23. May 2023

[dimakuv]

Agenda

(please write your proposed agenda items in comments under this discussion)

• woju: https://zuul.gramineproject.io/
• woju: Intel SGX repo key expiration
• woju: 18.04 deprecation (yet again)

Zuul

https://zuul.gramineproject.io -- Woju is currently working on this CI framework.

Several requirements for the prospective CI framework:

• License -- must be able to host it on our server, open-source
• Exposing some jobs to everyone
• Allow random people to trigger some jobs

Zuul satisfies all three requirements.

ITL folks had experiences with Zuul. Mostly positive, but in one case Zuul was flaky (though maybe it was just mismanaged).

Woju already has a GitHub app that plugs Zuul into GitHub.

Mona: what about CCC common CI infrastructure?

• Woju: I don't think there was any progress in CCC on this. We submitted some questions, but we didn't hear back, so assume that idea is abandoned.

Intel SGX repo key expiration

The Intel SGX key expires soon. If someone committed the key into their local keyring repository, then the user would need to update the key manually.

Benny: Intel changed the key, and re-signed the SGX packages. So for some time, some users will have the old key but apt-get the new packages, and there will be a signature-mismatch failure.

Woju: there is not much we can do, but users will come to Gramine and complain -- be prepared.

Woju/Benny: we need to find all occurrences of the old key and use the new one:

• https://github.com/gramineproject/gramine/blob/master/packaging/docker/Dockerfile seems fine, because our image has the "old" versions of the SGX key and the packages.
• https://github.com/gramineproject/gsc/blob/master/keys/intel-sgx-deb.key -- needs update
• https://github.com/gramineproject/gramine/blob/ad393992a30b1383da1b017e4a6ccfa7d9feb27d/.ci/intel-sgx-deb.key -- needs update
• https://github.com/gramineproject/contrib/blob/master/Intel-Confidential-Compute-for-X/keys/intel-sgx-deb.asc -- needs update

UPDATE from Dmitrii: all this was fixed, see gramineproject/gsc#151 for details.

Ubuntu 18.04 deprecation

We made a decision last week Tuesday to aggressively remove Ubuntu 18.04. But later there was another decision to keep build-from-sources support for the next release (v1.5), and drop fully in v1.6.

But here's case in point -- we have a PR that is ready for merge and it breaks Ubuntu 18.04 (gramine-sgx-sign tool will just fail, rendering Gramine unusable on 18.04).

Mona: we can bring it again in the Wednesday meeting. I think we didn't find any customer who would hold on to 18.04. Mona is Ok with dropping it. Since there is no explicit customer, and we have a compelling reason to drop it (pending PR from Woju).

Dmitrii: I'm not against aggressive removal, but just for info:

• Ubuntu 18.04 was deprecated a month ago, Gramine v1.5 will be released soon, so there will be ~1-2 months in-between these events.
• We could release v1.5 without the breaking PR, by just waiting before merging that PR.
• (I.e., it's about the timeline.)

Woju: We could have a patch that lies somewhere and fixes Gramine to build on 18.04. (Someone needs to write such patch of course, but this could be as a response to some customer complaining.)

Scott: Maybe there are other projects that are dropping support for Ubuntu 18.04, on which Gramine depends (e.g. Intel SGX PSW)? So then there is nothing to discuss -- Gramine won't be able to run on 18.04 anyway, because its dependencies don't run.

UPDATE from Dmitrii: in both Gramine meetings, it was agreed to aggressively drop Ubuntu 18.04 support.

[woju]

In this order please:

• woju: https://zuul.gramineproject.io
• woju: Intel SGX repo key expiration
• woju: 18.04 deprecation (yet again)