Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

access_control audit profile lists three undefined controls and omits OSPS-AC-04.01/04.02

Abierto
  • ¿Algo no está bien?
#581 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
45/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
authorization, security

Línea de trabajo

The bad list is the [audit_profiles.access_control] block in openssf-baseline.toml, and the tests that let it pass are test_access_control_profile and test_profile_control_ids_resolve in tests/darnit_baseline/test_profiles.py. Start by comparing the listed IDs with the AC controls the baseline actually defines, and check darnit profiles for the reported count. Done means the profile selects only defined controls, either by tag or by a corrected list, and a new test fails when a profile lists an undefined ID. Confirm the tag-based or explicit-list choice with a maintainer first.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs triage

Summary

The access_control audit profile in openssf-baseline.toml lists three controls the framework does not define, and leaves out two that it does.

[audit_profiles.access_control]
description = "Access control domain — branch protection, MFA, permissions"
controls = [
    "OSPS-AC-01.01", "OSPS-AC-01.02", "OSPS-AC-01.03",
    "OSPS-AC-02.01", "OSPS-AC-02.02",
    "OSPS-AC-03.01", "OSPS-AC-03.02",
]

The AC controls the baseline defines are OSPS-AC-01.01, 02.01, 03.01, 03.02, 04.01 and 04.02.

Controls
Listed, not defined OSPS-AC-01.02, OSPS-AC-01.03, OSPS-AC-02.02
Defined, not listed OSPS-AC-04.01, OSPS-AC-04.02

Effect

  • darnit profiles reports the profile as "7 controls".
  • An audit with the profile runs 4. (On main the CLI ignores --profile altogether; this is with #576, which connects it. The MCP tools already apply profiles, so they are affected today.)
  • Nothing reports the gap. #576 adds a warning that names listed controls the framework does not define.
  • A user who picks "access control" does not get the two AC-04 controls.

Why the tests pass

tests/darnit_baseline/test_profiles.py has test_access_control_profile and test_profile_control_ids_resolve. Both assert only that at least one ID is present or resolves, and that every ID starts with OSPS-AC-. Neither checks that each listed ID is a defined control.

Suggested direction

  • Make the profile tag-based, like the other two: tags = { domain = "AC" }. That selects the six AC controls today and cannot go stale when controls are added or renumbered. If an explicit list is wanted instead, correct it to the six above.
  • Add a test, over every shipped framework, that each ID a profile lists is a defined control.

I can send the PR if you agree with the tag-based form. I have not, because which controls belong in the profile is a content decision.

Environment

darnit main at 24a4fed.

Drafted with Claude; reviewed and filed by me.

Lenguaje dominante
Python
Estrellas
22
Forks
27
Merge medio
1 d 20 h
PR fusionados (30 d)
39

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de darnitdevorg/darnit

Todos los issues de darnitdevorg/darnit

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.