestation endpoints

* Database and SQLAlchemy 2.0 migration
    * Work in progress on database race conditions and SQLAlchemy 2.0 compatibility
    * Fixes for Fedora 42 compatibility with PostgreSQL backend
    * Addressed connection pool management across process forks
    * Migration from deprecated SQLAlchemy 1.x API to 2.0 API
    * Python 3.13 compatibility improvements
    * Branch: `include-new-attestation-information`

* Rust agent updates
    * Authentication middleware integration improvements
    * Enhanced logging consistency and coherency
    * Payload key persistence to avoid attestation failure on restart
    * Improved RFC compliance for Location header and URI parsing
    * Fixed RSA2048 and ECC algorithm reporting
    * Separate keys for payload mechanism and mTLS
    * Docker improvements to include keylime_push_model_agent binary

* Keylime and Post-Quantum Cryptography
    * Planned enhancement proposal: support dual certification on all server components
        * This will allow deployments using different key types at the same time for TLS (e.g. RSA and ML-DSA)

* Mentorship project CMW, EAT in collaboration with Veraison
    * [https://github.com/veraison/.github/issues/6](https://github.com/veraison/.github/issues/6)

* Enhancements:
    * 123_verifier_evidence_types [https://github.com/keylime/enhancements/pull/124](https://github.com/keylime/enhancements/pull/124)
        * Add support for other evidences types to the evidence verification endpoint
        * Merged!
        * The implementation was also merged: https://github.com/keylime/keylime/pull/1788
    * 126_verify_evidence_jwt https://github.com/keylime/enhancements/pull/127
        * Add JWT format response for the one-shot attestation endpoint
        * Merged!
        * Implementation pending
        * Note: JWE response was removed from the enhancement
    * 121_verify_evidence_api https://github.com/keylime/enhancements/pull/122
        * Verification API - endpoint name updated
    * 114_agent_multiple_api https://github.com/keylime/enhancements/pull/115
        * Add support for multiple API versions to the agent
        * Merged!
    * 112_nk_improvements https://github.com/keylime/enhancements/pull/113
        * Improvements around the Transport Key (NK)
        * Merged!
    * 98_spire_integration
        * SPIRE integration proposal
        * In progress

* Open PRs:
    * Keylime:
        * [**#1823** - Fix Database race conditions and SQLAlchemy 2.0 compatibility](https://github.com/keylime/keylime/pull/1823) - @sarroutbi
        * [**#1818** - Include new attestation information fields](https://github.com/keylime/keylime/pull/1818) - @sarroutbi
        * [**#1812** - Removed sphinx prompt from conf file because it caused build issues](https://github.com/keylime/keylime/pull/1812) - @msafarik
        * [**#1810** - verify/evidence: Add claims to JSON response](https://github.com/keylime/keylime/pull/1810) - @tylerfanelli
        * [**#1809** - docs: Add configuration options tables](https://github.com/keylime/keylime/pull/1809) - @ansasaki
        * [**#1781** - fix: resolve extreme line-too-long violations in keylime/tenant.py](https://github.com/keylime/keylime/pull/1781) - @msafarik
        * [**#1777** - Add support for CMW evidence format - server side](https://github.com/keylime/keylime/pull/1777) - @HarshvMahawar
        * [**#1731** - Push authentication](https://github.com/keylime/keylime/pull/1731) (Draft) - @gnurugs
        * [**#1715** - Allow separate CA and logging configurations for components](https://github.com/keylime/keylime/pull/1715) - @marcostork
        * [**#1670** - Add webhook for receiving and modifying registrar identity trust decisions](https://github.com/keylime/keylime/pull/1670) (Draft) - @stringlytyped
        * [**#1668** - Add support for EK Certificate Chain, resolves #1552](https://github.com/keylime/keylime/pull/1668) - @ematery
        * [**#1545** - Add support for a reject list in runtime policy](https://github.com/keylime/keylime/pull/1545) - @stefanberger
    * Agent (rust-keylime):
        * [**#1151** - Add minor README.md rephrasing](https://github.com/keylime/rust-keylime/pull/1151) - @sarroutbi
        * [**#1150** - docs: add documentation on FQDN hostnames](https://github.com/keylime/rust-keylime/pull/1150) - @tuminoid
        * [**#1149** - build(deps): bump clap from 4.5.45 to 4.5.51](https://github.com/keylime/rust-keylime/pull/1149) - dependabot
        * [**#1147** - build(deps): bump actions/upload-artifact from 4 to 5](https://github.com/keylime/rust-keylime/pull/1147) - dependabot
        * [**#1143** - build(deps): bump pest_derive from 2.8.1 to 2.8.3](https://github.com/keylime/rust-keylime/pull/1143) - dependabot
        * [**#1142** - build(deps): bump pest from 2.8.1 to 2.8.3](https://github.com/keylime/rust-keylime/pull/1142) - dependabot
        * [**#1139** - Add TLS support for Registrar communication](https://github.com/keylime/rust-keylime/pull/1139) - @sarroutbi
        * [**#1131** - build(deps): bump tempfile from 3.21.0 to 3.23.0](https://github.com/keylime/rust-keylime/pull/1131) - dependabot
        * [**#1118** - build(deps): bump chrono from 0.4.41 to 0.4.42](https://github.com/keylime/rust-keylime/pull/1118) - dependabot
        * [**#1107** - Add unwrap/panic detection for Push Model files](https://github.com/keylime/rust-keylime/pull/1107) (Draft) - @sarroutbi
        * [**#1104** - Make compilation to fail on warnings](https://github.com/keylime/rust-keylime/pull/1104) (Draft) - @sarroutbi
        * [**#1068** - keylimectl: A replacement for `keylime_tenant` in rust](https://github.com/keylime/rust-keylime/pull/1068) (Draft) - @ansasaki
        * [**#1051** - add support for CMW evidence format - agent side](https://github.com/keylime/rust-keylime/pull/1051) - @HarshvMahawar
        * [**#986** - Update rust-config to 0.15](https://github.com/keylime/rust-keylime/pull/986) - @LecrisUT
        * [**#658** - Remove deprecated zmq revocation notification feature](https://github.com/keylime/rust-keylime/pull/658) - @arkivm


## Recent Merged Work Highlights

* PUSH mode stability improvements (multiple commits merged to master):
    * Allow PUSH mode agents to recover immediately from failures
    * Fixed tenant status to only use PUSH mode when appropriate
    * Event-driven PUSH mode agent monitoring implementation
    * Auto-detection of push vs pull mode
    * Enhanced attestation status tracking

* Rust agent improvements:
    * Authentication client with middleware integration
    * Improved logging consistency
    * Payload key persistence
    * Algorithm reporting fixes (RSA2048, ECC)
    * Separate keys for payload and mTLS

## Action Items

* [ ] Review and test database race condition fixes (SQLAlchemy 2.0 migration)
* [ ] Continue PUSH mode testing and stabilization
* [ ] Review pending enhancement implementations (JWT response format)
* [ ] Follow up on Post-Quantum Cryptography enhancement proposal
* [ ] Keylime registrar does not reject same UUID from different TPM
* [ ] Add support for CMW evidence format - agent side

## Next Meeting

Next meeting: December 17, 2025 16:00 UTC

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Meeting 26/11/2025 #93

Keylime Community Meeting - November 26, 2025

Attendees

Topics

Recent Merged Work Highlights

Action Items

Next Meeting

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Uh oh!

Meeting 26/11/2025 #93

Description

Keylime Community Meeting - November 26, 2025

Attendees

Topics

Recent Merged Work Highlights

Action Items

Next Meeting

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions