Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Test/reference control STAGE1-REF-SECURITY-01 ships in the OpenSSF Baseline audit and counts toward results

Abierto
  • ¿Algo no está bien?
#466 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
52/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
devtools, testing

Línea de trabajo

Start with packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml and implementation.py, then inspect tests/darnit_baseline/test_implementation.py and its stage1-ref handling. Run the documented uv run darnit audit -f openssf-baseline -o json --no-fail <repo> reproduction. Done when an OSPS audit includes only OSPS controls and the relevant tests and parity fixtures pass.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

module-baseline

Summary

STAGE1-REF-SECURITY-01 was added to openssf-baseline.toml as the RFC-0001 Stage 1 acceptance-gate control. It is not an OSPS Baseline control, but every openssf-baseline audit evaluates it as a Level 1 control, includes it in totals, and emits it alongside OSPS ids. Its help URL falls back to a fabricated https://baseline.openssf.org/versions/2025-10-10#STAGE1-REF-SECURITY-01 anchor.

It duplicates OSPS-VM-02.01 (SECURITY.md presence), so a repo missing SECURITY.md is double-counted as a Level 1 failure, and a repo with one gets an extra PASS. Its second pass (llm_extract) is unreachable because the first pass is dispositive on both branches.

Impact

The audit claims to report against OSPS Baseline 2025-10-10 but its result set, counts and any attestation/SARIF derived from it include a non-spec control. Consumers comparing counts with the catalog (65 OSPS controls here) will see 66.

Evidence

Reproduction

Any repo with a SECURITY.md:

uv run darnit audit -f openssf-baseline -o json --no-fail <repo>

Actual: summary.total is 66; results contains {"id": "STAGE1-REF-SECURITY-01", "status": "PASS", "level": 1, "details": "Required file found: SECURITY.md"}. Text output header: Total: 66 | ....
Expected: only OSPS controls in an OSPS audit.

Also noted (minor)

OSPS-SA-03.01 declares manual before pattern, opposite to the convention in framework-design.md 3.1. manual returns INCONCLUSIVE so the verdict is unaffected today, but it will matter if manual gains any conclusive behavior. https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml#L4264-L4276

Suggested direction

Move the reference control to a test fixture framework (or darnit-testchecks) and point the Stage 1 acceptance tests and parity fixtures at it. If it must stay in the package, exclude stage1-ref-tagged controls from get_all_controls()/audits unless explicitly requested. Reorder SA-03.01.

Lenguaje dominante
Python
Estrellas
22
Forks
27
Merge medio
1 d 19 h
PR fusionados (30 d)
39

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de darnitdevorg/darnit

Todos los issues de darnitdevorg/darnit

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.