From Fedora Project Wiki
(initial draft)
 
(Add trackers)
 
(11 intermediate revisions by 3 users not shown)
Line 1: Line 1:
{{admon/important | Comments and Explanations | The page source contains comments providing guidance to fill out each section. They are invisible when viewing this page. To read it, choose the "view source" link.<br/> '''Copy the source to a ''new page'' before making changes!  DO NOT EDIT THIS TEMPLATE FOR YOUR CHANGE PROPOSAL.'''}}
{{admon/tip | Guidance | For details on how to fill out this form, see the [https://docs.fedoraproject.org/en-US/program_management/changes_guide/ documentation].}}
<!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name.  This keeps all change proposals in the same namespace -->
<!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name.  This keeps all change proposals in the same namespace -->


Line 16: Line 12:
This should link to your home wiki page so we know who you are.  
This should link to your home wiki page so we know who you are.  
-->
-->
* Name: Sergio Correia
* Name: [[User:Scorreia| Sergio Correia]], [[User:Ueno| Daiki Ueno]]
* Email: scorreia@redhat.com
* Email: scorreia@redhat.com, dueno@redhat.com
 
* Name: [[User:Ueno| Daiki Ueno]]
* Email: dueno@redhat.com
<!--- UNCOMMENT only for Changes with assigned Shepherd (by FESCo)
* FESCo shepherd: [[User:FASAccountName| Shehperd name]] <email address>
-->




== Current status ==
== Current status ==
[[Category:ChangePageIncomplete]]
[[Category:ChangeAcceptedF36]]
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->
Line 45: Line 35:
ON_QA -> change is fully code complete
ON_QA -> change is fully code complete
-->
-->
* FESCo issue: <will be assigned by the Wrangler>
* [https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/KRP7AF7PGQ3AKX5VFRGIU7OHUR52C3TE/ devel list thread]
* Tracker bug: <will be assigned by the Wrangler>
* FESCo issue: [https://pagure.io/fesco/issue/2716 #2716]
* Release notes tracker: <will be assigned by the Wrangler>
* Tracker bug: [https://bugzilla.redhat.com/show_bug.cgi?id=2045874 #2045874]
* Release notes tracker: [https://pagure.io/fedora-docs/release-notes/issue/793 #793]


== Detailed Description ==
== Detailed Description ==
Line 90: Line 81:
** The keylime package will be a meta package that will install all the subpackages
** The keylime package will be a meta package that will install all the subpackages
** The Rust based [https://github.com/keylime/rust-keylime agent] will be packaged along with its build dependencies
** The Rust based [https://github.com/keylime/rust-keylime agent] will be packaged along with its build dependencies
** Both keylime-agent implementations, one written in Python, the other written in Rust, will be selectively installable through [https://docs.fedoraproject.org/en-US/packaging-guidelines/Alternatives/ alternatives]
** Both keylime-agent implementations, one written in Python, the other written in Rust, will be selectively installable through RPM's installable alternatives framework, similar to how we can select beween PipeWire/PulseAudio and pipewire-media-session/wireplumber.


* Other developers: N/A (not a System Wide Change)<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Other developers: N/A (not a System Wide Change)<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
Line 130: Line 121:


<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
0. Make sure that your systems meet the requirement to run either Keylime agent or other components, as described in the [https://keylime-docs.readthedocs.io/en/latest/ documentation]
# Make sure that your systems meet the requirement to run either Keylime agent or other components, as described in the [https://keylime-docs.readthedocs.io/en/latest/ documentation]
1. Install the subpackages individually and see if they function as expected
# Install the subpackages individually and see if they function as expected
2. Install the meta package (keylime) and see if it pulls all the subpackages
# Install the meta package (keylime) and see if it pulls all the subpackages
3. Install rust-keylime-agent package and see if it does not interfere with the keylime-agent package
# Selectively install a package that provides the keylime-agent functionality: either  keylime-agent-rust (Rust-based) or (python-)keylime-agent (Python-based); they should conflict with each other, so that we should have only one of them installed at a time
4. Check that rust-keylime-agent can be the default, using the alternative --set command
 


== User Experience ==
== User Experience ==

Latest revision as of 20:25, 25 January 2022


Keylime subpackaging and agent alternatives

Summary

The keylime package will be split into subpackages per role (agent, registrar, verifier, and admin components), while allowing the alternative agent implementation in Rust.

Owner


Current status

Detailed Description

The current Keylime package available in Fedora provides all the components as a single package. To support the usage scenarios where only agent or management component is deployed on a specific host, we plan to split the package into subpackages per role. This change also enables the alternative Keylime agent implementation in Rust, which will eventually be preferred over the Python implementation.

Feedback

Benefit to Fedora

This makes it easier to deploy Keylime agent in IoT or Fedora CoreOS spins and thus enable remote attestation without installing full dependencies of Keylime.

Scope

  • Proposal owners:
    • The keylime package will provide subpackages (keylime-agent, keylime-registrar, etc)
    • The keylime package will be a meta package that will install all the subpackages
    • The Rust based agent will be packaged along with its build dependencies
    • Both keylime-agent implementations, one written in Python, the other written in Rust, will be selectively installable through RPM's installable alternatives framework, similar to how we can select beween PipeWire/PulseAudio and pipewire-media-session/wireplumber.
  • Other developers: N/A (not a System Wide Change)
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with Objectives:

Upgrade/compatibility impact

The keylime package will remain as a meta package for the compatibility with the current packaging.

How To Test

  1. Make sure that your systems meet the requirement to run either Keylime agent or other components, as described in the documentation
  2. Install the subpackages individually and see if they function as expected
  3. Install the meta package (keylime) and see if it pulls all the subpackages
  4. Selectively install a package that provides the keylime-agent functionality: either keylime-agent-rust (Rust-based) or (python-)keylime-agent (Python-based); they should conflict with each other, so that we should have only one of them installed at a time


User Experience

No visible change should be observed by the existing users.

Dependencies

N/A (not a System Wide Change)

Contingency Plan

  • Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change)
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? N/A (not a System Wide Change), No


Documentation

N/A (not a System Wide Change)

Release Notes

Retrieved from "https://fedoraproject.org/w/index.php?title=Changes/Keylime_subpackaging_and_agent_alternatives&oldid=635285"