amber: repro_deps_pinned and repro_build_env_declared only look at the repo root
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start in packages/darnit-amber/src/darnit_amber/handlers.py at the requirements lookup around line 141, then inspect the container_files table around line 261 and the related controls. Decide how multiple matching files should affect the result before implementing bounded-depth discovery for the paths described. Done means nested requirements and container files are recognized and the aggregation behavior is covered by tests.
由索引模型根据 Issue 内容生成。
描述
repro_deps_pinned and repro_build_env_declared look for their evidence at the repository root only, so a project that keeps requirements files and Dockerfiles in subdirectories scores WARN despite having fully pinned dependencies and a declared build environment.
git clone https://github.com/bouhoula/alsacnc.git
cd alsacnc && git checkout v1.0.3 # cd13e98
darnit audit --show-all --framework amber .
Total: 5 | Pass: 0 | Fail: 0 | Warn: 5 | N/A: 0 | Error: 0 | Pending LLM: 0
RE-01.01 .. RE-03.01: WARN - Could not automatically verify
Repo has:
requirements/crawler_requirements.txt db-dtypes==1.0.5, lxml==4.9.3, ...
requirements/ml_requirements.txt
requirements/observatory_requirements.txt
requirements/shared_requirements.txt
docker/docker-compose.yaml
docker/classifiers/Dockerfile
docker/crawler/Dockerfile
docker/ml-eval/Dockerfile
.dockerignore
Every requirement line is pinned to an exact version. The USENIX Security '24 artifact appendix states: "The artifact requires Docker and Docker Compose."
Cause:
packages/darnit-amber/src/darnit_amber/handlers.py:141
requirements = path / "requirements.txt"
Exact filename at the repo root. The container_files table (~L261) is keyed the same way - "Dockerfile", "Containerfile" - so three Dockerfiles one directory down are invisible.
Possible solution:
Search a bounded depth (two levels covers this case) for *requirements*.txt, Dockerfile*, docker-compose*.y*ml and lock files, rather than the root alone. #450 widened the set of names recognised; this is the same class of false negative in the path.
One design question that comes with it: if several requirements files are found, how does the control aggregate? All-pinned vs any-unpinned should be stated rather than resolved by taking the first match. alsacnc has four, all fully pinned, so it's PASS either way - but a repo with three pinned and one loose is the interesting case.
Second entry in darnitdevorg/amber-corpus (#534). Badges: Available, Functional, Results Reproduced , an evaluator independently reproduced this artifact's results.
Compare with the AEADProtocols case in the sibling issue, there the evidence lives in prose and an external image, which is genuinely hard. Here it's in a file, at a path the control doesn't look at.
- 主要语言
- Python
- 星标
- 22
- 派生
- 27
- 平均合并
- 1 天 20 小时
- 30 天内合并 PR
- 39
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
darnitdevorg/darnit 的其他 Issue
-
`darnit validate` crashes on openssf-baseline.toml summarising levels可能已有人在做 @i-am-paradox 于 2 天前认领。 未关闭needs triage
难度 2/5 1-3 小时 新手友好度 78/100
darnitdevorg/darnit#589 ·
维护者通常 1 天内回复
-
needs triage
难度 2/5 1-3 小时 新手友好度 83/100
darnitdevorg/darnit#587 ·
维护者通常 1 天内回复
-
needs triage
难度 2/5 1-3 小时 新手友好度 65/100
darnitdevorg/darnit#585 ·
维护者通常 1 天内回复
-
quality
难度 2/5 1-3 小时 新手友好度 66/100
darnitdevorg/darnit#523 ·
维护者通常 1 天内回复
-
documentation good first issue
难度 2/5 1-3 小时 新手友好度 76/100
darnitdevorg/darnit#516 ·
维护者通常 1 天内回复
查看 darnitdevorg/darnit 的全部 Issue
相似的 Issue
-
Questions crashes on a real SQuAD2 no-answer prediction可能已有人在做 @HuaTNA 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
GST is read as Gulf Standard Time (UTC+4) instead of Guam Standard Time (UTC+10)可能已有人在做 @yang00333 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
DOI-USGS/dataretrieval-python#454 ·
维护者通常 4 天内回复
-
area:core-platform effort:S priority:P3 status:in-review type:test
难度 2/5 1 小时以内 新手友好度 80/100
randomparity/kdive#3246 · 1 条评论 ·
维护者通常 1 天内回复
-
Requantification library converts m/z to mass with the hydrogen-atom mass instead of the proton mass未关闭bug
难度 1/5 1 小时以内 新手友好度 85/100
nf-core/metaboigniter#130 ·
维护者通常 1 天内回复
-
netbox status: needs owner type: documentation
难度 1/5 1 小时以内 新手友好度 75/100
netbox-community/netbox#23412 · 1 个 reaction ·
维护者通常 1 天内回复