Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

OSPS-AC-01.01 is always ERROR on a user-owned repository (owner-type detection, follow-up to #467)

Đang mở
  • Có gì không ổn?
#580 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
35/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
github, python
Lĩnh vực
cli, security

Hướng nghiên cứu

Start with the OSPS-AC-01.01 control definition (its TOML) and the gh_api handler path that calls /orgs/<owner> and /user, then reproduce with darnit audit -f openssf-baseline --include OSPS-AC-01.01 on a user-owned repository. Find where owner.type from /repos/{owner}/{repo} is already fetched and how it could reach this control. The issue leaves the resulting status for user-owned repos as a design decision, so settle that with the maintainers first. Done means a user-owned owner skips the org call and gives a clear needs-confirmation result, and a missing read:user scope is reported as such.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

needs triage

Summary

On a repository owned by a user account, OSPS-AC-01.01 is always ERROR, and the message reads like a failed API call:

$ darnit audit -f openssf-baseline --include OSPS-AC-01.01 <checkout of Marc-cn/SSI>
WARNING: OSPS-AC-01.01: gh_api handler could not complete (error_class=unavailable): Platform API call /orgs/Marc-cn could not be measured (unavailable): HTTP 404
WARNING: OSPS-AC-01.01: gh_api handler could not complete (error_class=evaluation): Could not evaluate expr over the response from /user: CEL evaluation failed: ("no such member in mapping: 'two_factor_authentication'", ...
Total: 1 | Pass: 0 | Fail: 0 | Warn: 0 | N/A: 0 | Error: 1 | Pending: 0
  ! OSPS-AC-01.01: ERROR [unavailable] - Platform API call /orgs/Marc-cn could not be measured (unavailable): HTTP 404

gh api /repos/Marc-cn/SSI --jq .owner.type returns User.

What is by design

The control's TOML says "404 (a user, not an org) and 401/403 are ERROR, never FAIL", and the /user step is evidence only, so that the auditor's own 2FA can never produce a PASS. That is the fix for #467 and it should stay.

What is missing

This is the follow-up #467 describes: PR #271 "promised a follow-up issue for owner-type detection; none was filed", and #467's suggested direction includes "Gate the /user fallback on the owner being a User account (owner.type from /repos/{owner}/{repo} is already fetched elsewhere in the audit)".

Without it, on a user-owned repository:

  1. The org step asks /orgs/<user>, which can only 404. The result is ERROR with a message about an unreachable platform. Nothing says "this owner is a user, so there is no organization setting to check".
  2. The help text says "a person confirms the control for a user-owned repository", but the audit result does not lead there. An agent reading the result (Claude Code, in my case) reported it as an API error and suggested confirming MFA by hand, which is the right conclusion reached by guessing.
  3. With a default gh auth login, the /user step errors as well, because the token has no read:user scope and the field is absent. So even the evidence is not recorded unless the user knows to run gh auth refresh -s read:user.

Suggested direction

  • Detect the owner type once (from /repos/{owner}/{repo}) and make it available to the control.
  • For a User owner: do not call /orgs/<owner>. Conclude a "needs confirmation by a person" result (WARN, or whatever fits the result-authority contract), with the /user response as evidence when the field is visible, and a message that says the repository is user-owned.
  • For an Organization owner: unchanged.
  • When /user has no two_factor_authentication field, say that the read:user scope is missing instead of reporting a CEL evaluation error.

Which status a user-owned repository should get is a design decision for this control, so I have not sent a PR.

Environment

darnit main at 24a4fed, RHEL 10.2, gh 2.102.0 logged in with scopes gist, read:org, repo, workflow.

Drafted with Claude; reviewed and filed by me.

Ngôn ngữ chính
Python
Star
22
Fork
27
Merge trung bình
1 ngày 20 giờ
Pull request đã merge (30 ngày)
39

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của darnitdevorg/darnit

Tất cả issue của darnitdevorg/darnit

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.