Let a verified runtime trace from an allowlisted monitor conclude PASS for RE-02.01
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- python
- Domain
- build-system, security
Research direction
Start by reading the step-type registration and RE-02.01 definitions, then inspect the corpus cases for reproducibility checks; the issue gives no file paths, so locate these through #453 and #227. Done when a separate Witness verification step is wired ahead of repro_hermetic_build, passes or fails as specified for verified attestations, returns ERROR when verification fails, and has corpus coverage.
Written by the indexing model from the issue text.
Description
Feature 044 (#453) registers every reproducibility step type that decides from text or file-presence signals as FAIL-only. A PASS from those signals is evidence only.
repro_hermetic_build also verifies Witness attestations. A verified attestation that records no network access during the build is a cryptographic observation, not a text signal. Because it sits inside the same step type, it can no longer conclude PASS for RE-02.01 either.
Proposal:
- Split Witness verification into its own step type with a
{pass, fail}ceiling. It passes on a verified attestation with no recorded network access, fails on a verified attestation that records network access, and is ERROR when the attestation can't be verified. - Add it as an RE-02.01 step ahead of
repro_hermetic_build. - Back it with corpus cases.
The signal-based checks in repro_hermetic_build stay FAIL-only.
Related: #453, #227. Paths change if #532 (rename to darnit-amber) lands first.
(Drafted with Claude Code.)
- Dominant language
- Python
- Stars
- 22
- Forks
- 27
- Avg merge
- 2d 28m
- Merged PRs (30d)
- 40
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from darnitdevorg/darnit
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
darnitdevorg/darnit#589 ·
Maintainers usually reply within 1 day
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
darnitdevorg/darnit#587 ·
Maintainers usually reply within 1 day
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
darnitdevorg/darnit#585 ·
Maintainers usually reply within 1 day
-
quality
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
darnitdevorg/darnit#523 ·
Maintainers usually reply within 1 day
-
documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
darnitdevorg/darnit#516 ·
Maintainers usually reply within 1 day
All issues in darnitdevorg/darnit
Similar issues
-
Difficulty 1/5 1-3 hours Newbie friendliness 87/100
adri0/scadustats#128 ·
Maintainers usually reply within 1 day
-
`TIMESTAMP`, `TIMESTAMP_NTZ`, `TINYINT` and the other `TypeDecorator`s don't declare `python_type`Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
RPBCOpenawaiting policy acceptance precheck-passed
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Bioconductor/BiocContributions#240 · 1 comment ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
documentation good first issue launch
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
FlologixAI/etchwork#4 ·