[openssl/general-policies] 41d07b: Add the OpenSSL Library FIPS Module Support Policy...

[Anton Arapov]

Branch: refs/heads/master
Home: https://github.com/openssl/general-policies
Commit: 41d07b7589b491d4463d4e823de88465ed6367b3
https://github.com/openssl/general-policies/commit/41d07b7589b491d4463d4e823de88465ed6367b3
Author: Anton Arapov <an...@openssl.org>
Date: 2026-08-11 (Tue, 11 Aug 2026)

Changed paths:
A policies/fips-module-support-policy.md

Log Message:
-----------
Add the OpenSSL Library FIPS Module Support Policy (#89)

* Add the OpenSSL Library FIPS Module Support Policy

Documents support for validated FIPS modules independently of the
support status of the OpenSSL Library release version they were built
from: support for the lifetime of the CMVP certificate, per-CVE
assessment of module boundary impact with public disclosure,
maintenance source releases for end-of-life versions delivered through
support agreements, certificate updates via the CMVP CVE re-validation
path, and the handling of rebranded certificates.

Assisted-by: Claude Code:claude-fable-5

* Scope the compatibility guarantee to the module's support lifetime

Review feedback on the pull request: as written, the sentence promised
unbounded forward compatibility to every future release series. Tie the
guarantee to the module's support lifetime, which is what bounds every
other commitment in this policy.

Assisted-by: Claude Code:claude-fable-5

* Restructure as a project policy with a Corporation delivery reference

Address review feedback:
- Speak with the OpenSSL Project's voice throughout; the commercial
delivery specifics move to the OpenSSL Corporation FIPS module support
services page, which section 4 now references (@mattcaswell).
- Remove the rebranded-certificates section; its content is part of the
Corporation's service description (@mattcaswell).
- Drop the 'applies to everyone' preamble in section 3; with the
commercial content removed, the whole policy applies to everyone
(@mattcaswell).
- Drop 'versioned and' from section 1; per section 4 the module version
matches the release it is built from (@t8m).
- State the validation aim precisely: every minor release, including
non-LTS releases (@t8m).
- Wrap the lines (@t8m).

Assisted-by: Claude Code:claude-fable-5

* State commitments neutrally with explicit Corporation attribution

Addresses the voice question raised in review: the commitments are
stated in neutral voice as project policy, while funding, execution and
discretion are attributed explicitly to the OpenSSL Corporation, which
makes these decisions in practice. Section 6 likewise attributes the
validation cadence to the Corporation's funding.

Assisted-by: Claude Code:claude-fable-5

* Going forward: commit to validation readiness, not to every validation

Review feedback (@t8m): promising to validate every minor release was
promising too much. The project-level commitment is keeping every minor
release in a state suitable for FIPS validation; which releases undergo
validation is a decision of the OpenSSL Corporation, made toward the
goal of keeping at least two validated modules overlapping.

Assisted-by: Claude Code:claude-fable-5

* Scope maintenance-release discretion to versions past public support

Review feedback (@levitte, wording per @t8m): while the module's release
version is publicly supported, boundary fixes ship in the ordinary
OpenSSL Library releases under the normal release process. The
Corporation's discretion over maintenance releases applies only after
public support for that release version has ended.

Assisted-by: Claude Code:claude-fable-5



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/general-policies/settings/notifications