Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Ship darnit itself in a hermetic container to eliminate host-environment as an audit-nondeterminism source

Aperta
  • Qualcosa non va?
#423 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
docker, github-actions, python
Ambito
devops, infrastructure, release

Direzione di ricerca

Start by reading feature 012 and its existing release assets to find where packaging, GHCR publishing, signing, and SBOM generation belong. Then inspect the workspace Python target, lockfile, release runbook, and CI setup; the issue names packaging/Dockerfile as a possible location. Done means a pinned non-root image is published with the existing release surfaces, documented usage, and a CI smoke test that runs a mock audit against a fixture repo.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

infrastructure

Summary

Short-term shippable companion to the determinism set (#418-#421):
publish darnit itself as a pinned container image so audit output is
not influenced by the operator's host environment (Python version,
gh CLI version, git version, tree-sitter version, LLM SDK version,
etc.).

This does not help the audited repo's reproducibility. It closes a
different loop: darnit's own audit runs are more reproducible across
operators when everyone runs the same pinned binaries.

Scope

  • Add a Dockerfile at packaging/Dockerfile (or wherever feature 012
    already lands packaging assets):
    • Pin Python interpreter version (matching workspace target).
    • uv sync --frozen for lockfile-pinned deps.
    • Install pinned versions of gh CLI, git, syft, cosign as
      needed by darnit's exec handlers.
    • Non-root user; minimal working-dir layout.
    • ENTRYPOINT ["darnit"].
  • Publish under the same release surfaces feature 012 already uses
    (GHCR image, cosign-signed, SBOM via syft).
  • Document usage in the release runbook (mount repo as
    /workspace, pass GH_TOKEN, ANTHROPIC_API_KEY env vars).
  • Add a smoke-test in CI that pulls the image and runs a mock audit
    against a fixture repo to catch regressions.

Non-goals for v0

  • Automatic invocation from darnit audit (the container is a
    distribution shape, not a runtime dependency of the CLI).
  • Devcontainer image for darnit development (separate concern;
    the shipped image is for audit execution).
  • Rootless / distroless base variants (nice-to-have; revisit if
    operators ask).
  • Reproducible-build guarantees on the image itself (bit-for-bit
    container reproducibility is #227 / feature 012's territory).

Constitution alignment

  • II. Conservative-by-Default: eliminating host-env drift from
    audit output preserves the "same commit -> same verdict" invariant
    that the determinism issues (#418 in particular) are chasing at
    the code-path level.

Related

  • 012-packaging-distribution -- reuses the existing release
    infrastructure (SBOM, cosign, GHCR).
  • #227 (HermeticBuild -- evolve beyond grep-based heuristic) --
    the image itself is a small proof point that darnit knows how to
    ship a hermetic build.
  • #418 (Determinism Tier 1) -- companion; a hermetic runner
    closes the host-side lever the code-side determinism fixes leave
    open.
  • Design conversation 2026-09-05 -- filed as short-term
    companion to the environment-generation sieve issue (filed
    alongside this one) while that ambitious sieve is still in
    investigation.
Lingua principale
Python
Stelle
22
Fork
27
Merge medio
2g 28m
PR unite (30g)
40

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di darnitdevorg/darnit

Tutte le issue di darnitdevorg/darnit

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.