apache / maven-gpg-plugin

Cuándo se añadió cada estrella y fork, recopilado de GitHub y agrupado por día. El crecimiento acumulado se sitúa justo encima de las adiciones diarias que lo componen, de modo que ambos se leen en conjunto: la acumulación orgánica sostenida no se parece en nada a un pico abrupto y efímero. Cuando esa diferencia es medible, se informa como autenticidad del crecimiento.

Cada punto abarca 7 días.

Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 6 paquetes directos y 33 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.

Instalar maven:org.apache.maven.plugins:maven-gpg-plugin@3.2.8 arrastra 38 paquetes, directos y transitivos: 3 tienen avisos conocidos, de los cuales 3 son dependencias directas.

Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.

{
  "data": {
    "repo": {
      "topics": [
        "java",
        "build-management",
        "maven",
        "maven-plugins",
        "maven-gpg-plugin"
      ],
      "is_fork": false,
      "size_kb": 524,
      "has_wiki": false,
      "homepage": "https://maven.apache.org/plugins/maven-gpg-plugin/",
      "languages": {
        "Java": 133966,
        "Shell": 948,
        "Groovy": 23008
      },
      "pushed_at": "2026-07-15T05:29:59Z",
      "created_at": "2017-12-09T15:08:09Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-22T02:34:32Z",
      "description": "Apache Maven GPG Plugin",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "master",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Java",
      "significant_languages": [
        "Java",
        "Groovy"
      ]
    },
    "owner": {
      "blog": "https://www.apache.org/",
      "name": "The Apache Software Foundation",
      "type": "Organization",
      "login": "apache",
      "company": null,
      "location": null,
      "followers": 23594,
      "avatar_url": "https://avatars.githubusercontent.com/u/47359?v=4",
      "created_at": "2009-01-17T20:14:40Z",
      "is_verified": null,
      "public_repos": 3148,
      "account_age_days": 6400
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "maven-gpg-plugin-3.2.8",
          "kind": "other",
          "published_at": "2025-07-02T07:21:56Z"
        },
        {
          "tag": "maven-gpg-plugin-3.2.7",
          "kind": "other",
          "published_at": "2024-09-27T14:05:42Z"
        },
        {
          "tag": "maven-gpg-plugin-3.2.6",
          "kind": "other",
          "published_at": "2024-09-14T15:37:42Z"
        },
        {
          "tag": "maven-gpg-plugin-3.2.5",
          "kind": "other",
          "published_at": "2024-08-12T08:38:16Z"
        },
        {
          "tag": "maven-gpg-plugin-3.2.4",
          "kind": "other",
          "published_at": "2024-04-19T08:32:05Z"
        },
        {
          "tag": "maven-gpg-plugin-3.2.3",
          "kind": "other",
          "published_at": "2024-04-11T06:59:18Z"
        },
        {
          "tag": "maven-gpg-plugin-3.2.2",
          "kind": "other",
          "published_at": "2024-03-26T08:49:20Z"
        },
        {
          "tag": "maven-gpg-plugin-3.2.1",
          "kind": "other",
          "published_at": "2024-03-18T08:46:18Z"
        },
        {
          "tag": "maven-gpg-plugin-3.2.0",
          "kind": "other",
          "published_at": "2024-03-11T08:12:55Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "e40ebf8652badf57f60e849b7b8f66e751011b65",
          "body": "…l (#328)\n\nBumps [apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml](https://github.com/apache/maven-gh-actions-shared) from 4 to 5.\n- [Commits](https://github.com/apache/maven-gh-actions-shared/compare/v4...v5)\n\n---\nupdated-dependencies:\n- dependency-name: apache/maven-gh-actions-sh\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.ym…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-15T05:29:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "643ea6c0910789f6e87cbe2e719b39164f44bfd8",
          "body": "…ml (#326)\n\nBumps [apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml](https://github.com/apache/maven-gh-actions-shared) from 4 to 5.\n- [Commits](https://github.com/apache/maven-gh-actions-shared/compare/v4...v5)\n\n---\nupdated-dependencies:\n- dependency-name: apache/maven-gh-actions-\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.y…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-15T05:29:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "78b80f84462e27886582306029eea4b8ffd92a04",
          "body": "Bumps [apache/maven-gh-actions-shared/.github/workflows/stale.yml](https://github.com/apache/maven-gh-actions-shared) from 4 to 5.\n- [Commits](https://github.com/apache/maven-gh-actions-shared/compare/v4...v5)\n\n---\nupdated-dependencies:\n- dependency-name: apache/maven-gh-actions-shared/.github/workf\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump apache/maven-gh-actions-shared/.github/workflows/stale.yml (#329)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-15T05:29:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29d821a83bee65d0b9f1d657da354b4a8f9694ee",
          "body": "Bumps `bouncycastleVersion` from 1.84 to 1.85.\n\nUpdates `org.bouncycastle:bcpg-jdk18on` from 1.84 to 1.85\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)\n- [Commits](https://github.com/bcgit/bc-java/commits)\n\nUpdates `org.bouncycastle:bcprov-jdk18on` from 1.84 to 1.8\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump bouncycastleVersion from 1.84 to 1.85 (#325)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T17:06:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8498a7335d28d9e10d0b4c1ca1ceb1253fe91062",
          "body": "…#321)",
          "is_bot": false,
          "headline": "Update to parent 48, Maven 3.9.16 and use version properties in ITS (…",
          "author_name": "Matthias Bünger",
          "author_login": "Bukama",
          "committed_at": "2026-07-11T23:10:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b715d270c163432aa9832b20f673c65ae6bc36a",
          "body": "Bumps [org.codehaus.plexus:plexus-utils](https://github.com/codehaus-plexus/plexus-utils) from 3.6.0 to 3.6.1.\n- [Release notes](https://github.com/codehaus-plexus/plexus-utils/releases)\n- [Commits](https://github.com/codehaus-plexus/plexus-utils/compare/plexus-utils-3.6.0...plexus-utils-3.6.1)\n\n---\n[…]\ne: org.codehaus.plexus:plexus-utils\n  dependency-version: 3.6.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-14T19:23:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f677738b1866b69626a1a5c7d327371c1fcec76b",
          "body": "Bumps `bouncycastleVersion` from 1.83 to 1.84.\n\nUpdates `org.bouncycastle:bcpg-jdk18on` from 1.83 to 1.84\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)\n- [Commits](https://github.com/bcgit/bc-java/commits)\n\nUpdates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.8\n[…]\ne: org.bouncycastle:bcutil-jdk18on\n  dependency-version: '1.84'\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump bouncycastleVersion from 1.83 to 1.84",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-14T19:23:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "033f93152b7992ff7456d3802202e5abd76c3bc4",
          "body": null,
          "is_bot": false,
          "headline": "Update PGP key for commons-io",
          "author_name": "Sylwester Lachiewicz",
          "author_login": "slachiewicz",
          "committed_at": "2026-06-14T19:23:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "93e88a80da9c6b6597762b67bcc518b721be0067",
          "body": "Bumps commons-io:commons-io from 2.21.0 to 2.22.0.\n\n---\nupdated-dependencies:\n- dependency-name: commons-io:commons-io\n  dependency-version: 2.22.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump commons-io:commons-io from 2.21.0 to 2.22.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-14T19:23:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "71e4b05dfbc8f607114b5b425a011ac2bf7f61fb",
          "body": null,
          "is_bot": false,
          "headline": "Reformat, no code change",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2026-06-05T15:49:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "66e965ad166eeab34993d0f56059986062c5a853",
          "body": "Bumps [org.apache.maven.plugins:maven-plugins](https://github.com/apache/maven-parent) from 46 to 47.\n- [Release notes](https://github.com/apache/maven-parent/releases)\n- [Commits](https://github.com/apache/maven-parent/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugins:\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump org.apache.maven.plugins:maven-plugins from 46 to 47 (#312)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-15T11:46:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5821f7fa6b8cbba9fdd70a8f7173ca436a158a53",
          "body": "Bumps [org.apache.maven.plugins:maven-plugins](https://github.com/apache/maven-parent) from 45 to 46.\n- [Release notes](https://github.com/apache/maven-parent/releases)\n- [Commits](https://github.com/apache/maven-parent/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugins:\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump org.apache.maven.plugins:maven-plugins from 45 to 46 (#311)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-01-07T05:37:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5906c372d584c0a405cd22f65d92e0f804f4b43c",
          "body": "Co-authored-by: Moderne <team@moderne.io>",
          "is_bot": false,
          "headline": "Cleanup tests (#310)",
          "author_name": "Sylwester Lachiewicz",
          "author_login": "slachiewicz",
          "committed_at": "2025-12-21T13:57:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c6873c5f27bf9493249188de271cc0037abd3fb",
          "body": "Bumps `mavenVersion` from 3.9.11 to 3.9.12.\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.11 to 3.9.12\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.11...maven-3.9.12)\n\nUpdates `org.apache.maven:maven-artifact` from \n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump mavenVersion from 3.9.11 to 3.9.12 (#309)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-12-17T04:58:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "41ae1b836198b84c5a03a2d264b36743152f9263",
          "body": "Split between features used by both GnuPG and BC signer and signer\nspecific information.\nImprove plugin parameter documentation (also with regards to primary and\nsecondary keys).",
          "is_bot": false,
          "headline": "Consolidate documentation in order to reduce redundancy",
          "author_name": "Konrad Windszus",
          "author_login": "kwin",
          "committed_at": "2025-12-02T18:50:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6319ec31b92cad8000fabf78b8cdad8e7f68ac4f",
          "body": "Use Site descriptor 2.0",
          "is_bot": false,
          "headline": "Migrate to Markdown format",
          "author_name": "Konrad Windszus",
          "author_login": "kwin",
          "committed_at": "2025-12-01T22:01:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e9f23a1161af71a9b7e979bdc415a482ce2bb49c",
          "body": null,
          "is_bot": false,
          "headline": "Move to match target converter format MARKDOWN with doxia-converter",
          "author_name": "Konrad Windszus",
          "author_login": "kwin",
          "committed_at": "2025-12-01T22:01:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e2ed3557774ecefbc61630a9152fc21b1823e2c0",
          "body": "This relates to #301",
          "is_bot": false,
          "headline": "Add test for BC signer leveraging subkeys (#305)",
          "author_name": "Konrad Windszus",
          "author_login": "kwin",
          "committed_at": "2025-12-01T15:21:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5c3cccad4d13201908fb7c2fd543fcfd5dfac5cb",
          "body": "Bumps `bouncycastleVersion` from 1.82 to 1.83.\n\nUpdates `org.bouncycastle:bcpg-jdk18on` from 1.82 to 1.83\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)\n- [Commits](https://github.com/bcgit/bc-java/commits)\n\nUpdates `org.bouncycastle:bcprov-jdk18on` from 1.82 to 1.8\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump bouncycastleVersion from 1.82 to 1.83 (#304)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-27T04:25:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1cb59c5bf29524e2b001d0ce75bd54287b0de329",
          "body": "Bumps [commons-io:commons-io](https://github.com/apache/commons-io) from 2.20.0 to 2.21.0.\n- [Changelog](https://github.com/apache/commons-io/blob/master/RELEASE-NOTES.txt)\n- [Commits](https://github.com/apache/commons-io/compare/rel/commons-io-2.20.0...rel/commons-io-2.21.0)\n\n---\nupdated-dependenci\n[…]\ndency-name: commons-io:commons-io\n  dependency-version: 2.21.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump commons-io:commons-io from 2.20.0 to 2.21.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-11-11T00:18:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d20eb5d87201ce104cf2062d69d57affefc5f808",
          "body": null,
          "is_bot": false,
          "headline": "Bump m-invoker-p to 3.9.1",
          "author_name": "Sylwester Lachiewicz",
          "author_login": "slachiewicz",
          "committed_at": "2025-11-11T00:18:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "31e2fbb93d9b5c71298ec7698a14560d036af56b",
          "body": "Bumps `bouncycastleVersion` from 1.81 to 1.82.\n\nUpdates `org.bouncycastle:bcpg-jdk18on` from 1.81 to 1.82\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)\n- [Commits](https://github.com/bcgit/bc-java/commits)\n\nUpdates `org.bouncycastle:bcprov-jdk18on` from 1.81 to 1.8\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump bouncycastleVersion from 1.81 to 1.82 (#297)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-09-18T15:29:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "efb9531ea1c771abe5137b0d0f76c86c3a904e37",
          "body": null,
          "is_bot": false,
          "headline": "feat: enable prevent branch protection rules",
          "author_name": "sebtiem",
          "author_login": "sebtiem",
          "committed_at": "2025-09-08T12:49:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4f8ca164be98e69c78902410f3afe48c9a3ae2e5",
          "body": null,
          "is_bot": false,
          "headline": "Add Apache 2.0 LICENSE file (#293)",
          "author_name": "Noah Tayebwa",
          "author_login": "Ndacyayisenga-droid",
          "committed_at": "2025-07-23T21:42:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4da58de3dc76823a6f685fac858de2d9d38a6619",
          "body": "Bumps [commons-io:commons-io](https://github.com/apache/commons-io) from 2.19.0 to 2.20.0.\n- [Changelog](https://github.com/apache/commons-io/blob/master/RELEASE-NOTES.txt)\n- [Commits](https://github.com/apache/commons-io/compare/rel/commons-io-2.19.0...rel/commons-io-2.20.0)\n\n---\nupdated-dependenci\n[…]\nrect:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#294)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-07-21T05:25:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f300dfb77845d340f4d8c74cf3e1239b945431e",
          "body": "---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-plugin-api\n  dependency-version: 3.9.11\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-artifact\n  dependency-version: 3.9.11\n  dependency-type: direct:produc\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump mavenVersion from 3.9.10 to 3.9.11 (#292)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-07-16T09:34:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "05f9d2f44dfbe4f896df0d5731aef1590a913cd7",
          "body": "Bumps `mavenVersion` from 3.9.9 to 3.9.10.\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.9 to 3.9.10\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.9...maven-3.9.10)\n\nUpdates `org.apache.maven:maven-artifact` from 3.9\n[…]\npache.maven:maven-settings-builder\n  dependency-version: 3.9.10\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump mavenVersion from 3.9.9 to 3.9.10",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-07-02T21:14:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "86f6b9d2423f5a2b4442e2cf05ba82993c7690b9",
          "body": null,
          "is_bot": false,
          "headline": "Remove guaranteed true null check (#289)",
          "author_name": "Elliotte Rusty Harold",
          "author_login": "elharo",
          "committed_at": "2025-06-30T10:40:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2bb3a7820e5d5e63ce0b7c5e7394e5e9218013c6",
          "body": null,
          "is_bot": false,
          "headline": "Remove unused test dependency (#288)",
          "author_name": "Elliotte Rusty Harold",
          "author_login": "elharo",
          "committed_at": "2025-06-30T10:39:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "27e19190a587a4ea0084098366c1e685bd17488b",
          "body": null,
          "is_bot": false,
          "headline": "Copy edit parameter descriptions (#290)",
          "author_name": "Elliotte Rusty Harold",
          "author_login": "elharo",
          "committed_at": "2025-06-29T22:44:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8a721a037fd3dbc00534a81b308e1eeea062714d",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare for next development iteration",
          "author_name": "Slawomir Jaranowski",
          "author_login": "slawekjaranowski",
          "committed_at": "2025-06-28T08:53:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8a46455fba7d315ce7fdc9d5bdaddd890753886e",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare release maven-gpg-plugin-3.2.8",
          "author_name": "Slawomir Jaranowski",
          "author_login": "slawekjaranowski",
          "committed_at": "2025-06-28T08:53:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "70128213b1fe0a2226e06d2281a7384fe5265668",
          "body": null,
          "is_bot": false,
          "headline": "Fix issueManagement, ciManagement system and url",
          "author_name": "Slawomir Jaranowski",
          "author_login": "slawekjaranowski",
          "committed_at": "2025-06-28T08:41:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a9a8c84176e33c715c922457c0a5df97066a8d83",
          "body": "And be consistent: as some legacy stuff in Maven and around (plugins) perform just nullcheck and not also empty string check, and get confused on empty string classifier. Plugins are (should) not be reused as dependencies, so despite the helper class is `public` I see no harm to alter it.\n\nSupersedes #135 \nFixes #138",
          "is_bot": false,
          "headline": "Make empty classifier null (not empty string) (#287)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2025-06-26T16:24:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a8368b0622529fa3b13457d19e7c7920ef661e66",
          "body": null,
          "is_bot": false,
          "headline": "Add .mvn",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2025-06-26T13:56:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f0e45e0a7c3f02a22612b33ff7fcfa8e4540462f",
          "body": "And related fixes:\n* POM add missing deps\n* move to Maven 3 p-u, drop p-x\n* test: checkstyle fixes",
          "is_bot": false,
          "headline": "Update parent POM to 45 (#284)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2025-06-24T18:34:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cb1236c251b458918b5a7b5b7d240315d5ab6430",
          "body": "Bumps `bouncycastleVersion` from 1.78.1 to 1.80.\n\nUpdates `org.bouncycastle:bcpg-jdk18on` from 1.78.1 to 1.80\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)\n- [Commits](https://github.com/bcgit/bc-java/commits)\n\nUpdates `org.bouncycastle:bcprov-jdk18on` from 1.78.1 \n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump bouncycastleVersion from 1.78.1 to 1.80 (#127)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-06-24T17:02:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5377a1044d364f5b345538ecaeaf39ec1bdbafb5",
          "body": "Bumps commons-io:commons-io from 2.18.0 to 2.19.0.\n\n---\nupdated-dependencies:\n- dependency-name: commons-io:commons-io\n  dependency-version: 2.19.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#133)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-06-24T16:37:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8b63932fbe869c8228d5d07527b606ed1da16268",
          "body": "…0 (#125)\n\nBumps [org.apache.maven.plugins:maven-invoker-plugin](https://github.com/apache/maven-invoker-plugin) from 3.8.0 to 3.9.0.\n- [Release notes](https://github.com/apache/maven-invoker-plugin/releases)\n- [Commits](https://github.com/apache/maven-invoker-plugin/compare/maven-invoker-plugin-3.8\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump org.apache.maven.plugins:maven-invoker-plugin from 3.8.0 to 3.9.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-06-24T16:24:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "54ea518a3f5c427e24fbc4cb6271e186b041b375",
          "body": "Bumps [org.simplify4u.plugins:pgpverify-maven-plugin](https://github.com/s4u/pgpverify-maven-plugin) from 1.18.2 to 1.19.1.\n- [Release notes](https://github.com/s4u/pgpverify-maven-plugin/releases)\n- [Commits](https://github.com/s4u/pgpverify-maven-plugin/compare/v1.18.2...v1.19.1)\n\n---\nupdated-depe\n[…]\n dependency-name: org.simplify4u.plugins:pgpverify-maven-plugin\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump org.simplify4u.plugins:pgpverify-maven-plugin from 1.18.2 to 1.19.1",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2025-06-24T16:23:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a6a412d68a603b0f180695f2721b71307d926297",
          "body": null,
          "is_bot": false,
          "headline": "Remove old JIRA issue link",
          "author_name": "Matthias Bünger",
          "author_login": "Bukama",
          "committed_at": "2025-06-14T12:10:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "490711ac9acc9bf5b2f23fefc7ffc7dc4424468e",
          "body": null,
          "is_bot": false,
          "headline": "Really enable GHissues (#136)",
          "author_name": "Matthias Bünger",
          "author_login": "Bukama",
          "committed_at": "2025-05-26T16:08:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "78c14a99f58bbda55f3176f2e74fb190da8ca2fc",
          "body": null,
          "is_bot": false,
          "headline": "Enable GitHub issues",
          "author_name": "Matthias Bünger",
          "author_login": "Bukama",
          "committed_at": "2025-05-05T19:30:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "69d6fc66f2cbc634ed540e0db8a60501df71dfe8",
          "body": "PR for MGPG-130 updated the defaults, but this documentation\nwas left out and may cause confusion.",
          "is_bot": false,
          "headline": "Update documentation (only), no code change.",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2025-02-25T10:28:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1365f1e84d566fa67151935703b1bcbb78ed1b76",
          "body": null,
          "is_bot": false,
          "headline": "[MNGSITE-529] Rename \"Goals\" to \"Plugin Documentation\"",
          "author_name": "Matthias Bünger",
          "author_login": "Bukama",
          "committed_at": "2025-02-12T16:33:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1c3977ca51dd20fdf2dd20e88da1e0b837dcc6cc",
          "body": null,
          "is_bot": false,
          "headline": "Describe how to prime a specific GPG key (#128)",
          "author_name": "Konrad Windszus",
          "author_login": "kwin",
          "committed_at": "2025-02-02T18:30:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "805077c80f457d432637ddef647829a038d63142",
          "body": null,
          "is_bot": false,
          "headline": "Prefer Guice constructor injection (#126)",
          "author_name": "Elliotte Rusty Harold",
          "author_login": "elharo",
          "committed_at": "2024-12-18T22:41:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8710092aeced74e1eee73c0459ae2cceb150e835",
          "body": "Bumps commons-io:commons-io from 2.17.0 to 2.18.0.\n\n---\nupdated-dependencies:\n- dependency-name: commons-io:commons-io\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump commons-io:commons-io from 2.17.0 to 2.18.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-12-14T22:23:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "969027f0ea378c30346eb2a24707c8961fb5eaf5",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare for next development iteration",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-09-24T13:01:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "43af21cbe6e62e417e5037c359f79dd7878b4908",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare release maven-gpg-plugin-3.2.7",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-09-24T13:01:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8c5a8d2eb990b3d9db8bc2f5563a0aeb4dbb5eea",
          "body": "Bumps commons-io:commons-io from 2.16.1 to 2.17.0.\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: commons-io:commons-io\r\n  dependency-type: direct:development\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-144",
          "is_bot": true,
          "headline": "[MGPG-144] Bump commons-io:commons-io from 2.16.1 to 2.17.0 (#119)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-09-24T12:57:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cb5422fc4f2372a58772e0b8a9a20b072696a7f4",
          "body": "…10.0 to 2.10.1 (#121)\n\nBumps [com.kohlschutter.junixsocket:junixsocket-core](https://github.com/kohlschutter/junixsocket) from 2.10.0 to 2.10.1.\r\n- [Release notes](https://github.com/kohlschutter/junixsocket/releases)\r\n- [Commits](https://github.com/kohlschutter/junixsocket/compare/junixsocket-2.10\n[…]\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-143",
          "is_bot": true,
          "headline": "[MGPG-143] Bump com.kohlschutter.junixsocket:junixsocket-core from 2.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-09-24T12:44:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6b2a27f3a60e8c92079f14e5240ee8c353ccfa35",
          "body": "Since 3.2.0 version we always appended \"line separator\" to passphrase unless it itself ended with one. But, this caused problem on Windows, as (our assumption is) that GPG uses binary read of STDIN, and on Windows \"line separator\" is \"\\r\\n\", while GPG handles \"\\n\" only, making passphrase corrupted by presence of unwanted \"\\r\".\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-136",
          "is_bot": false,
          "headline": "[MGPG-136] Windows passphrase corruption (#120)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-09-24T12:43:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "31e87e0062b7eacc3506fc6dea94e7ff509c16b9",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare for next development iteration",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-09-10T20:06:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1c9a14c0eec9dae40baa4a5db674e6a7ec012be4",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare release maven-gpg-plugin-3.2.6",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-09-10T20:05:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bbe6156400212b3fe063d218399ba09c24795f44",
          "body": null,
          "is_bot": false,
          "headline": "Add FAQ for \"no pinentry\" issue (#118)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-09-10T16:48:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b9427333ab4b7b48b297a8b9a4158688211f14a",
          "body": "The MGPG-138 also updated plexus-utils to 4.0.1 and plexus-xml to 3.0.1.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-141",
          "is_bot": false,
          "headline": "[MGPG-141] Remove use of deprecated classes (#117)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-09-10T16:38:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "afdfd28bab4a0530cfd655397716a36adc1644b6",
          "body": "Use proper Maven 3 API instead.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-138",
          "is_bot": false,
          "headline": "[MGPG-138] Drop direct use of plexus-cipher and secdispatcher (#115)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-09-09T12:21:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7516e7c73d6e5c8c3d6c2cbab9d55deb3987f388",
          "body": "This is really just \"build time\" as at runtime it uses\r\ngiven Maven version artifacts anyway.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-140",
          "is_bot": false,
          "headline": "[MGPG-140] Update Maven to 3.9.9 (#116)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-09-09T12:21:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ec571f561e330209189eb3c4387aaae0b37fb96",
          "body": "…7.0 to 3.8.0 (#114)\n\nBumps [org.apache.maven.plugins:maven-invoker-plugin](https://github.com/apache/maven-invoker-plugin) from 3.7.0 to 3.8.0.\r\n- [Release notes](https://github.com/apache/maven-invoker-plugin/releases)\r\n- [Commits](https://github.com/apache/maven-invoker-plugin/compare/maven-invok\n[…]\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-139",
          "is_bot": true,
          "headline": "[MGPG-139] Bump org.apache.maven.plugins:maven-invoker-plugin from 3.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-09-09T11:43:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1126b7b09cb8a4540e35f62146b1198bcadeb795",
          "body": null,
          "is_bot": false,
          "headline": "use new Reproducible Central badge endpoint",
          "author_name": "Hervé Boutemy",
          "author_login": "hboutemy",
          "committed_at": "2024-08-18T23:20:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1b40a0554b55c1d8a1c5da662e848688aa346aed",
          "body": "… (#112)\n\nCurrently AbstractGpgMojo has a fixed set of supported signers (and how\r\nthey are constructed), it would be good to allow extensions (e.g. Tycho\r\nis also using AbstractGpgMojo) to possibly override that aspect.\r\n\r\nThis extracts the creation of the signer into a (protected) method so\r\ndifferent types or alternative implementations can be used.\r\n\r\nCo-authored-by: Christoph Läubrich <christoph@laeubi-soft.de>",
          "is_bot": false,
          "headline": "[MGPG-135] Support Overriding / Enhance the signer in AbstractGpgMojo…",
          "author_name": "Christoph Läubrich",
          "author_login": "laeubi",
          "committed_at": "2024-08-14T12:26:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a31714e9cbdde86a6b12f1ef05d5c60252fef4a",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare for next development iteration",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-08-08T19:07:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "737d4eeea5bbc01779fd3b5b2a637c9d6453fe27",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare release maven-gpg-plugin-3.2.5",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-08-08T19:06:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "77470635c506af97be4712c1133d94eb3a593b69",
          "body": "Needs a bit tweaking due newer maven-shared-utils needed as well.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-134",
          "is_bot": false,
          "headline": "[MGPG-134] Update maven-invoker (#110)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-08-08T18:40:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3df5f83ebb041384807127e761d4e28011da4f79",
          "body": "…17.0 to 1.18.2 (#105)\n\nBumps [org.simplify4u.plugins:pgpverify-maven-plugin](https://github.com/s4u/pgpverify-maven-plugin) from 1.17.0 to 1.18.2.\r\n- [Release notes](https://github.com/s4u/pgpverify-maven-plugin/releases)\r\n- [Commits](https://github.com/s4u/pgpverify-maven-plugin/compare/v1.17.0...\n[…]\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-133",
          "is_bot": true,
          "headline": "[MGPG-133] Bump org.simplify4u.plugins:pgpverify-maven-plugin from 1.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-08-08T15:14:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "58a20697aa0878f0ab5099bb01c059b03ac84061",
          "body": "…9.1 to 2.10.0 (#107)\n\nBumps [com.kohlschutter.junixsocket:junixsocket-core](https://github.com/kohlschutter/junixsocket) from 2.9.1 to 2.10.0.\r\n- [Release notes](https://github.com/kohlschutter/junixsocket/releases)\r\n- [Commits](https://github.com/kohlschutter/junixsocket/compare/junixsocket-2.9.1.\n[…]\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-132",
          "is_bot": true,
          "headline": "[MGPG-132] Bump com.kohlschutter.junixsocket:junixsocket-core from 2.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-08-08T15:13:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e911b43d85ae48ab30d958c497c89c98c9aeed8e",
          "body": "…(#108)\n\nBumps [org.apache.maven.plugins:maven-plugins](https://github.com/apache/maven-parent) from 42 to 43.\r\n- [Release notes](https://github.com/apache/maven-parent/releases)\r\n- [Commits](https://github.com/apache/maven-parent/commits)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: org.apache\n[…]\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-131",
          "is_bot": true,
          "headline": "[MGPG-131] Bump org.apache.maven.plugins:maven-plugins from 42 to 43 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-08-08T15:12:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d2b60d383628d82a7f5098816ecb0db61a520ffe",
          "body": "Sigstore uses \".sigstore.json\" extension in all our plugins, \".sigstore\" is legacy",
          "is_bot": false,
          "headline": "[MGPG-130] Update sigstore extension for exclusion (#109)",
          "author_name": "Appu",
          "author_login": "loosebazooka",
          "committed_at": "2024-08-08T15:04:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "091f3884a1de72e9dec2b12cda7cccd8bbacb699",
          "body": "Bumps [org.apache.maven.plugins:maven-invoker-plugin](https://github.com/apache/maven-invoker-plugin) from 3.6.1 to 3.7.0.\n- [Release notes](https://github.com/apache/maven-invoker-plugin/releases)\n- [Commits](https://github.com/apache/maven-invoker-plugin/compare/maven-invoker-plugin-3.6.1...maven-\n[…]\n dependency-name: org.apache.maven.plugins:maven-invoker-plugin\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump org.apache.maven.plugins:maven-invoker-plugin from 3.6.1 to 3.7.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-07-08T20:56:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "899f4109920957da149a564e74bfc6dc74318e87",
          "body": "Up parent and prerequisite\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-128",
          "is_bot": false,
          "headline": "[MGPG-128] Parent POM 42, prerequisite 3.6.3 (#100)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-04-25T17:15:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f0be6f3f78972d9e9a797f57ca65e93af78a62cd",
          "body": "Bumps `bouncycastleVersion` from 1.78 to 1.78.1.\r\n\r\nUpdates `org.bouncycastle:bcpg-jdk18on` from 1.78 to 1.78.1\r\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)\r\n- [Commits](https://github.com/bcgit/bc-java/commits)\r\n\r\nUpdates `org.bouncycastle:bcprov-jdk18on` from 1\n[…]\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-127",
          "is_bot": true,
          "headline": "[MGPG-127] Bump bouncycastleVersion from 1.78 to 1.78.1 (#98)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-04-25T08:39:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7dd5166a02e5b92192819c2c1c830c4176346078",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare for next development iteration",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-04-16T13:24:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "789149ea5676238f4e2958f51ae10778ca2ba3f0",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare release maven-gpg-plugin-3.2.4",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-04-16T13:23:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "893aedcab271ac92ef01f1a4346320525e678b39",
          "body": "As currently due defaulted values it would always fail, unless user explicitly re-configures plugin. So, do not set \"default value\" on mojo level, instead handle it programmatically, when bestPractices is not set. Added ITs for \"bestPractices\", one for success and one for failure. \r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-125",
          "is_bot": false,
          "headline": "[MGPG-125] Fix \"bestPractices\" (#95)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-04-13T17:02:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b6f0324f27c780ee96840cfecfec866b44635f26",
          "body": "Bumps commons-io:commons-io from 2.16.0 to 2.16.1.\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: commons-io:commons-io\r\n  dependency-type: direct:development\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-126",
          "is_bot": true,
          "headline": "[MGPG-126] Bump commons-io:commons-io from 2.16.0 to 2.16.1 (#94)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-04-11T14:55:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3c5878b12cb95e077bc8f77bdb07913d210f8c95",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare for next development iteration",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-04-08T09:28:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "89b91a40617f911ce77cc3190842d46b1f470f45",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare release maven-gpg-plugin-3.2.3",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-04-08T09:28:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fc2efa3097fa620ce5d5167a9d8ab9018a4247a5",
          "body": "Upgrade:\r\n* Bouncycastle to 1.78\r\n* junixsocket to 2.9.1\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-123\r\nhttps://issues.apache.org/jira/browse/MGPG-124",
          "is_bot": false,
          "headline": "[MGPG-123][MGPG-124] Dependency upgrades (#93)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-04-08T07:53:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "50222d351ac12e746ce9921a957654e5e24a55de",
          "body": "New mojo, \"sign-deployed\" that is able to sign already deployed artifacts.\r\nAssuming there is no Maven project, hence mojo should not require project, just a list of artifacts.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-120",
          "is_bot": false,
          "headline": "[MGPG-120] New mojo sign-deployed (#88)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-04-03T14:49:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a6c3a094ea1e3b29fc3711f450f57e6e292fabed",
          "body": "…6.0 to 3.6.1 (#89)\n\nBumps [org.apache.maven.plugins:maven-invoker-plugin](https://github.com/apache/maven-invoker-plugin) from 3.6.0 to 3.6.1.\r\n- [Release notes](https://github.com/apache/maven-invoker-plugin/releases)\r\n- [Commits](https://github.com/apache/maven-invoker-plugin/compare/maven-invoke\n[…]\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-122",
          "is_bot": true,
          "headline": "[MGPG-122] Bump org.apache.maven.plugins:maven-invoker-plugin from 3.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-04-03T08:05:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "78f5e370ee5f02f1b613540d8d7204cab919d99d",
          "body": "Return the workaround, but this method is to be phased out.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-121",
          "is_bot": false,
          "headline": "[MGPG-121] Return the workaround for pseudo security (#90)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-04-02T13:44:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "582df745e6ec01e414be255fae0a8b262255c641",
          "body": "Make sure is gone from heap once not needed. Other smaller improvements as well.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-117",
          "is_bot": false,
          "headline": "[MGPG-117]  Improve passphrase handling (#86)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-29T09:08:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0adc6b8e50e09880495290aeb4a0dc953d1b7134",
          "body": "Bumps commons-io:commons-io from 2.15.1 to 2.16.0.\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: commons-io:commons-io\r\n  dependency-type: direct:development\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-118",
          "is_bot": true,
          "headline": "[MGPG-118] Bump commons-io:commons-io from 2.15.1 to 2.16.0 (#87)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2024-03-29T08:13:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef57091a7ffce55afe7b68bbd8b7592a6831687f",
          "body": "Allow 64K files as well, as this may be \"ring\" (collection of keys) as well.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-116",
          "is_bot": false,
          "headline": "[MGPG-116] Up max key file size to 64K (#85)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-28T10:27:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "944be4e628ac721f654b4bbabb454206355144ae",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare for next development iteration",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-23T21:55:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ab97064bd26c7c81dd115948837b7b39a9733707",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare release maven-gpg-plugin-3.2.2",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-23T21:55:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2be0a00b97105c9885c7f51f53cbc5f49720587a",
          "body": "Just show some usable feedback which key is used to sign.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-115",
          "is_bot": false,
          "headline": "[MGPG-115] Show more info about key used to sign (#84)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-23T19:47:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "363183053da3325683ef60fafcf1ffafe4d07e31",
          "body": "This insanely huge key size is mentioned as some extreme example\r\non page https://wiki.gnupg.org/LargeKeys\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-114",
          "is_bot": false,
          "headline": "[MGPG-114] Allow max key size of 16KB (#83)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-23T19:27:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "528fab96943fcbfd0b70367b8fa388d8ac2a8bbc",
          "body": "The RemoteRepository was \"bare\", it has to be equipped with AuthenticationSelector to be able to perform authenticated deploys. Also, remove \"layout\" as since Maven 3.0 there is no other layout than \"default\".\r\n\r\nAlso, a bit of tidy up, layout is deprecated in Maven3 and is unused.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-113",
          "is_bot": false,
          "headline": "[MGPG-113] SignAndDeployFileMojo results in 401 (#82)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-23T19:00:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "770636b978c9c48a8d975b76807d9553e3c2c452",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare for next development iteration",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-15T08:20:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b69086e7d2a48d985b6190cf75f1d0eb4ce2ecf",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare release maven-gpg-plugin-3.2.1",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-15T08:19:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "28d298c2a9049c3a8535f97100670638ce48b724",
          "body": "Changes:\r\n* add missing maven artifact and settings\r\n* add resolver impl to test scope\r\n* comment on plexus-cipher and sec-dispatcher",
          "is_bot": false,
          "headline": "[MGPG-111] Fix dependencies (#81)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-15T08:06:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "75d8ed56a05e7e886a61a92f076506b8ffba2bd1",
          "body": "That caused that settings.xml could not deliver GPG passphrase as it was set up in setup-java. Plus, related IT was neutered and it did not do what it was supposed to do.\r\n\r\nThis yields 3.2.1 release as 3.2.0 broke pw pickup from settings.xml\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-112",
          "is_bot": false,
          "headline": "[MGPG-112] serverId def value was unintentionally dropped (#80)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-15T07:40:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2a11a2d667a6dbe17b8f037a8b822a1b16326a73",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare for next development iteration",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-08T09:35:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4b23da86ebc38fb10a04e534c1043cf37e179304",
          "body": null,
          "is_bot": false,
          "headline": "[maven-release-plugin] prepare release maven-gpg-plugin-3.2.0",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-08T09:34:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "56645dd7ba4c1538a55de91a27232d29c6f70873",
          "body": null,
          "is_bot": false,
          "headline": "Fix tag template",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-08T09:30:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "036dfe005c64a3f881f493806e854ead033c563d",
          "body": "… doco (#77)\n\nDocument the latest changes. But also implement Java changes related to agent usage and back compat.\r\n\r\nNow we distinguish really (and option is un-deprecated):\r\n* `useAgent`\r\n* `interactive`\r\n\r\nMeans to provide secret needed for signing:\r\n\r\n|flag|agent pinentry|agent cached|env variab\n[…]\ngpg-agent`\r\nalso supports \"non interactive\" password caching that now both signers make use of.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-108\r\nhttps://issues.apache.org/jira/browse/MGPG-105",
          "is_bot": false,
          "headline": "[MGPG-105] [MGPG-108] Make plugin backward compat and update site and…",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-08T08:02:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0771b610492f0818c38d137f771182f51ff28f98",
          "body": "It was validating POMs as \"Maven2\". These POMs should be handled as \"new projects\" and they must have strict validation in effect instead. Still, given \"strict\" validation is a moving target (it depends on currently running Maven version), we need to factor in Maven4 as well. Once beta, Maven4 shoul\n[…]\nwas running locally the build with latest alpha-13 SNAPSHOT (it went OK) that showed one IT that was sensitive to it, fixed in this PR as well.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-110",
          "is_bot": false,
          "headline": "[MGPG-110] SignAndDeployFileMojo validation is off (#78)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-05T14:57:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "23b64f29dde787f35bafbe56da1e56567c45e798",
          "body": "When passphrase is being supplied with `--passphrase-fd 0`.\r\n\r\n---\r\n\r\nhttps://issues.apache.org/jira/browse/MGPG-99",
          "is_bot": false,
          "headline": "[MGPG-99] Make sure newline is added to input stream (#76)",
          "author_name": "Tamas Cservenak",
          "author_login": "cstamas",
          "committed_at": "2024-03-05T09:05:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 9,
      "commits_last_year": 23,
      "latest_release_at": "2025-07-02T07:21:56Z",
      "latest_release_tag": "maven-gpg-plugin-3.2.8",
      "releases_from_tags": false,
      "days_since_last_push": 13,
      "active_weeks_last_year": 14,
      "days_since_latest_release": 391,
      "mean_days_between_releases": 59.7
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 75,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "org.apache.maven.plugins:maven-gpg-plugin",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "maven",
          "matches_repo": true,
          "registry_url": "https://central.sonatype.com/artifact/org.apache.maven.plugins/maven-gpg-plugin",
          "is_deprecated": false,
          "latest_version": "3.2.8",
          "repository_url": "https://github.com/apache/maven-gpg-plugin/tree/${project.scm.tag}",
          "versions_count": 21,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2025-10-31T15:19:06Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 269
        }
      ]
    },
    "popularity": {
      "forks": 27,
      "stars": 30,
      "watchers": 19,
      "fork_history": {
        "days": [
          {
            "date": "2018-04-09",
            "count": 1
          },
          {
            "date": "2019-06-07",
            "count": 1
          },
          {
            "date": "2019-07-19",
            "count": 1
          },
          {
            "date": "2019-07-20",
            "count": 1
          },
          {
            "date": "2019-07-28",
            "count": 1
          },
          {
            "date": "2019-08-09",
            "count": 1
          },
          {
            "date": "2019-10-07",
            "count": 1
          },
          {
            "date": "2020-04-20",
            "count": 1
          },
          {
            "date": "2020-04-28",
            "count": 1
          },
          {
            "date": "2021-06-07",
            "count": 1
          },
          {
            "date": "2021-08-21",
            "count": 1
          },
          {
            "date": "2022-01-27",
            "count": 1
          },
          {
            "date": "2022-01-31",
            "count": 1
          },
          {
            "date": "2022-11-18",
            "count": 1
          },
          {
            "date": "2022-12-01",
            "count": 1
          },
          {
            "date": "2022-12-06",
            "count": 1
          },
          {
            "date": "2023-04-12",
            "count": 1
          },
          {
            "date": "2023-05-14",
            "count": 1
          },
          {
            "date": "2024-07-24",
            "count": 1
          },
          {
            "date": "2024-07-29",
            "count": 1
          },
          {
            "date": "2024-08-11",
            "count": 1
          },
          {
            "date": "2025-02-11",
            "count": 1
          },
          {
            "date": "2025-05-21",
            "count": 1
          },
          {
            "date": "2025-07-16",
            "count": 1
          },
          {
            "date": "2025-08-27",
            "count": 1
          },
          {
            "date": "2025-09-16",
            "count": 1
          },
          {
            "date": "2025-11-02",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 27,
        "total_forks": 27
      },
      "star_history": null,
      "open_issues_and_prs": 18
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "pom.xml",
        "src/it/alternative-secret-keyring/pom.xml",
        "src/it/no-main-artifact/pom.xml",
        "src/it/sign-release-best-practices-fail/pom.xml",
        "src/it/sign-release-best-practices/pom.xml",
        "src/it/sign-release-with-excludes/pom.xml",
        "src/it/sign-release-without-passphrase/pom.xml",
        "src/it/sign-release/pom.xml",
        "src/it/sign-with-passphase-from-maven-settings/pom.xml",
        "src/test/resources/it/sign-release-in-default-dir/pom.xml",
        "src/test/resources/it/sign-release-in-output-dir/pom.xml",
        "src/test/resources/it/sign-release-in-root-dir/pom.xml",
        "src/test/resources/it/sign-release-in-same-dir/pom.xml",
        "src/test/resources/it/sign-release-without-passphrase-interactive/pom.xml"
      ],
      "largest_source_bytes": 21429,
      "source_files_sampled": 20,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "pom.xml"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [
          {
            "name": "org.bouncycastle:bcpg-jdk18on",
            "direct": true,
            "version": "1.81",
            "severity": "high",
            "ecosystem": "maven",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-cj8j-37rh-8475"
            ],
            "fixed_version": "1.84",
            "advisory_count": 1,
            "oldest_advisory_days": 101
          },
          {
            "name": "org.bouncycastle:bcprov-jdk18on",
            "direct": true,
            "version": "1.81",
            "severity": "high",
            "ecosystem": "maven",
            "cvss_score": 7.7,
            "advisory_ids": [
              "GHSA-574f-3g2m-x479",
              "GHSA-c3fc-8qff-9hwx"
            ],
            "fixed_version": "1.84",
            "advisory_count": 2,
            "oldest_advisory_days": 101
          },
          {
            "name": "org.codehaus.plexus:plexus-utils",
            "direct": true,
            "version": "3.6.0",
            "severity": "high",
            "ecosystem": "maven",
            "cvss_score": null,
            "advisory_ids": [
              "GHSA-6fmv-xxpf-w3cw"
            ],
            "fixed_version": "4.0.3",
            "advisory_count": 1,
            "oldest_advisory_days": 124
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 3
        },
        "advisory_count": 4,
        "affected_count": 3,
        "assessed_count": 38,
        "malicious_count": 0,
        "assessed_package": "maven:org.apache.maven.plugins:maven-gpg-plugin@3.2.8",
        "unassessed_count": 0,
        "direct_affected_count": 3
      },
      "ecosystems": [
        "maven"
      ],
      "dependencies": [
        {
          "name": "org.apache.maven.resolver:maven-resolver-util",
          "manifest": "pom.xml",
          "ecosystem": "maven",
          "version_constraint": "${resolverVersion}"
        },
        {
          "name": "org.codehaus.plexus:plexus-utils",
          "manifest": "pom.xml",
          "ecosystem": "maven",
          "version_constraint": "3.6.1"
        },
        {
          "name": "org.bouncycastle:bcpg-jdk18on",
          "manifest": "pom.xml",
          "ecosystem": "maven",
          "version_constraint": "${bouncycastleVersion}"
        },
        {
          "name": "org.bouncycastle:bcprov-jdk18on",
          "manifest": "pom.xml",
          "ecosystem": "maven",
          "version_constraint": "${bouncycastleVersion}"
        },
        {
          "name": "org.bouncycastle:bcutil-jdk18on",
          "manifest": "pom.xml",
          "ecosystem": "maven",
          "version_constraint": "${bouncycastleVersion}"
        },
        {
          "name": "com.kohlschutter.junixsocket:junixsocket-core",
          "manifest": "pom.xml",
          "ecosystem": "maven",
          "version_constraint": "2.10.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "com.kohlschutter.junixsocket:junixsocket-core",
            "direct": true,
            "version": "2.10.1",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.resolver:maven-resolver-util",
            "direct": true,
            "version": "1.9.22",
            "ecosystem": "maven"
          },
          {
            "name": "org.bouncycastle:bcpg-jdk18on",
            "direct": true,
            "version": "1.85",
            "ecosystem": "maven"
          },
          {
            "name": "org.bouncycastle:bcprov-jdk18on",
            "direct": true,
            "version": "1.85",
            "ecosystem": "maven"
          },
          {
            "name": "org.bouncycastle:bcutil-jdk18on",
            "direct": true,
            "version": "1.85",
            "ecosystem": "maven"
          },
          {
            "name": "org.codehaus.plexus:plexus-utils",
            "direct": true,
            "version": "3.6.1",
            "ecosystem": "maven"
          },
          {
            "name": "commons-io:commons-io",
            "direct": false,
            "version": "2.22.0",
            "ecosystem": "maven"
          },
          {
            "name": "javax.inject:javax.inject",
            "direct": false,
            "version": "1",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugin-tools:maven-plugin-annotations",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-compiler-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-compiler-plugin",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-failsafe-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-gpg-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-install-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-install-plugin",
            "direct": false,
            "version": "2.2",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-invoker-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-jar-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-jar-plugin",
            "direct": false,
            "version": "2.1",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-resources-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-resources-plugin",
            "direct": false,
            "version": "2.2",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-source-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-source-plugin",
            "direct": false,
            "version": "2.0.4",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-surefire-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.plugins:maven-surefire-plugin",
            "direct": false,
            "version": "2.3.1",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.resolver:maven-resolver-api",
            "direct": false,
            "version": "1.9.22",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.resolver:maven-resolver-impl",
            "direct": false,
            "version": "1.9.22",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven.shared:maven-invoker",
            "direct": false,
            "version": "3.3.0",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven:maven-artifact",
            "direct": false,
            "version": "3.9.16",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven:maven-core",
            "direct": false,
            "version": "3.9.16",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven:maven-model",
            "direct": false,
            "version": "3.9.16",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven:maven-model-builder",
            "direct": false,
            "version": "3.9.16",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven:maven-plugin-api",
            "direct": false,
            "version": "3.9.16",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven:maven-settings",
            "direct": false,
            "version": "3.9.16",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.maven:maven-settings-builder",
            "direct": false,
            "version": "3.9.16",
            "ecosystem": "maven"
          },
          {
            "name": "org.apache.rat:apache-rat-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.junit.jupiter:junit-jupiter-api",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.junit.jupiter:junit-jupiter-params",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.simplify4u.plugins:pgpverify-maven-plugin",
            "direct": false,
            "version": null,
            "ecosystem": "maven"
          },
          {
            "name": "org.simplify4u.plugins:pgpverify-maven-plugin",
            "direct": false,
            "version": "1.19.1",
            "ecosystem": "maven"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 39,
        "direct_count": 6,
        "indirect_count": 33
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 3,
        "merged_prs": 111,
        "open_issues": 15,
        "closed_ratio": 0.901,
        "closed_issues": 137,
        "closed_unmerged_prs": 63
      },
      "bus_factor": 5,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "cstamas",
          "commits": 50,
          "avatar_url": "https://avatars.githubusercontent.com/u/45165?v=4"
        },
        {
          "type": "User",
          "login": "hboutemy",
          "commits": 44,
          "avatar_url": "https://avatars.githubusercontent.com/u/237462?v=4"
        },
        {
          "type": "User",
          "login": "bentmann",
          "commits": 41,
          "avatar_url": "https://avatars.githubusercontent.com/u/138698?v=4"
        },
        {
          "type": "User",
          "login": "dennisl",
          "commits": 33,
          "avatar_url": "https://avatars.githubusercontent.com/u/541536?v=4"
        },
        {
          "type": "User",
          "login": "khmarbaise",
          "commits": 23,
          "avatar_url": "https://avatars.githubusercontent.com/u/42484?v=4"
        },
        {
          "type": "User",
          "login": "stephenc",
          "commits": 19,
          "avatar_url": "https://avatars.githubusercontent.com/u/209336?v=4"
        },
        {
          "type": "User",
          "login": "elharo",
          "commits": 17,
          "avatar_url": "https://avatars.githubusercontent.com/u/1005544?v=4"
        },
        {
          "type": "User",
          "login": "dkulp",
          "commits": 17,
          "avatar_url": "https://avatars.githubusercontent.com/u/91569?v=4"
        },
        {
          "type": "User",
          "login": "slachiewicz",
          "commits": 16,
          "avatar_url": "https://avatars.githubusercontent.com/u/6705942?v=4"
        },
        {
          "type": "User",
          "login": "rfscholte",
          "commits": 12,
          "avatar_url": "https://avatars.githubusercontent.com/u/150992?v=4"
        }
      ],
      "contributors_sampled": 35,
      "top_contributor_share": 0.145
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "maven-verify.yml",
        "pr-automation.yml",
        "release-drafter.yml",
        "stale.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 0,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 9,
            "reason": "26 out of 27 merged PRs checked by a CI test -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 7,
            "reason": "Found 9/12 approved changesets -- score normalized to 7",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 43 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 9,
            "reason": "10 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 10,
            "reason": "0 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "e40ebf8652badf57f60e849b7b8f66e751011b65",
        "ran_at": "2026-07-28T14:11:42Z",
        "aggregate_score": 5.8,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-28T04:20:40Z",
      "oldest_open_prs": [
        {
          "number": 43,
          "created_at": "2023-04-12T03:02:24Z",
          "last_comment_at": "2024-08-14T12:28:35Z",
          "last_comment_author": "cstamas"
        },
        {
          "number": 324,
          "created_at": "2026-07-09T04:08:45Z",
          "last_comment_at": "2026-07-11T23:11:15Z",
          "last_comment_author": "slachiewicz"
        },
        {
          "number": 327,
          "created_at": "2026-07-14T18:22:26Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-15T05:29:58Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 233,
          "created_at": "2020-04-29T08:23:24Z",
          "last_comment_at": "2024-03-04T12:34:59Z",
          "last_comment_author": "jira-importer"
        },
        {
          "number": 232,
          "created_at": "2021-12-15T08:39:00Z",
          "last_comment_at": "2023-05-03T01:15:37Z",
          "last_comment_author": "jira-importer"
        },
        {
          "number": 160,
          "created_at": "2022-08-19T08:32:01Z",
          "last_comment_at": "2024-03-15T08:09:55Z",
          "last_comment_author": "jira-importer"
        },
        {
          "number": 229,
          "created_at": "2022-11-08T14:17:46Z",
          "last_comment_at": "2024-10-29T08:53:23Z",
          "last_comment_author": "jira-importer"
        },
        {
          "number": 251,
          "created_at": "2022-12-16T20:37:13Z",
          "last_comment_at": "2024-03-04T12:33:10Z",
          "last_comment_author": "jira-importer"
        },
        {
          "number": 272,
          "created_at": "2024-03-30T10:51:00Z",
          "last_comment_at": "2024-08-07T15:29:16Z",
          "last_comment_author": "jira-importer"
        },
        {
          "number": 265,
          "created_at": "2024-07-23T22:04:31Z",
          "last_comment_at": "2024-08-08T18:52:57Z",
          "last_comment_author": "jira-importer"
        },
        {
          "number": 281,
          "created_at": "2024-08-15T04:25:07Z",
          "last_comment_at": "2024-09-24T11:03:43Z",
          "last_comment_author": "jira-importer"
        },
        {
          "number": 276,
          "created_at": "2024-09-24T12:51:08Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 279,
          "created_at": "2024-09-28T11:20:35Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 137,
          "created_at": "2025-05-27T01:34:57Z",
          "last_comment_at": "2025-09-06T20:05:37Z",
          "last_comment_author": "cstamas"
        },
        {
          "number": 296,
          "created_at": "2025-09-15T10:54:41Z",
          "last_comment_at": "2025-09-15T10:56:28Z",
          "last_comment_author": "kwin"
        },
        {
          "number": 303,
          "created_at": "2025-11-26T11:10:02Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 307,
          "created_at": "2025-12-01T22:10:18Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 322,
          "created_at": "2026-06-03T05:38:26Z",
          "last_comment_at": "2026-06-05T15:54:04Z",
          "last_comment_author": "cstamas"
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/apache/maven-gpg-plugin",
    "host": "github.com",
    "name": "maven-gpg-plugin",
    "owner": "apache"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 66,
      "inputs": {
        "security": 59,
        "vitality": 60,
        "community": 56,
        "governance": 84,
        "engineering": 66
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 60,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "commits_last_year": 23,
              "human_commit_share": 0.68,
              "days_since_last_push": 13,
              "active_weeks_last_year": 14
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 13 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 13
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "14/52 weeks with commits",
                "points": 9.7,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 14
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "23 commits in the last year",
                "points": 12.4,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 23
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "10 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 9",
                "points": 9,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "moderate",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "releases_count": 9,
              "latest_release_tag": "maven-gpg-plugin-3.2.8",
              "releases_from_tags": false,
              "days_since_latest_release": 391,
              "mean_days_between_releases": 59.7
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "9 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 391 days ago",
                "points": 7.2,
                "status": "partial",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 391
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~59.7 days",
                "points": 19.8,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 59.7
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 16,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 16 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 16
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "moderate",
        "name": "Community & Adoption",
        "value": 56,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "at_risk",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 42,
            "inputs": {
              "forks": 27,
              "stars": 30,
              "watchers": 19,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "30 stars",
                "points": 23.7,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 30
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "27 forks",
                "points": 11.8,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 27
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "19 watchers",
                "points": 7,
                "status": "partial",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 19
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 72,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "good",
        "name": "Sustainability & Governance",
        "value": 84,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "excellent",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 89,
            "inputs": {
              "bus_factor": 5,
              "contributors_sampled": 35,
              "top_contributor_share": 0.145
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "5 contributor(s) cover half of all commits",
                "points": 45.9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 14% of commits",
                "points": 19.2,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 14
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "35 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 35
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 43 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 77,
            "inputs": {
              "merged_prs": 111,
              "open_issues": 15,
              "closed_issues": 137,
              "issue_closed_ratio": 0.901,
              "closed_unmerged_prs": 63
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "90% of issues closed",
                "points": 42.1,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 90
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "111/174 decided PRs merged",
                "points": 24.4,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 111,
                      "decided": 174
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 9/12 approved changesets -- score normalized to 7",
                "points": 10.5,
                "status": "partial",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "followers": 23594,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "apache",
              "public_repos": 3148,
              "account_age_days": 6400
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "23,594 followers of apache",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 23594,
                      "login": "apache"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "3148 public repos, account ~17 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 3148
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 17
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 91,
            "inputs": {
              "packages": [
                "org.apache.maven.plugins:maven-gpg-plugin"
              ],
              "ecosystems": "maven",
              "any_deprecated": false,
              "min_days_since_publish": 269
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on maven",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "maven"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 269 days ago",
                "points": 26,
                "status": "partial",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 269
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "21 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 21
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 66,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "26 out of 27 merged PRs checked by a CI test -- score normalized to 9",
                "points": 18,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [
                "java",
                "build-management",
                "maven",
                "maven-plugins",
                "maven-gpg-plugin"
              ],
              "has_wiki": false,
              "homepage": "https://maven.apache.org/plugins/maven-gpg-plugin/",
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://maven.apache.org/plugins/maven-gpg-plugin/",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "5 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 59,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 58,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 5.8
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "26 out of 27 merged PRs checked by a CI test -- score normalized to 9",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 9/12 approved changesets -- score normalized to 7",
                "points": 5.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 43 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "10 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 9",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "0 existing vulnerabilities detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "moderate",
            "name": "Dependency advisories",
            "note": "Matched the maven:org.apache.maven.plugins:maven-gpg-plugin@3.2.8 runtime dependency closure — what installing the published package pulls in — 38 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "maven:org.apache.maven.plugins:maven-gpg-plugin@3.2.8",
                  "assessed": 38
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 61,
            "inputs": {
              "source": "osv",
              "advisories": 4,
              "affected_packages": 3,
              "assessed_packages": 38,
              "unassessed_packages": 0,
              "affected_by_severity": "high 3",
              "direct_affected_packages": 3
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "3 affected: org.bouncycastle:bcpg-jdk18on 1.81 (high 7.5), org.bouncycastle:bcprov-jdk18on 1.81 (high 7.7), org.codehaus.plexus:plexus-utils 3.6.0 (high)",
                "points": 9.9,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 3,
                      "packages": "org.bouncycastle:bcpg-jdk18on 1.81 (high 7.5), org.bouncycastle:bcprov-jdk18on 1.81 (high 7.7), org.codehaus.plexus:plexus-utils 3.6.0 (high)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "3 advisory-carrying package(s) unaddressed past 90 days; oldest published 124 days ago",
                "points": 25.7,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_stale",
                    "params": {
                      "days": 90,
                      "count": 3,
                      "oldest": 124
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 38,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 17
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 53,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "critical",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 29,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.544,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "37 of 68 human commits state their intent (structured subject or explanatory body)",
                "points": 29,
                "status": "partial",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 37,
                      "sampled": 68
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "pom.xml",
                "src/it/alternative-secret-keyring/pom.xml",
                "src/it/no-main-artifact/pom.xml",
                "src/it/sign-release-best-practices-fail/pom.xml",
                "src/it/sign-release-best-practices/pom.xml",
                "src/it/sign-release-with-excludes/pom.xml",
                "src/it/sign-release-without-passphrase/pom.xml",
                "src/it/sign-release/pom.xml",
                "src/it/sign-with-passphase-from-maven-settings/pom.xml",
                "src/test/resources/it/sign-release-in-default-dir/pom.xml",
                "src/test/resources/it/sign-release-in-output-dir/pom.xml",
                "src/test/resources/it/sign-release-in-root-dir/pom.xml",
                "src/test/resources/it/sign-release-in-same-dir/pom.xml",
                "src/test/resources/it/sign-release-without-passphrase-interactive/pom.xml"
              ],
              "dependency_bot_commit_share": 0.32
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "pom.xml, src/it/alternative-secret-keyring/pom.xml, src/it/no-main-artifact/pom.xml (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "pom.xml, src/it/alternative-secret-keyring/pom.xml, src/it/no-main-artifact/pom.xml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Java (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Java"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "32 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 32,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Java",
              "largest_source_bytes": 21429,
              "source_files_sampled": 20,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Java (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Java"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/20 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 20,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-28T14:12:22.168692Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/apache/maven-gpg-plugin.svg",
  "full_name": "apache/maven-gpg-plugin",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}