Encryption-at-rest guide says rotating the SSE-KMS key re-encrypts existing model files; KMS key rotation does not re-encrypt stored objects (F-W1-DOCS-TRUST-19)
まだ誰も着手していません。
評価
- 難易度
- 2/5
- 見積もり時間
- 1〜3時間
- 初心者へのやさしさ
- 55/100
- issue の種類
- ドキュメント
- 明瞭さ
- おおむね明確
- 活発さ
- 活発
- 技術スタック
- aws
調査の方向性
The wrong claim is in docs/qms/encryption_at_rest.md around lines 92-95, where it says rotation makes model files re-encrypt at the storage layer, and the same passage appears in docs/qms/encryption_at_rest-tr.md around lines 94-97. Read the AWS KMS rotation page linked in the issue, then separate scheduled rotation (new writes only) from re-encryption by copying objects under the new key. Done when both language versions say rotation does not re-encrypt existing artefacts, state how re-encryption is done and how long old key material is kept, and link the provider procedure.
索引モデルが issue の本文から書いたものです。
説明
Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix
Summary
The guide says ForgeLM is unaffected by key rotation because "the model files re-encrypt at the storage layer". AWS KMS key rotation only changes the key material used for new encryption; it keeps the earlier material to decrypt existing ciphertext and does not re-encrypt stored data. An operator who rotates after a suspected key exposure would believe old model files are protected by new key material when they are not.
Primary finding
F-W1-DOCS-TRUST-19 — KMS rotation is incorrectly said to re-encrypt existing model files
severity Medium · confidence high · checked against the AWS KMS documentation
What happens. docs/qms/encryption_at_rest.md:92-95 (Turkish mirror docs/qms/encryption_at_rest-tr.md:94-97): "rotate the CMK itself, not just the data key. ForgeLM is unaffected by rotation — the model files re-encrypt at the storage layer without the training pipeline noticing." Objects already written with SSE-KMS stay encrypted under the data keys they were written with, protected by the earlier key material; moving them to new key material means re-encrypting them, for example by copying the objects.
Where.
Evidence (re-verified on 2026-10-09).
- AWS KMS developer guide, "Rotate AWS KMS keys": rotation changes the key material used for new cryptographic operations, KMS keeps the earlier key material to decrypt data encrypted under it, and rotating key material does not re-encrypt the data the key protects (https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html).
- Both pages are unchanged on
development.
Recommended fix. Separate the two operations. Scheduled key rotation protects new writes; existing artefacts stay readable and are not re-encrypted. Re-encrypting existing artefacts — after a suspected key compromise, or where a policy requires it — is a separate step (copy the objects under the new key) and the old key material must stay available until the copy and a restore test are verified. Link the provider's procedure instead of promising transparent re-encryption.
Acceptance criteria
- Neither page states or implies that key rotation re-encrypts existing model files.
- The guide says how existing artefacts are re-encrypted and how long the old key material is kept.
- Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
- The finding is resolved or explicitly closed with a reason.
Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.
- 主要言語
- Python
- スター
- 9
- フォーク
- 1
- 平均マージ
- 8時間 10分
- マージ済み PR（30日）
- 5
環境構築
- Dockerfile または Docker Compose ファイルあり
- プルリクエストのテンプレートあり
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
HodeTech/ForgeLM のほかの issue
-
area: dev-tooling bug severity: low source: roadmap wave: 4
難易度 2/5 1〜3時間 初心者へのやさしさ 70/100
-
area: site bug good first issue severity: low source: review-2026-09 wave: 4
難易度 2/5 1〜3時間 初心者へのやさしさ 66/100
-
documentation good first issue severity: medium source: review-2026-09 wave: 3
難易度 2/5 1〜3時間 初心者へのやさしさ 75/100
-
documentation good first issue severity: low source: review-2026-09 wave: 4
難易度 1/5 1〜3時間 初心者へのやさしさ 80/100
-
documentation severity: medium source: review-2026-09 wave: 3
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
HodeTech/ForgeLM の issue をすべて見る
似ている issue
-
bug
難易度 1/5 1時間未満 初心者へのやさしさ 88/100
openwisp/openwisp-utils#777 ·
-
難易度 2/5 1〜3時間 初心者へのやさしさ 63/100
google-research/weatherbenchX#310 ·
メンテナーはふだん 3 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 78/100
huggingface/peft#3955 ·
メンテナーはふだん 1 日以内に返信
-
author-page correction
難易度 2/5 1〜3時間 初心者へのやさしさ 60/100
acl-org/acl-anthology#10313 ·
メンテナーはふだん 1 日以内に返信
-
bug
難易度 2/5 1〜3時間 初心者へのやさしさ 76/100
AOSSIE-Org/Gitcord-GithubDiscordBot#147 · コメント 1 件 ·
メンテナーはふだん 1 日以内に返信