Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

OSPS-AC-01.01 is always ERROR on a user-owned repository (owner-type detection, follow-up to #467)

Abierto
  • ¿Algo no está bien?
#580 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
github, python
Área
cli, security

Línea de trabajo

Start with the OSPS-AC-01.01 control definition (its TOML) and the gh_api handler path that calls /orgs/<owner> and /user, then reproduce with darnit audit -f openssf-baseline --include OSPS-AC-01.01 on a user-owned repository. Find where owner.type from /repos/{owner}/{repo} is already fetched and how it could reach this control. The issue leaves the resulting status for user-owned repos as a design decision, so settle that with the maintainers first. Done means a user-owned owner skips the org call and gives a clear needs-confirmation result, and a missing read:user scope is reported as such.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs triage

Summary

On a repository owned by a user account, OSPS-AC-01.01 is always ERROR, and the message reads like a failed API call:

$ darnit audit -f openssf-baseline --include OSPS-AC-01.01 <checkout of Marc-cn/SSI>
WARNING: OSPS-AC-01.01: gh_api handler could not complete (error_class=unavailable): Platform API call /orgs/Marc-cn could not be measured (unavailable): HTTP 404
WARNING: OSPS-AC-01.01: gh_api handler could not complete (error_class=evaluation): Could not evaluate expr over the response from /user: CEL evaluation failed: ("no such member in mapping: 'two_factor_authentication'", ...
Total: 1 | Pass: 0 | Fail: 0 | Warn: 0 | N/A: 0 | Error: 1 | Pending: 0
  ! OSPS-AC-01.01: ERROR [unavailable] - Platform API call /orgs/Marc-cn could not be measured (unavailable): HTTP 404

gh api /repos/Marc-cn/SSI --jq .owner.type returns User.

What is by design

The control's TOML says "404 (a user, not an org) and 401/403 are ERROR, never FAIL", and the /user step is evidence only, so that the auditor's own 2FA can never produce a PASS. That is the fix for #467 and it should stay.

What is missing

This is the follow-up #467 describes: PR #271 "promised a follow-up issue for owner-type detection; none was filed", and #467's suggested direction includes "Gate the /user fallback on the owner being a User account (owner.type from /repos/{owner}/{repo} is already fetched elsewhere in the audit)".

Without it, on a user-owned repository:

  1. The org step asks /orgs/<user>, which can only 404. The result is ERROR with a message about an unreachable platform. Nothing says "this owner is a user, so there is no organization setting to check".
  2. The help text says "a person confirms the control for a user-owned repository", but the audit result does not lead there. An agent reading the result (Claude Code, in my case) reported it as an API error and suggested confirming MFA by hand, which is the right conclusion reached by guessing.
  3. With a default gh auth login, the /user step errors as well, because the token has no read:user scope and the field is absent. So even the evidence is not recorded unless the user knows to run gh auth refresh -s read:user.

Suggested direction

  • Detect the owner type once (from /repos/{owner}/{repo}) and make it available to the control.
  • For a User owner: do not call /orgs/<owner>. Conclude a "needs confirmation by a person" result (WARN, or whatever fits the result-authority contract), with the /user response as evidence when the field is visible, and a message that says the repository is user-owned.
  • For an Organization owner: unchanged.
  • When /user has no two_factor_authentication field, say that the read:user scope is missing instead of reporting a CEL evaluation error.

Which status a user-owned repository should get is a design decision for this control, so I have not sent a PR.

Environment

darnit main at 24a4fed, RHEL 10.2, gh 2.102.0 logged in with scopes gist, read:org, repo, workflow.

Drafted with Claude; reviewed and filed by me.

Lenguaje dominante
Python
Estrellas
22
Forks
27
Merge medio
1 d 23 h
PR fusionados (30 d)
48

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de darnitdevorg/darnit

Todos los issues de darnitdevorg/darnit

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.