13. June 2022

[dimakuv]

Organizing meeting notes

1. [Mona] How to organize our meetings and keep meeting notes?
   • [Vijay] Maybe record our meetings? [Mona, Michal] no, that will take too much time for people.
   • [Dmitrii] Create a Category "Meeting notes" in GitHub Discussions, no objections.
   • [Chia-Che] Are GitHub Discussions public, or they can be made private?
     • [Mona] Our meetings are public, so meeting notes should be also public.

Public Jenkins CI logs

2. [Mona] Can our Jenkins CI be opened to public (so the logs can be seen).
   • [Woju] No, the problem is Jenkins. It is buggy (so malicious users can exploit it), and it contains private variables in the logs in the clear (so curious users can steal e.g. EPID data).
   • [Woju] We can expand the set of people who can have access to Jenkins CI.
   • [Mona] Should we move to some other CI/CD system? Jenkins has many downsides. [Michal] It's not a priority, but would be good to move in the future.
   • [Erik] Other CCC projects use each their own CI/CD system. There is no unification in this.

Curated apps

3. [Sankar] Curated apps, what configurations/workloads do we provide for a specific application?
   • Example: Nginx. It may have multiple configurations, but a Gramine curated app needs to choose one config.
   • [Mona] How do SCONE and Fortanix do it?
     • [Sankar] SCONE simply redirects to their web page on Azure Marketplace. Need to check what Fortanix offers.
   • [Woju] A "hard-coded end-to-end" solution seems impossible. A "one-click" solution can't be published; hopefully Azure Marketplace allows more like tutorials/examples/guides.
   • [Dmitrii] Maybe for the end-to-end solutions, we ask how the Edgeless Marblerun team promotes curated app?
     • [Woju,Mona] Not sure it's a good idea, this way we steer people away from Gramine.
   • [Sankar] We started a good discussion; if anyone has more ideas/suggestions, please comment.

Rust and our build system/packaging

4. gramine-sgx-get-token tool rewritten in Rust.
   • [Jakub] PR [Pal/Linux-SGX] Implement gramine-sgx-get-token in Rust #639. It will be used in near future during Gramine startup, to generate the .token file on the fly (for EPID) or skip it completely (for DCAP).
   • [Jakub] Meson doesn't play nicely with Rust's build system of crates. The main issue is the one of trust: should we just write all Rust code ourselves (without external dependencies), or we must come up with a "trustworthy" way of downloading crates.
   • [Jakub] Position: avoiding dependencies (crates) is hard. We should embrace external crates, and rely on GPG public keys.
   • [Woju] Rust crates are huge, and no maintainer really knows/read their code. There is no good way to control dependencies (e.g., serde has multiple dependencies, and when it updates, all those dependencies probably also update).
   • [Michal,Jakub] The crates we plan to use -- including the ones inside the SGX enclaves -- are not too big. We can manually explore their codebase, and configure these crates for minimality.
   • [Woju] Another problem with Rust build: the packaging must be done offline, which Meson supports with its subprojects, but Rust prefers to download everything. There are ways to package offline, but it's cumbersome.
   • [Woju] For Rust dependencies, can we use Debian packages instead of download-from-github? Debian testing has pretty new versions, and we can switch to it (right now we package on Debian stable).
   • [Jakub] Taking Rust dependencies from Debian packages is shifting responsibility to someone else (Debian maintainers). Better to write some tools that verify Rust crates against e.g. GPG public keys of known-good actors.
   • [Jakub,Michal] Auto-alerts on GitHub if some of our Rust dependencies publish an CVE. This is a very nice feature which solves the problem of "when and how to update dependencies".

Updates on GitHub development

5. [Dmitrii] Update on PRs, issues and tasks for a previous week:
   • (no time for this during the meeting, but my take on this is below)
   • Rewrite sockets #579 is under last rounds of review, should be merged this week.
   • WIP: small fixes to RA-TLS and SecretProv; MS Azure Attestation support for RA-TLS in progress.

Agenda for the next meeting

(please write your proposed agenda items in comments under this discussion)

• TBD

[vijaydhanraj]

[Mona] How to organize our meetings and keep meeting notes?

@monavij @dimakuv @mkow Can we also capture the meeting agenda for next week as part of the minutes? It would be good if developers had permission to add to this agenda list as well. This will be helpful in cases when we are not able to finalize next week's agenda at the end of a meeting.

[dimakuv]

It would be good if developers had permission to add to this agenda list as well.

I don't know how to do this in GutHub discussions.

I suggest people just write their comments, and I (or someone else, e.g. @mkow) will add these items to the meeting agenda for a future meeting. But in general I like the idea.

[vijaydhanraj]

Thanks, it is reasonable. Developers can reach out to either of you to get the agenda added,