Meeting 29/04/2026

# Keylime Community Meeting - April 29, 2026

## Attendees

- [ ] @ansasaki
- [ ] @aplanas
- [ ] @deeglaze
- [ ] @edwards-n
- [ ] @ematery
- [ ] @galmasi
- [ ] @husky-parul
- [ ] @Isaac-Matthews
- [ ] @kkaarreell
- [ ] @maugustosilva
- [ ] @mayaCostantini
- [ ] @marcostork
- [ ] @mdrocco
- [ ] @mbestavros
- [ ] @mheese
- [ ] @mruffin
- [ ] @mpeters
- [ ] Niteesh Dubey
- [ ] @ruocco
- [ ] @stringlytyped
- [ ] @stefanberger
- [ ] @THS-on
- [ ] @tpletcher-hpe
- [ ] @tylerfanelli
- [ ] @ueno
- [ ] @sarroutbi
- [ ] @sergio-correia
- [ ] @gnurugs
- [ ] Shiva Dasari
- [ ] Christian Schilling

Time: 29/04/2026 14:00 UTC (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20260429T14)

Keylime community meeting
Google Meet joining info
Video call link: [https://meet.google.com/nos-bkdi-cnn](https://meet.google.com/nos-bkdi-cnn)
Or dial: ‪(DE) +49 30 300195060‬ PIN: ‪607 390 654 8381‬\#
More phone numbers: [https://tel.meet/nos-bkdi-cnn?pin=6073906548381](https://tel.meet/nos-bkdi-cnn?pin=6073906548381)
Or join via SIP: sip:6073906548381@gmeet.redhat.com

## Topics

* Current stable releases:
* [Keylime v7.14.1](https://github.com/keylime/keylime/releases/tag/v7.14.1)
* [Agent v0.2.9](https://github.com/keylime/rust-keylime/releases/tag/v0.2.9)

* Verifier stability and robustness:
* Graceful shutdown implemented — pending retries are cancelled and in-flight work is drained before exit
* [**#1869** - Graceful shutdown for verifier: cancel pending retries and drain in-flight work](https://github.com/keylime/keylime/pull/1869)
* Fixed race condition when deleting an agent during attestation
* [**#1874** - Prevent race condition when deleting agent during attestation](https://github.com/keylime/keylime/pull/1874)
* Manager processes now ignore SIGTERM/SIGINT to prevent orphaned children
* [**#1883** - shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes](https://github.com/keylime/keylime/pull/1883)

* SELinux and deployment fixes:
* SyncManager socket moved to `/var/run/keylime` to resolve SELinux AVC denials
* [**#1886** - Move SyncManager socket to /var/run/keylime to resolve SELinux AVC denials](https://github.com/keylime/keylime/pull/1886)
* Follow-up PR adds fallback to temp directory when `/var/run/keylime` is unavailable
* [**#1890** - Fall back to temp directory for SyncManager socket and fix cleanup logging](https://github.com/keylime/keylime/pull/1890) (open)

* Bug fixes:
* Fixed timezone handling in Unix timestamp conversion
* [**#1885** - Fix timezone handling in Unix timestamp conversion](https://github.com/keylime/keylime/pull/1885)
* CA organization updated from MITLL to Keylime
* [**#1876** - Switch from CA organization of MITLL to Keylime](https://github.com/keylime/keylime/pull/1876)

* Testing improvements:
* Unit tests can now run against installed packages (not just source tree)
* [**#1884** - test: Support test execution for installed package](https://github.com/keylime/keylime/pull/1884)
* Rust agent test infra updated to use Express-style named params in Mockoon endpoints
* [**#1222** - tests: use Express-style named params in Mockoon endpoints](https://github.com/keylime/rust-keylime/pull/1222)

* Documentation:
* Configuration options tables added to docs
* [**#1809** - docs: Add configuration options tables](https://github.com/keylime/keylime/pull/1809)

* Push-Attestation:
* Agent-side fix: cache UEFI event log bytes at startup to avoid post-privilege-drop failures
* [**#1223** - fix push-mode: cache UEFI event log bytes at startup to avoid post-privilege-drop failures](https://github.com/keylime/rust-keylime/pull/1223) (open)
* Fix PUSH mode agent status tracking across restarts and recovery
* [**#1889** - Fix PUSH mode agent status tracking across restarts and recovery](https://github.com/keylime/keylime/pull/1889) (open)

* Keylime and Post-Quantum Cryptography:
* Enhancement proposal for dual certification on all server components
* https://github.com/keylime/enhancements/pull/130

* Mentorship project CMW, EAT in collaboration with Veraison:
* [https://github.com/veraison/.github/issues/6](https://github.com/veraison/.github/issues/6)

* Enhancements:
* [**#130** - Dual TLS certification and crypto agility](https://github.com/keylime/enhancements/pull/130)
* [**#120** - Multiple addresses for server](https://github.com/keylime/enhancements/pull/120)
* [**#93** - Optional Paths Proposal](https://github.com/keylime/enhancements/pull/93)

* Open PRs:
* keylime/keylime:
* [**#1899** - Document attestation status fields in verifier REST API](https://github.com/keylime/keylime/pull/1899)
* [**#1897** - Document verifier wildcard bind address](https://github.com/keylime/keylime/pull/1897)
* [**#1890** - Fall back to temp directory for SyncManager socket and fix cleanup logging](https://github.com/keylime/keylime/pull/1890)
* [**#1889** - Fix PUSH mode agent status tracking across restarts and recovery](https://github.com/keylime/keylime/pull/1889)
* [**#1881** - docs: Fix verifier REST API docs and add undocumented endpoints](https://github.com/keylime/keylime/pull/1881)
* [**#1879** - tpm: use only policy's relevant PCRs for event log verification](https://github.com/keylime/keylime/pull/1879)
* [**#1878** - elparsing: check tpm2_eventlog exit code instead of stderr](https://github.com/keylime/keylime/pull/1878)
* [**#1812** - Removed sphinx prompt from conf file because it caused build issues](https://github.com/keylime/keylime/pull/1812)
* [**#1777** - Add support for CMW evidence format - server side](https://github.com/keylime/keylime/pull/1777)
* [**#1668** - Add support for EK Certificate Chain](https://github.com/keylime/keylime/pull/1668)
* [**#1545** - Add support for a reject list in runtime policy](https://github.com/keylime/keylime/pull/1545)
* keylime/rust-keylime:
* [**#1223** - fix push-mode: cache UEFI event log bytes at startup to avoid post-privilege-drop failures](https://github.com/keylime/rust-keylime/pull/1223)
* [**#1104** - Make compilation to fail on warnings](https://github.com/keylime/rust-keylime/pull/1104)
* [**#1051** - Add support for CMW evidence format - agent side](https://github.com/keylime/rust-keylime/pull/1051)
* [**#986** - Update rust-config to 0.15](https://github.com/keylime/rust-keylime/pull/986)
* [**#658** - Remove deprecated zmq revocation notification feature](https://github.com/keylime/rust-keylime/pull/658)

## Action Items
* [ ] Follow up on Post-Quantum Cryptography enhancement proposal
* [ ] Add support for CMW evidence format - agent side
* [ ] Define policy on which versions receive upstream security fixes (suggested: latest 2 stable releases)

## Next Meeting

Next meeting: 27/05/2026 16:00 UTC

Start with the meeting agenda, action items, and next-meeting section in this issue. There is no file, test, or concrete change identified; completion criteria would need to be defined before a newcomer could begin.

Written by the indexing model from the issue text.