15 April 2025

[donporter]

Agenda:

• Continue discussion of RFC: Support for filesystem migration after SGX SVN update #855 - Please review in advance and come prepared to discuss which proposal you favor.
• Next Release features
• Development priorities for next few months

[monavij]

Review CCC annual update slides

[woju]

minutes:

• review CCC slides (@monavij)

  • content will be mailed to be uploaded somewhere not on Intel infra (@monavij will email to @donporter)
  • who will co-present? ping @monavij, who will send invite;
    • @donporter is willing to be the fallback;
    • @woju can go, possibly as an interface to a keyboard, will drop out after first hour;
  • (we went through the slides)
  • how much time do we have for it? 30 min? @monavij will ask, also which half of the meeting

• support for SVN update (@kailun-qin, @mkow)

  • @kailun-qin: do we do it online, or provide separate, offline tool?
  • @kailun-qin: which types of key do we want to support?
  • @mkow: can we discuss in the issue? we don't have time (it was 16:55 —@woju)
  • @monavij: there's a group that needs to move files sealed to old SVNs
  • @mkow: last message from Dmitrii was >there's no simple and secure design proposed, please suggest a solution
  • @donporter: last message was a proposal
  • @mkow: it doesn't work
  • we need to describe exactly how every single thing behaves, there were partial proposals that were not complete
  • @donporter what are the desired properties
  • @mkow: external tool, but not sure if it's viable (because files sealed to MRENCLAVE)
  • @kailun-qin: needs to be done in Gramine
  • @kailun-qin: maybe start with one kind of key
  • @mkow: don't know if it's sufficient for people who need to use it (maybe they sealed to MRENCLAVE)
  • @mkow: you can't do partial updates, because you'd still accept old files, so you didn't update security properties
  • @mkow: the only secure way is to upgrade full FS at once, probably with external tool
  • @monavij: what if we built external tool, like manifest validation tool, then if it worked, then we could integrate it in gramine proper
  • @mkow: it needs the same MRENCLAVE
  • @monavij: people usually seal against MRSIGNER, not MRENCLAVE, let's ask them

• request about licence change Consider adopting a more permissive license to increase adoption #2123 (@monavij)

  • so the person says that they can't use, because LGPL
  • @woju: that's b*llocks, the only thing that stops him is his own l*gal department
  • @mkow: relicensing is much work, we'll need to go after past contributors
  • @monavij: can we relicense ratls attestation libraries (from contrib —@woju)?
  • @woju: no, because they link against core ratls in main repo, and we can't relicense it, because it's against our charter (we only have permission for examples and ratls is not an example, it's core)

postponed until next meeting:

• next release features
• devel priorities for next few months