I'm not really sure where to hang this, since there's no posted agenda or materials for the CCC meeting today. I'm afraid I also don't have a copy of the presentation to point people who weren't at the meeting to. However, it struck me you missed a third option: use the ima log format. This has the advantage that we can define additional events and have them published with a kernel patch (the IMA log format is defined in the kernel). Thanks to the TCG, it's also CEL compatible but doesn't require any sort of TCG blessing of the events. Plus we also have existing kernel infrastructure to log to that format. Regards, James
