Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Test/reference control STAGE1-REF-SECURITY-01 ships in the OpenSSF Baseline audit and counts toward results

Open
  • Is something wrong?
#466 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
devtools, testing

Research direction

Start with packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml and implementation.py, then inspect tests/darnit_baseline/test_implementation.py and its stage1-ref handling. Run the documented uv run darnit audit -f openssf-baseline -o json --no-fail <repo> reproduction. Done when an OSPS audit includes only OSPS controls and the relevant tests and parity fixtures pass.

Written by the indexing model from the issue text.

Description

module-baseline

Summary

STAGE1-REF-SECURITY-01 was added to openssf-baseline.toml as the RFC-0001 Stage 1 acceptance-gate control. It is not an OSPS Baseline control, but every openssf-baseline audit evaluates it as a Level 1 control, includes it in totals, and emits it alongside OSPS ids. Its help URL falls back to a fabricated https://baseline.openssf.org/versions/2025-10-10#STAGE1-REF-SECURITY-01 anchor.

It duplicates OSPS-VM-02.01 (SECURITY.md presence), so a repo missing SECURITY.md is double-counted as a Level 1 failure, and a repo with one gets an extra PASS. Its second pass (llm_extract) is unreachable because the first pass is dispositive on both branches.

Impact

The audit claims to report against OSPS Baseline 2025-10-10 but its result set, counts and any attestation/SARIF derived from it include a non-spec control. Consumers comparing counts with the catalog (65 OSPS controls here) will see 66.

Evidence

Reproduction

Any repo with a SECURITY.md:

uv run darnit audit -f openssf-baseline -o json --no-fail <repo>

Actual: summary.total is 66; results contains {"id": "STAGE1-REF-SECURITY-01", "status": "PASS", "level": 1, "details": "Required file found: SECURITY.md"}. Text output header: Total: 66 | ....
Expected: only OSPS controls in an OSPS audit.

Also noted (minor)

OSPS-SA-03.01 declares manual before pattern, opposite to the convention in framework-design.md 3.1. manual returns INCONCLUSIVE so the verdict is unaffected today, but it will matter if manual gains any conclusive behavior. https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml#L4264-L4276

Suggested direction

Move the reference control to a test fixture framework (or darnit-testchecks) and point the Stage 1 acceptance tests and parity fixtures at it. If it must stay in the package, exclude stage1-ref-tagged controls from get_all_controls()/audits unless explicitly requested. Reorder SA-03.01.

Dominant language
Python
Stars
22
Forks
27
Avg merge
2d 28m
Merged PRs (30d)
40

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from darnitdevorg/darnit

All issues in darnitdevorg/darnit

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.