Description
darnit audit does not register custom sieve handlers provided by external plugin packages (such as darnit-reproducibility or darnit-gittuf). As a result, all plugin-provided controls fail to run and fall back to manual verification warnings.
What We Did
- Installed darnit with an external plugin (
darnit-reproducibility).
- Ran:
darnit audit <path> --framework reproducibility --show-all
What It Was Supposed To Do
cmd_audit should discover and register custom sieve handlers from entry point darnit.implementations so that handlers like repro_deps_pinned and repro_build_env_declared execute against the target.
What We Got
Every control emitted a warning that the handler was missing from the registry:
WARNING: Control RE-01.01: handler 'repro_deps_pinned' not found in registry
WARNING: Control RE-01.02: handler 'repro_build_env_declared' not found in registry
...
Total: 5 | Pass: 0 | Fail: 0 | Warn: 5 | N/A: 0
All controls fell back to manual and returned WARN.
Root Cause & Proposed Fix
In packages/darnit/src/darnit/cli.py, cmd_audit calls load_effective_config_by_name() (which loads the TOML config), but never calls discover_implementations().
Adding from darnit.core.discovery import discover_implementations; discover_implementations() inside cmd_audit resolves the issue.
Reference report: https://github.com/Jaydeep869/darnit/blob/reproducibility-evaluation/reports/README.md#issue-1-critical-bug-cli-audit-fails-to-register-plugin-sieve-handlers-via-darnitimplementations
Description
darnit auditdoes not register custom sieve handlers provided by external plugin packages (such asdarnit-reproducibilityordarnit-gittuf). As a result, all plugin-provided controls fail to run and fall back to manual verification warnings.What We Did
darnit-reproducibility).darnit audit <path> --framework reproducibility --show-allWhat It Was Supposed To Do
cmd_auditshould discover and register custom sieve handlers from entry pointdarnit.implementationsso that handlers likerepro_deps_pinnedandrepro_build_env_declaredexecute against the target.What We Got
Every control emitted a warning that the handler was missing from the registry:
All controls fell back to
manualand returnedWARN.Root Cause & Proposed Fix
In
packages/darnit/src/darnit/cli.py,cmd_auditcallsload_effective_config_by_name()(which loads the TOML config), but never callsdiscover_implementations().Adding
from darnit.core.discovery import discover_implementations; discover_implementations()insidecmd_auditresolves the issue.Reference report: https://github.com/Jaydeep869/darnit/blob/reproducibility-evaluation/reports/README.md#issue-1-critical-bug-cli-audit-fails-to-register-plugin-sieve-handlers-via-darnitimplementations