Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

amber: repro_deps_pinned and repro_build_env_declared only look at the repo root

Aperta
  • Qualcosa non va?
#536 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
tooling

Direzione di ricerca

Start in packages/darnit-amber/src/darnit_amber/handlers.py at the requirements lookup around line 141, then inspect the container_files table around line 261 and the related controls. Decide how multiple matching files should affect the result before implementing bounded-depth discovery for the paths described. Done means nested requirements and container files are recognized and the aggregation behavior is covered by tests.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

module-reproducibility

repro_deps_pinned and repro_build_env_declared look for their evidence at the repository root only, so a project that keeps requirements files and Dockerfiles in subdirectories scores WARN despite having fully pinned dependencies and a declared build environment.

git clone https://github.com/bouhoula/alsacnc.git
cd alsacnc && git checkout v1.0.3 # cd13e98
darnit audit --show-all --framework amber .

Total: 5 | Pass: 0 | Fail: 0 | Warn: 5 | N/A: 0 | Error: 0 | Pending LLM: 0
RE-01.01 .. RE-03.01: WARN - Could not automatically verify

Repo has:
requirements/crawler_requirements.txt db-dtypes==1.0.5, lxml==4.9.3, ...
requirements/ml_requirements.txt
requirements/observatory_requirements.txt
requirements/shared_requirements.txt
docker/docker-compose.yaml
docker/classifiers/Dockerfile
docker/crawler/Dockerfile
docker/ml-eval/Dockerfile
.dockerignore

Every requirement line is pinned to an exact version. The USENIX Security '24 artifact appendix states: "The artifact requires Docker and Docker Compose."

Cause:

packages/darnit-amber/src/darnit_amber/handlers.py:141

requirements = path / "requirements.txt"

Exact filename at the repo root. The container_files table (~L261) is keyed the same way - "Dockerfile", "Containerfile" - so three Dockerfiles one directory down are invisible.

Possible solution:
Search a bounded depth (two levels covers this case) for *requirements*.txt, Dockerfile*, docker-compose*.y*ml and lock files, rather than the root alone. #450 widened the set of names recognised; this is the same class of false negative in the path.

One design question that comes with it: if several requirements files are found, how does the control aggregate? All-pinned vs any-unpinned should be stated rather than resolved by taking the first match. alsacnc has four, all fully pinned, so it's PASS either way - but a repo with three pinned and one loose is the interesting case.

Second entry in darnitdevorg/amber-corpus (#534). Badges: Available, Functional, Results Reproduced , an evaluator independently reproduced this artifact's results.

Compare with the AEADProtocols case in the sibling issue, there the evidence lives in prose and an external image, which is genuinely hard. Here it's in a file, at a path the control doesn't look at.

Lingua principale
Python
Stelle
22
Fork
27
Merge medio
2g 28m
PR unite (30g)
40

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di darnitdevorg/darnit

Tutte le issue di darnitdevorg/darnit

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.