A test starts real Sigstore signing (interactive OIDC login) when the attestation extra is installed
Maintainers usually reply within 2 days
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 65/100
Research direction
Start with test_signed_without_dependencies in tests/darnit_baseline/attestation/test_generator.py, then follow the sign=True path into darnit_baseline/attestation/signing.py to where Issuer.identity_token() is called. Stub the token source or signer at that seam so the test never reaches Sigstore, and check that no browser opens when the attestation extra is installed. Done means the test passes with the extra installed and no interactive login occurs.
Written by the indexing model from the issue text.
Description
tests/darnit_baseline/attestation/test_generator.py::TestGenerateAttestationFromResults::test_signed_without_dependencies calls generate_attestation_from_results(sign=True). With the attestation extra installed (as with uv sync --all-extras), that reaches darnit_baseline/attestation/signing.py → Issuer.identity_token(), Sigstore's interactive OIDC login.
Locally, it opens browser sign-in tabs and hung three full-suite runs during PR review on 2026-10-15. In CI there's no browser, so the result depends on the runner.
The test should stub the signer (or the token source) so it never reaches Sigstore. A test that exercises real signing belongs behind the opt-in live marker.
This is the kind of leak the proposed hermetic-suite check in #578 (ENF-R1) is meant to catch.
Drafted with Claude Code; reviewed and posted by me.
- Dominant language
- Python
- Stars
- 22
- Forks
- 27
- Avg merge
- 2d 5m
- Merged PRs (30d)
- 50
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from darnitdevorg/darnit
-
ci needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
darnitdevorg/darnit#607 ·
Maintainers usually reply within 2 days
-
dependencies module-baseline needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
darnitdevorg/darnit#606 ·
Maintainers usually reply within 2 days
-
`darnit validate` crashes on openssf-baseline.toml summarising levelsPossibly taken @i-am-paradox claimed this 6 days ago. Openinterface-cli module-core
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
darnitdevorg/darnit#589 · 1 comment ·
Maintainers usually reply within 2 days
-
good first issue maintenance
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
darnitdevorg/darnit#587 · 2 comments ·
Maintainers usually reply within 2 days
-
Container image has no zizmor, so OSPS-AC-04.02 always reports missing_toolPossibly taken @mlieberman85 claimed this 2 days ago. Openinfrastructure module-baseline
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
darnitdevorg/darnit#585 · 1 comment ·
Maintainers usually reply within 2 days
All issues in darnitdevorg/darnit
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
mihai-vlc/sublime-jsfmt#56 ·
-
comp/cli comp/plugins P2 type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
NousResearch/hermes-agent#141917 · 1 comment ·
Maintainers usually reply within 1 day
-
Go device SDK: Whisper transcriber keeps buffering and transcribing audio appended after Stop()Possibly taken @apoorvdarshan claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
BasedHardware/omi#22770 ·
Maintainers usually reply within 1 day
-
bug needs-acceptance wg/router-models-inference-runtime
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
vllm-project/semantic-router#5295 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
huggingface/huggingface_hub#5210 ·
Maintainers usually reply within 1 day