CNCF Parsec Annual Report 2021

[paulhowardarm]

CNCF have requested an annual report from the maintenance team. I am working on the report, and have included the proposed content below. I am opening up this discussion as a means of reviewing the content among the Parsec community before I create the PR into the CNCF TOC repo.

Parsec 2021 Annual Review

Project Summary

Parsec is the Platform Abstraction for Security. Parsec is creating convenient and portable interfaces to hardware security on any platform in any programming language. Parsec is deployed as a local software service (or daemon), which executes in user space on Linux systems. The software service contains back-end provider modules that offer compatibility with various hardware or firmware services for secure storage and cryptography, including Trusted Platform Modules (TPM), Hardware Security Modules (HSM), secure elemements or trusted firmware. Applications consume these services using a convenient and portable API. The Parsec API can be made available in any programming language, given the availability of a suitable client library. The end result is that applications are able to consume the best-available hardware security of their host platform, without being tightly coupled to the often complex and specialised APIs and software stacks that are otherwise needed.

The main Parsec repository can be found here. There are several satellite repositories in the same organisation.

You can read the Parsec documentation online.

Parsec was proposed and accepted as a sandbox project in June 2020.

Functional Highlights

Some functional development highlights for the reporting period 2020/2021 as follows:

• Introduction of the Parsec Go client through independent community contribution.
• Introduction of the Parsec Tool, allowing users to access Parsec functions from command-line or scripting contexts.
• Introduction of a new back-end provider module interfacing with CryptoAuthLib for compatibility with Microchip Secure Elements.
• Introduction of a new back-end provider module for compatibility with firmware trusted services from trustedfirmware.org.
• Development of multi-tenancy support, including an integration with the SPIFFE identity framework.
• Creation of a new, safe Rust abstraction for the PKCS#11 and PSA Crypto interfaces.
• Substantial enhancements to the Rust TPM Library.

Contribution Metrics

Please refer to the Parsec DevStats page.

Parsec has enjoyed a modest but increasing contribution rate during its first year as a CNCF sandbox project. The number of contributors has grown, as has the number of contributing organizations.

Across the individual repositories that make up the project, a contribution summary for the last review period is given below:

• The number of individual active GitHub repositories has grown from 9 to 14 as new client libraries and back-end provider integrations have been contributed.
• A total of 559 pull requests were successfully merged from 19 separate contributors.
• The number of contributing organisations has grown from three to six. The project has also seen some indepedent contributions in the community.

Maintainers

Please refer to the MAINTAINERS file.

The list of official maintainers covers three organisations: Arm, Docker and Mirantis. These are the individuals who have full admin rights to the project repositories. However, during the reporting period, an additional three contributors were granted the write role on some repositories, giving them the permission to merge pull requests.

Adoption

Parsec has been adopted commercially by Pelion. The Pelion Edge product uses Parsec as a portable means of protecting device identity keys in hardware. See the relevant release notes.

Fedora IoT has the dbus-parsec project in GitHub, which is the first community open-source project to be consuming Parsec.

The CNCF Keylime Project is making use of the Rust TPM library that was initially developed for Parsec.

Parsec has now been packaged for both the Fedora and openSUSE Linux distributions. It is included by default in the IoT variant of the Fedora distribution.

Parsec recipes are available for custom embedded Linux distributions based on Yocto Project.

Events and Publicity

During the reporting period, Parsec has been represented or showcased as follows:

• Cloud Native Security Day (Europe)
• Linaro Virtual Connect
• Cloud Native Security Day (NA)
• Cloud Native Rust Day
• KubeCon 2021
• Yocto Summit 2021
• Confidential Computing Developer Summit
• Arm Software Developer Breakdown

Project Goals

Performance Against Goals For Previous Review Period

The Parsec project has tracked well against the goals that were established when it was proposed for the CNCF sandbox. In particular:

• Rust and C client libraries have been made available as planned. There is also a Go client library, which was developed through community contribution.
• Integration into a commercial product has been achieved (see above).
• Integration into Yocto Linux has been achieved (see above), as well as packaging for Fedora and openSUSE distributions.
• Coverage of the API primitives has increased, as has the number of back-end integrations, which now offer compatibility with secure elements using CryptoAuthLib and services from Trusted Firmware.
• The multi-tenancy design was implemented in two variants, allowing client applications to be identified according to their Unix user identity (UID), or alternatively according to a SPIFFE ID.

The following are still backlog items:

• Support for Parsec in virtualised environments.
• API for arbitrary blob/secret storage and retrieval.

These are still both project goals, although they have not yet been of sufficiently high priority to be addressed by any of the contributors.

Current Goals

Goals for the coming year include:

• Establishing a formal release process and regular release cadence. Read the proposal here.
• Establishing a public project roadmap.
• Increasing the number of contributors and contributing organisations.
• Increasing the amount of end-user adoption.
• Meeting the criteria for incubation.
• Functional enhancements as needed in support of the above goals. Support for additional client languages and popular security frameworks will be a likely component of this.

CNCF Membership

Parsec contributors are grateful to the CNCF for the first year of sandbox membership.

Parsec has benefitted enormously from CNCF membership. CNCF provided invaluable assistance during the onboarding phase, helping with IP and trademark issues. Parsec's presence in the CNCF sandbox has made it more attractive to potential adopters. CNCF have also assisted with website content creation and hosting.

Parsec will continue to look towards the CNCF for guidance in preparing itself for incubation. Assistance with security assessment (if required) would be appreciated, as would recommendations for how to ensure that incubation criteria are being met.

Readiness for Incubation

Parsec does not yet meet the stated criteria for incubation for the following reasons:

• There are not yet three independent adoptions that are in production.
• Security assessment still pending.
• The release process and associated versioning scheme have been defined but not yet exercised in practice.

The following maturity indicators can however be demonstrated:

• Contributions from multiple independent vendor organisations.
• A body of comprehensive and well-maintained documentation.
• A consistent and increasing rate of contribution.
• A security page, which describes the project's security policy, and provides information about how to report vulnerabilities to the maintenance team.
• A continuous integration process, including fuzz testing and code coverage analysis.
• Use in production by one commercial software product/service.
• A documented security threat model.
• A documented set of stability and backwards-compatibility requirements, with appropriate build-time enforcement.
• A pull request checklist.
• A CII Best Practices badge.

[hug-dev]

Thanks for the details report!! Everything looks good to me and I have two minor comments:

Functional Highlights

I am not sure if it is included in the reporting period but we might want to include the Parsec Tool and the PSA Crypto Rust crate? First release of the psa-crypto crate is 3 June 2020 and the first one for parsec-tool is 20 October 2020.

The number of individual GitHub repositories has grown from 9 to 15 as new client libraries and back-end provider integrations have been contributed.

I guess you are counting the parsec-client-test repo as well, but as it is archived maybe it would be best to say "from 8 to 14"?

[paulhowardarm]

Good points - I will tweak. Thanks.