mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-01 19:12:14 +00:00
Zhengchao An
364168c0ba
* docs(kms): record the cryptographic compliance position RustFS links no FIPS-validated cryptographic module: the rustls provider is the ordinary aws-lc-rs build, and every data-path AEAD is RustCrypto. The crypto crate's default-on `fips` feature only selects PBKDF2+AES-GCM over Argon2id, with the same RustCrypto implementations behind both branches, so it cannot support a validation claim either. Document that status, the terminology rules for external material, the real semantics of the `fips` feature with a rename direction, the cost of the three routes to a stronger position, and the sequencing rules for retiring an algorithm. Refs rustfs/backlog#1587 (part of rustfs/backlog#1562) * docs(kms): document the mixed-version cluster constraints Collect the cross-version constraints that landed with versioned rotation and the check-and-set lifecycle work: which persisted formats decode both ways, which guarantees only hold once every node is upgraded, how long nodes can disagree on lifecycle state, and that reconfigure is persisted cluster-wide but applied only on the node that handled it. Adds the recommended rolling-upgrade sequence and the list of operations to avoid while two builds are running. Refs rustfs/backlog#1581 (part of rustfs/backlog#1562)