Outputs disagree on Baseline version and assessor identity (2025.10.10 vs v2026.02.19, nonexistent baseline-mcp)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
Research direction
Start with openssf-baseline.toml and trace the version and tool identity through attestation/predicate.py, formatters/sarif.py, and attestation/signing.py; check the related tests for expected output. Done means outputs use consistent version and identity values, and references to the nonexistent baseline-mcp package are removed.
Written by the indexing model from the issue text.
Description
Summary
darnit's outputs disagree about which OSPS Baseline version was assessed and who the assessor is:
- Framework TOML metadata:
spec_version = "OSPS v2026.02.19" - Attestation predicate: hard-codes baseline
2025.10.10and an assessor namedopenssf-baseline-mcpwith a URI for a repository that does not exist - SARIF formatter and about 60 control
docs_urlvalues: link tobaseline.openssf.org/versions/2025-10-10 - Attestation install hints reference a
baseline-mcppackage that does not exist
Impact
A signed attestation that names the wrong spec version and a nonexistent assessor is misleading to consumers, and version-specific control text links point at an older Baseline release than the one the controls were synced to.
Evidence
- https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml#L10-L12
- https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/attestation/predicate.py#L127-L129
- https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/formatters/sarif.py#L107
- https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/attestation/signing.py#L90
Suggested direction
Derive the spec version and tool identity from one place (TOML [metadata] and the installed package version) in every output; drop the hard-coded values and the baseline-mcp references. Separately, the predicate type lives under the openssf.org namespace, which darnit does not own; that is being discussed as part of the output-format review.
- Dominant language
- Python
- Stars
- 22
- Forks
- 27
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 39
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from darnitdevorg/darnit
-
`darnit validate` crashes on openssf-baseline.toml summarising levelsPossibly taken A pull request linked to this issue is open or already merged. Openneeds triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
darnitdevorg/darnit#589 ·
Maintainers usually reply within 1 day
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
darnitdevorg/darnit#587 ·
Maintainers usually reply within 1 day
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
darnitdevorg/darnit#585 ·
Maintainers usually reply within 1 day
-
quality
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
darnitdevorg/darnit#523 ·
Maintainers usually reply within 1 day
-
documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
darnitdevorg/darnit#516 ·
Maintainers usually reply within 1 day
All issues in darnitdevorg/darnit
Similar issues
-
[Bug]: LangGraph Store sync put bypasses namespace validationPossibly taken @ktz03 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
volcengine/OpenViking#6050 ·
Maintainers usually reply within 1 day
-
[Bug]: Streamed /v1/chat/completions sends unredacted agent error text (keys) in the final chunkPossibly taken @rodricksz4h5 claimed this today. Openarea/streaming comp/gateway P2 type/security
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
NousResearch/hermes-agent#138245 ·
Maintainers usually reply within 1 day
-
[oblt-aw][autodoc] Update user onboarding guide for mandatory trigger CODEOWNERS stepPossibly taken @github-actions claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
correction metadata
Difficulty 2/5 Under an hour Newbie friendliness 68/100
acl-org/acl-anthology#10378 · 1 comment ·
Maintainers usually reply within 1 day
-
cloudtrail_multi_region_enabled_logging_management_events fails when the advanced event selector has a custom namePossibly taken @12YYCCYY16 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
prowler-cloud/prowler#13033 ·
Maintainers usually reply within 1 day