Encryption-at-rest guide says rotating the SSE-KMS key re-encrypts existing model files; KMS key rotation does not re-encrypt stored objects (F-W1-DOCS-TRUST-19)
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 55/100
- Issue 类型
- 文档
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- aws
调研方向
The wrong claim is in docs/qms/encryption_at_rest.md around lines 92-95, where it says rotation makes model files re-encrypt at the storage layer, and the same passage appears in docs/qms/encryption_at_rest-tr.md around lines 94-97. Read the AWS KMS rotation page linked in the issue, then separate scheduled rotation (new writes only) from re-encryption by copying objects under the new key. Done when both language versions say rotation does not re-encrypt existing artefacts, state how re-encryption is done and how long old key material is kept, and link the provider procedure.
由索引模型根据 Issue 内容生成。
描述
Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix
Summary
The guide says ForgeLM is unaffected by key rotation because "the model files re-encrypt at the storage layer". AWS KMS key rotation only changes the key material used for new encryption; it keeps the earlier material to decrypt existing ciphertext and does not re-encrypt stored data. An operator who rotates after a suspected key exposure would believe old model files are protected by new key material when they are not.
Primary finding
F-W1-DOCS-TRUST-19 — KMS rotation is incorrectly said to re-encrypt existing model files
severity Medium · confidence high · checked against the AWS KMS documentation
What happens. docs/qms/encryption_at_rest.md:92-95 (Turkish mirror docs/qms/encryption_at_rest-tr.md:94-97): "rotate the CMK itself, not just the data key. ForgeLM is unaffected by rotation — the model files re-encrypt at the storage layer without the training pipeline noticing." Objects already written with SSE-KMS stay encrypted under the data keys they were written with, protected by the earlier key material; moving them to new key material means re-encrypting them, for example by copying the objects.
Where.
Evidence (re-verified on 2026-10-09).
- AWS KMS developer guide, "Rotate AWS KMS keys": rotation changes the key material used for new cryptographic operations, KMS keeps the earlier key material to decrypt data encrypted under it, and rotating key material does not re-encrypt the data the key protects (https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html).
- Both pages are unchanged on
development.
Recommended fix. Separate the two operations. Scheduled key rotation protects new writes; existing artefacts stay readable and are not re-encrypted. Re-encrypting existing artefacts — after a suspected key compromise, or where a policy requires it — is a separate step (copy the objects under the new key) and the old key material must stay available until the copy and a restore test are verified. Link the provider's procedure instead of promising transparent re-encryption.
Acceptance criteria
- Neither page states or implies that key rotation re-encrypts existing model files.
- The guide says how existing artefacts are re-encrypted and how long the old key material is kept.
- Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
- The finding is resolved or explicitly closed with a reason.
Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.
- 主要语言
- Python
- 星标
- 9
- 派生
- 1
- 平均合并
- 8 小时 10 分钟
- 30 天内合并 PR
- 5
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
HodeTech/ForgeLM 的其他 Issue
-
area: dev-tooling bug severity: low source: roadmap wave: 4
难度 2/5 1-3 小时 新手友好度 70/100
-
Site: the theme-locked --code-comment grey (#6a6f80) on the dark code surface is 3.8:1, below WCAG AA, in both themes (F-W1-SITE-06)可能已有人在做 @vortsghost2025 今天认领。 未关闭area: site bug good first issue severity: low source: review-2026-09 wave: 4
难度 2/5 1-3 小时 新手友好度 66/100
-
documentation good first issue severity: medium source: review-2026-09 wave: 3
难度 2/5 1-3 小时 新手友好度 75/100
-
documentation good first issue severity: low source: review-2026-09 wave: 4
难度 1/5 1-3 小时 新手友好度 80/100
-
documentation severity: medium source: review-2026-09 wave: 3
难度 2/5 1-3 小时 新手友好度 72/100
相似的 Issue
-
vis.image() reports "Unsupported number of image channels: 224" for an HxWxC image可能已有人在做 @piyush182004 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 62/100
fossasia/visdom#1997 · 3 条评论 ·
维护者通常 6 天内回复
-
Byse new domain未关闭
难度 2/5 1-3 小时 新手友好度 62/100
Gujal00/ResolveURL#1525 ·
维护者通常 1 天内回复
-
Serialisation fails with pydantic 2.14: wrap serialisers pass SerializationInfo as index_key可能已有人在做 @hugohills-regnosys 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
finos/rune-python-runtime#45 ·
-
[Bug]: LangGraph Store sync put bypasses namespace validation可能已有人在做 @ktz03 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
volcengine/OpenViking#6050 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
hummingbot/condor#283 ·
维护者通常 1 天内回复