Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

`darnit-reproducibility`: heuristic checks for execution and build reproducibility signals

未关闭
  • 哪里不对？
#416 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
冷清
技术栈
docker, python, r, rust
领域
build-system, devtools, tooling

调研方向

Start by reading the sieve pass shape and the existing RE-02.01 HermeticBuild check referenced in #227, then review #414 for extracted signals and #415 for layer/tightness applicability. Define the new controls in the darnit-reproducibility TOML and ensure each follows the required pass shape; done means execution- and build-layer signals are covered, missing signals warn rather than pass, and signals serialize into the ontology vocabulary in #393.

由索引模型根据 Issue 内容生成。

描述

module-reproducibility

Summary

New sieve controls under darnit-reproducibility that gate on the signals
the extraction module (#414) surfaces, at the (layer, tightness) target
declared per the taxonomy (#415).

Scope: signals to check

Execution layer (Layer 2: built tool + inputs -> outputs)
  • Environment lockfile presence and pinning strength: uv.lock,
    poetry.lock, Pipfile.lock, conda-lock.yml, environment.yml,
    renv.lock, Manifest.toml, frozen-form requirements.txt.
  • Random seed calls: numpy.random.seed, torch.manual_seed,
    random.seed, tensorflow.random.set_seed, R set.seed.
  • Determinism flags: torch.use_deterministic_algorithms(True),
    CUBLAS_WORKSPACE_CONFIG, PYTHONHASHSEED, TF op-level determinism.
  • Non-determinism smells: datetime.now() on critical paths, unpinned
    network fetches (wget / curl without checksum).
  • Workflow specs (declarative beats scripts for auditability): Nextflow,
    Snakemake, CWL, Makefile, papermill-executed notebooks.
  • Data lineage markers: DVC (*.dvc), MLflow tracking, W&B,
    hash-pinned Zenodo DOIs vs raw GitHub URLs.
  • Container env: Dockerfile FROM <image>@sha256:... (pinned digest) vs
    :latest.
  • Compute-env capture: repo2docker-compatible layout.
Build layer (Layer 1: source -> built tool)
  • SOURCE_DATE_EPOCH in build scripts.
  • Locked toolchain: rust-toolchain.toml, .tool-versions (asdf),
    pinned Python interpreter in lockfile.
  • Reproducible-flags: -Wl,--build-id=none, -ffile-prefix-map,
    timestamp stripping.
  • Container-build digest pinning (build stage).
  • Cross-check against existing RE-02.01 HermeticBuild (see #227).

Each check emits a signal the extraction module (#414) exposes, at a
specific (layer, tightness) applicability declared per #415.

Non-goals for v0

  • Remediation actions (auto-generate Dockerfile, insert seed calls,
    produce lockfile) -- separate follow-up.
  • LLM-based verification of non-heuristic-detectable practices -- later,
    if signals below prove insufficient.
  • Language-specific idiomatic seeding beyond Python / R (Julia, Rust, Go
    idioms in v1+).

Constitution alignment

  • III. TOML-First: all controls defined in darnit-reproducibility's
    TOML.
  • II. Conservative-by-Default: missing signal at declared tier ->
    WARN, never silent PASS.
  • V. Sieve Pipeline Integrity: each check follows the sieve pass
    shape (file_must_exist -> exec/regex -> llm_eval -> manual).

Related

  • #414 (extractor module).
  • #415 (layer + tightness taxonomy -- each control declares
    applicability).
  • #227 (RE-02.01 HermeticBuild) -- Layer 1 heuristic already lives
    here; this issue widens the check family.
  • #393 (ontology) -- signals should serialize into the ontology vocab.
主要语言
Python
星标
22
派生
27
平均合并
1 天 19 小时
30 天内合并 PR
39

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

darnitdevorg/darnit 的其他 Issue

查看 darnitdevorg/darnit 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。