feat(testing/fipsscan): extend the fipsscan package to improve FIPS auto-audit - #438

Open

macdewee wants to merge 16 commits into

mainfrom

drosiek-fipsscan

Commits on Jul 17, 2026

feat(testing/fipsscan): expand forbidden-pkg list and scan all by default

macdewee
and
claude
committed
feat(testing/fipsscan): redesign API around per-binary known violations

macdewee
and
claude
committed
fix(testing/fipsscan): add Reason, patterns []string, scoped stale detection, and two correctness fixes

macdewee
and
claude
committed
feat(testing/fipsscan): add skipBinaries to exclude non-shipped binaries from scan

macdewee
and
claude
committed
feat(testing/fipsscan): nest knownViolations by binary then component

macdewee
and
claude
committed
docs(testing/fipsscan): add component key examples with concrete import chain

macdewee
and
claude
committed
fipsscan: match violations against all reachable components, not just the shortest chain

macdewee
and
claude
committed
fipsscan: support empty and prefix Importer in KnownViolation

macdewee
and
claude
committed
fipsscan: add prefix matching for Imported in KnownViolation

macdewee
and
claude
committed
fix(testing/fipsscan): fix 4 correctness bugs found in code review

macdewee
and
claude
committed

Commits on Jul 30, 2026

feat(testing/fipsscan): add tags parameter to all scan functions

macdewee
and
claude
committed