Outputs disagree on Baseline version and assessor identity (2025.10.10 vs v2026.02.19, nonexistent baseline-mcp)
维护者通常 2 天内回复
评估
调研方向
Start with openssf-baseline.toml and trace the version and tool identity through attestation/predicate.py, formatters/sarif.py, and attestation/signing.py; check the related tests for expected output. Done means outputs use consistent version and identity values, and references to the nonexistent baseline-mcp package are removed.
由索引模型根据 Issue 内容生成。
描述
Summary
darnit's outputs disagree about which OSPS Baseline version was assessed and who the assessor is:
- Framework TOML metadata:
spec_version = "OSPS v2026.02.19" - Attestation predicate: hard-codes baseline
2025.10.10and an assessor namedopenssf-baseline-mcpwith a URI for a repository that does not exist - SARIF formatter and about 60 control
docs_urlvalues: link tobaseline.openssf.org/versions/2025-10-10 - Attestation install hints reference a
baseline-mcppackage that does not exist
Impact
A signed attestation that names the wrong spec version and a nonexistent assessor is misleading to consumers, and version-specific control text links point at an older Baseline release than the one the controls were synced to.
Evidence
- https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml#L10-L12
- https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/attestation/predicate.py#L127-L129
- https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/formatters/sarif.py#L107
- https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/attestation/signing.py#L90
Suggested direction
Derive the spec version and tool identity from one place (TOML [metadata] and the installed package version) in every output; drop the hard-coded values and the baseline-mcp references. Separately, the predicate type lives under the openssf.org namespace, which darnit does not own; that is being discussed as part of the output-format review.
- 主要语言
- Python
- 星标
- 22
- 派生
- 27
- 平均合并
- 2 天 19 小时
- 30 天内合并 PR
- 51
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
darnitdevorg/darnit 的其他 Issue
-
module-core needs triage ux
难度 2/5 1-3 小时 新手友好度 72/100
darnitdevorg/darnit#648 ·
维护者通常 2 天内回复
-
ci needs triage
难度 2/5 1-3 小时 新手友好度 62/100
darnitdevorg/darnit#607 ·
维护者通常 2 天内回复
-
dependencies module-baseline needs triage
难度 2/5 1-3 小时 新手友好度 68/100
darnitdevorg/darnit#606 ·
维护者通常 2 天内回复
-
`darnit validate` crashes on openssf-baseline.toml summarising levels可能已有人在做 @i-am-paradox 于 12 天前认领。 未关闭interface-cli module-core
难度 2/5 1-3 小时 新手友好度 78/100
darnitdevorg/darnit#589 · 1 条评论 ·
维护者通常 2 天内回复
-
good first issue maintenance
难度 2/5 1-3 小时 新手友好度 83/100
darnitdevorg/darnit#587 · 2 条评论 ·
维护者通常 2 天内回复
查看 darnitdevorg/darnit 的全部 Issue
相似的 Issue
-
The changelog workflow excludes otelbot but not dependabot, so every Dependabot pull request fails the changelog check可能已有人在做 @ocelotl 今天认领。 未关闭
难度 1/5 1 小时以内 新手友好度 82/100
open-telemetry/opentelemetry-python#5825 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
cuga-project/cuga-agent#1020 ·
维护者通常 2 天内回复
-
难度 1/5 1 小时以内 新手友好度 70/100
microsoft/playwright#43640 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
stac-utils/stac-fastapi-elasticsearch-opensearch#965 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复