Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

OSPS catalog drift: retired BR-01.02 still assessed; VM-04.01 PASSes on GitHub Issues being enabled

Open
  • Is something wrong?
#495 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
security

Research direction

Start by reading packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml at OSPS-BR-01.02 and OSPS-VM-04.01, then inspect the existing catalog-drift CI check. Confirm how retired controls affect compliance scoring and how VM-04.01 evaluates its result. Done means retired controls are excluded from assessment and VM-04.01 no longer passes solely because GitHub Issues are enabled.

Written by the indexing model from the issue text.

Description

module-baseline

Summary

Two OSPS control definitions are out of line with the upstream Baseline catalog:

  1. OSPS-BR-01.02 is retired upstream but still assessed. security-baseline marks it "Retired in ossf/security-baseline#443" (state Retired in v2026.08.28, applicability retired in v2026.02.19). darnit still defines and scores it.
  2. OSPS-VM-04.01 checks the wrong thing. The requirement is "The project documentation MUST publicly publish data about discovered vulnerabilities." darnit's pass runs gh api /repos/$OWNER/$REPO --jq .has_issues and PASSes when GitHub Issues is enabled, with the description "Repository supports security advisories". Issues being enabled says nothing about published vulnerability data, so this is a false PASS.

Evidence

Suggested direction

  • Remove BR-01.02 (or mark it retired and exclude it from compliance math), and extend the existing catalog-drift CI check to fail on controls that upstream marks retired.
  • For VM-04.01, stop concluding PASS from has_issues; look for published advisories (GitHub Security Advisories for the repo, OSV entries, or a documented vulnerability-disclosure location) and fall back to WARN/manual.
  • Worth a full pass comparing control descriptions against upstream text; several descriptions paraphrase the requirement loosely.
Dominant language
Python
Stars
22
Forks
27
Avg merge
1d 20h
Merged PRs (30d)
39

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from darnitdevorg/darnit

All issues in darnitdevorg/darnit

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.