29. November 2022

[dimakuv]

Agenda

(please write your proposed agenda items in comments under this discussion)

• Discuss "plugins in separate repos":
  • MS Azure specific plugins in new gramine-azure-integration GitHub repo?
  • OpenSSL Engine plugin in contrib GitHub repo?
  • Where do we put Microsoft Azure Attestation (MAA) version of RA-TLS then?
  • Michal's take: strongly against splitting it into multiple repositories.
  • Mona's take: use contrib for now as we figure out the repo structure.

[mkow]

Meeting notes:

• Zuul testing status: @woju is still playing with it, nothing to show yet.
• Discussion about Project Amber support ([SGX] RFC: Support for Intel Project Amber Attestation #822):
  • It has some token which expires and requires re-doing of the attestation.
  • Can't it just be done in the preloaded library, in a worker thread? Should be simpler and doesn't require special support in Gramine API.
  • LD_PRELOAD doesn't work for static binaries, but static binaries are super-slow anyways, so this probably is not a problem.
  • The original request was to run some magic hook on accesses to /dev/amber/token, but that's not something we want to add to Gramine (complicated and not really needed to implement Amber).
  • We need to talk with them and ask why won't they just use that design with a thread in the preloaded library.
• Plugins in separate repos:
  • Let's try a separate repository integrations and put specific integrations in subdirectories there. We'll re-discuss this in case @woju hits any issues.
  • OpenSSL Engine plugin:
    • @woju is against making it official, because this approach is missing any control over the HSM access (e.g. logging), so we shouldn't suggest it to the users.
    • Decision: let's put in into contrib for now and reassess later.