)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bfdaabb93d0802892339c2ec5352219ef07c5733","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"1b46c69b_6ca4e929","updated":"2026-05-11 20:04:36.000000000","message":"I don\u0027t understand the base concept well enough to competently review this.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"}],"specs/approved/attestation-interface-v2.rst":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2cf3cb8e84e003af08457866111b9116882e0db3","unresolved":false,"context_lines":[{"line_number":223,"context_line":"    ┌─────────────────────────────────────────────────────────────┐"},{"line_number":224,"context_line":"    │ Node (Untrusted - Could Be Compromised)                      │"},{"line_number":225,"context_line":"    │                                                               │"},{"line_number":226,"context_line":"    │  ┌──────────────────────┐        ┌──────────────────────┐   │"},{"line_number":227,"context_line":"    │  │   Keylime Agent      │───────▶│   TPM 2.0 Hardware   │   │"},{"line_number":228,"context_line":"    │  │  (Collects quotes)   │        │ (Signs measurements) │   │"},{"line_number":229,"context_line":"    │  └──────────────────────┘        └──────────────────────┘   │"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5debf217_98442a17","line":226,"updated":"2026-04-06 21:23:41.000000000","message":"Yeah, cleanup needed here.\n\nI fixed it in the file, but yeah, I do\u0027t know why the formatting looks a little weird in gerrit.","commit_id":"f6ddc02aebd1135e5ad0639f05ac061ae649fa3e"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2cf3cb8e84e003af08457866111b9116882e0db3","unresolved":false,"context_lines":[{"line_number":235,"context_line":"                ▼"},{"line_number":236,"context_line":"    ┌─────────────────────────────────────────────────────────────┐"},{"line_number":237,"context_line":"    │ Keylime Verifier (Trusted)                                   │"},{"line_number":238,"context_line":"    │                                                               │"},{"line_number":239,"context_line":"    │  1. Validate TPM quote signature                             │"},{"line_number":240,"context_line":"    │  2. Verify quote is fresh (not replayed)                     │"},{"line_number":241,"context_line":"    │  3. Extract validated measurements                           │"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9c840766_4d44ebe8","line":238,"updated":"2026-04-06 21:23:41.000000000","message":"and here...","commit_id":"f6ddc02aebd1135e5ad0639f05ac061ae649fa3e"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":53,"context_line":"      security model of attestation: **measurements must come from the"},{"line_number":54,"context_line":"      verifier after cryptographic validation, never directly from the agent"},{"line_number":55,"context_line":"      being attested**. A compromised agent could lie about its measurements,"},{"line_number":56,"context_line":"      defeating the entire purpose of TPM-based attestation."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"3. **No Measurement Lifecycle Management**: There is no mechanism to:"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"c4836657_07512a9e","line":56,"updated":"2026-07-21 13:32:13.000000000","message":"Apparently, Keylime can prevent replay attacks, which is what you\u0027re describing.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bfdaabb93d0802892339c2ec5352219ef07c5733","unresolved":true,"context_lines":[{"line_number":53,"context_line":"      security model of attestation: **measurements must come from the"},{"line_number":54,"context_line":"      verifier after cryptographic validation, never directly from the agent"},{"line_number":55,"context_line":"      being attested**. A compromised agent could lie about its measurements,"},{"line_number":56,"context_line":"      defeating the entire purpose of TPM-based attestation."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"3. **No Measurement Lifecycle Management**: There is no mechanism to:"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a808413_e7de3488","line":56,"updated":"2026-05-11 20:04:36.000000000","message":"To restate for my own knowledge:\n1) Ironic (or the thing attached to attestation_interface) takes a measurement that comes from the agent\n2) Later, Ironic (or the thing attached to attestation_interface) takes another measurement that comes from the agent\n3) At no point does the agent in (2) know the measurement taken in (1), so if the measurements are the same, it\u0027s strong evidence the machine is configured as expected\n\n?\n\n(edit: after reading the diagram on 223 I\u0027m even more confused)\n\nNote that this isn\u0027t feedback on the spec, this is me trying to figure out the value of attestation via understanding how it works/what it measures.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":78,"context_line":"Beyond the gaps in the partial implementation, production deployment scenarios"},{"line_number":79,"context_line":"reveal additional challenges:"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"**TPM Re-enrollment Challenge**"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"When a node is deployed to a tenant and later reclaimed:"},{"line_number":84,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3e42fa6a_deb35d6f","line":81,"updated":"2026-07-21 13:32:13.000000000","message":"Now that service steps don\u0027t automatically cause a reboot, cannot we use servicing for that?","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"6ee1b70be7b07c20119527585fb119d908bc7155","unresolved":true,"context_lines":[{"line_number":78,"context_line":"Beyond the gaps in the partial implementation, production deployment scenarios"},{"line_number":79,"context_line":"reveal additional challenges:"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"**TPM Re-enrollment Challenge**"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"When a node is deployed to a tenant and later reclaimed:"},{"line_number":84,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"cdc53c23_193c5055","line":81,"updated":"2026-04-08 04:22:28.000000000","message":"This unpacks the re-enrol elsewhere scenario. However what if the tenant workload wants to enrol with the same verifier and use the ironic attestation API to monitor the node during the whole deployed phase of its lifecycle? I think supporting this is beyond the requirements of an MVP, but it would be good to discuss in the spec how it might be achieved in the future to give confidence that this design is compatible with that.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"a394896bb5f884a2b4bf24b55df1c7019ff83585","unresolved":true,"context_lines":[{"line_number":78,"context_line":"Beyond the gaps in the partial implementation, production deployment scenarios"},{"line_number":79,"context_line":"reveal additional challenges:"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"**TPM Re-enrollment Challenge**"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"When a node is deployed to a tenant and later reclaimed:"},{"line_number":84,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"88e4130d_f526582c","line":81,"in_reply_to":"c6b2b958_7b879f7f","updated":"2026-04-08 23:25:09.000000000","message":"I don\u0027t see anything in the design preventing this from being implemented in the future so this all sounds good.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"063b65cecda4349059a3c276a2845615213bd8f5","unresolved":true,"context_lines":[{"line_number":78,"context_line":"Beyond the gaps in the partial implementation, production deployment scenarios"},{"line_number":79,"context_line":"reveal additional challenges:"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"**TPM Re-enrollment Challenge**"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"When a node is deployed to a tenant and later reclaimed:"},{"line_number":84,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"c6b2b958_7b879f7f","line":81,"in_reply_to":"cdc53c23_193c5055","updated":"2026-04-08 13:35:57.000000000","message":"So, tenant using the same verifier should be fine, if they have the details. One aspect I had never envisioned though is having some sort of periodic to occasionally resync with the verifier outside of the workflow. I think ideally we would expect the user just to engage the verifier directly, but you\u0027ve also got a good point brewing!\n\nTo me that feels like a good additional step since to have a periodic roll to reconcile status \"as we go\". it would be fairly light weight to query the verifier. As for the user polling ironic as well, that seems like we would get that for free out of the box with our policy access model of nodes.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":304,"context_line":"                                               ┌────────────────┴─────────────┐"},{"line_number":305,"context_line":"                                               │                              │"},{"line_number":306,"context_line":"                                   Operator Remediates              Operator Approves"},{"line_number":307,"context_line":"                                   (re-flash firmware)           (approve_baseline step)"},{"line_number":308,"context_line":"                                               │                              │"},{"line_number":309,"context_line":"                                       (re-inspect/clean)                     │"},{"line_number":310,"context_line":"                                               │                 (step updates baseline,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bf60ffee_95f1a9fd","line":307,"updated":"2026-07-21 13:32:13.000000000","message":"Hmm, this is still automated cleaning, right? Can we actually go from automated cleaning into manual cleaning this way?","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":329,"context_line":"    class Node(base.IronicObject):"},{"line_number":330,"context_line":"        # Existing fields..."},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"        attestation_status \u003d fields.StringField(nullable\u003dTrue)"},{"line_number":333,"context_line":"        # Possible values:"},{"line_number":334,"context_line":"        #   None - Node has no attestation_interface configured"},{"line_number":335,"context_line":"        #   \u0027never_attested\u0027 - Interface configured but never attested"}],"source_content_type":"text/x-rst","patch_set":2,"id":"06b72834_0567831b","line":332,"updated":"2026-07-21 13:32:13.000000000","message":"nit: this is not how it looks (hello AI!), mixing database and object syntax here","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":351,"context_line":""},{"line_number":352,"context_line":"    CREATE TABLE node_attestation_state ("},{"line_number":353,"context_line":"        id INTEGER PRIMARY KEY AUTO_INCREMENT,"},{"line_number":354,"context_line":"        node_uuid VARCHAR(36) NOT NULL UNIQUE,"},{"line_number":355,"context_line":"        created_at DATETIME NOT NULL,"},{"line_number":356,"context_line":"        updated_at DATETIME NOT NULL,"},{"line_number":357,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"90475940_6cf6e27d","line":354,"updated":"2026-07-21 13:32:13.000000000","message":"We use IDs for foreign keys","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":365,"context_line":"        -- TPM agent UUID (derived from EK hash, should not change)"},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"        -- Current measurements (latest snapshot from verifier)"},{"line_number":368,"context_line":"        current_measurements JSON,"},{"line_number":369,"context_line":"        current_measurements_timestamp DATETIME,"},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"        -- Baseline measurements (approved \"known good\")"}],"source_content_type":"text/x-rst","patch_set":2,"id":"38a4d772_5c5ea1ed","line":368,"updated":"2026-07-21 13:32:13.000000000","message":"Do we care about exact values or do we just compare them for equality? If the latter, would could just as well keep a SHA512 of them.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":366,"context_line":""},{"line_number":367,"context_line":"        -- Current measurements (latest snapshot from verifier)"},{"line_number":368,"context_line":"        current_measurements JSON,"},{"line_number":369,"context_line":"        current_measurements_timestamp DATETIME,"},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"        -- Baseline measurements (approved \"known good\")"},{"line_number":372,"context_line":"        baseline_measurements JSON,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"18f26e54_04cf7b4f","line":369,"updated":"2026-07-21 13:32:13.000000000","message":"nit: measurements_updated_at (assuming updated_at does not cover it)","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":372,"context_line":"        baseline_measurements JSON,"},{"line_number":373,"context_line":"        baseline_set_at DATETIME,"},{"line_number":374,"context_line":"        baseline_set_by VARCHAR(255),"},{"line_number":375,"context_line":"        -- Format: \u0027system\u0027 or \u0027operator:\u003cuser_id\u003e\u0027"},{"line_number":376,"context_line":"        baseline_reason TEXT,"},{"line_number":377,"context_line":"        -- Human-readable reason for this baseline"},{"line_number":378,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9d2c8426_2a45acf7","line":375,"updated":"2026-07-21 13:32:13.000000000","message":"Let\u0027s keep the existing owner format, i.e. either None or project ID (user ID?)","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":376,"context_line":"        baseline_reason TEXT,"},{"line_number":377,"context_line":"        -- Human-readable reason for this baseline"},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"        -- Drift detection"},{"line_number":380,"context_line":"        drift_detected BOOLEAN DEFAULT FALSE,"},{"line_number":381,"context_line":"        drift_detected_at DATETIME,"},{"line_number":382,"context_line":"        drift_pcrs JSON,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fef36c6a_ec146484","line":379,"updated":"2026-07-21 13:32:13.000000000","message":"Also duplicated with measurements below..","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":387,"context_line":"        pending_firmware_update JSON,"},{"line_number":388,"context_line":"        -- Set when firmware update initiated, cleared when acknowledged"},{"line_number":389,"context_line":"        -- Format: {\"timestamp\": \"...\", \"reason\": \"...\","},{"line_number":390,"context_line":"        --          \"firmware_images\": [...]}"},{"line_number":391,"context_line":""},{"line_number":392,"context_line":"        -- Verifier connection (alternative: store in driver_info)"},{"line_number":393,"context_line":"        verifier_ip VARCHAR(45),"}],"source_content_type":"text/x-rst","patch_set":2,"id":"872ad963_40c4fd1e","line":390,"updated":"2026-07-21 13:32:13.000000000","message":"This is an odd bit which I\u0027m not sure how will work in practice. I think we should rather rely on Node history for the \"why\" part. You anyway cannot compare image URLs to new PCR values.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":407,"context_line":""},{"line_number":408,"context_line":".. code-block:: sql"},{"line_number":409,"context_line":""},{"line_number":410,"context_line":"    CREATE TABLE node_attestation_measurements ("},{"line_number":411,"context_line":"        id INTEGER PRIMARY KEY AUTO_INCREMENT,"},{"line_number":412,"context_line":"        node_uuid VARCHAR(36) NOT NULL,"},{"line_number":413,"context_line":"        created_at DATETIME NOT NULL,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"0319eeee_4f1035c9","line":410,"updated":"2026-07-21 13:32:13.000000000","message":"I don\u0027t quite like duplicating measurements in the state table and here.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":424,"context_line":""},{"line_number":425,"context_line":"        -- Context"},{"line_number":426,"context_line":"        triggered_by VARCHAR(255),"},{"line_number":427,"context_line":"        -- Format: \u0027system\u0027, \u0027operator:\u003cuser_id\u003e\u0027, \u0027periodic:\u003cjob_id\u003e\u0027"},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"        ramdisk_version VARCHAR(50),"},{"line_number":430,"context_line":"        -- IPA version that was running (for troubleshooting)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"8a2f42bd_a771271c","line":427,"updated":"2026-07-21 13:32:13.000000000","message":"I don\u0027t think we can actually trigger measurement by a periodic task? I mean, it needs IPA?","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":426,"context_line":"        triggered_by VARCHAR(255),"},{"line_number":427,"context_line":"        -- Format: \u0027system\u0027, \u0027operator:\u003cuser_id\u003e\u0027, \u0027periodic:\u003cjob_id\u003e\u0027"},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"        ramdisk_version VARCHAR(50),"},{"line_number":430,"context_line":"        -- IPA version that was running (for troubleshooting)"},{"line_number":431,"context_line":""},{"line_number":432,"context_line":"        -- Comparison result (compared to baseline at time of measurement)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"250f7fe4_1cfe9073","line":429,"updated":"2026-07-21 13:32:13.000000000","message":"nit: I think we call it agent_version elsewhere","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":430,"context_line":"        -- IPA version that was running (for troubleshooting)"},{"line_number":431,"context_line":""},{"line_number":432,"context_line":"        -- Comparison result (compared to baseline at time of measurement)"},{"line_number":433,"context_line":"        matches_baseline BOOLEAN,"},{"line_number":434,"context_line":"        changed_pcrs JSON,"},{"line_number":435,"context_line":"        -- Format: {\"PCR0\": true, \"PCR1\": false, ...}"},{"line_number":436,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"57f44178_9ffa171b","line":433,"updated":"2026-07-21 13:32:13.000000000","message":"Redundant if you have changed_pcrs","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":431,"context_line":""},{"line_number":432,"context_line":"        -- Comparison result (compared to baseline at time of measurement)"},{"line_number":433,"context_line":"        matches_baseline BOOLEAN,"},{"line_number":434,"context_line":"        changed_pcrs JSON,"},{"line_number":435,"context_line":"        -- Format: {\"PCR0\": true, \"PCR1\": false, ...}"},{"line_number":436,"context_line":""},{"line_number":437,"context_line":"        INDEX idx_node_uuid (node_uuid),"}],"source_content_type":"text/x-rst","patch_set":2,"id":"593a2355_50bd2eb9","line":434,"updated":"2026-07-21 13:32:13.000000000","message":"... or better changed_measurements?","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":482,"context_line":""},{"line_number":483,"context_line":"**New Read-Only Endpoints**"},{"line_number":484,"context_line":""},{"line_number":485,"context_line":"``GET /v1/nodes/{node_ident}/attestation``"},{"line_number":486,"context_line":""},{"line_number":487,"context_line":"Get detailed attestation state for a node, including inline drift details:"},{"line_number":488,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7f985_20021601","line":485,"updated":"2026-07-21 13:32:13.000000000","message":"nit: ``.../states/attestation`` (for better or worse, we have this sub-endpoint)","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":512,"context_line":"            \"detected_at\": \"2026-04-06T14:23:11Z\","},{"line_number":513,"context_line":"            \"changed_pcrs\": {"},{"line_number":514,"context_line":"                \"PCR0\": {"},{"line_number":515,"context_line":"                    \"description\": \"BIOS/UEFI firmware\","},{"line_number":516,"context_line":"                    \"baseline\": \"abc123...\","},{"line_number":517,"context_line":"                    \"current\": \"xyz789...\""},{"line_number":518,"context_line":"                },"}],"source_content_type":"text/x-rst","patch_set":2,"id":"27921e40_c0ffa5e7","line":515,"updated":"2026-07-21 13:32:13.000000000","message":"Do these descriptions come from Keylime? Because I doubt we can now that.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":524,"context_line":"            },"},{"line_number":525,"context_line":"            \"unchanged_pcrs\": [\"PCR1\", \"PCR3\", \"PCR4\", ...]"},{"line_number":526,"context_line":"        },"},{"line_number":527,"context_line":"        \"pending_firmware_update\": null"},{"line_number":528,"context_line":"    }"},{"line_number":529,"context_line":""},{"line_number":530,"context_line":"**Note**: The ``source`` field in ``current_measurements`` explicitly"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1e1a69b9_043ebfc1","line":527,"updated":"2026-07-21 13:32:13.000000000","message":"nit: misses a link to ``/history``","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"6ee1b70be7b07c20119527585fb119d908bc7155","unresolved":true,"context_lines":[{"line_number":606,"context_line":"            use. Performs the following:"},{"line_number":607,"context_line":""},{"line_number":608,"context_line":"            1. Sends verifier/registrar configuration to IPA"},{"line_number":609,"context_line":"            2. IPA configures Keylime agent and triggers registration"},{"line_number":610,"context_line":"            3. IPA verifies agent is successfully attesting to verifier"},{"line_number":611,"context_line":"            4. IPA returns agent UUID/IP/port to Ironic"},{"line_number":612,"context_line":"            5. Ironic registers node with verifier (sends allowlist/excludelist)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fcaa3f6b_8cb191c6","line":609,"updated":"2026-04-08 04:22:28.000000000","message":"The abstract class should probably not refer to Keylime explicitly. Assuming a different attestation service has an analogous architecture these comments can just refer to \u0027agent\u0027 and \u0027referrer\u0027.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"063b65cecda4349059a3c276a2845615213bd8f5","unresolved":true,"context_lines":[{"line_number":606,"context_line":"            use. Performs the following:"},{"line_number":607,"context_line":""},{"line_number":608,"context_line":"            1. Sends verifier/registrar configuration to IPA"},{"line_number":609,"context_line":"            2. IPA configures Keylime agent and triggers registration"},{"line_number":610,"context_line":"            3. IPA verifies agent is successfully attesting to verifier"},{"line_number":611,"context_line":"            4. IPA returns agent UUID/IP/port to Ironic"},{"line_number":612,"context_line":"            5. Ironic registers node with verifier (sends allowlist/excludelist)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ddb45ee8_cae3ee26","line":609,"in_reply_to":"fcaa3f6b_8cb191c6","updated":"2026-04-08 13:35:57.000000000","message":"Relatively, should be similar. Intel ?IME?, (I think that is/was the latest name for their attstation solution) is very similar, just has a different workflow model. I haven\u0027t looked at Trustee that much which is a very similar idea with a container workload focus.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":614,"context_line":"            7. Stores measurements as baseline"},{"line_number":615,"context_line":""},{"line_number":616,"context_line":"            Can be decorated as:"},{"line_number":617,"context_line":"            - @base.inspect_step(priority\u003d80, requires_ramdisk\u003dTrue)"},{"line_number":618,"context_line":"            - @base.clean_step(priority\u003d75, requires_ramdisk\u003dTrue)"},{"line_number":619,"context_line":""},{"line_number":620,"context_line":"            :param task: A TaskManager instance"}],"source_content_type":"text/x-rst","patch_set":2,"id":"f2bcf01c_9aad715f","line":617,"updated":"2026-07-21 13:32:13.000000000","message":"This is not a thing","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"6ee1b70be7b07c20119527585fb119d908bc7155","unresolved":true,"context_lines":[{"line_number":626,"context_line":"        def validate_security_status(self, task):"},{"line_number":627,"context_line":"            \"\"\"Validate node measurements against baseline."},{"line_number":628,"context_line":""},{"line_number":629,"context_line":"            Queries Keylime verifier (authoritative source) for current"},{"line_number":630,"context_line":"            validated measurements, compares to approved baseline, records"},{"line_number":631,"context_line":"            results in history, and raises exception if drift detected and"},{"line_number":632,"context_line":"            fail_on_attestation_failure is True."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3006511b_75618b4d","line":629,"updated":"2026-04-08 04:22:28.000000000","message":"ditto","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"6ee1b70be7b07c20119527585fb119d908bc7155","unresolved":true,"context_lines":[{"line_number":666,"context_line":""},{"line_number":667,"context_line":"            This is a clean step that operators invoke manually to approve"},{"line_number":668,"context_line":"            drift after reviewing the changes. Updates the baseline in both"},{"line_number":669,"context_line":"            Ironic\u0027s database and the Keylime verifier\u0027s allowlist."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"            Can be decorated as:"},{"line_number":672,"context_line":"            - @base.clean_step(priority\u003d0, requires_ramdisk\u003dTrue, argsinfo\u003d{"}],"source_content_type":"text/x-rst","patch_set":2,"id":"981758ee_5a4f09aa","line":669,"updated":"2026-04-08 04:22:28.000000000","message":"ditto","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":669,"context_line":"            Ironic\u0027s database and the Keylime verifier\u0027s allowlist."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"            Can be decorated as:"},{"line_number":672,"context_line":"            - @base.clean_step(priority\u003d0, requires_ramdisk\u003dTrue, argsinfo\u003d{"},{"line_number":673,"context_line":"                  \u0027reason\u0027: {\u0027description\u0027: \u0027Reason for approving baseline\u0027,"},{"line_number":674,"context_line":"                             \u0027required\u0027: False}"},{"line_number":675,"context_line":"              })"}],"source_content_type":"text/x-rst","patch_set":2,"id":"22f99666_2114086e","line":672,"updated":"2026-07-21 13:32:13.000000000","message":"Why does it require a ramdisk? You already have the drift recorded, this way you\u0027re risking to approve something you haven\u0027t verified.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"6ee1b70be7b07c20119527585fb119d908bc7155","unresolved":true,"context_lines":[{"line_number":685,"context_line":"        def get_measurements(self, task):"},{"line_number":686,"context_line":"            \"\"\"Retrieve current validated measurements from verifier."},{"line_number":687,"context_line":""},{"line_number":688,"context_line":"            Queries Keylime verifier REST API for current measurements. Does"},{"line_number":689,"context_line":"            not compare to baseline or update state - just retrieves validated"},{"line_number":690,"context_line":"            measurements."},{"line_number":691,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"95b26bc4_4c8c14d6","line":688,"updated":"2026-04-08 04:22:28.000000000","message":"Ditto","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":709,"context_line":""},{"line_number":710,"context_line":"    class KeylimeAttestation(base.AttestationInterface):"},{"line_number":711,"context_line":""},{"line_number":712,"context_line":"        @base.inspect_step(priority\u003d80, requires_ramdisk\u003dTrue)"},{"line_number":713,"context_line":"        def start_attestation(self, task):"},{"line_number":714,"context_line":"            \"\"\"Register TPM and establish initial baseline."},{"line_number":715,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"c132944b_6008f774","line":712,"updated":"2026-07-21 13:32:13.000000000","message":"Slop again. Unless you actually propose changing inspection to use steps (which I wouldn\u0027t mind, but that\u0027s plenty of work)","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":825,"context_line":"            # These have been cryptographically verified by verifier"},{"line_number":826,"context_line":"            return agent_data.get(\u0027measurements\u0027, {})"},{"line_number":827,"context_line":""},{"line_number":828,"context_line":"        # Internal helper methods"},{"line_number":829,"context_line":"        def _reclaim_tpm_registration(self, task):"},{"line_number":830,"context_line":"            \"\"\"Re-register TPM with verifier after tenant use.\"\"\""},{"line_number":831,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5e4198c1_2625990b","line":828,"updated":"2026-07-21 13:32:13.000000000","message":"Not needed in the spec","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":851,"context_line":"ensure the Keylime agent is configured and attesting to the verifier, NOT to"},{"line_number":852,"context_line":"provide measurements."},{"line_number":853,"context_line":""},{"line_number":854,"context_line":".. code-block:: python"},{"line_number":855,"context_line":""},{"line_number":856,"context_line":"    class AttestationExtension(base.BaseAgentExtension):"},{"line_number":857,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9dce3842_c35a6f37","line":854,"updated":"2026-07-21 13:32:13.000000000","message":"Let\u0027s not have the entire implementation here, a general idea is enough","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"6ee1b70be7b07c20119527585fb119d908bc7155","unresolved":true,"context_lines":[{"line_number":1004,"context_line":""},{"line_number":1005,"context_line":".. code-block:: ini"},{"line_number":1006,"context_line":""},{"line_number":1007,"context_line":"    [keylime]"},{"line_number":1008,"context_line":"    # Behavior on attestation failure"},{"line_number":1009,"context_line":"    fail_clean_on_attestation_failure \u003d True"},{"line_number":1010,"context_line":"    fail_deploy_on_attestation_failure \u003d True"}],"source_content_type":"text/x-rst","patch_set":2,"id":"2941bdbc_28b86ac4","line":1007,"updated":"2026-04-08 04:22:28.000000000","message":"I can\u0027t see in the spec where verifier_ip (or registrar_ip) is actually configured. Could it be per node instance_info plus ironic.conf [keylime]verifier_ip fallback default?\n\nClaude suggested the following config options but I have not confirmed what is really necessary:\n\n- verifier_ip / verifier_port\n- registrar_ip / registrar_port\n- Any mTLS configuration (client_cert, client_key, trusted_server_ca, tls_dir)\n- tpm_cert_store","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"063b65cecda4349059a3c276a2845615213bd8f5","unresolved":true,"context_lines":[{"line_number":1004,"context_line":""},{"line_number":1005,"context_line":".. code-block:: ini"},{"line_number":1006,"context_line":""},{"line_number":1007,"context_line":"    [keylime]"},{"line_number":1008,"context_line":"    # Behavior on attestation failure"},{"line_number":1009,"context_line":"    fail_clean_on_attestation_failure \u003d True"},{"line_number":1010,"context_line":"    fail_deploy_on_attestation_failure \u003d True"}],"source_content_type":"text/x-rst","patch_set":2,"id":"8ccfaa3b_07a22987","line":1007,"in_reply_to":"2941bdbc_28b86ac4","updated":"2026-04-08 13:35:57.000000000","message":"It would more likely verifier URL and we would likely need to pass the registrar_url across to the agent. Looks like the prior spec didn\u0027t cover that and the implementation was trying to draw it from baked config files. :\\\n\nWe would likely need mtls config options for at least our engagement, but also I\u0027m sort of viewing them more as low level implementation details we\u0027ll figure out.\n\nA tpm_cert_store? I have no idea where claude is coming up with that one...","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":1127,"context_line":""},{"line_number":1128,"context_line":".. code-block:: bash"},{"line_number":1129,"context_line":""},{"line_number":1130,"context_line":"    $ openstack baremetal node attestation history node-3 --limit 10"},{"line_number":1131,"context_line":""},{"line_number":1132,"context_line":"    +-----+---------------------+----------------+------------------+"},{"line_number":1133,"context_line":"    | ID  | Timestamp           | Event Type     | Matches Baseline |"}],"source_content_type":"text/x-rst","patch_set":2,"id":"a6844cec_f95b3874","line":1130,"updated":"2026-07-21 13:32:13.000000000","message":"nit: I wonder if having the extra information still justifies not having it as part of the node history..","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":1142,"context_line":"``openstack baremetal node attestation approve \u003cnode\u003e``"},{"line_number":1143,"context_line":""},{"line_number":1144,"context_line":"Shorthand convenience command that invokes the ``approve_baseline`` clean step"},{"line_number":1145,"context_line":"and resumes automated cleaning."},{"line_number":1146,"context_line":""},{"line_number":1147,"context_line":".. code-block:: bash"},{"line_number":1148,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"8ce714c0_e9f4456e","line":1145,"updated":"2026-07-21 13:32:13.000000000","message":"I don\u0027t mind it at all, but we haven\u0027t done shorthands so far. Let\u0027s have an explicit ack from the team that we now do shorthands for steps.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"134429826e546dbb3d6ab888cc8beaa17a21e22f","unresolved":false,"context_lines":[{"line_number":1315,"context_line":""},{"line_number":1316,"context_line":"**PCR Categorization**"},{"line_number":1317,"context_line":""},{"line_number":1318,"context_line":"Complete listing of PCRs 0-7 and their typical usage:"},{"line_number":1319,"context_line":""},{"line_number":1320,"context_line":"* **PCR0** (BIOS/UEFI firmware): Contains measurements of BIOS/UEFI firmware"},{"line_number":1321,"context_line":"  code. Changes only with firmware updates. **CRITICAL** for detecting"}],"source_content_type":"text/x-rst","patch_set":2,"id":"22c0e2b5_33b25d04","line":1318,"updated":"2026-07-21 13:32:13.000000000","message":"Are you sure it\u0027s virtually always the case? Otherwise, I\u0027d not commit to specific descriptions/meanings.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"6ee1b70be7b07c20119527585fb119d908bc7155","unresolved":true,"context_lines":[{"line_number":1370,"context_line":"    monitored_pcrs \u003d 0,1,2,7"},{"line_number":1371,"context_line":""},{"line_number":1372,"context_line":"    # Always fail if firmware or Secure Boot changes"},{"line_number":1373,"context_line":"    critical_pcrs \u003d 0,7"},{"line_number":1374,"context_line":""},{"line_number":1375,"context_line":"    # Warn but don\u0027t fail if BIOS settings or Option ROMs change"},{"line_number":1376,"context_line":"    warning_pcrs \u003d 1,2"}],"source_content_type":"text/x-rst","patch_set":2,"id":"6d4fe0ef_f465a794","line":1373,"updated":"2026-04-08 04:22:28.000000000","message":"If secure boot is disabled always would this result in attestation failed, or only if the state changed?\n\nI suspect there is no confidence in any attestation if secure boot starts as disabled.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"063b65cecda4349059a3c276a2845615213bd8f5","unresolved":true,"context_lines":[{"line_number":1370,"context_line":"    monitored_pcrs \u003d 0,1,2,7"},{"line_number":1371,"context_line":""},{"line_number":1372,"context_line":"    # Always fail if firmware or Secure Boot changes"},{"line_number":1373,"context_line":"    critical_pcrs \u003d 0,7"},{"line_number":1374,"context_line":""},{"line_number":1375,"context_line":"    # Warn but don\u0027t fail if BIOS settings or Option ROMs change"},{"line_number":1376,"context_line":"    warning_pcrs \u003d 1,2"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a93a66d_6eb24318","line":1373,"in_reply_to":"6d4fe0ef_f465a794","updated":"2026-04-08 13:35:57.000000000","message":"I think that is disjointed, in that secure boot is just a feature which is related, but doesn\u0027t have to be enabled in every case. Yes, that means the kernel could be compromised on the host, or it might just not matter. For example, operators using PXE boot might not care about secure boot, where as operators using vmedia might care. The key is to give the operator what they feel they need to monitor through configuration options.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"a394896bb5f884a2b4bf24b55df1c7019ff83585","unresolved":true,"context_lines":[{"line_number":1370,"context_line":"    monitored_pcrs \u003d 0,1,2,7"},{"line_number":1371,"context_line":""},{"line_number":1372,"context_line":"    # Always fail if firmware or Secure Boot changes"},{"line_number":1373,"context_line":"    critical_pcrs \u003d 0,7"},{"line_number":1374,"context_line":""},{"line_number":1375,"context_line":"    # Warn but don\u0027t fail if BIOS settings or Option ROMs change"},{"line_number":1376,"context_line":"    warning_pcrs \u003d 1,2"}],"source_content_type":"text/x-rst","patch_set":2,"id":"aa9cbe22_341b69a6","line":1373,"in_reply_to":"7a93a66d_6eb24318","updated":"2026-04-08 23:25:09.000000000","message":"Ack","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"6ee1b70be7b07c20119527585fb119d908bc7155","unresolved":true,"context_lines":[{"line_number":1623,"context_line":""},{"line_number":1624,"context_line":"**Functional Testing**"},{"line_number":1625,"context_line":""},{"line_number":1626,"context_line":"Using ansible-keylime-tpm-emulator for TPM simulation:"},{"line_number":1627,"context_line":""},{"line_number":1628,"context_line":"* Inspection with attestation baseline establishment"},{"line_number":1629,"context_line":"* Deployment pre-deploy validation (pass and fail scenarios)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"542fada8_9579a4a7","line":1626,"updated":"2026-04-08 04:22:28.000000000","message":"On virtual bare metal used in test environments could libvirt vTPM replace the need for ansible-keylime-tpm-emulator?","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"063b65cecda4349059a3c276a2845615213bd8f5","unresolved":true,"context_lines":[{"line_number":1623,"context_line":""},{"line_number":1624,"context_line":"**Functional Testing**"},{"line_number":1625,"context_line":""},{"line_number":1626,"context_line":"Using ansible-keylime-tpm-emulator for TPM simulation:"},{"line_number":1627,"context_line":""},{"line_number":1628,"context_line":"* Inspection with attestation baseline establishment"},{"line_number":1629,"context_line":"* Deployment pre-deploy validation (pass and fail scenarios)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"866d35ac_1930ea10","line":1626,"in_reply_to":"542fada8_9579a4a7","updated":"2026-04-08 13:35:57.000000000","message":"Quite likely, this is just what claude whipped up upfront. I\u0027m sort of skeptical because on the timeline we might not be able to fit full functional testing into this development cycle as well as the base attestation work.","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"}],"specs/approved/attestation-interface.rst":[{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"ddf4e5e3eef0990d647caa54cd69231e42e50a8b","unresolved":true,"context_lines":[{"line_number":12,"context_line":"   This specification has been superseded by the revised design at"},{"line_number":13,"context_line":"   :doc:`attestation-interface-v2`. This original specification was never"},{"line_number":14,"context_line":"   fully implemented and the revised version addresses gaps and production"},{"line_number":15,"context_line":"   deployment requirements identified since the original proposal."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"https://storyboard.openstack.org/#!/story/2002713"},{"line_number":18,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5cb28a5f_2d3cc9a3","line":15,"updated":"2026-04-22 15:39:58.000000000","message":"nit: maybe move this one to backlog?","commit_id":"f0633e69f931e75f913d8e9f718489e6c5f430d2"}]}