sabamdarif/chroot-distro tiene un índice de salud de 75 sobre 100, lo que lo sitúa en la banda Bueno. Su puntuación más alta es Vitality (94/100) y la más baja, Security (45/100). Se actualizó por última vez hoy. Una sola persona concentra la mayor parte del trabajo reciente.
75
global / 100
Bueno
Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala estandarizada de 1 a 100. El resultado global parte de su media ponderada, calibrada contra la distribución del registro público para que las bandas tengan significado percentil; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe un límite «En riesgo» de 34.
75
Excepcional93-100El nivel más alto del registro (≈ el 5% superior); cumple prácticamente todos los criterios evaluados
Excelente80-92Sólido en todos los frentes; carencias menores
Bueno65-79Saludable; carencias limitadas y manejables
Moderado50-64Aceptable con carencias notables; se recomienda revisión
Débil35-49Debilidades sustanciales en varias áreas
En riesgo20-34Debilidades significativas; su adopción exige cautela
Crítico1-19Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
El resultado global ponderado 65 se calibra a 75 en la escala publicada del índice (calibración del registro 2026-08-02).
255 seguidores45 repositorios públicosdesde ago 2022
Este repositorio pertenece a una cuenta personal. Un proyecto con un único propietario conlleva más riesgo de continuidad que uno respaldado por una organización.
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Tiene un peso deliberadamente pequeño (4%): las herramientas para agentes son una señal real de mantenimiento, pero un repositorio sin ninguna puede alcanzar igualmente 100/100.
Código verificable por tipos — Python con configuración de verificación de tipos (src/chroot_distro/py.typed)
55/55
Tamaños de archivo manejables — 0/175 archivos fuente de más de 60 KB
Datos de entrada utilizados
primary_language
Python
largest_source_bytes
58.471
source_files_sampled
175
oversized_source_files
0
Datos clave
125estrellas de GitHub
7contribuidores
668commits en los últimos 12 meses
0días desde el último push
68versiones publicadas
1factor bus
2issues abiertas
PyPIecosistemas de paquetes
Advertencias de recopilación de datos
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
deps.dev does not index pypi:chroot-distro@2.8.2; advisories assessed against the repository dependency graph instead
Más detalle
Historial de estrellas y forks 0 ★ / 17 ⇿
0Estrellas
17Forks
51Versiones
Cuándo se añadió cada estrella y fork, recopilado de GitHub y agrupado por día. El crecimiento acumulado se sitúa justo encima de las adiciones diarias que lo componen, de modo que ambos se leen en conjunto: la acumulación orgánica sostenida no se parece en nada a un pico abrupto y efímero. Cuando esa diferencia es medible, se informa como autenticidad del crecimiento.
Mayor 1Menor 6Parche 31
OpenSSF Scorecard 4.5 / 10
4.5agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).Scorecard v5.5.0 · 2026-08-01 16:59 UTC
No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [
"chroot",
"chroot-distro",
"android",
"termux",
"docker",
"docker-container",
"dockerhub",
"linux",
"linux-containers"
],
"is_fork": false,
"size_kb": 2492,
"has_wiki": true,
"homepage": "https://pypi.org/project/chroot-distro/",
"languages": {
"Shell": 34998,
"Python": 1435954
},
"pushed_at": "2026-08-01T16:56:35Z",
"created_at": "2025-08-06T15:32:57Z",
"owner_type": "User",
"updated_at": "2026-08-01T16:55:39Z",
"description": "A lightweight chroot based utility for managing Linux containers",
"is_archived": false,
"is_disabled": false,
"license_spdx": "GPL-3.0",
"default_branch": "main",
"license_spdx_raw": "GPL-3.0",
"primary_language": "Python",
"significant_languages": [
"Python"
]
},
"owner": {
"blog": null,
"name": "Md Arif",
"type": "User",
"login": "sabamdarif",
"company": null,
"location": "world",
"followers": 255,
"avatar_url": "https://avatars.githubusercontent.com/u/111168803?v=4",
"created_at": "2022-08-13T05:20:00Z",
"is_verified": null,
"public_repos": 45,
"account_age_days": 1449
},
"license": {
"state": "standard",
"spdx_id": "GPL-3.0",
"raw_spdx": "GPL-3.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v2.8.2",
"kind": "patch",
"published_at": "2026-08-01T16:57:35Z"
},
{
"tag": "v2.8.1",
"kind": "patch",
"published_at": "2026-07-29T14:55:28Z"
},
{
"tag": "v2.8.0",
"kind": "minor",
"published_at": "2026-07-29T11:27:44Z"
},
{
"tag": "v2.7.0",
"kind": "minor",
"published_at": "2026-07-21T14:24:20Z"
},
{
"tag": "v2.6.0",
"kind": "minor",
"published_at": "2026-07-15T16:43:43Z"
},
{
"tag": "v2.5.3",
"kind": "patch",
"published_at": "2026-07-07T07:26:14Z"
},
{
"tag": "v2.5.2",
"kind": "patch",
"published_at": "2026-07-06T16:55:45Z"
},
{
"tag": "v2.5.1",
"kind": "patch",
"published_at": "2026-07-05T17:31:18Z"
},
{
"tag": "v2.5.0",
"kind": "minor",
"published_at": "2026-07-05T10:47:38Z"
},
{
"tag": "v2.4.2",
"kind": "patch",
"published_at": "2026-06-28T14:52:09Z"
},
{
"tag": "v2.4.1",
"kind": "patch",
"published_at": "2026-06-23T14:04:57Z"
},
{
"tag": "v2.4.0",
"kind": "minor",
"published_at": "2026-06-23T08:27:12Z"
},
{
"tag": "v2.3.1",
"kind": "patch",
"published_at": "2026-06-21T15:54:47Z"
},
{
"tag": "v2.3.0",
"kind": "minor",
"published_at": "2026-06-20T09:37:49Z"
},
{
"tag": "v2.2.1",
"kind": "patch",
"published_at": "2026-06-18T16:45:35Z"
},
{
"tag": "v2.2.0",
"kind": "minor",
"published_at": "2026-06-17T17:29:54Z"
},
{
"tag": "v2.1.4",
"kind": "patch",
"published_at": "2026-06-16T16:28:33Z"
},
{
"tag": "v2.1.3",
"kind": "patch",
"published_at": "2026-06-15T17:24:37Z"
},
{
"tag": "v2.1.2",
"kind": "patch",
"published_at": "2026-06-14T15:52:53Z"
},
{
"tag": "v2.1.1",
"kind": "patch",
"published_at": "2026-06-12T11:05:37Z"
},
{
"tag": "v2.1.0",
"kind": "minor",
"published_at": "2026-06-11T08:15:26Z"
},
{
"tag": "v2.0.9",
"kind": "patch",
"published_at": "2026-06-10T16:37:13Z"
},
{
"tag": "v2.0.8",
"kind": "patch",
"published_at": "2026-06-09T11:13:54Z"
},
{
"tag": "v2.0.7",
"kind": "patch",
"published_at": "2026-06-07T17:27:34Z"
},
{
"tag": "v2.0.6",
"kind": "patch",
"published_at": "2026-06-07T11:39:46Z"
},
{
"tag": "v2.0.5",
"kind": "patch",
"published_at": "2026-06-06T20:43:32Z"
},
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2026-06-04T07:54:31Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2026-06-03T11:41:53Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2026-06-02T13:02:20Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2026-05-31T20:13:54Z"
},
{
"tag": "1.5.6",
"kind": "patch",
"published_at": "2026-04-27T06:57:53Z"
},
{
"tag": "1.5.5",
"kind": "patch",
"published_at": "2026-03-28T19:06:40Z"
},
{
"tag": "1.5.4",
"kind": "patch",
"published_at": "2026-03-04T15:40:20Z"
},
{
"tag": "1.5.3",
"kind": "patch",
"published_at": "2026-02-21T18:31:19Z"
},
{
"tag": "1.5.2",
"kind": "patch",
"published_at": "2026-02-15T18:16:33Z"
},
{
"tag": "rocky",
"kind": "other",
"published_at": "2026-02-15T07:20:50Z"
},
{
"tag": "1.5.1",
"kind": "patch",
"published_at": "2026-02-11T18:35:39Z"
},
{
"tag": "1.5.0",
"kind": "minor",
"published_at": "2026-02-06T14:22:24Z"
},
{
"tag": "void",
"kind": "other",
"published_at": "2026-02-06T08:56:55Z"
},
{
"tag": "trisquel",
"kind": "other",
"published_at": "2026-02-06T08:56:49Z"
},
{
"tag": "rockylinux",
"kind": "other",
"published_at": "2026-02-06T08:56:43Z"
},
{
"tag": "opensuse",
"kind": "other",
"published_at": "2026-02-06T08:56:38Z"
},
{
"tag": "manjaro",
"kind": "other",
"published_at": "2026-02-06T08:56:33Z"
},
{
"tag": "alpine",
"kind": "other",
"published_at": "2026-02-06T08:56:25Z"
},
{
"tag": "ubuntu",
"kind": "other",
"published_at": "2026-02-05T20:26:19Z"
},
{
"tag": "kali",
"kind": "other",
"published_at": "2026-02-05T20:26:13Z"
},
{
"tag": "fedora",
"kind": "other",
"published_at": "2026-02-05T20:26:02Z"
},
{
"tag": "debian",
"kind": "other",
"published_at": "2026-02-05T20:25:58Z"
},
{
"tag": "archlinux",
"kind": "other",
"published_at": "2026-02-05T20:25:53Z"
},
{
"tag": "1.4.9",
"kind": "patch",
"published_at": "2026-02-05T13:53:28Z"
},
{
"tag": "1.4.8",
"kind": "patch",
"published_at": "2026-02-04T08:35:42Z"
},
{
"tag": "1.4.7",
"kind": "patch",
"published_at": "2025-12-29T07:01:20Z"
},
{
"tag": "1.4.6",
"kind": "patch",
"published_at": "2025-12-03T17:46:16Z"
},
{
"tag": "1.4.5",
"kind": "patch",
"published_at": "2025-11-13T10:01:50Z"
},
{
"tag": "1.4.4",
"kind": "patch",
"published_at": "2025-11-10T15:37:42Z"
},
{
"tag": "1.4.3",
"kind": "patch",
"published_at": "2025-10-12T17:52:11Z"
},
{
"tag": "1.4.2",
"kind": "patch",
"published_at": "2025-09-14T06:14:23Z"
},
{
"tag": "1.4.1",
"kind": "patch",
"published_at": "2025-08-30T07:28:04Z"
},
{
"tag": "distro",
"kind": "other",
"published_at": "2025-08-31T05:06:17Z"
},
{
"tag": "1.4",
"kind": "other",
"published_at": "2025-08-18T06:37:27Z"
},
{
"tag": "1.3",
"kind": "other",
"published_at": "2025-08-15T10:09:51Z"
},
{
"tag": "1.1.2",
"kind": "patch",
"published_at": "2025-08-14T04:31:22Z"
},
{
"tag": "1.1.1",
"kind": "patch",
"published_at": "2025-08-13T17:34:21Z"
},
{
"tag": "1.1",
"kind": "other",
"published_at": "2025-08-11T15:32:40Z"
},
{
"tag": "1.0.1",
"kind": "patch",
"published_at": "2025-08-09T10:31:38Z"
},
{
"tag": "1.0",
"kind": "other",
"published_at": "2025-08-08T07:55:04Z"
},
{
"tag": "1.0-beta2",
"kind": "other",
"published_at": "2025-08-07T08:10:16Z"
},
{
"tag": "1.0-beta",
"kind": "other",
"published_at": "2025-08-06T16:56:40Z"
}
],
"recent_commits": [
{
"oid": "821c623123cd8c537a9e0c81cdfd212db14d45fc",
"body": null,
"is_bot": false,
"headline": "release: 2.8.2",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-08-01T16:55:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dd71a27ae99aa3bf2c5e74a57199a259e0d29ab4",
"body": "Two ways a login rewrote the host's /dev/pts until reboot, breaking\nsshd's pty setup (\"Connection closed by remote host\" on every new\nconnection; confirmed on 4.4 and 3.4 devices and on a desktop host):\n\n- Single-instance devpts kernels (< 4.7 without\n CONFIG_DEVPTS_MULTIPLE_INSTANCES) have one sup\n[…]\nind propagated a copy of itself onto the host /dev/pts (a peer of\n the bind). Make the covered mount private before stacking, and stop\n send-propagation from the /dev bind right after it is created.",
"is_bot": false,
"headline": "fix: never let container devpts mounts alter the host /dev/pts",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-31T10:49:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a487a04752f639b004073f780e11cec9942a1169",
"body": "Vendor kernels can reject individual bind mounts (file bind -> EINVAL on\nkernel 3.4.112), and a single failed cosmetic bind like /property_contexts\nkilled the whole login. Classify system files, dalvik caches, storage and\nTermux app dirs as best-effort: warn and skip on failure, keep /dev, /sys,\n/da\n[…]\nhe three duplicated mount loops\n(login, max_isolation_session, namespace_session)\n- tests: old-kernel fault-injection matrix (EINVAL bind skip, required\nbind still fatal, tmpfs option-reject fallback)",
"is_bot": false,
"headline": "fix: skip failing Android integration binds instead of aborting login",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-30T15:03:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "71897a466104cf636e3c13e546f0d39e08adabed",
"body": "… errors\n\nOn kernels < 4.7 without CONFIG_DEVPTS_MULTIPLE_INSTANCES, devpts is a\nsingle global instance: 'newinstance' is ignored and stacking it on the\nhost /dev/pts bind fails with EBUSY, aborting every login. Reuse the\ninstance already mounted at the target instead (it is the only one then\nkernel\n[…]\ngets: lazy detach\nat debug level instead of a warning on every logout\n- info: CONFIG_DEVPTS_MULTIPLE_INSTANCES row backed by a runtime mount\nprobe (vendor config.gz has been seen contradicting itself)",
"is_bot": false,
"headline": "fix: log in on single-instance devpts kernels and report true syscall…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-30T09:59:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b98e0fc1ea04882cb0551baaa2bcb87fd68143cb",
"body": null,
"is_bot": false,
"headline": "release: 2.8.1",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-29T14:51:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88a4cf8bde823a667daa8e39a1a69945cf245969",
"body": null,
"is_bot": false,
"headline": "docs: rewrite README for simplicity",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-29T14:50:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d07d7daf52834d325849d1540d56c39f419dd409",
"body": "…anup",
"is_bot": false,
"headline": "build: switch build backend from hatchling to setuptools and some cle…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-29T13:34:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "718b7619e29a4ce7e65d4a6d9dfabc6ead4a9bc3",
"body": null,
"is_bot": false,
"headline": "ci: remove CodeQL workflow and config",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-29T11:33:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b23433d7cc4984dfe5ec38b063ad29610de1d97a",
"body": null,
"is_bot": false,
"headline": "release: 2.8.0",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-29T11:25:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "da29a9dbf6e5cda8f54a24eca4be3405ab41ede1",
"body": null,
"is_bot": false,
"headline": "perf(login): cut Termux login/exit from ~6s to ~1s",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-29T11:22:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "22854d56726928d3414a75947cccb1aec811e691",
"body": null,
"is_bot": false,
"headline": "docs: shorten comments across restore, login, and info",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-29T10:24:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1878b032304d7e4d66110c69e65f7d08007a31c7",
"body": null,
"is_bot": false,
"headline": "fix(login): make --get-chroot-cmd output copy-pasteable",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-29T07:38:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11055e5323fb316497a4d75f4af79d7986264e0f",
"body": null,
"is_bot": false,
"headline": "release: 2.7.0",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-21T14:21:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbf5c398c004235c211ec273f5de5d3d1cd740c1",
"body": "… questions",
"is_bot": false,
"headline": "ci: add GitHub issue templates for bug reports, feature requests, and…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-21T14:16:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "186722ade31dc2f729523b2a3e72e92abf862ecc",
"body": "Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7.\n- [Release notes](https://github.com/actions/setup-python/releases)\n- [Commits](https://github.com/actions/setup-python/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-python\n dependency-version: '7'\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/setup-python from 6 to 7",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-20T06:59:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8990829c585be6119f27931a8edc291bac24389",
"body": "…ss reporters\n\n- RUN --mount type=bind/cache/tmpfs/secret/ssh with sharing modes;\n unsupported RUN flags rejected with line numbers (no silent ignore)\n- COPY --parents with /./ pivot; COPY/ADD flag whitelist\n- CD_USE_NS: namespace-only build isolation (holder not chrooted);\n CD_USE_ISOLATION wins \n[…]\nuto,plain,tty,rawjson} reporters\n- CLI: --secret id=NAME[,src=PATH], --ssh ID[=SOCK]\n- Advanced multi-stage build E2E test in CI (cache mounts, secrets,\n --build-arg invalidation, CACHED layer reuse)",
"is_bot": false,
"headline": "feat(build): RUN --mount, COPY --parents, CD_USE_NS isolation, progre…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-16T20:10:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "af7becfd88743e0fa3318eda82355007ea2ebc91",
"body": "Add unit tests for previously-uncovered pure logic and syscall wrappers,\nreaching the security-critical modules without requiring root:\n\n- syscalls: mount/umount/capabilities 100%, nsenter 56%, idmap 50%,\n chroot 33%, max_iso_holder 56% (pure fns, mocked libc, real fork paths)\n- build_engine parsin\n[…]\ncache, restore dest-path\n parser, install ref helpers, docker platform picker, nvidia lib remap,\n mount_manager parsers, isolation decisions, tar_extract safe-resolve,\n info.py formatters, __main__",
"is_bot": false,
"headline": "test: raise coverage 47%->52%, focus on syscall/security core",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-16T10:07:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c07d1a49352bf5b1509ea39bedcf4a89069adf81",
"body": "chroot-distro install alpine debian ubuntu\nchroot-distro remove alpine debian ubuntu\n\nPositionals are now nargs=\"*\"; handlers loop over targets. --name is\nrejected with multiple images. Internal single-string callers (reset,\nbuild) pass through unchanged.",
"is_bot": false,
"headline": "feat: install/remove multiple containers in one command",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-16T07:12:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9165102fd7796a427e96c4bd4e4927d8946f56a",
"body": null,
"is_bot": false,
"headline": "release: 2.6.0",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-15T16:42:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70675605f165bd1fff38a0350fe9d9ed1fccd28c",
"body": "treat \"rootfs exists + marker present\" as an interrupted install to wipe and redo automatically",
"is_bot": false,
"headline": "fix: don't mark corrupted distro install as installed",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-15T16:39:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81c867c8d3e3d70e33de02307a1dd3ae19e6ace1",
"body": "…ded holders\n\nTwo problems around \"container 'x' is busy\" after a Ctrl+Z'd install:\n\n1. _FlockBase.acquire() opened the lock file with mode \"w\", which\n truncates *before* the flock attempt. Every conflicting acquire\n therefore wiped the holder's \"PID command\" diagnostic line, so\n read_lock_inf\n[…]\nerminate (kill) it.\n\nThe busy error now reads e.g.:\n container 'ubuntu' is busy (PID 1234: install — suspended, e.g. by\n Ctrl+Z; resume it with 'kill -CONT 1234' or terminate it with\n 'kill 1234').",
"is_bot": false,
"headline": "fix(locking): stop truncating the lock file on conflict + name suspen…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-15T08:22:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6ce45c2504f7f519a915cd2765912fb95a494d97",
"body": "Pressing Ctrl+C during a layer/archive download frequently did nothing\n(the ^C^C^C wall): the SIGINT handler called resp.close() on in-flight\nresponses, but HTTPResponse.close() needs the BufferedReader's internal\nbuffer lock — held, uninterruptibly at the C level, by the worker thread\nblocked insid\n[…]\n install's KeyboardInterrupt path exits with os._exit() after\n cleanup: sys.exit() ran the concurrent.futures atexit hook, joining\n worker threads that could each block up to the 30s socket timeout.",
"is_bot": false,
"headline": "fix(download): make Ctrl+C actually cancel in-flight downloads",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-15T08:21:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "873ed7a5ba2409575bc7179863bb7178b584148e",
"body": "…iering\n\nRoot-run `--isolated` never created a user namespace: probe_and_report_namespaces\ndeliberately stripped CLONE_NEWUSER for uid 0, so container root held the full\nhost capability set. Enabling CLONE_NEWUSER naively\nbroke all mounts. This wires up a tiered, runtime-probed user namespace that\nk\n[…]\nd-rootfs holder integration — no regression.\n- Tests: unit coverage for tiering, sysfs/dev handling, setgroups, warnings;\n E2E workflow checks for uid mapping, capability confinement, file ownership.",
"is_bot": false,
"headline": "feat(isolation): enable user-namespace isolation as root + graceful t…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-14T14:58:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "40cccd9b0b56722c7080312a9c8c603e756188bf",
"body": "All five py/overly-permissive-file alerts flag permissions that are\nintentional and required; tightening them would break functionality.\nAdd justifying comments and inline lgtm suppressions instead.\n\n- setup.py _write (0o644): init service/socket unit files must be\n readable by the init daemon\n- da\n[…]\nd mode for /tmp\n- atomic.py (caller-supplied mode): generic helper only applies the\n destination mode the caller chose\n- setup.py /etc/group (0o644): must stay world-readable for name/id\n resolution",
"is_bot": false,
"headline": "fix: suppress false-positive CodeQL overly-permissive-file findings",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-12T10:19:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a1b0568286eddba839dfaceb87c20e3f95422cf1",
"body": "…ATION\n\nExtract the maximum-isolation setup into a single shared helper\n(helpers/isolation.py) so login, run, and build apply the identical\nnamespace + chroot technology instead of each reimplementing it.\n\n- New CD_USE_ISOLATION env var forces maximum isolation on (env-var\n equivalent of --isolated\n[…]\nnever\n chroot and left the chroot /proc/1/root escape open.\n- build writes the container's resolv.conf under isolation so package\n installs keep DNS. Documented the env var in help pages and README.",
"is_bot": false,
"headline": "refactor(isolation): centralize namespace isolation + add CD_USE_ISOL…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-11T06:50:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7338213f1be246ee53fafd509218f6f39b0d15c7",
"body": "Worker threads block in resp.read(); the socket force-close registry\nexisted only within a single layer's segmented download, so multi-layer\npulls only aborted between reads or at the 30s socket timeout.\n\nShare a _LiveResponses registry across the layer pool with a SIGINT\nhandler that force-closes e\n[…]\nal connections track the worker budget. Log when a layer falls back\nto a single connection so the user understands why extra workers do not\nincrease speed on registries without ranged-request support.",
"is_bot": false,
"headline": "fix(download): make Ctrl+C cancel immediately and clarify worker scaling",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-10T20:55:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "36b0cfb15620ef8b66477ae58da681e9b55b4b72",
"body": "The /proc scan returns every process sharing a container's rootfs, but\nthe registry only records the top-level login PID, so descendants (e.g.\na browser's helpers) were flagged untracked. Chromium double-forks its\nhelpers, reparenting them to init, so a parent-chain walk alone can't\nreattach them.\n\n\n[…]\nalready has a\nlive tracked session; only containers with no session at all can have\ngenuine orphans, where an ancestry check (read_ppid/has_tracked_ancestor)\nstill filters descendants of tracked PIDs.",
"is_bot": false,
"headline": "fix(ps): stop reporting a tracked container's children as untracked",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-10T20:55:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bc9440fb00c8f2757b01f3a797d79ca3d2b79ac2",
"body": "diff hard-aborted when any raw image layer tar was missing, but\nclear-cache wipes exactly that cache directory. The reconstructed\nbaseline persisted next to the container survives clear-cache and is\nsufficient to diff, yet the layer-existence gate ran before consulting\nit.\n\nAdd baseline_cache_is_valid() and only require the raw layer blobs when\nno valid baseline exists.",
"is_bot": false,
"headline": "fix(diff): keep diff working after clear-cache via persisted baseline",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-10T20:54:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b62ac6e5a9cb3375f2219b4eb12f5d6845fa596",
"body": "…uard\n\nClose the remaining image-config integration gaps for run/login:\n\n- run: add --entrypoint to replace the image Entrypoint (Docker semantics:\n Cmd cleared, trailing -- args become the new arguments).\n- Add CD_ENTRYPOINT/CD_USER/CD_WORKDIR/CD_ENV env vars as equivalents to\n the override flags\n[…]\n\n layered before --env so a matching --env still wins.\n- Document the new flag/env vars in README and shell completions.\n- Add tests/unit/test_run.py; extend test_parser.py and test_login_helpers.py.",
"is_bot": false,
"headline": "feat(run): add --entrypoint override, CD_* env vars, and shell-form g…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-10T15:40:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0e0e35fc577b853c07b13b2ab6160861fa314f34",
"body": "Squash of diagnostic improvements, exception handling refactoring, and Termux privilege auto-elevation.\n\n- **Dynamic Root Elevation on Termux**:\n - Implemented `is_root_available()` to verify active root privileges, file capabilities, `su` (Termux), or Linux escalation tools/daemon socket availabil\n[…]\nntation**:\n - Updated `README.md` and command help text to document the new `info` elevation behavior.\n - Added full unit test coverage for `is_root_available()` and the updated capabilities checks.",
"is_bot": false,
"headline": "refactor(info): improve kernel diagnostics and error handling robustness",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-07T19:28:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2e1033aa54bccf5d93c8bebc8da13daa81274e38",
"body": "…ful degradation\n\nReplace the 3-branch IS_TERMUX/non-Termux namespace check that either\nrefused to start or silently disabled isolation with a tiered\nprobe-warn-proceed system that works on all platforms equally.\n\nKey changes:\n- Tiered namespace flags: only mount NS is mandatory; PID/UTS/IPC are\n r\n[…]\nnd nsenter.py, before the host filesystem becomes\n inaccessible\n- Remove the redundant user namespace uid_map check from E2E\n workflows, since user namespaces are skipped for root (sudo) by\n design",
"is_bot": false,
"headline": "refactor(isolation): replace all-or-nothing namespace gate with grace…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-07T18:09:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d83ccb1f4af3b4cf2b7ba3220f7b086d341949b5",
"body": null,
"is_bot": false,
"headline": "release: 2.5.3",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-07T07:24:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d6a6f4fdcc6eac0bd3314e2a0b776b4f04cf8af5",
"body": "- Warn when listing containers fails due to permission denied\n(EACCES/EPERM) in list command and path helpers.\n- Emit warnings in locking module when creating lock directory or file\nfails, instead of silently proceeding unlocked.\n- Add warnings in session registry for folder creation, write, and flock\nfailures to improve debuggability.\n- Add corresponding unit tests to verify warning outputs and mock OS\nerrors.\n- Ensure all static checks and pytest unit tests pass cleanly.",
"is_bot": false,
"headline": "refactor: add better error and warning reporting on failures",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-07T07:19:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b09fb9b3959eb864312c2600d0c69693535e117a",
"body": "Foreground commands executed via `run` (e.g., interactive shells) were\npreviously spawned directly as the namespace holder process without a\nPTY. This left the child processes without a controlling terminal,\ncausing \"Inappropriate ioctl for device\" errors and disabling job\ncontrol.",
"is_bot": false,
"headline": "fix: allocate PTY for foreground holder commands in `run`",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-06T19:07:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a5ae89d1c8725b3aaf46bc2c2d0886a933d3706",
"body": "Removed the unnecessary `enable_docker_cgroup` parameter and the\n`_docker_cgroup_specials` helper function.\n\nMounting legacy cgroups v1 controllers (`devices`, `cpuset`) on Android\nvia Termux is insufficient to make Docker functional out-of-the-box due\nto broader kernel, namespace, and storage driver requirements. Removing\nthese mounts simplifies the login/mount configuration.",
"is_bot": false,
"headline": "refactor(login): remove legacy Docker cgroup mounts on Termux",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-06T18:39:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fea48cb29470974a5889876dee9c9ad519de4b36",
"body": null,
"is_bot": false,
"headline": "release: 2.5.2",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-06T16:54:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18fdcbc1942a81ff998872f69c8c973b1a469289",
"body": "…phan detection\n\n- fix(chroot): allocate a fresh PTY via os.openpty() in the native\n fork path (chroot_and_exec/chroot_and_run) so the child gets its own\n controlling terminal with proper job control. Parent runs a raw-mode\n relay loop (like script(1)/pty.spawn()) forwarding data between the\n or\n[…]\nrocess count) instead of one row per PID.\n\n- refactor: add installed_containers() to paths.py and\n containers_with_active_pids() to session_registry.py. Clear\n mount_opts.json in all teardown paths.",
"is_bot": false,
"headline": "fix: proper TTY/signal handling, smart multi-session warnings, and or…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-06T16:42:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9ac4f520fa9773c2029045778e0c7f8e287437c6",
"body": null,
"is_bot": false,
"headline": "release: 2.5.1",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-05T17:29:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d4b0c71cd60c06df996509e3c2d33d3e5e6c4020",
"body": "…ad caches\n\n- Resolve the executable path using `shutil.which` and `sys.argv`.\n- Determine the module installation path (site-packages/dist-packages) from the package's file path.\n- Display `Cache location` and `OCI layer cache` paths under program details.\n- Prevent duplicate file size calculations\n[…]\ng seen file paths.\n- Split cache capability reporting into separate, non-overlapping `Download cache` and `OCI layer cache` entries.\n- And add update mocks and tests to verify capabilities formatting.",
"is_bot": false,
"headline": "feat(info): show executable/package locations and separate OCI/downlo…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-05T17:28:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "22c35a2e9dea6446933be5cccb391b52cf903a76",
"body": "…ip install is recommended",
"is_bot": false,
"headline": "docs: update that user on regular linux can do pip install but sudo p…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-05T17:28:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "210923c9e665ab5f75d0117982bc584b4f4e8646",
"body": "…legate cgroups\n\n- Fix a daemon bug where active guest sessions running longer than 5\nminutes were killed because the idle timeout timer did not track active\nthreads. Spawning threads are now named 'connection-handler' and the\nidle timer is reset while they remain active.\n- Add support for the 'CD_N\n[…]\nimes inside the chroot to manage cgroup v2\nsub-hierarchies.\n- Patch 'RUNTIME_DIR' in 'test_create_holder_success' unit tests to\navoid writing to the host's actual share data directory during test runs",
"is_bot": false,
"headline": "fix(daemon): solve idle timeout crashes, support CD_NO_DAEMON, and de…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-05T17:28:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fc2b4b5c51339b49b4e363c0dba485d992bde806",
"body": null,
"is_bot": false,
"headline": "release: 2.5.0",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-05T10:46:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "742daf783b05c25385701ead1a5e516e8cbd65c8",
"body": "…ount hygiene part\n\n- mount-utils not used anymore and we don't use the chroot from\ncoreutils , although coreutils will be installed anyway so it was\nunnecessary from the beginning\n- crashed sessions or orphan processes are now handled handled by\nunmount command",
"is_bot": false,
"headline": "docs: remove mount-utils from the termux setup part and remove Bind m…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-05T06:56:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ae98d0dbc081613f386280bc21d3ce802ca31c9",
"body": "When running `chroot-distro login` via the daemon socket, the elevated\nguest shell executes within the daemon's background session which lacks\na controlling terminal. Consequently, bash fails to configure the\nterminal process group, printing: \"bash: cannot set terminal process\ngroup (...): Inappropr\n[…]\n CLI\nas root.\n- Detect `_CHROOT_DISTRO_DAEMON` in `login/__init__.py` and execute the\nshell under `script` (if available in the rootfs) to allocate a new Pty\nand assign it as the controlling terminal.",
"is_bot": false,
"headline": "fix(login): wrap daemon interactive sessions with script for job control",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-05T06:32:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3eaacc1464a78a420076853047bcc4f6071142f9",
"body": "…elevation\n\n- Expand daemon client env allowlist to forward X11, Wayland, audio, and\nD-Bus session environment variables (e.g., DISPLAY, WAYLAND_DISPLAY,\nXDG_RUNTIME_DIR, PULSE_SERVER, etc.) when running `--shared-display`.\n- Propagate the invoking user's identity by passing the socket client\nUID to\n[…]\n VAR=val` during sudo/doas/su/pkexec\nelevation.\n- Mock the daemon delegation `_try_daemon_delegation` in\n`test_elevate.py` unit tests to ensure tests run cleanly when the host\ndaemon socket is active.",
"is_bot": false,
"headline": "fix(daemon): preserve display and audio environment variables across …",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T21:22:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bd1c486d3656db02f35d9fd5684fb884ae97c3c7",
"body": null,
"is_bot": false,
"headline": "fix: fix termux-type containers (termux-docker) failing on Termux hosts",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T19:41:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6522641e7f47703998aa916e09d770c248ba2062",
"body": null,
"is_bot": false,
"headline": "test: update test and the readme",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T19:41:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dab92568fb967e372067f3bfaf82cb0c1d0e1e3c",
"body": "The `setup` command was implemented in !1/!2 but never listed in the\ntop-level `COMMANDS` help output or in the README table of contents and\ncommands reference. Add a full help page (so `setup --help` works), add\nit to TOP_COMMANDS, and document it in the README.",
"is_bot": false,
"headline": "docs(setup): list setup in top-level help and README commands reference",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T19:16:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b9d0958322dc21239365e2210aede09cc02565e0",
"body": "…pip install\n\nThe daemon service bakes `{sys.executable} -m chroot_distro daemon` into the\nunit and runs it as root. With a `pip install --user` install the package\nlives under the invoking user's ~/.local site-packages, which root's Python\ndoes not search, so the daemon fails with \"No module named \n[…]\nC / runit / dinit / sysvinit. Termux uses\n native su and needs no setup.\n- Update the README so the regular-Linux install uses `sudo pip install` and\n documents why a root-owned install is required.",
"is_bot": false,
"headline": "fix(setup): refuse user (non-root) installs and Termux; require sudo …",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T19:16:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7fe2866bbe7faec44b62142a34bbe75509592dc2",
"body": "Stale mounts whose origin namespace died (e.g. from old\n`su --mount-master` sessions) become MNT_LOCKED slave copies: umount2\nfails with EINVAL and only a reboot removes them. Login previously\ntrusted any existing mount at a target, so a leftover empty tmpfs on\nrootfs/dev (no ptmx node) made safe_mo\n[…]\nvpts was silently skipped because the host /dev/pts\n bind had just been mounted at the same target.\n- Add _mount_fs_and_options() helper returning the fstype/options of\n the topmost mount at a path.",
"is_bot": false,
"headline": "fix(login): mount over stale MNT_LOCKED mounts instead of trusting them",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T19:15:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7ecdf2b49df8681bb977d960b8a3d8e1d50f8384",
"body": "The stale-mount origins are not necessarily in PID 1's namespace:\n`su --mount-master` actually enters magiskd's namespace (where\n/data_mirror exists), and the copies propagated into app namespaces\nare MNT_LOCKED slaves whose umount2 fails with EINVAL locally.\n\nScan /proc/*/ns/mnt, deduplicate namesp\n[…]\n container marker.\nUnmounting at the true origin propagates the removal to all slave\ncopies, including locked ones. A final local sweep and a remaining-\nmarker check with a reboot hint close the loop.",
"is_bot": false,
"headline": "fix(unmount): sweep all mount namespaces, not just init's",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T19:15:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "671dd67f72d73f5f307940aa9ec3092165ab1dcc",
"body": "…pace\n\nMounts created in the init (global) mount namespace by earlier\n`su --mount-master` runs propagate into app namespaces as slave copies.\nUnmounting a slave never removes its master, so `chroot-distro um` run\nfrom a per-session su namespace appeared to succeed while `mount` in\nTermux still showe\n[…]\nthat the rootfs-prefix\nwalk in unmount_all cannot see.\n\nThe unmount command now runs this sweep on Termux before the final\nremaining-mounts check. Failures are non-fatal (reboot remains the\nfallback).",
"is_bot": false,
"headline": "feat(unmount): clean stale container mounts in the global mount names…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T19:15:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "01d2d82e37fdb70fb99d6518546ebdcfb475b855",
"body": "… resilient\n\n- Stop passing --mount-master by default: in the global namespace /data is\n MS_SHARED, so binding /data inside a rootfs living under /data creates\n recursive phantom mounts (rootfs/.../rootfs/...) that break unmount and\n pty allocation. Magisk's default requester namespace (what term\n[…]\n the root side (su changes cwd),\n matching termux-sudo.\n- Treat ENOENT like EINVAL in safe_unmount (standard and lazy): a mount\n removed by peer-group propagation is already gone, not a fatal error.",
"is_bot": false,
"headline": "fix(termux): match termux-sudo su invocation and make unmount cleanup…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T19:15:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6bb2095bb4cae2649f8fe1b9718f0568c3245bed",
"body": "- Add pure-stdlib root daemon listening on /run/chroot-distro.sock,\n gated by the 'chroot-distro' group via SO_PEERCRED (Docker's\n docker-group model). The client passes argv, cwd, an env allow-list\n and its stdio fds (SCM_RIGHTS); the daemon forks and re-executes the\n CLI as root wired to the c\n[…]\n -> (Termux) native su ->\n daemon socket -> sudo/doas/pkexec/su fallback.\n- Add hidden 'daemon' subcommand and python -m chroot_distro entry.\n- Document the passwordless one-time setup in the README.",
"is_bot": false,
"headline": "feat: docker-style passwordless elevation via group-gated root daemon",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-04T19:15:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4bdd551741308347a78c51490d75da2dfabc3caa",
"body": "…in README",
"is_bot": false,
"headline": "docs: clarify direct syscall usage for chroot, mount, and namespaces …",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-01T18:09:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6dd4c1ca5aaf494af628111887fae44fefb30d71",
"body": "- i want to find a better way to do this",
"is_bot": false,
"headline": "docs: remove Running without `sudo` (File Capabilities) section",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-01T17:17:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4dcbb41898c4bbb0ad4fabe64763d13df339fe86",
"body": "…arnings\n\n- Replaces all empty `except Exception/OSError: pass` blocks across 30+\nfiles in commands, login helpers, syscalls, and low-level system\nutilities with proper logger/warning calls.\n- Adds `logging.getLogger(__name__)` to modules missing loggers and\nensures correct import ordering to preven\n[…]\ns).\n- Fixes Pyright unbound variable warning in `sync.py` by constructing\nfile paths outside of try-except blocks.\n- Passes all Ruff linting, Pyright/Mypy type checks, and 389 unit tests\nsuccessfully.",
"is_bot": false,
"headline": "refactor: replace silent except-pass blocks with contextual logging/w…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-07-01T13:19:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aa6512dc696801610385e265c6ebd85204a26b52",
"body": "Replace externel programs programs with python stdlibs and some more improvements",
"is_bot": false,
"headline": "Merge pull request #97 from sabamdarif/replace-externel-programs",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-30T17:41:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed5470f7807154b667ce57e936bc0731844b2961",
"body": "Add e2e-tests.yml that runs on every push/PR across Python 3.10-3.14,\ntesting 19 commands against real Alpine, Debian, and httpd containers:\n\n- Smoke tests: --version, --help, list, ps, search, info, clear-cache\n- Login tests: basic, --user, --work-dir, --env, --isolated\n- Isolation/escape preventio\n[…]\nation: CD_USE_NS=1 on Debian and Alpine\n- Container management: rename, copy, sync, backup, diff, remove,\n restore, reset\n- Build test: minimal Dockerfile with --install-as\n- Always-run cleanup phase",
"is_bot": false,
"headline": "ci: add comprehensive E2E integration test workflow",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-30T17:00:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "677ddd44073eca9e07d50d2d9b6bb0924253cfd4",
"body": "- Replace `du -sb -x` subprocess in list_cmd.py with os.walk/os.lstat\n implementation that respects filesystem boundaries via st_dev check\n- Add helpers/xauthority.py: pure-Python .Xauthority binary format\n parser/writer, eliminating the external xauth binary dependency\n- Update x11.py provision_g\n[…]\ngacy sleep-based holder detection functions in namespace.py\n for clarity (_is_sleep_infinity_holder → _is_legacy_sleep_holder etc.)\n- Update tests to match new implementation; remove subprocess mocks",
"is_bot": false,
"headline": "refactor: replace external du, xauth with pure-Python alternatives",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-30T11:06:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b676d510cc075da4697971c45beb82f8d3f0b632",
"body": "…ot Termux logins\n\n- Modifies `_try_exec` in `chroot.py` to catch `EACCES` (Permission\ndenied) errors.\n- Triggers the dynamic linker fallback when the Android kernel blocks\nnon-root users from executing binaries under `/data`.",
"is_bot": false,
"headline": "fix(chroot): trigger ELF dynamic linker fallback on EACCES for non-ro…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-30T10:15:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6784f0471b6c62970b555c34b6df8535c47d618e",
"body": "- Introduces `_try_exec`, `_binary_interpreter`, and `_read_pt_interp` helper functions to parse ELF headers and locate a binary's dynamic linker (PT_INTERP).\n- Replaces direct `os.execvp`/`os.execvpe` execution with `_try_exec` fallback inside `native_chroot`, `chroot_and_exec`, and `chroot_and_run`.\n- Resolves the Android/Termux kernel dynamic loader restriction that causes direct guest execve calls to fail with `ENOENT`.",
"is_bot": false,
"headline": "fix(chroot): add ELF dynamic linker fallback on Termux/Android",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-29T17:58:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "92b32b1440b02bb924d603af233390e37c120b89",
"body": "…/ lint issues\n\n- Replaces external `/bin/umount` subprocess execution in `kill` command\nwith native `native_umount` and `do_umount` syscall wrappers.\n- Restores missing `libc` handle initialization and correctly passes it\nto all native `_mount` calls inside `max_iso_holder.py`.\n- Fixes Pyright/Mypy\n[…]\nshes, unused\nimports, and double-checked lock static reachability checks.\n- Updates unit tests in `test_kill.py` and `test_namespace.py` to match\nthe new native unmounting logic and API modifications.",
"is_bot": false,
"headline": "refactor: use native unmounting in kill command and fix type checker …",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-29T17:14:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c7b3fa578ce9eef5ef4993aad2e9971b378d83b7",
"body": "…olation\n\n- Return the host PID of the actual grandchild process (which runs\ninside the new PID namespace) from create_holder_process() instead of\nthe launcher PID.\n- Double-fork inside do_mount_filesystem() when entering a PID namespace\nto ensure that the process mounting procfs is inside the new PID\nnamespace (since setns(2) only affects subsequent children).\n- Update and align unit tests in test_namespace.py and\ntest_login_helpers.py to match the native syscall signatures and\nbitmasks.",
"is_bot": false,
"headline": "fix(security): resolve container escape by hardening PID namespace is…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-29T16:09:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "201079ca6073cdad8546b73986c598af8ad4b677",
"body": "…on login\n\n- Split generic VFS flags (ro, nosuid, nodev, noexec) from\nfilesystem-specific\n data in mount_filesystem() to prevent EINVAL (Errno 22) during native\nmount(2) syscalls.\n- Synchronize the guest container's /etc/resolv.conf with current host\n nameservers on the initial login session.\n- Update and add unit tests to cover the mount options splitting logic\nand namespace holder assertions.",
"is_bot": false,
"headline": "fix: split generic VFS mount flags from options and sync resolv.conf …",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-29T15:44:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6bc462bcaa42a58949796334d82be214d9003fac",
"body": null,
"is_bot": false,
"headline": "refactor: replce all external programs with python's builtin",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-29T15:20:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f04ae7e86540822133c17769545bfb5baf83534b",
"body": null,
"is_bot": false,
"headline": "release: 2.4.2",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-28T14:50:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5bc11b2d5ffe711e065cdca93c443cb943ba9fe1",
"body": "Resolves an issue where specifying a host path (like a shared directory\nor shared home) in `--work-dir` failed to change directory inside the\nchroot\ndue to different path structures (e.g. `/home/sabamdarif` vs\n`/home/saba`).\nTranslates the host path using the active bind mounts before launching\nthe session.",
"is_bot": false,
"headline": "fix(login): translate host path in --work-dir to guest path",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-28T14:49:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4bf7187c9f8961bbaeb11dd4c224612f6bcc517a",
"body": null,
"is_bot": false,
"headline": "build: update Pyright to version 1.1.411",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-28T14:44:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f7f21b8683f0e48e0b53a70a3eb45a405c6177f5",
"body": "Under maximum isolation (`--isolated`), a fresh tmpfs is mounted at\n`/dev` which lacks `/dev/ptmx` on all hosts. This causes tools requiring\nPTY allocation (such as `sudo` and `su`) to fail with `unable to open\npty`.\nFix this by automatically creating `/dev/ptmx` as a symlink pointing to\n`pts/ptmx` inside the container's private mount namespace. A safety\ncross-check is included to only create or replace it if `/dev/ptmx` is\nnot already a symbolic link.",
"is_bot": false,
"headline": "fix(login): safely symlink /dev/ptmx to pts/ptmx under maximum isolation",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-28T14:40:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "975fe5fe662d563ea1f1dbd7e7fe9d937bb8f838",
"body": null,
"is_bot": false,
"headline": "release: 2.4.1",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T14:02:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "152cd5173c5b7fb30cc0d37b1673b204b8117871",
"body": "Under maximum isolation (--isolated), a fresh tmpfs is mounted at the\ncontainer's `/dev` and minimal device nodes are created via `mknod`.\nHowever, because `nsenter` is run without `--root`, using a guest path\nlike `/dev/null` caused `mknod` to be executed relative to the host's\n`/dev/null` instead \n[…]\n-root user shell attempted to write to `/dev/null`.\nFix this by using `host_path` (the rootfs-prefixed path) when a\nnamespace\nholder is present. Also add unit tests to verify the correct path is\nused.",
"is_bot": false,
"headline": "fix(login): use host_path for mknod in isolated mount namespace",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T14:00:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "896cc2642da1f8da98d02301abd696e0517cf09c",
"body": null,
"is_bot": false,
"headline": "docs: update the readme",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T13:51:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "719382c0aacfddb3165696c900b446b2d75ff5d4",
"body": null,
"is_bot": false,
"headline": "refactor: remove PD_DOCKER_AUTH fallback and simplify cgroups info",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T11:20:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9dc7e3d50fc999d54db347a5a68541ff99c0ced8",
"body": null,
"is_bot": false,
"headline": "release: 2.4.0",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:25:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3274c7ed75e47b8487d99e043a0ce5dff4c7abf7",
"body": "… to the kill command",
"is_bot": false,
"headline": "feat(kill): add support for killing the container by passing it's pid…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8426978cedf776a8f636ad3258410c4f2a01c3a7",
"body": null,
"is_bot": false,
"headline": "feat(ps): improve ps ui same as proot-distro's 73a8dbd2 commit",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8647c26c35cc75b6fb608898e99840c5e581938e",
"body": null,
"is_bot": false,
"headline": "fix(lint): resolve Ruff, Pyright, and Mypy errors",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "232bd6c0ade42a463fe4f18e28f710b96fd8f17f",
"body": "Run the image Entrypoint/Cmd in the background, detached from the\nterminal, with output captured to a per-container log file. The parent\nprints the started PID and log path, then returns immediately while the\ncontainer stays mounted. The detached process is tracked via\n/proc/*/root, so `kill`/`unmount` stop it like any other session.\n\nMirrors proot-distro's `run --detach`.",
"is_bot": false,
"headline": "feat: add --detach support to the run command",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3d92491aea457bdfd4dc37e737aefb6ab520b531",
"body": null,
"is_bot": false,
"headline": "fix(info): correct _proc_filesystems return annotation to allow None",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f95b1b4dc9569077904ca8326d25b4d991b368c",
"body": "…None semantics",
"is_bot": false,
"headline": "test(info): update runtime probe tests for ns dir listing and procfs …",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d80629ef3980f5ef9944cb76e22473d9d1143ab",
"body": "Namespace ns files are special symlink-like nodes whose stat() target can be\nunreadable to an unprivileged caller, so os.path.exists() returned False and\nthe probe wrongly reported the namespaces as unavailable. Use os.path.lexists\n(no target stat) and fall back to listing /proc/self/ns. Also distinguish a\ngenuinely empty /proc/filesystems read from a failed read so the pseudo-fs\nchecks no longer collapse to 'unknown' when the file simply could not be\nopened.",
"is_bot": false,
"headline": "fix(info): correct runtime probe false negatives for ns files and procfs",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae66fda7ad94e2d7ae2a89e4ad1fdde272b01a74",
"body": null,
"is_bot": false,
"headline": "test(info): cover runtime probe and unreadable-config probing fallback",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9002911fdc7fad78db538f24156cb292329d5003",
"body": null,
"is_bot": false,
"headline": "feat(info): use runtime probe fallback when kernel config is unreadable",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3d97738db8b801eb4fda812913d1a3fbf86034b",
"body": null,
"is_bot": false,
"headline": "feat(info): export runtime-probe symbols from kernel_config",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "acdd7546a0f4bcf21d9c42ef11bca8aae454d68d",
"body": "…adable\n\nOn Android /proc/config.gz is root-only and `info` runs rootless, so the\nstatic config read fails. Add a dependency-free runtime probe (namespace ns\nfiles, /proc/filesystems, /sys/fs/cgroup, max_user_namespaces) used as a\nfallback so Termux users still get a meaningful per-feature report.",
"is_bot": false,
"headline": "feat(info): probe live kernel for feature support when config is unre…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9024c96f83db311de982c9f64d083fd699dd36e6",
"body": null,
"is_bot": false,
"headline": "test(info): cover kernel config parsing, lookup, discovery and rendering",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ffedff33e01b0f1090f7b5ebad160cd2f81a55c2",
"body": null,
"is_bot": false,
"headline": "feat(info): render KERNEL CONFIG section in `chroot-distro info`",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff923d0fc2091d7d4e280d48a0fa6545b73b490d",
"body": "…ure support\n\nAdds a kernel-config reader (modelled on check-config.sh's config discovery)\nand a new \"KERNEL CONFIG\" section to `chroot-distro info` that shows which of\nthe kernel options chroot-distro relies on are enabled or missing, grouped by\nthe feature each one powers (namespace isolation, pseudo-filesystems, cgroups\nfor Docker-on-Android). Helps users diagnose why --isolated / CD_USE_NS fall\nback on a given kernel.",
"is_bot": false,
"headline": "feat(info): add KERNEL CONFIG section reporting namespace/cgroup feat…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34abd6bbc2b4f033906f4f47d533ec98309e28cc",
"body": "…procfs",
"is_bot": false,
"headline": "test(isolation): default mode binds no host /proc and mounts a fresh …",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2bba618d94f66960f122a004dd9b575283c8c47b",
"body": "…host /proc is never bound\n\nThe host /proc is no longer bind-mounted in any mode, so the host's\nbinfmt_misc registrations never appear inside the chroot's fresh procfs.\nMount binfmt_misc explicitly regardless of the isolation level.",
"is_bot": false,
"headline": "fix(isolation): always treat /proc as fresh for binfmt_misc now that …",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "86bcb4d04e32e22d166a4742663117bb46befe41",
"body": "…ounting host /proc\n\nThe default (no-flag) login no longer bind-mounts the host /proc. A fresh\nprocfs is mounted in get_special_mounts() instead, so the container gets its\nown /proc instance rather than sharing the host mount. Note: without a PID\nnamespace this is NOT a security boundary (same global PIDs are visible);\nit is a cleaner default and stops the host /proc mount from leaking into the\ncontainer's mount table.",
"is_bot": false,
"headline": "feat(isolation): default mode mounts a fresh procfs instead of bind-m…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bfc315432baaf32646656e8198d3794a7406569d",
"body": null,
"is_bot": false,
"headline": "test(isolation): cover Termux max-isolation fallback retry and helper",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "05d16cd2b97c72855a59a892c1b48d9b6d9dd22c",
"body": "…fallback",
"is_bot": false,
"headline": "feat(isolation): add one-shot retry wrapper for Termux max-isolation …",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e62ae6119efcd7713431af9f94ee8fd01709f298",
"body": "…ht at login entry",
"is_bot": false,
"headline": "refactor(isolation): signal max-isolation fallback via exception caug…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2f186ea3f0a10f42f9422f0a2e1512d56cffd87a",
"body": "…ion setup failure",
"is_bot": false,
"headline": "fix(isolation): retry login in old isolated mode on Termux max-isolat…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb2e8229fccefc67a51d34a13f6a378d9c25190a",
"body": "…olation fails mid-setup",
"is_bot": false,
"headline": "fix(isolation): on Termux, fall back to old isolated mode when max is…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be832812f650d78906c706abc5f6bb16d68f7404",
"body": "…olation\n\nAndroid kernels can't sustain the namespace holder used for max isolation\n(SELinux blocks the fresh tmpfs /dev, and the chrooted holder dies leaving\nnsenter unable to open even /proc/<pid>/ns/mnt). Rather than abort, on\nTermux --isolated now degrades to chroot-only maximum isolation: still\n[…]\n namespace. The user is warned that, without a PID namespace, this\ndoes not close the /proc/<pid>/root escape on Android; full isolation\nneeds a kernel that supports the namespaces (use a Linux host).",
"is_bot": false,
"headline": "fix(isolation): on Termux/Android, --isolated uses chroot-only max is…",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4f95def3b503311ef1a74a02e18ff57dba93d3bb",
"body": "Allows the caller to treat an otherwise-required mount (e.g. the\nmax-isolation /dev tmpfs) as best-effort so a denied mount returns False\nfor graceful fallback instead of aborting the session.",
"is_bot": false,
"headline": "fix(isolation): add force_optional to apply_special_mount",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a52798e56a1a7bc986a7deef19332fca38814701",
"body": "If the fresh /dev tmpfs cannot be mounted (e.g. SELinux denies tmpfs on\nsome Android kernels), do not abort the isolated session: fall back to the\ncontainer's own empty on-disk /dev directory (still no host bind, still\nisolated) and create the minimal device nodes there. The /dev tmpfs is\ntreated as best-effort under max isolation so devpts/shm and the login can\nstill proceed.",
"is_bot": false,
"headline": "fix(isolation): fall back to on-disk /dev when tmpfs is denied (Android)",
"author_name": "Md Arif",
"author_login": "sabamdarif",
"committed_at": "2026-06-23T08:17:02Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 68,
"commits_last_year": 668,
"latest_release_at": "2026-08-01T16:57:35Z",
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 38,
"days_since_latest_release": 0,
"mean_days_between_releases": 3.8
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "chroot-distro",
"exists": true,
"license": "GPL-3.0-only",
"keywords": [],
"ecosystem": "pypi",
"matches_repo": true,
"registry_url": "https://pypi.org/project/chroot-distro/",
"is_deprecated": false,
"latest_version": "2.8.2",
"repository_url": "https://github.com/sabamdarif/chroot-distro",
"versions_count": 32,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 2499,
"first_published_at": "2026-05-31T19:35:26.599010Z",
"latest_published_at": "2026-08-01T16:57:27.130682Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 17,
"stars": 125,
"watchers": 2,
"fork_history": {
"days": [
{
"date": "2025-08-31",
"count": 1
},
{
"date": "2025-10-22",
"count": 1
},
{
"date": "2026-01-07",
"count": 1
},
{
"date": "2026-02-15",
"count": 1
},
{
"date": "2026-03-01",
"count": 1
},
{
"date": "2026-03-20",
"count": 1
},
{
"date": "2026-04-15",
"count": 1
},
{
"date": "2026-04-20",
"count": 1
},
{
"date": "2026-05-31",
"count": 1
},
{
"date": "2026-06-06",
"count": 1
},
{
"date": "2026-06-07",
"count": 3
},
{
"date": "2026-06-13",
"count": 1
},
{
"date": "2026-06-16",
"count": 1
},
{
"date": "2026-07-06",
"count": 2
}
],
"complete": true,
"collected": 17,
"total_forks": 17
},
"star_history": null,
"open_issues_and_prs": 2
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"src/chroot_distro/py.typed"
],
"toolchain_manifests": [],
"largest_source_bytes": 58471,
"source_files_sampled": 175,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"pyproject.toml"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"pypi"
],
"dependencies": [
{
"name": "backports-zstd",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": null
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 45,
"open_issues": 2,
"closed_ratio": 0.951,
"closed_issues": 39,
"closed_unmerged_prs": 15
},
"bus_factor": 1,
"bot_contributors": 2,
"top_contributors": [
{
"type": "User",
"login": "sabamdarif",
"commits": 615,
"avatar_url": "https://avatars.githubusercontent.com/u/111168803?v=4"
},
{
"type": "User",
"login": "quratoop",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/187558780?v=4"
},
{
"type": "User",
"login": "faizanfatmi",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/238895052?v=4"
},
{
"type": "User",
"login": "viveksh01",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/249681319?v=4"
},
{
"type": "User",
"login": "surajde-dev",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/254968033?v=4"
},
{
"type": "User",
"login": "rexackermann",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/61972253?v=4"
},
{
"type": "User",
"login": "SudeeptoBhakat",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/118655609?v=4"
}
],
"contributors_sampled": 7,
"top_contributor_share": 0.979
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"e2e-tests.yml",
"publish.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": true,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"uv.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "1 out of 1 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/29 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 0,
"reason": "dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "821c623123cd8c537a9e0c81cdfd212db14d45fc",
"ran_at": "2026-08-01T16:59:26Z",
"aggregate_score": 4.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-08-01T16:57:40Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-20T06:59:26Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 101,
"created_at": "2026-07-24T21:52:39Z",
"last_comment_at": "2026-07-29T11:28:04Z",
"last_comment_author": "sabamdarif"
},
{
"number": 103,
"created_at": "2026-08-01T06:33:47Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/sabamdarif/chroot-distro",
"host": "github.com",
"name": "chroot-distro",
"owner": "sabamdarif"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": "The weighted overall 65 is calibrated to 75 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 65,
"calibrated": 75,
"calibration": "2026-08-02"
}
}
],
"value": 75,
"inputs": {
"security": 45,
"vitality": 94,
"community": 49,
"governance": 58,
"calibration": "2026-08-02",
"engineering": 74,
"ai_readiness": 53,
"weighted_overall_raw": 65
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "exceptional",
"name": "Vitality",
"value": 94,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"commits_last_year": 668,
"human_commit_share": 0.99,
"days_since_last_push": 0,
"active_weeks_last_year": 38
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "38/52 weeks with commits",
"points": 26.3,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 38
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "668 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 668
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "exceptional",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 68,
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 3.8
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "68 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 68
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3.8 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3.8
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 3,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 3 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 3
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "weak",
"name": "Community & Adoption",
"value": 49,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "weak",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 44,
"inputs": {
"forks": 17,
"stars": 125,
"watchers": 2,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "125 stars",
"points": 34,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 125
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "17 forks",
"points": 10,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 17
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "2 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 2
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"readme_badges": null,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"readme_badge_services": [],
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (GPL-3.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "GPL-3.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 57,
"inputs": {
"packages": [
"chroot-distro"
],
"dependents": null,
"ecosystems": "pypi",
"total_downloads": null,
"monthly_downloads": 2499
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "2,499 downloads/month across pypi",
"points": 45.3,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 2499,
"ecosystems": "pypi"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 58,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 19,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 7,
"top_contributor_share": 0.979
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 98% of commits",
"points": 0.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 98
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "7 contributors",
"points": 9.5,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 7
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 72,
"inputs": {
"merged_prs": 45,
"open_issues": 2,
"closed_issues": 39,
"prs_merged_7d": null,
"prs_decided_7d": null,
"prs_merged_30d": null,
"prs_decided_30d": null,
"issue_closed_ratio": 0.951,
"closed_unmerged_prs": 15,
"first_time_authors_30d": null,
"first_time_prs_merged_30d": null,
"first_time_prs_decided_30d": null
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "95% of issues closed",
"points": 39.9,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 95
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "45/60 decided PRs merged",
"points": 22.5,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 45,
"decided": 60
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/29 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 59,
"inputs": {
"followers": 255,
"owner_type": "User",
"is_verified": null,
"owner_login": "sabamdarif",
"public_repos": 45,
"account_age_days": 1449
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "255 followers of sabamdarif",
"points": 17.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 255,
"login": "sabamdarif"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "45 public repos, account ~3 yr old",
"points": 20,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 45
}
},
{
"code": "account_age_years",
"params": {
"years": 3
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"chroot-distro"
],
"ecosystems": "pypi",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on pypi",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "pypi"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "32 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 32
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 74,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 74,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "1 out of 1 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [
"chroot",
"chroot-distro",
"android",
"termux",
"docker",
"docker-container",
"dockerhub",
"linux",
"linux-containers"
],
"has_wiki": true,
"homepage": "https://pypi.org/project/chroot-distro/",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://pypi.org/project/chroot-distro/",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "9 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 9
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "weak",
"name": "Security",
"value": 45,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "weak",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 45,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 4.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "1 out of 1 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/29 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "dangerous workflow patterns detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 5
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 53,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "weak",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "99 of 99 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 99,
"sampled": 99
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"uv.lock"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"src/chroot_distro/py.typed"
],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0.01
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "src/chroot_distro/py.typed",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "src/chroot_distro/py.typed"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "1 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 1,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 82,
"inputs": {
"primary_language": "Python",
"largest_source_bytes": 58471,
"source_files_sampled": 175,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Python with type-check config (src/chroot_distro/py.typed)",
"points": 27,
"status": "partial",
"details": [
{
"code": "typecheck_config_language",
"params": {
"files": "src/chroot_distro/py.typed",
"language": "Python"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/175 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 175,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"top": [
"library"
],
"labels": [
"library"
],
"scores": {
"library": 6
},
"primary": "library",
"evidence": [
{
"tier": "distribution",
"label": "library",
"source": "registry:pypi",
"weight": 6
}
],
"artifacts": [],
"confidence": "medium",
"host_extension": false,
"runs_as_process": false,
"consumed_by_code": true
},
"metrics_version": "2.5.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index pypi:chroot-distro@2.8.2; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-08-01T16:59:36.180969Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/s/sabamdarif/chroot-distro.svg",
"full_name": "sabamdarif/chroot-distro",
"license_state": "standard",
"license_spdx": "GPL-3.0"
}
Registros relacionados
Repositorios inspeccionados que comparten etiquetas de catálogo o ecosistemas con sabamdarif/chroot-distro. Leer en paralelo →
Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v2.5.0, esquema v0.27.0 — metodología completa · wiki de métricas.
