mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-18 10:43:15 +00:00
overtrue
abca7ddfd7
`test_vault_kv2_sources_do_not_claim_transit_wrapping` asserted that four `include_str!`-pinned files never describe the Vault KV2 backend as wrapping key material through Vault's Transit engine. The invariant is a documentation-claim invariant with no behavioral twin by construction, and the test form was weak in both directions: it saw only four files (the same prose in a fifth file passed silently) and it stopped compiling — rather than reporting a violation — as soon as one of them was renamed. Move the four literals verbatim into `scripts/check_fips_wording.sh`, which already guards the adjacent cryptographic over-claim class (unsupported FIPS validation wording) and is anchored to the same policy document. The guard now greps every file under `crates/kms` for the same four case-sensitive literals and separately reports a moved pinned source instead of failing to build. `check_fips_wording.sh` previously ran only in `make pre-commit` / `pre-pr`, so wire it into the Quick Checks job of both CI workflows to keep the invariant's failure visibility at least as strong as the deleted test's.
118 lines
4.2 KiB
Bash
Executable File
118 lines
4.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Guard: cryptographic capability wording must not over-claim what RustFS
|
|
# actually does. Two independent blocks, both anchored to the policy in
|
|
# docs/operations/kms-cryptographic-compliance.md:
|
|
#
|
|
# 1. Outward README and CHANGELOG material must not make an unsupported
|
|
# FIPS validation or certification claim. This block intentionally scans
|
|
# only the two public project-facing documents; the permitted qualifiers
|
|
# live in the policy document.
|
|
#
|
|
# 2. Nothing in crates/kms may describe the Vault KV2 backend as wrapping
|
|
# key material through Vault's Transit engine. `KmsBackend::VaultKv2`
|
|
# stores RustFS-wrapped key material in Vault's KV v2 engine and never
|
|
# calls Transit (see crates/kms/src/config.rs and
|
|
# docs/operations/kms-backend-security.md), so such prose tells operators
|
|
# their key material is cryptographically isolated inside Vault when it is
|
|
# not.
|
|
#
|
|
# Block 2 replaces the unit test `test_vault_kv2_sources_do_not_claim_transit_wrapping`
|
|
# that used to live in crates/kms/src/config.rs (rustfs/backlog#1884). The
|
|
# invariant is a documentation-claim invariant, so it has no behavioral twin by
|
|
# construction and belongs in a wording guard rather than in a test. The test
|
|
# could only see four `include_str!`-pinned files and stopped compiling —
|
|
# rather than reporting a violation — the moment one of them was renamed; this
|
|
# block scans every file in the crate and reports a rename explicitly.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
ROOT_DIR="${CHECK_FIPS_WORDING_ROOT:-$(cd "${SCRIPT_DIR}/.." && pwd)}"
|
|
|
|
cd "$ROOT_DIR"
|
|
|
|
TARGETS=(README.md CHANGELOG.md)
|
|
FORBIDDEN_PATTERNS=(
|
|
'FIPS[[:space:]]+(140-[23](/[[:space:]]*140-[23])?[[:space:]]+)?(validated|certified|compliant)'
|
|
'FIPS[[:space:]]+mode'
|
|
'FIPS-enabled'
|
|
'NIST[[:space:]]+(certified|approved)'
|
|
'CMVP[[:space:]]+certificate'
|
|
'(meets|satisfies)[[:space:]]+FIPS'
|
|
)
|
|
|
|
KMS_CRATE_DIR="crates/kms"
|
|
|
|
# The four files the retired unit test pinned with include_str!. They stay
|
|
# listed so that moving one out of crates/kms is reported here instead of
|
|
# silently shrinking the scan; the scan itself is not limited to them.
|
|
KMS_PINNED_SOURCES=(
|
|
"crates/kms/src/config.rs"
|
|
"crates/kms/src/api_types.rs"
|
|
"crates/kms/src/backends/vault.rs"
|
|
"crates/kms/src/lib.rs"
|
|
)
|
|
|
|
# Literal, case-sensitive, and byte-for-byte the needles the retired test built
|
|
# at runtime via format!("wrapping via {}", "Transit") and friends.
|
|
KMS_VAULT_KV2_FORBIDDEN=(
|
|
'wrapping via Transit'
|
|
'KV v2 + Transit'
|
|
'KV2+Transit'
|
|
"you would use Vault's transit engine"
|
|
)
|
|
|
|
fips_status=0
|
|
kms_status=0
|
|
|
|
for target in "${TARGETS[@]}"; do
|
|
if [[ ! -f "$target" ]]; then
|
|
printf 'FIPS wording guard failed: %s is missing\n' "$target" >&2
|
|
fips_status=1
|
|
continue
|
|
fi
|
|
|
|
for pattern in "${FORBIDDEN_PATTERNS[@]}"; do
|
|
matches="$(grep -E -i -n -- "$pattern" "$target" || true)"
|
|
if [[ -n "$matches" ]]; then
|
|
printf 'FIPS wording guard failed: forbidden pattern /%s/ in %s:\n%s\n' \
|
|
"$pattern" "$target" "$matches" >&2
|
|
fips_status=1
|
|
fi
|
|
done
|
|
done
|
|
|
|
for source in "${KMS_PINNED_SOURCES[@]}"; do
|
|
if [[ ! -f "$source" ]]; then
|
|
printf 'KMS wording guard failed: %s is missing; update KMS_PINNED_SOURCES in scripts/check_fips_wording.sh after moving it\n' \
|
|
"$source" >&2
|
|
kms_status=1
|
|
fi
|
|
done
|
|
|
|
if [[ -d "$KMS_CRATE_DIR" ]]; then
|
|
for pattern in "${KMS_VAULT_KV2_FORBIDDEN[@]}"; do
|
|
matches="$(grep -r -F -n -- "$pattern" "$KMS_CRATE_DIR" || true)"
|
|
if [[ -n "$matches" ]]; then
|
|
printf 'KMS wording guard failed: forbidden Vault KV2 claim "%s" in %s:\n%s\n' \
|
|
"$pattern" "$KMS_CRATE_DIR" "$matches" >&2
|
|
kms_status=1
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if [[ "$fips_status" -ne 0 ]]; then
|
|
printf 'Remove unsupported FIPS validation wording from README.md or CHANGELOG.md.\n' >&2
|
|
fi
|
|
|
|
if [[ "$kms_status" -ne 0 ]]; then
|
|
printf 'The Vault KV2 backend does not wrap key material through Vault Transit; fix the wording in crates/kms.\n' >&2
|
|
fi
|
|
|
|
if [[ "$fips_status" -ne 0 || "$kms_status" -ne 0 ]]; then
|
|
exit 1
|
|
fi
|
|
|
|
printf 'FIPS wording guard passed (README.md and CHANGELOG.md contain no forbidden claims).\n'
|
|
printf 'KMS wording guard passed (crates/kms claims no Vault KV2 Transit wrapping).\n'
|