Issues

• OSPS-SA-03.02 judgment prompt assumes a darnit-generated threat model with code snippets

  module-baselineneeds triagequality
  darnitdevorg/darnit#651 · Filter by author mlieberman85 opened on Oct 20, 2026

• Project-data question labels: "Compiled Ass" header and a Yes option that says to choose No

  good first issuemodule-baselineneeds triageux
  darnitdevorg/darnit#650 · Filter by author mlieberman85 opened on Oct 20, 2026

• get_pending_data asks questions whose answers cannot change any result

  module-baselineneeds triageux
  darnitdevorg/darnit#649 · Filter by author mlieberman85 opened on Oct 20, 2026

• Every WARN reads "Could not automatically verify - manual verification required"; the evidence is only in pass_history

  module-coreneeds triageux
  darnitdevorg/darnit#648 · Filter by author mlieberman85 opened on Oct 20, 2026

• OSPS-BR-01.02 reports a grep match as unexpected_exit

  module-baselineneeds triagequality
  darnitdevorg/darnit#647 · Filter by author mlieberman85 opened on Oct 20, 2026

• Suggestive FAIL judgments are not kept, and summary output does not distinguish PASS candidates from unjudged controls

  interface-mcpmodule-coreneeds triagequality
  darnitdevorg/darnit#646 · Filter by author mlieberman85 opened on Oct 20, 2026

• On a case-insensitive filesystem, file probes duplicate evidence and cite paths that are not in the repository

  module-baselinemodule-coreneeds triagequality
  darnitdevorg/darnit#645 · Filter by author mlieberman85 opened on Oct 20, 2026

• audit_openssf_baseline JSON output is about 1 MB and exceeds the MCP client's result limit

  interface-mcpmodule-baselineneeds triagequality
  darnitdevorg/darnit#644 · Filter by author mlieberman85 opened on Oct 20, 2026

• Run darnit end to end through the person's own Claude Code: one-command run and a real-repository test loop

  needs triage
  darnitdevorg/darnit#639 · Filter by author mlieberman85 opened on Oct 20, 2026

• Attestation signing: use ambient CI credentials, the browser when interactive, or a local key

  module-baselineneeds triagesecurity
  darnitdevorg/darnit#631 · Filter by author mlieberman85 opened on Oct 18, 2026
  

• Make darnit harness the primary entry point

  interface-climodule-coreneeds triage
  darnitdevorg/darnit#627 · Filter by author mlieberman85 opened on Oct 17, 2026
  

• Make uv tool install darnit-mcp work: give the root package a darnit executable

  documentationinfrastructureneeds triage
  darnitdevorg/darnit#621 · Filter by author mlieberman85 opened on Oct 16, 2026
  

• darnit's git calls can run programs from the audited repository's config

  module-coreneeds triagesecurity
  darnitdevorg/darnit#617 · Filter by author mlieberman85 opened on Oct 16, 2026

• ProjectStateStore.read_maintainers has no production reader

  module-coreneeds triage
  darnitdevorg/darnit#608 · Filter by author mlieberman85 opened on Oct 16, 2026

• release-smoke cannot verify PyPI attestations: wrong sigstore flag and wrong artifact type

  cineeds triage
  darnitdevorg/darnit#607 · Filter by author mlieberman85 opened on Oct 16, 2026

• attestation extra allows sigstore 3.x, but signing needs sigstore 4.0

  dependenciesmodule-baselineneeds triage
  darnitdevorg/darnit#606 · Filter by author mlieberman85 opened on Oct 16, 2026

• Remediation reuses a cached audit made under a different trust target

  module-baselinemodule-coreneeds triage
  darnitdevorg/darnit#605 · Filter by author mlieberman85 opened on Oct 16, 2026

• A test starts real Sigstore signing (interactive OIDC login) when the attestation extra is installed

  module-baselineneeds triagetesting
  darnitdevorg/darnit#604 · Filter by author mlieberman85 opened on Oct 16, 2026

• Release smoke run failed on every job for v0.1.1; three causes remain after #519

  ciinfrastructure
  darnitdevorg/darnit#593 · Filter by author Marc-cn opened on Oct 12, 2026
  1

• darnit validate crashes on openssf-baseline.toml summarising levels

  interface-climodule-core
  darnitdevorg/darnit#589 · Filter by author andrew opened on Oct 12, 2026
  1

• Container audit loses the repository identity: git refuses the mounted repo (dubious ownership)

  documentationinfrastructure
  darnitdevorg/darnit#586 · Filter by author Marc-cn opened on Oct 11, 2026
  1

• Plugins hard-code version "0.1.0" while the packages are at 0.1.1

  good first issuemaintenance
  darnitdevorg/darnit#587 · Filter by author Marc-cn opened on Oct 11, 2026
  2

• Container image has no zizmor, so OSPS-AC-04.02 always reports missing_tool

  infrastructuremodule-baseline
  darnitdevorg/darnit#585 · Filter by author Marc-cn opened on Oct 11, 2026
  1

• No-workflows repositories: three controls report unexpected_exit instead of saying there is nothing to audit

  needs triage
  darnitdevorg/darnit#584 · Filter by author Marc-cn opened on Oct 10, 2026

• Stale kusari-oss references: signing identities, container image name, package metadata

  needs triage
  darnitdevorg/darnit#583 · Filter by author Marc-cn opened on Oct 10, 2026