From da531c8a9719eba696fe7d7eb045bd9735586dc6 Mon Sep 17 00:00:00 2001 From: Zhengchao An Date: Sun, 2 Aug 2026 18:50:54 +0800 Subject: [PATCH] docs(kms): guard outward FIPS wording (#5624) --- .config/make/lint-fmt.mak | 5 ++ .config/make/pre-commit.mak | 6 +-- .../kms-cryptographic-compliance.md | 2 +- scripts/check_fips_wording.sh | 48 +++++++++++++++++++ 4 files changed, 57 insertions(+), 4 deletions(-) create mode 100755 scripts/check_fips_wording.sh diff --git a/.config/make/lint-fmt.mak b/.config/make/lint-fmt.mak index d45fef63f..ea4682e72 100644 --- a/.config/make/lint-fmt.mak +++ b/.config/make/lint-fmt.mak @@ -60,6 +60,11 @@ body-cache-whitelist-check: ## Check the body-cache eligibility gate stays a fai @echo "🧱 Checking body-cache whitelist guard..." ./scripts/check_body_cache_whitelist.sh +.PHONY: fips-wording-check +fips-wording-check: ## Check outward docs do not make unsupported FIPS claims + @echo "📣 Checking FIPS wording guard..." + ./scripts/check_fips_wording.sh + .PHONY: log-analyzer-rules-check log-analyzer-rules-check: core-deps ## Check log-analyzer rule anchors still exist verbatim in source @echo "🩺 Checking log-analyzer rule anchors..." diff --git a/.config/make/pre-commit.mak b/.config/make/pre-commit.mak index 2780a8343..ad46d7e7d 100644 --- a/.config/make/pre-commit.mak +++ b/.config/make/pre-commit.mak @@ -19,13 +19,13 @@ planning-docs-check: ## Check that no planning-type documents are committed ./scripts/check_no_planning_docs.sh .PHONY: pre-commit -pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests +pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check fips-wording-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests @echo "✅ All pre-commit checks passed!" .PHONY: pre-pr -pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests +pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check fips-wording-check doc-paths-check planning-docs-check log-analyzer-rules-check clippy-check test ## Run full pre-PR checks with clippy and tests @echo "✅ All pre-PR checks passed!" .PHONY: dev-check -dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks +dev-check: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check fips-wording-check doc-paths-check planning-docs-check quick-check ## Run fast local development checks @echo "✅ Fast development checks passed!" diff --git a/docs/operations/kms-cryptographic-compliance.md b/docs/operations/kms-cryptographic-compliance.md index a9756e383..c9ce1a4d4 100644 --- a/docs/operations/kms-cryptographic-compliance.md +++ b/docs/operations/kms-cryptographic-compliance.md @@ -51,7 +51,7 @@ Suggested boilerplate when the topic cannot be avoided: ### Guard -There is currently no FIPS-related wording anywhere in the repository's Markdown; that clean baseline is what a grep anchor test protects. Any future occurrence of the banned strings in shipped documentation should be treated as a defect and either removed or brought under the qualifier rule above. +`README.md` and `CHANGELOG.md` currently contain no FIPS-related wording; `scripts/check_fips_wording.sh` is the grep guard for that public baseline. Any future occurrence of the banned strings in either file should be treated as a defect and either removed or brought under the qualifier rule above. This document intentionally contains the terminology needed to define the policy and is not part of that narrow outward-material scan. ## The `rustfs-crypto` `fips` feature: what it actually does diff --git a/scripts/check_fips_wording.sh b/scripts/check_fips_wording.sh new file mode 100755 index 000000000..49027119c --- /dev/null +++ b/scripts/check_fips_wording.sh @@ -0,0 +1,48 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Guard: outward README and CHANGELOG material must not make an unsupported +# FIPS validation or certification claim. The detailed policy and permitted +# qualifiers live in docs/operations/kms-cryptographic-compliance.md; this +# check intentionally scans only the two public project-facing documents. + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="${CHECK_FIPS_WORDING_ROOT:-$(cd "${SCRIPT_DIR}/.." && pwd)}" + +cd "$ROOT_DIR" + +TARGETS=(README.md CHANGELOG.md) +FORBIDDEN_PATTERNS=( + 'FIPS[[:space:]]+(140-[23](/[[:space:]]*140-[23])?[[:space:]]+)?(validated|certified|compliant)' + 'FIPS[[:space:]]+mode' + 'FIPS-enabled' + 'NIST[[:space:]]+(certified|approved)' + 'CMVP[[:space:]]+certificate' + '(meets|satisfies)[[:space:]]+FIPS' +) + +status=0 + +for target in "${TARGETS[@]}"; do + if [[ ! -f "$target" ]]; then + printf 'FIPS wording guard failed: %s is missing\n' "$target" >&2 + status=1 + continue + fi + + for pattern in "${FORBIDDEN_PATTERNS[@]}"; do + matches="$(grep -E -i -n -- "$pattern" "$target" || true)" + if [[ -n "$matches" ]]; then + printf 'FIPS wording guard failed: forbidden pattern /%s/ in %s:\n%s\n' \ + "$pattern" "$target" "$matches" >&2 + status=1 + fi + done +done + +if [[ "$status" -ne 0 ]]; then + printf 'Remove unsupported FIPS validation wording from README.md or CHANGELOG.md.\n' >&2 + exit "$status" +fi + +printf 'FIPS wording guard passed (README.md and CHANGELOG.md contain no forbidden claims).\n'