Meeting 27/05/2026

# Keylime Community Meeting - May 27, 2026

## Attendees

- [ ] @ansasaki
- [ ] @aplanas
- [ ] @deeglaze
- [ ] @edwards-n
- [ ] @ematery
- [ ] @galmasi
- [ ] @husky-parul
- [ ] @Isaac-Matthews
- [ ] @kkaarreell
- [ ] @maugustosilva
- [ ] @mayaCostantini
- [ ] @marcostork
- [ ] @mdrocco
- [ ] @mbestavros
- [ ] @mheese
- [ ] @mruffin
- [ ] @mpeters
- [ ] Niteesh Dubey
- [ ] @ruocco
- [ ] @stringlytyped
- [ ] @stefanberger
- [ ] @THS-on
- [ ] @tpletcher-hpe
- [ ] @tylerfanelli
- [ ] @ueno
- [ ] @sarroutbi
- [ ] @sergio-correia
- [ ] @gnurugs
- [ ] Shiva Dasari
- [ ] Christian Schilling

Time: 27/05/2026 14:00 UTC (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20260527T14)

Keylime community meeting
Google Meet joining info
Video call link: [https://meet.google.com/nos-bkdi-cnn](https://meet.google.com/nos-bkdi-cnn)
Or dial: (DE) +49 30 300195060 PIN: 607 390 654 8381#
More phone numbers: [https://tel.meet/nos-bkdi-cnn?pin=6073906548381](https://tel.meet/nos-bkdi-cnn?pin=6073906548381)
Or join via SIP: sip:6073906548381@gmeet.redhat.com

## Topics

* Current stable releases:
* [Keylime v7.14.2](https://github.com/keylime/keylime/releases/tag/v7.14.2)
* [Agent v0.2.9](https://github.com/keylime/rust-keylime/releases/tag/v0.2.9)

* New release - Keylime v7.14.2 (2026-05-06):
* Bundles all the stability and bug-fix work from the past cycle

* Verifier stability & bug fixes:
* Fixed TOCTOU race where `process_agent()` could overwrite a TERMINATED state
* [**#1902** - verifier: Prevent process_agent() from overwriting TERMINATED state (TOCTOU race)](https://github.com/keylime/keylime/pull/1902)
* SyncManager socket now falls back to temp directory when `/run/keylime` is unavailable; also fixes cleanup logging
* [**#1890** - Fall back to temp directory for SyncManager socket and fix cleanup logging](https://github.com/keylime/keylime/pull/1890)
* Deprecated `/var/run` paths replaced with `/run`
* [**#1905** - Replace deprecated `/var/run` with `/run`](https://github.com/keylime/keylime/pull/1905)

* Configuration:
* New `max_workers` config option caps the number of verifier worker processes
* [**#1907** - server: Add max_workers config to cap worker process count](https://github.com/keylime/keylime/pull/1907)

* Push-Attestation:
* Fixed agent status tracking across restarts and recovery in PUSH mode
* [**#1889** - Fix PUSH mode agent status tracking across restarts and recovery](https://github.com/keylime/keylime/pull/1889)
* Rust agent now caches UEFI event log bytes at startup to avoid post-privilege-drop read failures
* [**#1223** - fix push-mode: cache UEFI event log bytes at startup to avoid post-privilege-drop failures](https://github.com/keylime/rust-keylime/pull/1223)

* TPM / IAK Certification:
* Qualifying data is now hashed in TPM2_Certify for IAK-based AK certification (both verifier and agent)
* [**#1911** - tpm: Hash qualifying data in TPM2_Certify for IAK-based AK certification](https://github.com/keylime/keylime/pull/1911)
* [**#1239** - tpm: Hash qualifying data in TPM2_Certify for IAK-based AK certification](https://github.com/keylime/rust-keylime/pull/1239)

* Documentation:
* Attestation status fields in the verifier REST API are now documented
* [**#1899** - Document attestation status fields in verifier REST API](https://github.com/keylime/keylime/pull/1899)
* Wildcard bind address behaviour documented for the verifier
* [**#1897** - Document verifier wildcard bind address](https://github.com/keylime/keylime/pull/1897)

* Keylime and Post-Quantum Cryptography:
* Enhancement proposal for dual certification on all server components
* https://github.com/keylime/enhancements/pull/130

* Mentorship project CMW, EAT in collaboration with Veraison:
* [https://github.com/veraison/.github/issues/6](https://github.com/veraison/.github/issues/6)

* Enhancements:
* [**#130** - Dual TLS certification and crypto agility](https://github.com/keylime/enhancements/pull/130)
* [**#120** - Multiple addresses for server](https://github.com/keylime/enhancements/pull/120)
* [**#93** - Optional Paths Proposal](https://github.com/keylime/enhancements/pull/93)

* Open PRs:
* keylime/keylime:
* [**#1912** - [CI] Split e2e CI testing to fast and full](https://github.com/keylime/keylime/pull/1912)
* [**#1881** - docs: Fix verifier REST API docs and add undocumented endpoints](https://github.com/keylime/keylime/pull/1881)
* [**#1879** - tpm: use only policy's relevant PCRs for event log verification](https://github.com/keylime/keylime/pull/1879)
* [**#1878** - elparsing: check tpm2_eventlog exit code instead of stderr](https://github.com/keylime/keylime/pull/1878)
* [**#1812** - Removed sphinx prompt from conf file because it caused build issues](https://github.com/keylime/keylime/pull/1812)
* [**#1777** - Add support for CMW evidence format - server side](https://github.com/keylime/keylime/pull/1777)
* [**#1668** - Add support for EK Certificate Chain](https://github.com/keylime/keylime/pull/1668)
* [**#1545** - Add support for a reject list in runtime policy](https://github.com/keylime/keylime/pull/1545)
* keylime/rust-keylime:
* [**#1104** - Make compilation to fail on warnings](https://github.com/keylime/rust-keylime/pull/1104)
* [**#1051** - add support for CMW evidence format - agent side](https://github.com/keylime/rust-keylime/pull/1051)
* [**#986** - Update rust-config to 0.15](https://github.com/keylime/rust-keylime/pull/986)
* [**#658** - Remove deprecated zmq revocation notification feature](https://github.com/keylime/rust-keylime/pull/658)

## Action Items

* [ ] Follow up on Post-Quantum Cryptography enhancement proposal
* [ ] Add support for CMW evidence format - agent side
* [ ] Define policy on which versions receive upstream security fixes (suggested: latest 2 stable releases)

## Next Meeting

Next meeting: 24/06/2026 14:00 UTC

This issue contains the Keylime community meeting notes, including release updates, open pull requests, and action items, but it does not name a documentation change to make. Read the meeting body and its linked resources first; a contribution would need a clearly defined documentation task before completion can be assessed.

Written by the indexing model from the issue text.