:-)

Of course. Wouldn't leave them out! -Josh On Jul 1, 2017, at 12:10 AM, Alexis Richardson <alexis@...> wrote:

Josh How about people from docker and kubernetes? Are they in the loop? Alexis

Hi Alexis, I'm not sure exactly the number of people, but it's been a large effort from everyone around the community between the folks at Mesosphere, those of us at Dell, and all of the rest of the

this looks like very quick progress; impressive how many people are involved?

FYI ---------- Forwarded message ---------- From: Clinton Kitson <clintonskitson@...> Date: Sat, Jul 1, 2017 at 12:56 AM Subject: first CSI example implementation To: cncf-wg-storage

Rob, Zach, to clarify: do you have specific concerns about InfraKit that we should ask Dave to address? My understanding is that 1) InfraKit is OS-agnostic and does not require LinuxKit 2) InfraKit

I'd agree with Rob here. LinuxKit is certain a component, but I think that the full hardware and network lifecycle associated with booting "all the things" is a pretty broad and messy space right

Responding to request from TOC meeting last week... I think that Day 1 and Day 2 provisioning is key area for CNCF to cover; however, I think that the space is transforming in several different ways

FYI ---------- Forwarded message ---------- From: Jie Yu <jie@...> Date: Tue, Jun 27, 2017 at 6:57 AM Subject: CSI regular community sync To: container-storage-interface-community@... Cc:

Last call for comments. TOC vote to follow.

Just wanted to weigh in from CoreOS. We are using Notary for signing packages as well for the Quay container registry running at Quay.io. Signing packages is tricky and TUF seems to get things right.

Thanks Justin, that is very helpful & certainly length-appropriate.

I didn't do a deep dive, but it looks like the "simple signing" design from Fedora would enable an attacker that has compromised the signing server to compromise user devices (even with HSMs, etc.).

Scott What are your thoughts on Notary? a

Per the comments on GnuPG - the ubiquitous use of GPG is what drove Red Hat to work on what we call "simple signing" [1][2]. We would love to partner on more of this work. [1]:

Thanks Richard. +1 on .debs. My 2c is that signing functionality used to be quite inhumane, and any project seeking to do better could certainly focus on being "pleasant". Although the Notary

<cncf-toc@...> wrote: Speaking as a Debian Developer, most of my work in that regard is underpinned by GnuPG. A lot of the functionality mentioned could be built with GnuPG and installed

To be clear I dialed in but it was totally unclear how to unmute myself. I own a phone with a mute button perhaps there's a default setting we could fix to not default phone to mute

That's good info. Keen to learn more from the community about this use case and project!