8. November 2022

[dimakuv]

Agenda

(please write your proposed agenda items in comments under this discussion)

• Benny and Deb: Current status of documentation restructuring.
• Sankar and Dmitrii: HSM integrations -- add as core Python funcs or add as separate Python scripts?
  • See [python] Add support for production signing with Azure Key Vault #1020 for the first approach.
• Vijay: Discuss design for EDMM with VMA bookkeeping.
• Vijay: Discuss and get direction on Inter-operable RA-TLS support in Gramine.
• woju: possibly ditch fosshost and discuss alternatives

Woju: possibly ditch fosshost and discuss alternatives

• Woju: Fosshost was down for some time; their admins did something wrong and it started swapping to hard disk. Woju fixed it by switching to his private VPS. Does Linux Foundation provide VPS hosting for projects?
  • Eric: doesn't know.
  • Woju: will contact Linux Foundation for web-site hosting or sponsorship.

Benny and Deb: Current status of documentation restructuring

• Benny: shows the documentation example.

• Deb: Private page https://deb-intel.github.io/GramineTest/index.html. Repo: https://github.com/deb-intel/GramineTest, branch "grammybranch". Unfortunately, it's her last day working on this Gramine documentation, the rest is on us.

• Benny: Summary: restructuring is for people who don't want to read stuff; they just want to do X, or Y, or Z.

• Michal: when taking the changes from Deb, how do we contribute the work to her? Answer: Just add a Co-authored-by: Deb Taylor <intel email>.

• Woju: Some of this documentation is more suited for Gramine web page, instead of ReadTheDocs.

  • Mona: Let's improve ReadTheDocs for now, even if we'll have some duplication with the web page.

• Dmitrii: YouTube videos on the main page?

  • Michal: these videos are too outdated.
  • Deb: video/slides could be added to the bottom of the main page.
  • Michal: always with a date, so people know how old it is. We can add diagrams in SVG though.

Sankar and Dmitrii: HSM integrations

Dmitrii: Do we add such logic in core Gramine repo (new funcs) or separate Python scripts (plugins)?

• Woju: it won't be tested in CI, so shouldn't be in the core Gramine repo. We don't want to keep cloud- or HSM-specific code in the core repo that we can't test in CI.

• Michal/Mona: should be in a separate repo, like integrations, with subdirs for each integration (MS Azure with MAA + KeyVault + ...).

• Woju: doesn't like a single repo. He wants one repo per each integration/cloud.

• Dmitrii: decide which repo name, what structure, installation scripts (to combine with core Gramine).

  • UPDATE: Dmitrii took Sankar's PR [python] Add support for production signing with Azure Key Vault #1020 and re-created in contrib/ repo as a separate plugin: Add SGX enclave signing with Azure Key Vault's Managed HSM contrib#11

• Anees: GSC must be aware of this, and git-clone the repos and run some scripts.

  • TODO: Someone must implement this once we agree on repo(s) structure, names, etc.

Vijay: Discuss design for EDMM with VMA bookkeeping

• Vijay wanted to discuss EDMM design and steps, but there was no time left.
• It was agreed to have a separate meeting on this with Vijay, Dmitri, Mona, Michal and Borys.
  • UPDATE: The separate meeting happened, it was agreed to implement two approaches soon (Vijay vs Borys) and compare their performance.