attestation extra allows sigstore 3.x, but signing needs sigstore 4.0
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
Research direction
Start with the attestation extra in packages/darnit/pyproject.toml, which sets the sigstore floor to 3.0.0, then find the signing path that calls SigningContext.from_trust_config. Check whether the existing tests exercise signing at all. Done means the floor is raised to 4.0.0 and a test either runs signing against the lowest allowed version or asserts that SigningContext.from_trust_config exists.
Written by the indexing model from the issue text.
Description
The attestation extra declares sigstore>=3.0.0 (packages/darnit/pyproject.toml), but the signing path calls SigningContext.from_trust_config, which first appears in sigstore 4.0.0. With sigstore 3.x installed, signing fails.
Raise the floor to sigstore>=4.0.0, and add a signing test that runs against the lowest allowed version, or at least asserts the API exists.
Found while removing the dead sigstore 1.x/2.x branches (branch ci-mypy-gate).
Drafted with Claude Code; reviewed and posted by me.
- Dominant language
- Python
- Stars
- 22
- Forks
- 27
- Avg merge
- 2d 5m
- Merged PRs (30d)
- 50
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from darnitdevorg/darnit
-
ci needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
darnitdevorg/darnit#607 ·
Maintainers usually reply within 2 days
-
A test starts real Sigstore signing (interactive OIDC login) when the attestation extra is installedPossibly taken @mlieberman85 claimed this 1 day ago. Openmodule-baseline needs triage testing
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
darnitdevorg/darnit#604 ·
Maintainers usually reply within 2 days
-
`darnit validate` crashes on openssf-baseline.toml summarising levelsPossibly taken @i-am-paradox claimed this 5 days ago. Openinterface-cli module-core
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
darnitdevorg/darnit#589 · 1 comment ·
Maintainers usually reply within 2 days
-
good first issue maintenance
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
darnitdevorg/darnit#587 · 2 comments ·
Maintainers usually reply within 2 days
-
Container image has no zizmor, so OSPS-AC-04.02 always reports missing_toolPossibly taken @mlieberman85 claimed this 1 day ago. Openinfrastructure module-baseline
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
darnitdevorg/darnit#585 · 1 comment ·
Maintainers usually reply within 2 days
All issues in darnitdevorg/darnit
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
SACGF/variantgrid#2341 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 2 days
-
comp/cli P3 type/security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
NousResearch/hermes-agent#141420 · 1 comment ·
Maintainers usually reply within 1 day
-
CKV_GCP_18 (GKEPublicControlPlane) passes when master_authorized_networks_config is absent, control plane is internet-reachablePossibly taken @Varshith-Kali claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
bridgecrewio/checkov#7753 ·
Maintainers usually reply within 1 day