Boyi (Elliot) Li 3a1fac16e3 feat(tls): add opt-in fips feature for aws-lc-rs and rustls (#9084) ...

Add an opt-in `fips` Cargo feature to `rustfs` and `rustfs-tls-runtime`
that enables `rustls/fips` and `tokio-rustls/fips` (activating
`aws-lc-rs/fips` / `aws-lc-fips-sys` and `rustls-webpki/aws-lc-rs-fips`).

When compiled with `--features fips`, `startup_runtime_hooks` installs
`rustls::crypto::default_fips_provider()` as the process-wide default
crypto provider and asserts `provider.fips()` at startup.

Also lock `aws-lc-fips-sys v0.14.4` in `Cargo.lock`, allow the `OpenSSL`
license on `aws-lc-fips-sys` in `deny.toml`, and update
`docs/operations/kms-cryptographic-compliance.md` to document the scope
of `-p rustfs --features fips` vs. `rustfs-crypto`.

Co-authored-by: hector <42570491+majinghe@users.noreply.github.com>

2026-11-02 04:27:05 +00:00

..

admin-peer-probe-timeout.md

fix(admin): bound peer probe retries to one round deadline (#7257)

2026-09-06 14:13:47 +08:00

amqp-notifications.md

fix(amqp): emit S3 events directly in notification records (#8066)

2026-09-22 12:16:40 +00:00

architecture-guard-troubleshooting.md

docs: unify agent instructions across tools (#8675)

2026-10-19 07:52:51 +09:00

atomic-object-undo.md

docs(knowledge-base): prune stale content and add agent-facing index (#7035)

2026-09-02 08:26:59 +08:00

audit-denial-entries.md

fix(audit): emit a bounded audit entry for authorization denials (#9073)

2026-10-30 23:18:42 +08:00

btf-prototype-inspection.md

feat(tools): inspect BTF scalar member layouts (#9003)

2026-10-28 01:37:31 +08:00

bucket-heal-recovery.md

fix(heal): safely recover missing bucket directories by default (#8517)

2026-10-14 03:57:09 -07:00

bucket-metadata-recovery.md

fix: reconcile bucket generations and observe lock failures (#8421)

2026-10-08 21:26:12 +08:00

bucket-operation-admission.md

fix: refresh peer metadata without blocking bucket mutations (#8486)

2026-10-12 05:03:16 -07:00

bucket-usage-metrics.md

fix(obs): isolate bucket usage dashboards by cluster (#8510)

2026-10-13 03:00:44 -07:00

cargo-publish-workspace.md

feat(release): add workspace cargo publish tooling (#7973)

2026-09-17 18:15:35 +08:00

cluster-lifecycle-operations.md

docs(listing): describe degraded strict quorum limits (#8981)

2026-10-28 03:53:24 +08:00

container-resource-detection.md

docs(knowledge-base): prune stale content and add agent-facing index (#7035)

2026-09-02 08:26:59 +08:00

delete-transaction-recovery.md

fix(listing): leave delete recovery out of list requests (#8980)

2026-10-27 23:04:22 +08:00

dial9-runtime-profiling.md

feat(ecstore): integrate io_uring backend improvements (#8105)

2026-09-26 17:14:17 +08:00

drive-timeout-tuning.md

fix(ecstore): honor idle drive monitoring opt-out (#8770)

2026-10-21 23:29:41 +09:00

durability-modes.md

fix(storage): default new bucket durability to strict (#8253)

2026-09-30 09:23:32 +08:00

durable-quota-reservation-v2.md

fix(quota): keep reads available without snapshot-wide copies (#8928)

2026-10-25 18:06:35 +08:00

encrypted-etags.md

fix(replication): locate encrypted replicas without comparing ETags (#8602)

2026-10-16 13:44:33 +08:00

ftps.md

fix(protocols): enforce S3 policies for file protocol operations (#8262)

2026-10-03 21:40:56 -07:00

hotpath-warp-ab-runbook.md

feat(observability): attribute local batch shard reads (#8991)

2026-10-28 07:48:32 +08:00

internode-grpc-benchmark-runbook.md

fix: rename admin metrics endpoint to realtime (#8046)

2026-09-21 19:23:58 +08:00

internode-http-transport.md

test(e2e): harden multipart fault and TLS acceptance (#8907)

2026-10-25 04:54:35 +08:00

internode-msgpack-json-convergence-runbook.md

docs(knowledge-base): prune stale content and add agent-facing index (#7035)

2026-09-02 08:26:59 +08:00

io-uring-initialization.md

feat(ecstore): integrate io_uring backend improvements (#8105)

2026-09-26 17:14:17 +08:00

io-uring-read-chunks.md

feat(ecstore): integrate io_uring backend improvements (#8105)

2026-09-26 17:14:17 +08:00

kms-admin-contract.md

fix(kms): refuse key ids that leave the key prefix on the Vault backends (#7727)

2026-09-14 12:37:45 +00:00

kms-backend-security.md

fix(sse): guard copy-source SSE-C keys over TLS and reject bucket-keyed KMS context (#8296)

2026-10-03 09:31:08 +08:00

kms-cryptographic-compliance.md

feat(tls): add opt-in fips feature for aws-lc-rs and rustls (#9084)

2026-11-02 04:27:05 +00:00

kms-disaster-recovery-drill.md

chore(release): merge release into main for rc.6 (#7638)

2026-09-10 18:24:20 +08:00

kms-observability-runbook.md

chore(release): merge release into main for rc.6 (#7638)

2026-09-10 18:24:20 +08:00

kms-per-key-authorization.md

docs(knowledge-base): prune stale content and add agent-facing index (#7035)

2026-09-02 08:26:59 +08:00

local-batch-cpu-diagnostics.md

feat(ecstore): add sampled batch CPU diagnostics (#9019)

2026-10-29 10:32:06 +08:00

lock-rpc-storm-protection.md

fix(lock): contain slow peer RPC admission storms (#7970)

2026-09-17 10:01:16 +00:00

log-diagnose.md

docs(knowledge-base): prune stale content and add agent-facing index (#7035)

2026-09-02 08:26:59 +08:00

logging-governance.md

docs: trim redundant project skills (#8323)

2026-10-03 21:30:26 +08:00

mrf-responsibilities.md

fix(heal): gate unresolved MRF lifecycle writes on reader support (#8918)

2026-10-25 22:59:49 +08:00

multipart-memory.md

chore(release): merge 1.0.1 back into main and refresh installation references (#8314)

2026-10-03 14:40:52 +08:00

nats-jetstream.md

docs(knowledge-base): prune stale content and add agent-facing index (#7035)

2026-09-02 08:26:59 +08:00

no-parity-bitrot-recovery.md

docs(knowledge-base): prune stale content and add agent-facing index (#7035)

2026-09-02 08:26:59 +08:00

object-io-tuning-ab-matrix.md

perf(ecstore): reduce multipart and object I/O overhead (#8095)

2026-10-03 14:53:00 +08:00

object-lock-contention.md

fix(ecstore): unify multipart generation fence lifetimes (#8830)

2026-10-23 20:14:34 +09:00

oidc-console-integration.md

feat(oidc): make the Console session duration configurable (#8568)

2026-10-19 06:52:05 +09:00

oidc-provider-requirements.md

refactor(iam): organize OIDC runtime modules (#8445)

2026-10-11 13:27:46 +08:00

on-demand-migration.md

fix(e2e): require a verified server binary for every e2e run (#7687)

2026-09-12 11:23:06 +08:00

outbound-connection-policy.md

fix(tier): restore private endpoints and forced config removal (#8725)

2026-10-21 10:21:27 +08:00

persisted-config-compatibility.md

fix(config): preserve persisted compatibility fields (#8803)

2026-10-22 20:05:21 +08:00

pool-metadata-recovery.md

fix(storage): fence multipart and metadata recovery (#8919)

2026-10-26 12:39:54 +08:00

presigned-size-limits.md

fix(ecstore): prove multipart part sizes before cleanup (#9037)

2026-10-29 00:14:32 +08:00

put-cleanup-isolation.md

perf(ecstore): isolate cleanup and preserve metadata authority (#8289)

2026-10-12 22:07:50 -07:00

rebalance-stored-representation-impact.md

docs(knowledge-base): prune stale content and add agent-facing index (#7035)

2026-09-02 08:26:59 +08:00

replacement-generation-recovery.md

feat(heal): inspect blocked checkpoint validation without mutation (#8838)

2026-10-23 23:03:57 +09:00

replication-check.md

fix(replication): resolve drifted replicas via a target version ledger (#7368)

2026-09-07 11:23:32 +00:00

replication-object-size-limits.md

fix(replication): quote the ETag in the single-PUT size guard message (#7075)

2026-09-03 07:03:49 +08:00

replication-outbound-transport.md

fix(replication): locate encrypted replicas without comparing ETags (#8602)

2026-10-16 13:44:33 +08:00

reverse-proxy.md

feat(http3): add opt-in QUIC transport (#7903)

2026-10-07 03:59:21 -07:00

rolling-restart.md

fix(readiness): hold startup readiness until peers re-admit the node (#8704)

2026-10-20 00:28:48 +09:00

s3-tables-cutover-runbook.md

fix(s3-tables): clean empty catalogs and cache registration reads (#9063)

2026-11-01 04:49:50 +00:00

s3-tables-maintenance-scheduler.md

feat(table-catalog): support conditional maintenance worker retries (#8562)

2026-10-18 10:03:58 +08:00

s3-write-failure-diagnostics.md

fix: rename admin metrics endpoint to realtime (#8046)

2026-09-21 19:23:58 +08:00

scanner-benchmark-runbook.md

feat(storage): share physical admission across scanner and heal (#8911)

2026-10-31 01:00:07 +08:00

scanner-excess-alerts.md

docs(knowledge-base): prune stale content and add agent-facing index (#7035)

2026-09-02 08:26:59 +08:00

scanner-runtime-controls.md

feat(storage): share physical admission across scanner and heal (#8911)

2026-10-31 01:00:07 +08:00

sftp.md

fix(ecstore): prove multipart part sizes before cleanup (#9037)

2026-10-29 00:14:32 +08:00

shard-integrity-audit.md

feat(integrity): add inventory, audit, and protected migration (#8065)

2026-09-22 19:23:41 +08:00

shard-integrity-rollout.md

fix(heal): certify metadata health and marker repair receipts (#7932)

2026-09-16 22:41:51 +08:00

site-replication-operations.md

fix(replication): count force-delete outcomes in replication stats (#9072)

2026-10-30 18:00:03 +08:00

snowball-auto-extract.md

feat(storage): complete Snowball and decommission follow-ups (#7039)

2026-09-03 03:58:59 +00:00

static-website-hosting.md

fix(s3): serve bucket websites on dedicated domains

2026-09-28 18:48:21 +08:00

storage-metrics.md

fix(e2e): require a verified server binary for every e2e run (#7687)

2026-09-12 11:23:06 +08:00

tier-ilm-debugging.md

fix(tiering): diagnose blocked tier deletion and retry cleanup (#9035)

2026-10-29 09:06:23 +08:00

tls-certificate-rotation.md

feat(tls): reload and publish external certificate generations (#8467)

2026-10-12 08:53:11 +08:00

two-factor-auth.md

feat(auth): allow custom secret keys beyond 40 bytes (#8419)

2026-10-08 17:37:15 +08:00

vault-kms-authentication.md

chore(release): merge release into main for rc.6 (#7638)

2026-09-10 18:24:20 +08:00