OSPS-LE-01.01 checks for a license file, but the requirement is contributor sign-off (DCO/CLA)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Start by reading the LE-01.01 HasLicense control in packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml, then compare its behavior with the issue's description of LE-03.01. Determine how the project represents control checks and WARN/manual outcomes before assessing sign-off evidence. Done means LE-01.01 no longer passes because a LICENSE file exists, and its remediation no longer creates that file.
Written by the indexing model from the issue text.
Description
Summary
darnit's OSPS-LE-01.01 checks the wrong requirement. Upstream, LE-01.01 is "Require Code Contributors to Assert Right to Commit": "The version control system MUST require all code contributors to assert that they are legally authorized to make the associated contributions on every commit" (for example DCO sign-off enforcement or a CLA check). darnit's control is named HasLicense, checks for a license file, and its remediation creates a LICENSE file -- which is what OSPS-LE-03.01 ("Maintain and Release Licenses in a Well Known Location") covers.
Impact
- Repositories with a LICENSE file PASS LE-01.01 whether or not contributors are required to sign off, so the control can report compliance for a requirement it never checked.
- The license-file check is duplicated between LE-01.01 and LE-03.01.
Evidence
- darnit control: https://github.com/darnitdevorg/darnit/blob/bbe1bb426e701a3b283d74425a566425011daa89/packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml#L1694
- Upstream requirement text: OSPS Baseline catalog (ossf/security-baseline), OSPS-LE-01.01.
Suggested direction
Re-implement LE-01.01 to check that contributions must assert the right to commit -- for example a required DCO status check, a DCO/CLA app or workflow, or branch rules requiring signed-off commits -- falling back to WARN/manual when it cannot be determined, and never PASS from the presence of a LICENSE file. Remove the license-file remediation from LE-01.01 (LE-03.01 keeps it). Related: #495 (other catalog drift).
- Dominant language
- Python
- Stars
- 22
- Forks
- 27
- Avg merge
- 2d 28m
- Merged PRs (30d)
- 40
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from darnitdevorg/darnit
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
darnitdevorg/darnit#589 ·
Maintainers usually reply within 1 day
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
darnitdevorg/darnit#587 ·
Maintainers usually reply within 1 day
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
darnitdevorg/darnit#585 ·
Maintainers usually reply within 1 day
-
quality
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
darnitdevorg/darnit#523 ·
Maintainers usually reply within 1 day
-
documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
darnitdevorg/darnit#516 ·
Maintainers usually reply within 1 day
All issues in darnitdevorg/darnit
Similar issues
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 88/100
openwisp/openwisp-utils#777 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
google-research/weatherbenchX#310 ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
huggingface/peft#3955 ·
Maintainers usually reply within 1 day
-
author-page correction
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
acl-org/acl-anthology#10313 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
AOSSIE-Org/Gitcord-GithubDiscordBot#147 · 1 comment ·
Maintainers usually reply within 1 day