Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

access_control audit profile lists three undefined controls and omits OSPS-AC-04.01/04.02

Open
  • Is something wrong?
#581 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
Half a day
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
authorization, security

Research direction

The bad list is the [audit_profiles.access_control] block in openssf-baseline.toml, and the tests that let it pass are test_access_control_profile and test_profile_control_ids_resolve in tests/darnit_baseline/test_profiles.py. Start by comparing the listed IDs with the AC controls the baseline actually defines, and check darnit profiles for the reported count. Done means the profile selects only defined controls, either by tag or by a corrected list, and a new test fails when a profile lists an undefined ID. Confirm the tag-based or explicit-list choice with a maintainer first.

Written by the indexing model from the issue text.

Description

needs triage

Summary

The access_control audit profile in openssf-baseline.toml lists three controls the framework does not define, and leaves out two that it does.

[audit_profiles.access_control]
description = "Access control domain — branch protection, MFA, permissions"
controls = [
    "OSPS-AC-01.01", "OSPS-AC-01.02", "OSPS-AC-01.03",
    "OSPS-AC-02.01", "OSPS-AC-02.02",
    "OSPS-AC-03.01", "OSPS-AC-03.02",
]

The AC controls the baseline defines are OSPS-AC-01.01, 02.01, 03.01, 03.02, 04.01 and 04.02.

Controls
Listed, not defined OSPS-AC-01.02, OSPS-AC-01.03, OSPS-AC-02.02
Defined, not listed OSPS-AC-04.01, OSPS-AC-04.02

Effect

  • darnit profiles reports the profile as "7 controls".
  • An audit with the profile runs 4. (On main the CLI ignores --profile altogether; this is with #576, which connects it. The MCP tools already apply profiles, so they are affected today.)
  • Nothing reports the gap. #576 adds a warning that names listed controls the framework does not define.
  • A user who picks "access control" does not get the two AC-04 controls.

Why the tests pass

tests/darnit_baseline/test_profiles.py has test_access_control_profile and test_profile_control_ids_resolve. Both assert only that at least one ID is present or resolves, and that every ID starts with OSPS-AC-. Neither checks that each listed ID is a defined control.

Suggested direction

  • Make the profile tag-based, like the other two: tags = { domain = "AC" }. That selects the six AC controls today and cannot go stale when controls are added or renumbered. If an explicit list is wanted instead, correct it to the six above.
  • Add a test, over every shipped framework, that each ID a profile lists is a defined control.

I can send the PR if you agree with the tag-based form. I have not, because which controls belong in the profile is a content decision.

Environment

darnit main at 24a4fed.

Drafted with Claude; reviewed and filed by me.

Dominant language
Python
Stars
22
Forks
27
Avg merge
2d 28m
Merged PRs (30d)
40

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from darnitdevorg/darnit

All issues in darnitdevorg/darnit

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.