Encryption-at-rest guide says rotating the SSE-KMS key re-encrypts existing model files; KMS key rotation does not re-encrypt stored objects (F-W1-DOCS-TRUST-19)
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 2/5
- Tiempo estimado
- 1-3 horas
- Aptitud para principiantes
- 55/100
- Tipo de issue
- Documentación
- Claridad
- Bastante claro
- Estado de actividad
- Activo
- Stack tecnológico
- aws
- Área
- documentation, security
Línea de trabajo
The wrong claim is in docs/qms/encryption_at_rest.md around lines 92-95, where it says rotation makes model files re-encrypt at the storage layer, and the same passage appears in docs/qms/encryption_at_rest-tr.md around lines 94-97. Read the AWS KMS rotation page linked in the issue, then separate scheduled rotation (new writes only) from re-encryption by copying objects under the new key. Done when both language versions say rotation does not re-encrypt existing artefacts, state how re-encryption is done and how long old key material is kept, and link the provider procedure.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix
Summary
The guide says ForgeLM is unaffected by key rotation because "the model files re-encrypt at the storage layer". AWS KMS key rotation only changes the key material used for new encryption; it keeps the earlier material to decrypt existing ciphertext and does not re-encrypt stored data. An operator who rotates after a suspected key exposure would believe old model files are protected by new key material when they are not.
Primary finding
F-W1-DOCS-TRUST-19 — KMS rotation is incorrectly said to re-encrypt existing model files
severity Medium · confidence high · checked against the AWS KMS documentation
What happens. docs/qms/encryption_at_rest.md:92-95 (Turkish mirror docs/qms/encryption_at_rest-tr.md:94-97): "rotate the CMK itself, not just the data key. ForgeLM is unaffected by rotation — the model files re-encrypt at the storage layer without the training pipeline noticing." Objects already written with SSE-KMS stay encrypted under the data keys they were written with, protected by the earlier key material; moving them to new key material means re-encrypting them, for example by copying the objects.
Where.
Evidence (re-verified on 2026-10-09).
- AWS KMS developer guide, "Rotate AWS KMS keys": rotation changes the key material used for new cryptographic operations, KMS keeps the earlier key material to decrypt data encrypted under it, and rotating key material does not re-encrypt the data the key protects (https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html).
- Both pages are unchanged on
development.
Recommended fix. Separate the two operations. Scheduled key rotation protects new writes; existing artefacts stay readable and are not re-encrypted. Re-encrypting existing artefacts — after a suspected key compromise, or where a policy requires it — is a separate step (copy the objects under the new key) and the old key material must stay available until the copy and a restore test are verified. Link the provider's procedure instead of promising transparent re-encryption.
Acceptance criteria
- Neither page states or implies that key rotation re-encrypts existing model files.
- The guide says how existing artefacts are re-encrypted and how long the old key material is kept.
- Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
- The finding is resolved or explicitly closed with a reason.
Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.
- Lenguaje dominante
- Python
- Estrellas
- 9
- Forks
- 1
- Merge medio
- 8 h 10 min
- PR fusionados (30 d)
- 5
Preparar el entorno
- Incluye un Dockerfile o un archivo de Docker Compose
- Tiene una plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de HodeTech/ForgeLM
-
area: dev-tooling bug severity: low source: roadmap wave: 4
Dificultad 2/5 1-3 horas Aptitud para principiantes 70/100
-
area: site bug good first issue severity: low source: review-2026-09 wave: 4
Dificultad 2/5 1-3 horas Aptitud para principiantes 66/100
-
documentation good first issue severity: medium source: review-2026-09 wave: 3
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
-
documentation good first issue severity: low source: review-2026-09 wave: 4
Dificultad 1/5 1-3 horas Aptitud para principiantes 80/100
-
documentation severity: medium source: review-2026-09 wave: 3
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
Todos los issues de HodeTech/ForgeLM
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
huggingface/peft#3955 ·
Los mantenedores suelen responder en 1 día
-
author-page correction
Dificultad 2/5 1-3 horas Aptitud para principiantes 60/100
acl-org/acl-anthology#10313 ·
Los mantenedores suelen responder en 1 día
-
anime duplicate exception request-theme
Dificultad 1/5 Menos de una hora Aptitud para principiantes 82/100
LizardByte/ThemerrDB#8926 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
huggingface/transformers#49556 ·
Los mantenedores suelen responder en 1 día
-
area/security bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 82/100
mozilla-ai/otari#2245 ·
Los mantenedores suelen responder en 1 día