Repository navigation
Validate the Docker service example as a group - #4282
Merged
Merged
Conversation
The Run Docker section in variations-services-caches.md shows a service definition and a check that uses it. Neither passes `chainctl checks validate` alone, so validate.py reported both as failures. List them as a group, the same way the Postgres service examples are listed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
s-stumbo
approved these changes
Oct 21, 2026
Rodrigo-Munoz-Salas
pushed a commit
to Rodrigo-Munoz-Salas/edu
that referenced
this pull request
Oct 21, 2026
…246) (chainguard-dev#4143) [ ] Check if this is a typo or other quick fix and ignore the rest :) ## Type of change <!-- Please be sure to add the appropriate label to your PR. --> **Documentation Update** - Remove hardcoded FIPS certificate numbers from the kernel-independent architecture, FIPS images, and FedRAMP considerations pages, and point readers to the FIPS commitment page instead - Add `-e OPENSSL_CONF_INCLUDE=/etc/ssl-3.6.0` to the first `openssl-fips-test` command in `verify-fips.md`, so the command produces the 3.6 output the page shows. The 3.6 module is opt-in now and becomes the default on December 1, 2026. - Correct the `getting-started.md` sample output, whose SHA-256 hash and OpenSSL version didn't match a real run - Describe the FedRAMP page's entropy source certificate as an ESV, not a CMVP, and fix typos and grammar in the changed files ### What should this PR do? <!-- Does this PR resolve an issue? Please include a reference to it. --> resolves https://linear.app/chainguard/issue/DOCS-246/remove-fips-module-numbers-from-the-kernel-independent-architecture Makes the FIPS docs defer to the FIPS commitment page for module and certificate details, and corrects sample output that no longer matches the images. ### Why are we making this change? <!-- What larger problem does this PR address? --> The kernel-independent architecture page cited CMVP Certificate chainguard-dev#4282, which the FIPS commitment page no longer lists, and the FedRAMP page listed a module deprecated in May 2025. The FIPS team keeps the commitment page current, so pointing to it means module changes don't require docs updates. In `verify-fips.md`, the first sample shows the 3.6 module's output, but the command that precedes it runs the current default, the 3.4 module, so readers saw different output. ### What are the acceptance criteria? <!-- What should be happening for this PR to be accepted? Please list criteria. --> <!-- Do any stakeholders need to be tagged in this review? If so, please add them. --> - No changed page cites a CMVP certificate number except `verify-fips.md`, which uses them to explain SBOM indicators and the opt-in steps - Sample output in `verify-fips.md` and `getting-started.md` matches a current run of the documented commands - The **Opt in to different FIPS provider versions** section of `verify-fips.md` is unchanged. Dimitri John Ledkov confirmed that it is current for images shipping from October 2026 through March 2027. - Zayn Lohit and Dimitri John Ledkov confirm the technical changes ### How should this PR be tested? Any documentation published to Chainguard Academy is reviewed carefully for accuracy. GUI procedures, API commands, and CLI code snippets in a draft are run and tested thoroughly — by both the author and the reviewer — to confirm they work exactly as written. This helps ensure that readers can follow along and get the same results. See the [`edu` repo's README](https://github.com/chainguard-dev/edu#testing). 1. Check the preview link and ensure the changes look right 2. On the **Kernel-independent FIPS architecture** page, check the **Core components**, **Validation architecture**, **Verifying kernel independence**, and **Next steps** sections 3. On the **Verify that Chainguard FIPS containers are configured to use FIPS modules** page, run `docker run -e OPENSSL_CONF_INCLUDE=/etc/ssl-3.6.0 -it --entrypoint openssl-fips-test cgr.dev/<organization>/python-fips` and confirm the output matches the first sample, including provider 3.6.0 and CMVP #5523. 4. On the **Getting started with FIPS containers** page, run `test_fips.py` in `python-fips:latest` and confirm the hash matches the sample 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Mark Drake <mark@chainguard.dev> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a
[[group]]toscripts/checks-examples/examples.tomlfor the two YAML blocks in the "Run Docker" section ofvariations-services-caches.md: the service definition,.chainguard/ci/services/docker/docker.yaml, and the check that uses it,.chainguard/ci/docker.yaml.Why
#4271 added the section. Its blocks only make sense together: the service file alone has no checks, and the check alone names a service that doesn't exist.
validate.pytests any block the manifest doesn't mention on its own, so it reported both as failures onmain. The examples themselves are correct. This lists them as a group, the same way the Postgres service examples are listed.How it was checked
main,python3 scripts/checks-examples/validate.pyreports 34 passed, 2 failed, and 4 skipped. With this change, it reports 36 passed, 0 failed, and 4 skipped, and the group's output showsdocker.yamlvalidated with the service beside it.chainctl checks validateread both files. Checked withchainctl0.2.388.python3 -m unittest discover -s scripts/checks-examplespasses all 27 tests, and the pre-commit hooks pass.🤖 Generated with Claude Code