Packaging

[woju]

Development:

• Jenkins split, stage 1 (Modular Jenkins, stage 1 graphene#1858)
• Jenkins split, stage 2 (Modular Jenkins, stage 2 graphene#1859)
• Initial meson implementation (Add first meson.build for installing graphene#1879)
• Python packaging (python modules in python/, and install them graphene#1909)
• Remove submodules ([Pal/Linux-SGX] Get rid of sgx driver submodule graphene#1997)
• First meson options (Misc jenkins fixes 2020.11 graphene#2003)
• Manifest preprocessor (Manifest preprocessor graphene#2288)
• Make testsuites test installed graphene (WIP Test what's installed, not from repo graphene#2064, Test what's installed graphene#2298)
• Jenkins split, stage 3: make CI test installed graphene
• packages.grapheneproject.io/distfiles ([CI] Add download mirror graphene#2119, [Examples] Add https://packages.grapheneproject.io/ mirror graphene#2280)
• Full meson, remove makefiles
  • Compile SGX tools with meson #64
  • [Tools] Compile argv_serializer with meson #68
  • Compile glibc in meson, retire Runtime/ #71
  • [common,Pal/Linux] Compile with Meson #102
  • [Pal/Linux-SGX] Compile with Meson #107
  • [Pal/Linux-SGX] Generate gsgx.h using Meson #112
  • [Pal/Linux-SGX] Switch fully to Meson  #122
  • [Docs] Make Python TOML package a dependency for non-SGX Gramine #126
  • Stop using Make for main build #129
• Meson wraps, deprecate Scripts/download
• meson dist tarballs
• debian/, .spec
• repo (packages.gramineproject.io), build infrastructure

Documentation:

• NEWS/ChangeLog/whatever
• new installation procedure ([Docs] Advise to install from repo #244)
• new building procedure
• guide for distro maintainers/packagers

Release:

• maintainer scripts for releasing
• make a release

Outside effort:

• Upstream SGX driver (merged in 5.11)
• /dev exec mount options (pid1: stop making /dev noexec systemd/systemd#17940)
• udev rules for /dev/sgx/enclave (udev: add default group for sgx enclave access systemd/systemd#18944, released in 248)

[dimakuv]

Since we changed the name, we should also use gramineproject.io instead of the old grapheneproject.io.

[woju]

Since we changed the name, we should also use gramineproject.io instead of the old grapheneproject.io.

Done.

[dimakuv]

@woju Could you update the TODO list? What's left to be done? Or maybe this issue can be closed now?

[woju]

I think it's up to date. We didn't have scripted release, so that's unchecked. debian/ and .spec are only available from repos, they're not committed to repo, and they will be around CI reorganisation. New installation procedure is #244.

[dimakuv]

I'll just copy-paste my comment from #244 because I think it's important to discuss this. The context is that the current Gramine package doesn't come with DCAP attestation enabled (only EPID attestation enabled).

If you want to deploy Gramine in the cloud, you almost certainly want to use Intel SGX and SGX attestation. And in the cloud, you don't use EPID attestation these days, you always use DCAP attestation.

So even though you can run a simple HelloWorld SGX application, any real SGX workload will fail because Gramine is built/installed without DCAP-attestation support. The users will be perplexed by this; once they realize that this package doesn't have DCAP attestation, they'll curse us and will have to revert to the old-style "build from GitHub" way.

This is pretty bad actually... Even in QuickStart, we should advise a "feature complete" Gramine package. Since the package comes without DCAP attestation, we doom ourselves to unhappy users (who can successfully run local workloads, but as soon as they want to do SGX attestation, Gramine fails). We definitely need to revisit our packaging.

[dimakuv]

I think all tasks were done already. @woju Please re-open this issue (or create a new one) if something still needs to be done.

[woju]

Yes, apart from testing gramine from packages.

I've unpinned this ticket from the issue tracker.