Stale kusari-oss references: signing identities, container image name, package metadata
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 55/100
- Issue 类型
- 文档
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- docker, github-actions, python
- 领域
- documentation, release
调研方向
Start with packaging/README.md, which states the identity rule, and .github/workflows/release.yml, which sets the GHCR image name. The section 4 items in docs/install/from-source.md (line 11 clone URL, lines 25 and 35 control count, checked against darnit list) are the most self-contained place to start. Sections 1 and 2 need the maintainers' answer first. Done means the stale references are updated where the issue asks, the Homebrew tap and DEFAULT_TRUSTED_PUBLISHERS stay unchanged, and the git grep count is re-run.
由索引模型根据 Issue 内容生成。
描述
Summary
171 references to kusari-oss remain in 35 files under docs/, packaging/, README.md, the pyproject.toml files and the workflows. Most are links that GitHub redirects. Some ae not harmless, and with 0.2.0 coming it seemed worth sorting them.
packaging/README.md already states the rule: "Sigstore certificate identities do not redirect", releases cut after the move resolve against darnitdevorg/darnit, and two things stay under the old org on purpose (the Homebrew tap and the kusari-oss entry in DEFAULT_TRUSTED_PUBLISHERS).
1. Signing identities in user-facing verification commands
These tell users to verify against the old identity:
docs/install/README.md:47,:53docs/install/binary.md:43docs/install/container.md:49,:74docs/install/pypi.md:76(fixed by #530, still open)packaging/RECOVERY.md:149,:155,:242packaging/container/README.md:65
A user who follows them for a release signed under darnitdevorg/darnit gets a verification failure on a genuine artifact.
Question: the examples all use v0.1.0. If 0.1.0 was published before the move, the old identity is correct for that version. Should the docs move to the new identity with a newer example version, or state which identity applies to which versions?
2. Container image name
release.yml pushes to ghcr.io/${{ github.repository_owner }}/darnit, which is now ghcr.io/darnitdevorg/darnit. docs/install/container.md, packaging/container/README.md and packaging/RECOVERY.md use ghcr.io/kusari-oss/darnit throughout (pull, run, cosign verify, cosign download attestation).
I do not think GHCR redirects image names between organizations, so these would not find new releases. I have not tested it.
3. Package metadata
pyproject.toml (root and packages/*) set Homepage, Repository and Issues to https://github.com/kusari-oss/darnit. They redirect, but they are what PyPI will show for 0.2.0.
4. docs/install/from-source.md
- Line 11 clones
https://github.com/kusari-oss/darnit(redirects). - Lines 25 and 35 say the baseline has 62 controls.
darnit listreports 66.
5. Plain links
Release download URLs, issue links and the like, across the install docs, README.md, docs/SECURITY_GUIDE.md and docs/getting-started/. They redirect. Low priority.
Deliberate, not to change
kusari-oss/homebrew-tapandbrew tap kusari-oss/tap, including the three references inrelease-smoke.yml.- The
kusari-ossentry inDEFAULT_TRUSTED_PUBLISHERS.
Suggested order
1, 2 and 3 before 0.2.0 is published. 4 and 5 whenever.
I can send PRs for any of these once the question in section 1 is answered. Context: this is the follow-up I mentioned in #530.
Counted on main at 24a4fed with git grep -c kusari-oss -- docs/ packaging/ README.md pyproject.toml 'packages/*/pyproject.toml' '.github/workflows/*.yml'.
Drafted with Claude; reviewed and filed by me.
- 主要语言
- Python
- 星标
- 22
- 派生
- 27
- 平均合并
- 1 天 20 小时
- 30 天内合并 PR
- 39
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
darnitdevorg/darnit 的其他 Issue
-
`darnit validate` crashes on openssf-baseline.toml summarising levels可能已有人在做 @i-am-paradox 于 2 天前认领。 未关闭needs triage
难度 2/5 1-3 小时 新手友好度 78/100
darnitdevorg/darnit#589 ·
维护者通常 1 天内回复
-
needs triage
难度 2/5 1-3 小时 新手友好度 83/100
darnitdevorg/darnit#587 ·
维护者通常 1 天内回复
-
needs triage
难度 2/5 1-3 小时 新手友好度 65/100
darnitdevorg/darnit#585 ·
维护者通常 1 天内回复
-
quality
难度 2/5 1-3 小时 新手友好度 66/100
darnitdevorg/darnit#523 ·
维护者通常 1 天内回复
-
documentation good first issue
难度 2/5 1-3 小时 新手友好度 76/100
darnitdevorg/darnit#516 ·
维护者通常 1 天内回复
查看 darnitdevorg/darnit 的全部 Issue
相似的 Issue
-
area:core-platform effort:S priority:P3 status:in-review type:test
难度 2/5 1 小时以内 新手友好度 80/100
randomparity/kdive#3246 · 1 条评论 ·
维护者通常 1 天内回复
-
Requantification library converts m/z to mass with the hydrogen-atom mass instead of the proton mass未关闭bug
难度 1/5 1 小时以内 新手友好度 85/100
nf-core/metaboigniter#130 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
common-workflow-language/cwl-utils#477 ·
维护者通常 1 天内回复
-
Add dependabot未关闭feat
难度 2/5 1 小时以内 新手友好度 72/100
open-nudge/opentemplate#204 ·
维护者通常 1 天内回复
-
github-stale-ci-pr-closer: KV state is double-wrapped, never persists, and hits the depth-32 limit可能已有人在做 @VascoSch92 今天认领。 未关闭priority:medium ready-for-dev
难度 2/5 1-3 小时 新手友好度 72/100
OpenHands/extensions#781 ·
维护者通常 1 天内回复