The next TOC meeting is on the 11th, not sure what's up with the phantom calendar invite for today. Sorry for the confusion. -- Chris Aniszczyk (@cra) | +1-512-961-6719

Hi - https://www.uberconference.com/cloudnative -- Shawn Preissner Integrated Marketing Manager The Linux Foundation Cell: +1 (919)257-9591 Web: cncf.io and cncf.io/events Sign up for our

Are we on uberconference or zoom today?

:-)

Of course. Wouldn't leave them out! -Josh

Josh How about people from docker and kubernetes? Are they in the loop? Alexis

Hi Alexis, I'm not sure exactly the number of people, but it's been a large effort from everyone around the community between the folks at Mesosphere, those of us at Dell, and all of the rest of the

this looks like very quick progress; impressive how many people are involved?

FYI ---------- Forwarded message ---------- From: Clinton Kitson <clintonskitson@...> Date: Sat, Jul 1, 2017 at 12:56 AM Subject: first CSI example implementation To: cncf-wg-storage

Rob, Zach, to clarify: do you have specific concerns about InfraKit that we should ask Dave to address? My understanding is that 1) InfraKit is OS-agnostic and does not require LinuxKit 2) InfraKit

I'd agree with Rob here. LinuxKit is certain a component, but I think that the full hardware and network lifecycle associated with booting "all the things" is a pretty broad and messy space right

Responding to request from TOC meeting last week... I think that Day 1 and Day 2 provisioning is key area for CNCF to cover; however, I think that the space is transforming in several different ways

FYI ---------- Forwarded message ---------- From: Jie Yu <jie@...> Date: Tue, Jun 27, 2017 at 6:57 AM Subject: CSI regular community sync To: container-storage-interface-community@... Cc:

Last call for comments. TOC vote to follow.

Just wanted to weigh in from CoreOS. We are using Notary for signing packages as well for the Quay container registry running at Quay.io. Signing packages is tricky and TUF seems to get things right.

Thanks Justin, that is very helpful & certainly length-appropriate.

I didn't do a deep dive, but it looks like the "simple signing" design from Fedora would enable an attacker that has compromised the signing server to compromise user devices (even with HSMs, etc.).

Scott What are your thoughts on Notary? a

Per the comments on GnuPG - the ubiquitous use of GPG is what drove Red Hat to work on what we call "simple signing" [1][2]. We would love to partner on more of this work. [1]:

Thanks Richard. +1 on .debs. My 2c is that signing functionality used to be quite inhumane, and any project seeking to do better could certainly focus on being "pleasant". Although the Notary