devnw-json
fork of gitlab.com/devnw/zig/json for zig 0.17
Star
Fork
Watch
devnw-json docs FIPS.md
1.5 kB · 30 lines
Markdown
at main

FIPS-140-3 Status — json #

REQ-ID: REQ-FIPS-EXEMPT-001 — non-security crypto/hash/RNG sites are allow-listed (exempt) from the workspace FIPS-140-3 routing requirement per docs/superpowers/specs/2026-06-20-fips-pqc-design.md §5.

Mode: This library performs only non-security hashing: a JSON-Schema $ref resolution cache key. It is exempt from the workspace FIPS-140-3 routing requirement (see fips package spec docs/superpowers/specs/2026-06-20-fips-pqc-design.md §5). No site produces, protects, or verifies a secret, key, credential, authentication tag, or signature; therefore none is routed through the crypto_backend seam and none links the OpenSSL FIPS provider. When a consumer builds with -Dfips=true, this library is unaffected: it adds no -Dfips flag and changes no behavior.

Exempt call sites #

File:Line Primitive Use Why non-security (exempt)
src/schema.zig:681 std.hash.Wyhash JSON-Schema $ref resolution cache key (ref + base_uri) Hashmap lookup only; not a secret

Line numbers are pre-annotation approximations.

zlint allow-list #

The site above carries an inline // fips-exempt: non-security — <reason> annotation so the zlint FIPS rule treats it as allow-listed rather than a violation. Adding a new std.crypto / std.hash / std.Random use to this library REQUIRES adding both the inline annotation and a row in the table above.