Public recordModerate
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-25 23:51 UTC
frisky1985 / yuleDKCS
🚗 yuleDKCS — Digital Key Connectivity System. 开源车联网数字钥匙解决方案，支持CCC/ICCOA/ICCE三大协议，覆盖嵌入式车端+手机SDK+云端服务。
frisky1985/yuleDKCS holds a health index of 52 out of 100, placing it in the Moderate band. It scores highest on Engineering Quality (82/100) and lowest on Security (35/100). It was last updated 5 days ago. A single contributor accounts for most of its recent work.
52
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
52
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership
Stefan MingPersonal account
4 followers129 public repossince Sep 2014NAEN Auto
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish |
|---|---|---|---|---|---|
| Go | github.com/frisky1985/yuleDKCS | v2.1.0+incompatible | - | 2 | 9 days ago |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
64
Development activity
53Moderate
How it's scored
| 36/36 | Push recency — last push 5 days ago |
| 2.1/36 | Commit cadence — 3/52 weeks with commits |
| 14.7/18 | Commit volume — 42 commits in the last year |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Inputs used
| commits_last_year | 42 |
| human_commit_share | 1 |
| days_since_last_push | 5 |
| active_weeks_last_year | 3 |
Release discipline
80Good
How it's scored
| 16.2/27 | Ships releases — 2 version tags (no GitHub releases) |
| 36/36 | Release recency — latest release 9 days ago |
| 19.8/27 | Release cadence — a release every ~51.2 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 2 |
| latest_release_tag | v2.1.0 |
| releases_from_tags | yes |
| days_since_latest_release | 9 |
| mean_days_between_releases | 51.2 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
42
Popularity & adoption
5Critical
How it's scored
| 4.9/60 | Stars — 3 stars |
| 0/25 | Forks — 1 forks |
| 0/15 | Watchers — 1 watchers |
Inputs used
| forks | 1 |
| stars | 3 |
| watchers | 1 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
85Excellent
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (Apache-2.0) |
| 18/18 | CONTRIBUTING guide |
| 13.5/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | yes |
| has_issue_template | no |
| has_code_of_conduct | yes |
| has_pull_request_template | no |
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
35
Maintainer resilience (bus factor)
13Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 0/22.5 | Commit distribution — top contributor authored 100% of commits |
| 1.4/13.5 | Contributor breadth — 1 contributors |
| 3/10 | OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Issue & PR responsiveness
1Critical
How it's scored
| 0/46.8 | Issue resolution — no issues or no data |
| 0/38.3 | PR acceptance — no decided pull requests or no data |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 0 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 0 |
Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.
Ownership & stewardship
50Moderate
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 5/25 | Owner reach — 4 followers of frisky1985 |
| 25/25 | Track record — 129 public repos, account ~11 yr old |
Inputs used
| followers | 4 |
| owner_type | User |
| is_verified | — |
| owner_login | frisky1985 |
| public_repos | 129 |
| account_age_days | 4,327 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Package maintenance
92Excellent
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on go |
| 35/35 | Publish recency — latest publish 9 days ago |
| 12/20 | Version history — 2 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | github.com/frisky1985/yuleDKCS |
| ecosystems | go |
| any_deprecated | no |
| min_days_since_publish | 9 |
Engineering Quality
Are baseline engineering and documentation practices in place?
82
Engineering practices
80Good
How it's scored
| 24/24 | CI workflows — 5 workflow(s) |
| 24/24 | Tests present |
| 16/16 | Linter config — .golangci.yml |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — no data |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | yes |
| has_precommit_config | no |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.
Documentation
85Excellent
How it's scored
| 30/30 | README |
| 25/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 10/10 | Topics — 12 topics |
| 10/10 | Wiki |
Inputs used
| topics | automotive, bluetooth, ccc, connected-car, digital-key, digital-twin, icce, iot, nfc, uwb, car-connectivity, iccoa |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | yes |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
35
Security posture
35At risk
How it's scored
| 6.8/7.5 | Binary-Artifacts — binaries present in source code |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — no data |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 5/5 | Fuzzing — project is fuzzed |
| 2.5/2.5 | License — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 0/5 | Packaging — no data |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — no data |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6.8/7.5 | Vulnerabilities — 1 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 15 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 3 |
| scorecard_aggregate | 3.5 |
Excluded from scoring (no data or not applicable): ci_tests, packaging, signed_releases. Remaining weights renormalized.
Dependency advisories
36At risk
How it's scored
| 5.2/35 | Direct dependencies free of known advisories — 5 affected: google.golang.org/grpc v1.62.0 (critical 9.1), google.golang.org/grpc v1.63.2 (critical 9.1), google.golang.org/grpc v1.81.1 (critical 9.1), +2 more |
| 0/25 | Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope |
| 21.9/40 | No advisories left outstanding — 4 advisory-carrying package(s) unaddressed past 90 days; oldest published 674 days ago |
Inputs used
| source | osv |
| advisories | 50 |
| affected_packages | 12 |
| assessed_packages | 83 |
| unassessed_packages | 17 |
| affected_by_severity | critical 4, high 2, moderate 1, unknown 5 |
| direct_affected_packages | 5 |
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 83 resolved dependencies against OSV. 17 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
68
Agent context & guidance
40At risk
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 41 of 42 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.976 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
How it's scored
| 18/18 | One-command bootstrap — Makefile, embedded/tests/Makefile |
| 22/22 | Automated tests |
| 11/11 | Lint / format config — .golangci.yml |
| 11/11 | Static type checking — Go (statically typed) |
| 10/10 | Reproducible environment — Dockerfile, lockfile |
| 0/10 | Demonstrated agent practice — no agent-authored commits among the last 42 |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | go.sum |
| has_dockerfile | yes |
| typed_language | yes |
| bootstrap_files | Makefile, embedded/tests/Makefile |
| has_devcontainer | no |
| has_linter_config | yes |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | backend/adapters/adapter-ccc/pom.xml, backend/adapters/adapter-core/pom.xml, backend/adapters/adapter-grpc-server/pom.xml, backend/adapters/adapter-icce/pom.xml, backend/adapters/adapter-iccoa/pom.xml, backend/adapters/pom.xml, backend/cloud/hub/go.mod, backend/cloud/hub/tests/integration/go.mod, backend/cloud/hub/tests/stress/go.mod, backend/dkcs/go.mod, backend/dkcs/proto/go.mod, frontend/android-app/build.gradle.kts, frontend/android/build.gradle.kts |
| dependency_bot_commit_share | 0 |
Code legibility for models
100Excellent
How it's scored
| 45/45 | Type-checkable code — Go (statically typed) |
| 54.8/55 | Manageable file sizes — 1/281 source files over 60KB |
Inputs used
| primary_language | Go |
| largest_source_bytes | 101,443 |
| source_files_sampled | 281 |
| oversized_source_files | 1 |
How it's scored
| 40/40 | API schema (OpenAPI/GraphQL/proto) — backend/adapters/adapter-grpc-server/src/main/proto/adapter.proto, backend/cloud/hub/api/dk/v1/dk_server.proto, backend/cloud/hub/api/v1/hub.proto, backend/cloud/protocol/dkcs-hub.proto, backend/cloud/protocol/dkcs-tcu.proto, backend/dkcs/internal/proto/dkcs.proto, docs/api/openapi.yaml |
| 0/20 | MCP server |
| 40/40 | Runnable examples — examples |
Inputs used
| example_dirs | examples |
| has_mcp_signal | no |
| api_schema_files | backend/adapters/adapter-grpc-server/src/main/proto/adapter.proto, backend/cloud/hub/api/dk/v1/dk_server.proto, backend/cloud/hub/api/v1/hub.proto, backend/cloud/protocol/dkcs-hub.proto, backend/cloud/protocol/dkcs-tcu.proto, backend/dkcs/internal/proto/dkcs.proto, docs/api/openapi.yaml |
Key facts
3GitHub stars
1contributors
42commits, last 12 months
5days since last push
2releases
1bus factor
0open issues
—package ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail
OpenSSF Scorecard 3.5 / 10
3.5aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 9 | Binary-Artifacts | binaries present in source code |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| n/a | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 10 | Fuzzing | project is fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| n/a | Packaging | packaging workflow not detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| n/a | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 9 | Vulnerabilities | 1 existing vulnerabilities detected |
Direct dependencies 14
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| Maven | org.springframework.boot:spring-boot-dependencies | ${spring-boot.version} | backend/adapters/pom.xml |
| Maven | net.devh:grpc-server-spring-boot-starter | ${grpc-spring-boot.version} | backend/adapters/pom.xml |
| Maven | io.grpc:grpc-protobuf | ${grpc.version} | backend/adapters/pom.xml |
| Maven | io.grpc:grpc-stub | ${grpc.version} | backend/adapters/pom.xml |
| Maven | io.grpc:grpc-netty-shaded | ${grpc.version} | backend/adapters/pom.xml |
| Maven | io.grpc:grpc-services | ${grpc.version} | backend/adapters/pom.xml |
| Maven | com.google.protobuf:protobuf-java | ${protobuf.version} | backend/adapters/pom.xml |
| Maven | io.micrometer:micrometer-core | ${micrometer.version} | backend/adapters/pom.xml |
| Maven | io.micrometer:micrometer-registry-prometheus | ${micrometer.version} | backend/adapters/pom.xml |
| Go | github.com/golang-jwt/jwt/v5 | v5.3.1 | backend/dkcs/go.mod |
| Go | github.com/jmoiron/sqlx | v1.4.0 | backend/dkcs/go.mod |
| Go | github.com/lib/pq | v1.10.9 | backend/dkcs/go.mod |
| Go | github.com/redis/go-redis/v9 | v9.21.0 | backend/dkcs/go.mod |
| Go | google.golang.org/grpc | v1.63.2 | backend/dkcs/go.mod |
All dependencies 100
Full resolved dependency set from the GitHub dependency graph: 22 direct and 78 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
| Registry | Package | Version | Relation |
|---|---|---|---|
| Go | github.com/golang-jwt/jwt/v5 | v5.3.1 | direct |
| Go | github.com/jmoiron/sqlx | v1.4.0 | direct |
| Go | github.com/lib/pq | v1.10.9 | direct |
| Go | github.com/redis/go-redis/v9 | v9.21.0 | direct |
| Go | google.golang.org/grpc | v1.62.0 | direct |
| Go | google.golang.org/grpc | v1.63.2 | direct |
| Go | google.golang.org/grpc | v1.81.1 | direct |
| Maven | com.google.protobuf:protobuf-java | — | direct |
| Maven | com.google.protobuf:protobuf-java | 3.25.4 | direct |
| Maven | io.grpc:grpc-netty-shaded | 1.62.2 | direct |
| Maven | io.grpc:grpc-protobuf | — | direct |
| Maven | io.grpc:grpc-protobuf | 1.62.2 | direct |
| Maven | io.grpc:grpc-services | — | direct |
| Maven | io.grpc:grpc-services | 1.62.2 | direct |
| Maven | io.grpc:grpc-stub | — | direct |
| Maven | io.grpc:grpc-stub | 1.62.2 | direct |
| Maven | io.micrometer:micrometer-core | 1.13.4 | direct |
| Maven | io.micrometer:micrometer-registry-prometheus | — | direct |
| Maven | io.micrometer:micrometer-registry-prometheus | 1.13.4 | direct |
| Maven | net.devh:grpc-server-spring-boot-starter | — | direct |
| Maven | net.devh:grpc-server-spring-boot-starter | 3.1.0.RELEASE | direct |
| Maven | org.springframework.boot:spring-boot-dependencies | 3.2.5 | direct |
| Go | github.com/alicebob/miniredis/v2 | v2.38.0 | indirect |
| Go | github.com/bytedance/sonic | v1.11.6 | indirect |
| Go | github.com/bytedance/sonic/loader | v0.1.1 | indirect |
| Go | github.com/cespare/xxhash/v2 | v2.3.0 | indirect |
| Go | github.com/cloudwego/base64x | v0.1.4 | indirect |
| Go | github.com/cloudwego/iasm | v0.2.0 | indirect |
| Go | github.com/data-dog/go-sqlmock | v1.5.2 | indirect |
| Go | github.com/davecgh/go-spew | v1.1.1 | indirect |
| Go | github.com/eapache/go-resiliency | v1.7.0 | indirect |
| Go | github.com/gabriel-vasile/mimetype | v1.4.3 | indirect |
| Go | github.com/gin-contrib/sse | v0.1.0 | indirect |
| Go | github.com/gin-gonic/gin | v1.10.0 | indirect |
| Go | github.com/go-playground/locales | v0.14.1 | indirect |
| Go | github.com/go-playground/universal-translator | v0.18.1 | indirect |
| Go | github.com/go-playground/validator/v10 | v10.20.0 | indirect |
| Go | github.com/go-redis/redis/v8 | v8.11.5 | indirect |
| Go | github.com/goccy/go-json | v0.10.2 | indirect |
| Go | github.com/hashicorp/go-uuid | v1.0.3 | indirect |
| Go | github.com/ibm/sarama | v1.50.1 | indirect |
| Go | github.com/jcmturner/aescts/v2 | v2.0.0 | indirect |
| Go | github.com/jcmturner/dnsutils/v2 | v2.0.0 | indirect |
| Go | github.com/jcmturner/gofork | v1.7.6 | indirect |
| Go | github.com/jcmturner/gokrb5/v8 | v8.4.4 | indirect |
| Go | github.com/jcmturner/rpc/v2 | v2.0.3 | indirect |
| Go | github.com/json-iterator/go | v1.1.12 | indirect |
| Go | github.com/klauspost/compress | v1.18.6 | indirect |
| Go | github.com/klauspost/cpuid/v2 | v2.2.7 | indirect |
| Go | github.com/lann/builder | v0.0.0-20180802200727-47ae307949d0 | indirect |
| Go | github.com/lann/ps | v0.0.0-20150810152359-62de8c46ede0 | indirect |
| Go | github.com/leodido/go-urn | v1.4.0 | indirect |
| Go | github.com/masterminds/squirrel | v1.5.4 | indirect |
| Go | github.com/mattn/go-isatty | v0.0.20 | indirect |
| Go | github.com/modern-go/concurrent | v0.0.0-20180306012644-bacd9c7ef1dd | indirect |
| Go | github.com/modern-go/reflect2 | v1.0.2 | indirect |
| Go | github.com/pelletier/go-toml/v2 | v2.2.2 | indirect |
| Go | github.com/pierrec/lz4/v4 | v4.1.26 | indirect |
| Go | github.com/pmezard/go-difflib | v1.0.0 | indirect |
| Go | github.com/prometheus/client_golang | v1.19.0 | indirect |
| Go | github.com/rcrowley/go-metrics | v0.0.0-20250401214520-65e299d6c5c9 | indirect |
| Go | github.com/segmentio/kafka-go | v0.4.47 | indirect |
| Go | github.com/stretchr/testify | v1.10.0 | indirect |
| Go | github.com/twitchyliquid64/golang-asm | v0.15.1 | indirect |
| Go | github.com/ugorji/go/codec | v1.2.12 | indirect |
| Go | github.com/yuin/gopher-lua | v1.1.1 | indirect |
| Go | go.uber.org/atomic | v1.11.0 | indirect |
| Go | go.uber.org/multierr | v1.10.0 | indirect |
| Go | go.uber.org/zap | v1.27.0 | indirect |
| Go | golang.org/x/arch | v0.8.0 | indirect |
| Go | golang.org/x/crypto | v0.48.0 | indirect |
| Go | golang.org/x/crypto | v0.52.0 | indirect |
| Go | golang.org/x/net | v0.51.0 | indirect |
| Go | golang.org/x/net | v0.55.0 | indirect |
| Go | golang.org/x/sys | v0.42.0 | indirect |
| Go | golang.org/x/sys | v0.45.0 | indirect |
| Go | golang.org/x/text | v0.34.0 | indirect |
| Go | golang.org/x/text | v0.37.0 | indirect |
| Go | google.golang.org/genproto/googleapis/rpc | v0.0.0-20240227224415-6ceb2ff114de | indirect |
| Go | google.golang.org/genproto/googleapis/rpc | v0.0.0-20260226221140-a57be14db171 | indirect |
| Go | google.golang.org/protobuf | v1.33.0 | indirect |
| Go | google.golang.org/protobuf | v1.36.11 | indirect |
| Go | gopkg.in/yaml.v3 | v3.0.1 | indirect |
| Maven | com.digitalkey:adapter-core | 1.0.0-SNAPSHOT | indirect |
| Maven | com.fasterxml.jackson.core:jackson-databind | — | indirect |
| Maven | io.grpc:grpc-testing | — | indirect |
| Maven | io.grpc:grpc-testing | 1.62.2 | indirect |
| Maven | jakarta.annotation:jakarta.annotation-api | — | indirect |
| Maven | org.apache.maven.plugins:maven-compiler-plugin | 3.13.0 | indirect |
| Maven | org.apache.tomcat:annotations-api | 6.0.53 | indirect |
| Maven | org.projectlombok:lombok | — | indirect |
| Maven | org.springframework.boot:spring-boot-configuration-processor | — | indirect |
| Maven | org.springframework.boot:spring-boot-maven-plugin | — | indirect |
| Maven | org.springframework.boot:spring-boot-maven-plugin | 3.2.5 | indirect |
| Maven | org.springframework.boot:spring-boot-starter-actuator | — | indirect |
| Maven | org.springframework.boot:spring-boot-starter-test | — | indirect |
| Maven | org.springframework.boot:spring-boot-starter-web | — | indirect |
| Maven | org.springframework.boot:spring-boot-starter-webflux | — | indirect |
| Maven | org.xolstice.maven.plugins:protobuf-maven-plugin | — | indirect |
| Maven | org.xolstice.maven.plugins:protobuf-maven-plugin | 0.6.1 | indirect |
Dependency advisories 12
This repository publishes no package the index resolves, so its own dependency graph was assessed — 83 packages, which also include development and test pins that never ship: 12 carry known advisories, of which 5 are direct. 17 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list.
| Package | Version | Relation | Severity | Advisories | Fixed in |
|---|---|---|---|---|---|
| google.golang.org/grpc | v1.62.0 | direct | critical | 3 | 1.82.1 |
| google.golang.org/grpc | v1.63.2 | direct | critical | 3 | 1.82.1 |
| google.golang.org/grpc | v1.81.1 | direct | critical | 1 | 1.82.1 |
| golang.org/x/crypto | v0.48.0 | indirect | critical | 27 | 0.52.0 |
| com.google.protobuf:protobuf-java | 3.25.4 | direct | high | 1 | 4.28.2 |
| io.grpc:grpc-netty-shaded | 1.62.2 | direct | high | 1 | 4.2.4.Final |
| golang.org/x/net | v0.51.0 | indirect | moderate | 9 | 1.26.3 |
| golang.org/x/crypto | v0.52.0 | indirect | unknown | 1 | — |
| golang.org/x/net | v0.55.0 | indirect | unknown | 1 | 0.56.0 |
| golang.org/x/sys | v0.42.0 | indirect | unknown | 1 | 0.44.0 |
| golang.org/x/text | v0.34.0 | indirect | unknown | 1 | 0.39.0 |
| golang.org/x/text | v0.37.0 | indirect | unknown | 1 | 0.39.0 |
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"automotive",
"bluetooth",
"ccc",
"connected-car",
"digital-key",
"digital-twin",
"icce",
"iot",
"nfc",
"uwb",
"car-connectivity",
"iccoa"
],
"is_fork": false,
"size_kb": 14255,
"has_wiki": true,
"homepage": null,
"languages": {
"C": 549592,
"Go": 993531,
"Java": 85996,
"CMake": 2402,
"Shell": 4803,
"Swift": 330401,
"Kotlin": 449999,
"PLpgSQL": 13685,
"Makefile": 9114,
"Dockerfile": 2027,
"Go Template": 1488
},
"pushed_at": "2026-07-20T02:41:33Z",
"created_at": "2026-05-06T03:07:38Z",
"owner_type": "User",
"updated_at": "2026-07-18T10:48:31Z",
"description": "🚗 yuleDKCS — Digital Key Connectivity System. 开源车联网数字钥匙解决方案，支持CCC/ICCOA/ICCE三大协议，覆盖嵌入式车端+手机SDK+云端服务。",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "master",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go",
"C",
"Kotlin",
"Swift"
]
},
"owner": {
"blog": "www.naen-china.com",
"name": "Stefan Ming",
"type": "User",
"login": "frisky1985",
"company": "NAEN Auto",
"location": "Shanghai",
"followers": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/8830125?v=4",
"created_at": "2014-09-19T07:44:43Z",
"is_verified": null,
"public_repos": 129,
"account_age_days": 4327
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v2.1.0",
"kind": "minor",
"published_at": "2026-07-16T13:58:13Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2026-05-26T08:21:31Z"
}
],
"recent_commits": [
{
"oid": "0a6e90ab4bee61dc4b62042e133e9d507f1960c2",
"body": "今日完成 11 条 Pipeline，从 CL1 (55/100) → CL2 (85+)\n\n## 修复\n- Registry 大小写不敏感匹配 (KNI-001~003)\n- ICCOACodec/ICCECodec 7 处 nil guard\n- Fuzz 发现并修复 5 个生产 bug (越界访问 x2, nil指针, 字段丢失, 死循环)\n- Go 漏洞修复: toolchain 1.26.3→1.26.5 (4个CVE), redis v9.5.1→v9.21.0\n\n## 测试\n- hub/service 0%→80.2%, hub/logger 0%→98.6%, hub/erro\n[…]\n+ golangci-lint)\n- Java CI 流水线 (continue-on-error)\n\n## 流程\n- 需求管理: 40条ID + 追溯矩阵\n- Spec-delta 变更模板\n- CHANGE_PROCESS.md\n\n## 产出\n- 生产bug发现/修复: 8个 (1P0+7P1)\n- 新测试代码: ~5,500行\n- hub整体覆盖: ~35%→83.4%\n- 零测试包: 清零",
"is_bot": false,
"headline": "🚀 yuleDKCS 全流程质量提升 Sprint",
"author_name": "System Administrator",
"author_login": null,
"committed_at": "2026-07-18T10:47:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2fe02c5623422ea727c9273f4b77226b7b03f0a2",
"body": "## 车端 (embedded) — 47/47 测试\n- Unity 测试框架 + Makefile 搭建\n- ICCOA 核心/BLE 测试 (17)\n- CCC 核心测试 (18)\n- 统一协议测试 (12)\n- 引入真实源码编译，HAL 桩函数模拟硬件\n- 修复 dk_logger.h va_list 不匹配 + iccoa_ble.c 宏空格 bug\n\n## iOS UI 测试 — 32 用例\n- XCTest UI: Tab导航/钥匙列表/添加流程/远程控制/设置\n\n## Android UI 测试 — 78 用例\n- Espresso: 密钥列表(14)/绑定(29)/远程控制(35)\n- 覆盖生命周期、空状态、错误重试、多步骤流程\n\n## 技能\n- 🌀 ralph-loop: 自主任务循环 (OpenClaw/Hermes/Claude)\n- 🔧 lark-cli: 飞书 CLI 工具 (OpenClaw/Hermes/Claude)",
"is_bot": false,
"headline": "🚗🚀 车端C测试框架+前端UI测试+RalphLoop技能",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-02T16:13:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "38620eb6f648272583984226dbe06e776ffc6544",
"body": "## iOS (90+ 测试用例)\n- APIClient 网络层 MockURLProtocol 测试 (45+)\n- KeyService API 测试 (16)\n- VehicleService API 测试 (17)\n- Model 编解码测试 (12)\n\n## Android (40 测试用例 + 11 文件)\n- ApiService.kt — Retrofit 接口 30+ 端点\n- ApiClient.kt — 客户端配置 + 认证拦截器\n- 全部 DTO 模型 (Auth/Key/Share/Vehicle/Token/Device/Hub)\n- ApiServiceTest — MockWebServer 40 个测试\n 密钥绑定/解绑/列表/状态变更/车辆控制/分享/Token/设备/错误处理",
"is_bot": false,
"headline": "📱 端侧API测试: iOS + Android API客户端全链路测试",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-02T15:49:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "272f610dcd6127b8b2b289c5143c3fcb58cd9955",
"body": "## 编译修复\n- 修复 dkcs/cloud/hub 全部 10 个编译失败包\n- 修复 proto 初始化 panic (重新生成 hub.pb.go)\n- 修复 ICCE codec encodeTag 多字节 tag 编码 bug\n- 修复 ICCOA detectMessageType 错位读取\n- 修复 gateway 语法错误 + 鉴权 key 取错\n- 修复 bertlv encoder int64(-1) 长度错误\n\n## 测试覆盖率 (9.8% → ~72%)\n- 新增 6 个 100% 覆盖包: cache, config, device, keymgmt, teleme\n[…]\n规测试\n- CCC 合规测试 (绑定/远程控制/安全)\n- ICCE 合规测试 (华为生态)\n- ICCOA 合规测试 (DK4.0/DK3.0 + 国密SM2/SM4 + 厂商差异)\n\n## Android 测试\n- Gradle wrapper + JUnit5/MockK/Espresso/Robolectric\n- 62 个测试用例覆盖 ViewModel+Repository+Model",
"is_bot": false,
"headline": "🏗️ 全量推进: 编译修复+测试覆盖率提升+基础设施搭建",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-02T15:25:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a806acd7aaee0960130794c47eff8e597e8e5e4b",
"body": "基于Claude和Hermes双重审查结果修复:\n\nP0安全: Token签名漏了permissions字段→攻击者可篡改权限\n 修复: sign()加入权限位签名, TestTamperedPermissions验证通过\n\nP0竞态: exchangeToken UseCount检查有TOCTOU缺陷\n 修复: 移除脆弱的UseCount>1检查,改用专属exchange状态\n\nP0权限: uint8不够(8位),缺充电口和代客模式\n 修复: uint8→uint16, 新增PermChargePort/PermValetMode\n\n新增API:\n GET /tokens — 列出我的Token\n PUT /tokens/:id/suspend — 临时挂起\n PUT /tokens/:id/resume — 恢复\n\n测试: 10/10 PASS (含权限篡改/挂起恢复/列表查询)",
"is_bot": false,
"headline": "🔒 跨Agent审查P0修复: 权限签名+竞态条件+缺少API",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T16:22:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01b229c1410c59b9889d8ac573669aa8a4f7c44c",
"body": "新增:\n- api/dk/v1/dk_server.proto — Hub↔Server gRPC接口定义\n IssueKey / RevokeKey / SyncKeyStatus\n- service.GRPCDKServer — gRPC服务端实现(server-only模式)\n- service.RegisterGRPCServer — 注册到gRPC服务器\n\n更新:\n- cmd/yuledkcs/main.go — server-only模式启动gRPC服务\n- hub-only模式标注gRPC对接位置\n- all-in-one模式不变(同进程调用)\n\n三种模式:\n all-in-one: Hub+Server同进程,零网络开销\n hub-only: 只启Hub,通过gRPC连Server\n server-only:只启Server,接受gRPC",
"is_bot": false,
"headline": "🎫 gRPC骨架 + 三种模式完整链路",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T16:16:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4168cef7bb21d33315a52d3afcde00097835c969",
"body": "token包: 7测试 7/7 PASS\n- Issue/Verify/Revoke/Expired/MaxUses/Tamper/权限组合\n\n新增:\n- internal/token/token_test.go — 完整单元测试\n- internal/service/dk_server.go — DK Server接口契约\n IssueKey: Token→DK Server→TSP→PKI签发钥匙\n RevokeKeyByToken: 吊销Token触发的车端钥匙作废\n LocalDKServer: all-in-one模式的默认实现\n\n更新:\n- token_handler.go exchange接口对接真实DK Server\n- rest_gateway.go 接入 dkServer 依赖\n\n完整链路:\n 车主签发Token → 接收方验证 → 换钥匙(通知DK Server)\n → DK Server调TSP/PKI签发 → 写入手机SE → 离线可用",
"is_bot": false,
"headline": "🎫 Token完整链路: 7测试全过 + DK Server接口 + 权限映射",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T16:13:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02231986e86c85725ea082373941d0060564822d",
"body": "完整API:\n POST /tokens 签发 {permissions: [lock,engine,trunk...], duration, subject}\n GET /tokens/:id 验证 (返回车主/车辆/权限/有效期)\n POST /tokens/:id/exchange 换离线钥匙 (验证→通知DK Server签发)\n DELETE /tokens/:id 吊销\n\n设计原则:\n- Token签发量极为轻(3接口,153行核心代码)\n- 离线链路不动(embedded/ frontend/零变更)\n- 权限位映射: lock/engine/trunk/window/climate/seat/fuel\n- 默认只有lock(最小权限原则)",
"is_bot": false,
"headline": "🎫 Token模块完整: 权限映射 + 换钥匙接口 + 离线链路确保",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T16:11:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6f0238901f001088aea375de339ce1cfc855a944",
"body": "核心模型:\n- Token = {ID, Owner, Subject, Vehicle, Permissions, ExpiresAt, MaxUses}\n- HMAC签名防篡改\n- 在线验证(计数) + 离线凭据(后续换钥匙)\n\n新增:\n- internal/token/token.go — Token Service (Issue/Verify/Revoke)\n- internal/gateway/token_handler.go — REST API\n POST /tokens 签发\n GET /tokens/:id 验证\n DELETE /tokens/:id 吊销\n\n设计原则:\n- 分享和服务商是同一个Token模型\n- 不分人还是系统,统一授权凭据\n- 极轻,不碰任何密钥材料",
"is_bot": false,
"headline": "🎫 DK Hub Token模块: 签发/验证/吊销 三接口骨架",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T16:07:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "89444b8e868399853bb352b7ad97522e1c54415f",
"body": "最终共识:\n- DK Hub = Token签发机,不碰钥匙\n- Token是授权凭据,钥匙是执行凭据\n- 服务商可在♂验证(轻量)或换受限钥匙(离线稳)\n- 分享和服务商是同一Token模型,不分家\n- 受限钥匙泄露了也影响有限(权限位+有效期)",
"is_bot": false,
"headline": "📐 DK Hub定稿: Token签发机模型 + 在线/离线统一",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T16:02:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f91dc19abdd5f79dd80d015a4474cbd8ca5f35e",
"body": "关键修正:\n- Hub不生成钥匙,只做授权决策\n- 钥匙签发链路: Hub→通知DK Server→TSP→PKI\n- 新增生态服务商授权数据流图\n- 比喻: Hub是'钥匙授权的OAuth平台'\n- 明确定义Hub不做清单(不生成钥匙/不碰私钥/不直接对接车端)",
"is_bot": false,
"headline": "📐 DK Hub定稿: 生态服务商授权场景 + Hub只做决策不碰钥匙",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T15:53:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0c71e2f55a4c990591b33ffcd901570a8cdae310",
"body": "新增:\n- backend/cloud/hub/cmd/yuledkcs/main.go — 统一入口\n --mode=all-in-one (默认) Hub+Server同进程\n --mode=hub-only 仅编排层\n --mode=server-only 仅密钥材料层\n\n文档:\n- docs/design/DK-HUB-ARCHITECTURE.md — 三层架构(更新)\n- docs/design/MIGRATION-PLAN.md — 包重组迁移计划\n- README.md — 快速启动更新为统一入口\n\n架构:\n- DK Hub = 编排层 (手机厂商对接+钥匙编排,不碰密钥)\n- DK Server = 密钥材料层 (KMS/证书/车端通信)\n- all-in-one模式部署在车厂云,密钥不出厂",
"is_bot": false,
"headline": "🎯 yuleDKCS统一入口: cmd/yuledkcs + 三种部署模式",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T15:42:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "68e5abe06e7e8b0c7c27643b40562ce8b9d32312",
"body": "老板确认架构合理，补充关键分层:\n- DK Hub: 编排层（我们管）\n- OEM DK Server: 车厂数字钥匙云（管密钥材料+车端通信）\n- OEM TSP: 车厂原有车联网平台（管车辆注册/数据上报）\n- 更新了绑定/分享数据流图\n- 更新了三种部署模式说明",
"is_bot": false,
"headline": "📐 DK Hub架构修正: 三层模型 DK Hub → OEM DK Server → OEM TSP",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T15:29:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8b00eb183e991b04a4345b74e0d28582386bfe90",
"body": "基于CCC/ICCOA/ICCE三个协议深度分析:\n- 三个协议都不要求云端持有密钥材料\n- 密钥材料天然在车端SE050和手机SE/Keychain\n- DKCS拆分: Hub(编排) + OEM KMS(密钥材料)\n- 三种部署模式: SaaS / On-Prem / 混合\n- 新增 docs/design/DK-HUB-ARCHITECTURE.md (9KB)",
"is_bot": false,
"headline": "📐 DK Hub 架构设计: 密钥编排层与密钥材料层分离",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T15:25:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "14d5bc8bb66e8d6bedc2e4a694d387adc40c0ebc",
"body": "- 8 个权限位定义 + 预设角色模板\n- 多车主 = 给多个用户分配 0xFF 权限，无需新功能\n- 示例场景: 夫妻/公司公车/代驾/修车/租车\n- 关键逻辑: 角色 = 权限组合，不是代码级概念",
"is_bot": false,
"headline": "📖 权限模型文档: 8位权限位组合实现多车主场景",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T15:22:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "acb6b3eeb59c19cd7922ff0833755a4422d11b6e",
"body": "- DeviceService: 设备注册/查询/删除 + 按设备能力配钥 + 远程吊销\n- REST API: POST/devices GET/devices GET/devices/:id\n POST/devices/:id/provision POST/devices/:id/revoke DELETE/devices/:id\n- Android DeviceCapabilities: BLE/UWB/NFC/StrongBox 自动检测\n- iOS DeviceCapabilities: BLE/CoreNFC/NearbyInteraction/SecureEnclave 自动检测\n- OpenSpec: docs/spec/spec-multi-device.md\n- 流程: 登录App → 自动检测能力 → 注册设备 → 按能力配专属钥匙\n\n每个设备最多5台, 已有钥匙不重复创建, 吊销即时生效",
"is_bot": false,
"headline": "📱 多设备配钥功能: 设备注册 + 按能力配钥 + 远程吊销",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T15:20:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1010d7ae252a68fd34e89887e4be2e560403296e",
"body": "- CreateShare: 增加valid_from/valid_until校验, 默认24h过期, max_uses计数\n- AcceptShare: 有效期验证 + 使用次数校验 + 密钥创建完整流程\n- CancelShare: 通知车端+手机端取消分享\n- GetShare: 查询分享状态(有效期/使用次数/状态)\n- 全链路审计日志",
"is_bot": false,
"headline": "🔑 分享生命周期完善: 过期约束 + 接收验证 + 取消/查询",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T15:06:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "607c8106d12e7407703c5235b4d8c0fc206a90fa",
"body": "- 全仓模块路径 github.com/digitalkey → github.com/frisky1985/yuleDKCS/backend/\n- 生产代码 TODO 清零（10处全部实现或清理）\n- 新增 go.work 多模块本地开发支持",
"is_bot": false,
"headline": "🧹 收尾清理: go.mod路径修正 + TODO清零 + go.work",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T06:13:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8e7edf9054cfa4cce014c57c400d5aaf034d3ff",
"body": null,
"is_bot": false,
"headline": "📚 整理项目结构: 审查报告移入docs/reviews/, 报告移入docs/reports/",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T03:03:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "24bd4e52f9ebe1bb219be2b39e43feec7c04040b",
"body": "Critical-1: 权限越权\n- KeyRecord/KeyStore 抽象存储层\n- verifyKeyOwnership() 全局资源归属检查\n- 6个Handler全部增加owner验证（admin豁免）\n\nCritical-2: 速率限制\n- 令牌桶per-IP限流 (100 req/s, burst 200)\n- 后台自动清理闲置IP (5min轮询, 10min TTL)\n- 429 + Retry-After header\n- 通过 WithRateLimit() 可配置/关闭",
"is_bot": false,
"headline": "🔒 渗透Critical修复: 权限越权 + 速率限制",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T01:41:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70ef873fbfaf5809ee754d0d4f4bad3beef58046",
"body": "Track G: K8s 部署\n- 19 K8s manifest (Hub/DKCS/MySQL/Redis/Kafka/EMQX/Ingress/PDB/HPA)\n- 19 Helm chart templates (parameterized deployment)\n- Prometheus + Grafana 监控全家桶 + 4条告警规则\n- docker-compose + monitoring compose 本地一键启动\n\nTrack H: 压力+渗透测试\n- 3场景压测框架 (1000/2000/3000并发)\n- 7攻击面渗透测试 (发现2个Critical + 2个Medium)\n- 性能瓶颈分析 + 改进建议",
"is_bot": false,
"headline": "Week 3: K8s部署 + 监控体系 + 压力测试框架 + 渗透测试",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T01:37:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8788d11ccef701c7a6aa29fc7e6a8e4cf89a5d84",
"body": "P0-1: SM2随机数生成器 LCG→三层安全RNG (HW TRNG→CTR_DRBG→DEBUG)\nP0-2: CCC GATT Service注册 (UUID 0xFFD1 + 6个Characteristic 0xFFD2-0xFFD7)\nP0-3: CCC SE050密钥存储 (sec_store/load/delete_key 完整实现)\nP0-4: CCC密钥持久化 (save/load_keys + Magic+Version+CRC校验)\nP0-5: ICCOA引擎启动安全检查 (ACCESS_ENGINE_START权限验证)\n\n修复覆盖: embedded/icce_protocol + embedded/ccc_protocol + embedded/iccoa_protocol",
"is_bot": false,
"headline": "🔒 P0合规隐患修复: SM2 RNG + CCC GATT + SE050存储 + 密钥持久化 + ICCOA引擎检查",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T01:24:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6bd9fdeea9b2dd8aba19ea30fa8ccb4a002db9a0",
"body": "Track D: 标准合规自检\n- CCC 3.0: 32项自检清单, 81.3%符合(26/32), 6项不符合含修复建议\n- ICCOA DK3.0/4.0: 32项自检清单, 90.6%符合(29/32), 3项不符合\n- SM3/SM4: 国标测试向量完全通过 ✅\n- SM2: 随机数生成器P0问题(LCG固定种子→需TRNG)\n\nTrack E: CI/CD流水线\n- .github/workflows/ci.yml (364行, 8个jobs)\n- .github/workflows/lint.yml (176行, cppcheck+gosec)\n- Go构建/测试/lint + 嵌入式编译 + Android/iOS构建 + 集成测试\n\n红线修复:\n- LICENSE (Apache 2.0), .gitignore\n- docker-compose.yml 密码强制env注入\n- 配置无明文密码",
"is_bot": false,
"headline": "Week 2: 标准合规自检 + CI/CD流水线 + 安全加固",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T01:01:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "22349d330518adcbc32e43d5495cebd988500c03",
"body": "- 创建 LICENSE (Apache 2.0, 含完整条款)\n- 创建 .gitignore (排除 IDE/构建产物/系统文件)\n- docker-compose.yml: 移除硬编码默认密码, 强制环境变量注入\n- 红线问题 P0 全部解决",
"is_bot": false,
"headline": "🔓 开源准备: Apache 2.0 License + .gitignore + 修复硬编码密码",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T00:59:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed5d0bfc9790f60c812c82b86adcd9b638ed8dff",
"body": "V-01: JWT鉴权中间件完整实现 (HMAC-SHA256, 真实login, claims提取)\nV-07: RevokeKey完整实现 (PushService接口, SuspendKey/ResumeKey)\nV-12: 速率限制 + JWT验证 (jwt.go, AuthInterceptor编译修复)\n包含: go.mod依赖更新, proto生成文件, go.sum",
"is_bot": false,
"headline": "🔒 P0漏洞修复闭环: JWT完整实现 + 速率限制 + RevokeKey改进",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-06-01T00:08:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e94589d798403083a0bf9e7a3a5409a2cf30723",
"body": "- BLE UUID统一: CCC 0xFFD1, ICCE 0xFEFA, ICCOA 0xFEF5\n- ICCE GATT常量定义 + Android/iOS选择器\n- CAN 死循环修复 + sec_verify 加固\n- README ICCE状态修正\n- 国密 SM2/SM3/SM4 算法层实现 (14文件, 4203行)\n- 双重算法栈: AES/SHA/ECDSA ↔ SM4/SM3/SM2 运行时切换\n- 全部通过 Hermes 最终审查 (41/41)",
"is_bot": false,
"headline": "🔧 协议标准符合性修复 (Hermes审查通过)",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-05-31T16:19:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b2204b110e7e37069848f2153bbed4f1918c312b",
"body": "- CR-7: 嵌入式非对齐内存访问 → 手动字节赋值\n- CR-8: iOS Keychain print() → os_log / 静默处理\n- CR-9: Android keysCache → ConcurrentHashMap\n- CR-10: Go后端 UnbindKey/SuspendKey/ResumeKey/RenewKey 实现\n- 全部通过 Hermes 最终审查",
"is_bot": false,
"headline": "🔧 CR-7~CR-10: 低优修复 (Hermes审查通过)",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-05-31T11:02:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac89587168fa1703cbf8bc2e583fe758999d094c",
"body": "- CODE-REVIEW-CR5-HANDLERS.md: Hermes handler审查\n- CODE-REVIEW-CR5-REGRESSION.md: Hermes回归审查\n- CODE-REVIEW-FINAL-CLAUDE.md: Claude最终验证\n- CODE-REVIEW-FINAL-HERMES.md: Hermes最终验证",
"is_bot": false,
"headline": "📄 添加审查报告: CR-5+Claude+Hermes最终验证",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-05-31T10:59:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb427d7472667b23cdbadab6cc6071a0eba056d7",
"body": "P0: RevokeKeyRequest.UserId — 已移除旧 c.GetString 模式, user_id 通过 gRPC metadata 传递\nP1: sendCommand Params — 使用 json.RawMessage 直接强转 []byte, 无额外 json.Marshal\nP2: listAdapters/hubHealthCheck — 已改用 replyProto, 旧 c.JSON 已清理\nP2: handleGRPCError — 已增加 DeadlineExceeded→504, ResourceExhausted→429",
"is_bot": false,
"headline": "✅ 回归审查通过: REST gateway handler 所有问题已修复",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-05-31T09:18:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f1d9611db5daa4c29ffc1eb18d744fffe986ae22",
"body": "CR-1 (🔴): iccoa_dk30.c seq_num 回绕 0xFFFF→0 被拒绝\n - 添加合法的回绕分支\nCR-2 (🔴): NfcSecureChannel READ 使用 WRITE APDU\n - 新增 buildSecureReadApdu() 使用 INS_SECURE_READ\n - NfcManager.kt secureReadData 改为调用 buildSecureReadApdu\nCR-3 (🔴): ShareKey 明文存储 Secret\n - 改为 hashSecret() 哈希后存储\nCR-4 (🟠): generateShareCode() 弱随机\n - 使用全部4字节，熵从<20位提升到32位\nCR-5 (🟠): REST handler stub\n - (标记为后续迭代)\nCR-6 (🟠): middleware.go 缺失 fmt import\n - 添加 import\n\n+ CODE-REVIEW-HERMES.md 审查报告",
"is_bot": false,
"headline": "🔒 CR-1~CR-6: Hermes代码审查发现的修复",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-05-31T08:54:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e5d6f8a4f26a354735ff32ae133978b6ca5260eb",
"body": "## 高危漏洞 (P0) — 7/7 修复\n- V-01: REST 网关添加 JWT auth middleware\n- V-02: ICCOA DK3.0 栈缓冲区溢出修复 (边界检查+wire offset+枚举验证)\n- V-03: CreateKey 不再明文返回 Secret (SHA-256 哈希存储)\n- V-04: Android SharedPreferences → EncryptedSharedPreferences\n- V-05: 全线时间戳 TODO 修复 (sys_tick_get_ms)\n- V-06: Android AES KeyGenerator → EC\n[…]\nbedded/system_architecture/sys_time.h — 时间抽象层\n- frontend/android/.../NfcSecureChannel.kt — NFC 安全通道\n- frontend/ios/.../KeychainManager.swift — iOS Keychain 封装\n- CODE-REVIEW-ARCHITECTURE-V3.md — 架构审查报告",
"is_bot": false,
"headline": "🔒 安全修复: 20个漏洞全清",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-05-31T08:41:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "15ed89946baaba6a5deebf39684643fc5065e119",
"body": "- 新增 unified/ 包 (2710行): 协议协商器、统一编解码、会话状态机\n- 支持 ICCOA/ICCE/CCC 三套协议自动路由\n- BER-TLV decoder 测试全部通过 (29/29)\n- BER-TLV encoder 测试 53/54 通过 (writeTag 多字节编码待修复)\n- dkcs 服务测试骨架 + key_service_test.go\n- 统一数据模型: Device/UnifiedMessage/CapabilitySet",
"is_bot": false,
"headline": "feat: 统一协议接口层 + BER-TLV编解码器",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-05-08T03:36:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2f4fa22545742028a81b71dad2d7be7ef65d7747",
"body": "- 新增 docs/design/ 目录，包含完整设计文档集\n - PRD (产品需求规格说明书, 26,000字)\n - PROJECT-PLAN (44任务/40周/7520工时)\n - TEST-PLAN (三端测试用例矩阵)\n - API-CONTRACT (详细接口契约)\n - 三端开发指南 (嵌入式/App/云端)\n - CODE-REVIEW-V2 (代码审查通过报告)\n - DELIVERY-REPORT (完整交付报告)\n - S32K3-MIGRATION-GUIDE\n- 重写 README.md，整合双项目文档索引",
"is_bot": false,
"headline": "docs: 补充 digital-key-project 设计文档",
"author_name": "Stefan Ming",
"author_login": null,
"committed_at": "2026-05-08T01:40:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91c30d047710fc39ca431707ce5990e5809b3196",
"body": "- DK 4.0: UWB安全测距、Session Token认证、HMAC-SHA256\n- BLE服务: GATT服务端、数据/控制特性、MTU协商\n- 认证模块: 用户权限管理、有效性检查\n- 车辆服务: 门锁/引擎/车窗/空调控制\n- 多设备并发支持(最多4个)",
"is_bot": false,
"headline": "feat(embedded): 完成ICCOA DK 3.0/4.0协议实现",
"author_name": "frisky1985",
"author_login": "frisky1985",
"committed_at": "2026-05-08T00:03:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d47bc1c55d09fd96c7c5232ac0fbdaa914a7ac2",
"body": "- 统一API整合CCC/ICCOA/ICCE三套协议\n- 设备类型驱动协议选择\n- 能力配置动态决定功能集\n- 状态机统一管理连接/认证/定位\n- 包含示例代码和完整文档",
"is_bot": false,
"headline": "feat(embedded): 添加统一协议接口层",
"author_name": "frisky1985",
"author_login": "frisky1985",
"committed_at": "2026-05-07T23:41:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09d6fcbfedac023ae7a14d222f6a142d8eba8b6c",
"body": "- BLE: 低功耗广播模式(非连接beacon)\n- BLE: 连接后自动唤醒UWB测距\n- BLE: 深度休眠支持(~0.5uA)\n- NFC: LPCD间歇场检测(~10uA)\n- NFC: EMD噪声抑制与状态机",
"is_bot": false,
"headline": "feat(embedded): 添加BLE低功耗模式与NFC LPCD支持",
"author_name": "frisky1985",
"author_login": "frisky1985",
"committed_at": "2026-05-07T16:53:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b68149acf3d5287b9ae8446e4bdb049a29c35c76",
"body": "- 新增 docs/SYSTEM_ARCHITECTURE.md: 完整的系统架构设计文档\n- 新增 docs/API_REFERENCE.md: REST/gRPC/MQTT API 参考文档\n- 新增 docs/DEPLOYMENT_GUIDE.md: Kubernetes 生产部署指南\n- 新增 docs/SECURITY_GUIDE.md: 安全架构和配置指南\n- 新增 docs/README.md: 项目主 README\n- 新增 backend/db/schema.sql: 完整数据库 schema\n- 新增 backend/dkcs/internal/proto/dkcs.proto: gRPC 协议定义\n- 更新 backend/dkcs/go.mod: Go 依赖管理\n- 更新 backend/dkcs/internal/config/config.go: 配置管理",
"is_bot": false,
"headline": "docs: 完善系统架构设计、API文档、部署指南、安全指南",
"author_name": "frisky1985",
"author_login": "frisky1985",
"committed_at": "2026-05-06T16:17:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8126b953347e774276df14d51302c6f47c90d866",
"body": null,
"is_bot": false,
"headline": "chore: 删除非技术文档文件",
"author_name": "frisky1985",
"author_login": "frisky1985",
"committed_at": "2026-05-06T15:47:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d1361bd3feedd6656eaa0411088ab091ab0bf514",
"body": "- 删除742个无关文件（agents配置、skills、临时文件等）\n- 保留backend/（云端服务）、frontend/（手机端）、embedded/（车端）\n- 确保工程结构清晰，聚焦三端能力实现",
"is_bot": false,
"headline": "chore: 清理仓库，仅保留三端核心代码",
"author_name": "frisky1985",
"author_login": "frisky1985",
"committed_at": "2026-05-06T15:41:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2c9db962de6c4c18e277e1e1a297b178c8f91239",
"body": "- frontend/: 手机端\n- backend/: 云端服务\n- embedded/: 车端嵌入式协议栈\n\n详见各目录README",
"is_bot": false,
"headline": "feat: 数字钥匙系统三端完整代码",
"author_name": "frisky1985",
"author_login": "frisky1985",
"committed_at": "2026-05-06T15:33:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5a70505800f9bc3a62da7bc361ab5f148a92b999",
"body": "- API Gateway + Core Service (Go)\n- Adapter Service (Java/Spring Boot)\n- gRPC双向通信接口\n- 完整数据库Schema\n- Docker Compose部署\n- 6周实施计划",
"is_bot": false,
"headline": "feat(architecture): v2.0 Go+Java混合架构设计",
"author_name": "frisky1985",
"author_login": "frisky1985",
"committed_at": "2026-05-06T02:43:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9dd72b7dc2d322bc430e994c588cc55b9ae01c6f",
"body": "- BLE管理 (BleManager.kt) - BLE扫描/连接/读写\n- NFC管理 (NfcManager.kt) - NFC读卡/APDU命令\n- UWB管理 (UwbManager.kt) - UWB测距\n- 密钥管理 (KeyManager.kt) - 密钥生命周期管理\n- BERTLV编解码 (BertlvEncoder.kt, BertlvDecoder.kt)\n- 统一错误码 (DkError.kt)\n- 统一日志 (DkLogger.kt)\n- 统一埋点 (DkTelemetry.kt)",
"is_bot": false,
"headline": "feat(android-sdk): 完成Android数字钥匙SDK核心模块",
"author_name": "frisky1985",
"author_login": "frisky1985",
"committed_at": "2026-05-06T02:18:28Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 2,
"commits_last_year": 42,
"latest_release_at": "2026-07-16T13:58:13Z",
"latest_release_tag": "v2.1.0",
"releases_from_tags": true,
"days_since_last_push": 5,
"active_weeks_last_year": 3,
"days_since_latest_release": 9,
"mean_days_between_releases": 51.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 71,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/frisky1985/yuleDKCS",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/frisky1985/yuleDKCS",
"is_deprecated": false,
"latest_version": "v2.1.0+incompatible",
"repository_url": "https://github.com/frisky1985/yuleDKCS",
"versions_count": 2,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-16T13:58:13Z",
"latest_version_yanked": null,
"days_since_latest_publish": 9
}
]
},
"popularity": {
"forks": 1,
"stars": 3,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2026-07-11",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile",
"embedded/tests/Makefile"
],
"api_schema_files": [
"backend/adapters/adapter-grpc-server/src/main/proto/adapter.proto",
"backend/cloud/hub/api/dk/v1/dk_server.proto",
"backend/cloud/hub/api/v1/hub.proto",
"backend/cloud/protocol/dkcs-hub.proto",
"backend/cloud/protocol/dkcs-tcu.proto",
"backend/dkcs/internal/proto/dkcs.proto",
"docs/api/openapi.yaml"
],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"backend/adapters/adapter-ccc/pom.xml",
"backend/adapters/adapter-core/pom.xml",
"backend/adapters/adapter-grpc-server/pom.xml",
"backend/adapters/adapter-icce/pom.xml",
"backend/adapters/adapter-iccoa/pom.xml",
"backend/adapters/pom.xml",
"backend/cloud/hub/go.mod",
"backend/cloud/hub/tests/integration/go.mod",
"backend/cloud/hub/tests/stress/go.mod",
"backend/dkcs/go.mod",
"backend/dkcs/proto/go.mod",
"frontend/android-app/build.gradle.kts",
"frontend/android/build.gradle.kts"
],
"largest_source_bytes": 101443,
"source_files_sampled": 281,
"oversized_source_files": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "google.golang.org/grpc",
"direct": true,
"version": "v1.62.0",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 9.1,
"advisory_ids": [
"GHSA-hrxh-6v49-42gf",
"GHSA-p77j-4mvh-x3m3",
"GO-2026-4762"
],
"fixed_version": "1.82.1",
"advisory_count": 3,
"oldest_advisory_days": 129
},
{
"name": "google.golang.org/grpc",
"direct": true,
"version": "v1.63.2",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 9.1,
"advisory_ids": [
"GHSA-hrxh-6v49-42gf",
"GHSA-p77j-4mvh-x3m3",
"GO-2026-4762"
],
"fixed_version": "1.82.1",
"advisory_count": 3,
"oldest_advisory_days": 129
},
{
"name": "google.golang.org/grpc",
"direct": true,
"version": "v1.81.1",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 9.1,
"advisory_ids": [
"GHSA-hrxh-6v49-42gf"
],
"fixed_version": "1.82.1",
"advisory_count": 1,
"oldest_advisory_days": 4
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.48.0",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 10,
"advisory_ids": [
"GHSA-45gg-vh54-h5m9",
"GHSA-5cgq-3rg8-m6cv",
"GHSA-78mq-xcr3-xm33",
"GHSA-89gr-r52h-f8rx",
"GHSA-9m57-25v3-79x9",
"GHSA-f5wc-c3c7-36mc",
"GHSA-jppx-rxg9-jmrx",
"GHSA-q4h4-gmj2-qvw2",
"GHSA-qpw4-5x99-6vjp",
"GHSA-rm3j-f69w-wqmq"
],
"fixed_version": "0.52.0",
"advisory_count": 27,
"oldest_advisory_days": 64
},
{
"name": "com.google.protobuf:protobuf-java",
"direct": true,
"version": "3.25.4",
"severity": "high",
"ecosystem": "maven",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-735f-pc8j-v9w8"
],
"fixed_version": "4.28.2",
"advisory_count": 1,
"oldest_advisory_days": 674
},
{
"name": "io.grpc:grpc-netty-shaded",
"direct": true,
"version": "1.62.2",
"severity": "high",
"ecosystem": "maven",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-prj3-ccx8-p6x4"
],
"fixed_version": "4.2.4.Final",
"advisory_count": 1,
"oldest_advisory_days": 346
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.51.0",
"severity": "moderate",
"ecosystem": "go",
"cvss_score": 6.5,
"advisory_ids": [
"GHSA-5cv4-jp36-h3mw",
"GO-2026-4918",
"GO-2026-5025",
"GO-2026-5026",
"GO-2026-5027",
"GO-2026-5028",
"GO-2026-5029",
"GO-2026-5030",
"GO-2026-5942"
],
"fixed_version": "1.26.3",
"advisory_count": 9,
"oldest_advisory_days": 79
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 18
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.55.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5942"
],
"fixed_version": "0.56.0",
"advisory_count": 1,
"oldest_advisory_days": 11
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.42.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5024"
],
"fixed_version": "0.44.0",
"advisory_count": 1,
"oldest_advisory_days": 64
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.34.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5970"
],
"fixed_version": "0.39.0",
"advisory_count": 1,
"oldest_advisory_days": 11
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.37.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5970"
],
"fixed_version": "0.39.0",
"advisory_count": 1,
"oldest_advisory_days": 11
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"high": 2,
"unknown": 5,
"critical": 4,
"moderate": 1
},
"advisory_count": 50,
"affected_count": 12,
"assessed_count": 83,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 17,
"direct_affected_count": 5
},
"ecosystems": [],
"dependencies": [
{
"name": "org.springframework.boot:spring-boot-dependencies",
"manifest": "backend/adapters/pom.xml",
"ecosystem": "maven",
"version_constraint": "${spring-boot.version}"
},
{
"name": "net.devh:grpc-server-spring-boot-starter",
"manifest": "backend/adapters/pom.xml",
"ecosystem": "maven",
"version_constraint": "${grpc-spring-boot.version}"
},
{
"name": "io.grpc:grpc-protobuf",
"manifest": "backend/adapters/pom.xml",
"ecosystem": "maven",
"version_constraint": "${grpc.version}"
},
{
"name": "io.grpc:grpc-stub",
"manifest": "backend/adapters/pom.xml",
"ecosystem": "maven",
"version_constraint": "${grpc.version}"
},
{
"name": "io.grpc:grpc-netty-shaded",
"manifest": "backend/adapters/pom.xml",
"ecosystem": "maven",
"version_constraint": "${grpc.version}"
},
{
"name": "io.grpc:grpc-services",
"manifest": "backend/adapters/pom.xml",
"ecosystem": "maven",
"version_constraint": "${grpc.version}"
},
{
"name": "com.google.protobuf:protobuf-java",
"manifest": "backend/adapters/pom.xml",
"ecosystem": "maven",
"version_constraint": "${protobuf.version}"
},
{
"name": "io.micrometer:micrometer-core",
"manifest": "backend/adapters/pom.xml",
"ecosystem": "maven",
"version_constraint": "${micrometer.version}"
},
{
"name": "io.micrometer:micrometer-registry-prometheus",
"manifest": "backend/adapters/pom.xml",
"ecosystem": "maven",
"version_constraint": "${micrometer.version}"
},
{
"name": "github.com/golang-jwt/jwt/v5",
"manifest": "backend/dkcs/go.mod",
"ecosystem": "go",
"version_constraint": "v5.3.1"
},
{
"name": "github.com/jmoiron/sqlx",
"manifest": "backend/dkcs/go.mod",
"ecosystem": "go",
"version_constraint": "v1.4.0"
},
{
"name": "github.com/lib/pq",
"manifest": "backend/dkcs/go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.9"
},
{
"name": "github.com/redis/go-redis/v9",
"manifest": "backend/dkcs/go.mod",
"ecosystem": "go",
"version_constraint": "v9.21.0"
},
{
"name": "google.golang.org/grpc",
"manifest": "backend/dkcs/go.mod",
"ecosystem": "go",
"version_constraint": "v1.63.2"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/golang-jwt/jwt/v5",
"direct": true,
"version": "v5.3.1",
"ecosystem": "go"
},
{
"name": "github.com/jmoiron/sqlx",
"direct": true,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/lib/pq",
"direct": true,
"version": "v1.10.9",
"ecosystem": "go"
},
{
"name": "github.com/redis/go-redis/v9",
"direct": true,
"version": "v9.21.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/grpc",
"direct": true,
"version": "v1.62.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/grpc",
"direct": true,
"version": "v1.63.2",
"ecosystem": "go"
},
{
"name": "google.golang.org/grpc",
"direct": true,
"version": "v1.81.1",
"ecosystem": "go"
},
{
"name": "com.google.protobuf:protobuf-java",
"direct": true,
"version": null,
"ecosystem": "maven"
},
{
"name": "com.google.protobuf:protobuf-java",
"direct": true,
"version": "3.25.4",
"ecosystem": "maven"
},
{
"name": "io.grpc:grpc-netty-shaded",
"direct": true,
"version": "1.62.2",
"ecosystem": "maven"
},
{
"name": "io.grpc:grpc-protobuf",
"direct": true,
"version": null,
"ecosystem": "maven"
},
{
"name": "io.grpc:grpc-protobuf",
"direct": true,
"version": "1.62.2",
"ecosystem": "maven"
},
{
"name": "io.grpc:grpc-services",
"direct": true,
"version": null,
"ecosystem": "maven"
},
{
"name": "io.grpc:grpc-services",
"direct": true,
"version": "1.62.2",
"ecosystem": "maven"
},
{
"name": "io.grpc:grpc-stub",
"direct": true,
"version": null,
"ecosystem": "maven"
},
{
"name": "io.grpc:grpc-stub",
"direct": true,
"version": "1.62.2",
"ecosystem": "maven"
},
{
"name": "io.micrometer:micrometer-core",
"direct": true,
"version": "1.13.4",
"ecosystem": "maven"
},
{
"name": "io.micrometer:micrometer-registry-prometheus",
"direct": true,
"version": null,
"ecosystem": "maven"
},
{
"name": "io.micrometer:micrometer-registry-prometheus",
"direct": true,
"version": "1.13.4",
"ecosystem": "maven"
},
{
"name": "net.devh:grpc-server-spring-boot-starter",
"direct": true,
"version": null,
"ecosystem": "maven"
},
{
"name": "net.devh:grpc-server-spring-boot-starter",
"direct": true,
"version": "3.1.0.RELEASE",
"ecosystem": "maven"
},
{
"name": "org.springframework.boot:spring-boot-dependencies",
"direct": true,
"version": "3.2.5",
"ecosystem": "maven"
},
{
"name": "github.com/alicebob/miniredis/v2",
"direct": false,
"version": "v2.38.0",
"ecosystem": "go"
},
{
"name": "github.com/bytedance/sonic",
"direct": false,
"version": "v1.11.6",
"ecosystem": "go"
},
{
"name": "github.com/bytedance/sonic/loader",
"direct": false,
"version": "v0.1.1",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/cloudwego/base64x",
"direct": false,
"version": "v0.1.4",
"ecosystem": "go"
},
{
"name": "github.com/cloudwego/iasm",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/data-dog/go-sqlmock",
"direct": false,
"version": "v1.5.2",
"ecosystem": "go"
},
{
"name": "github.com/davecgh/go-spew",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/eapache/go-resiliency",
"direct": false,
"version": "v1.7.0",
"ecosystem": "go"
},
{
"name": "github.com/gabriel-vasile/mimetype",
"direct": false,
"version": "v1.4.3",
"ecosystem": "go"
},
{
"name": "github.com/gin-contrib/sse",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/gin-gonic/gin",
"direct": false,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "github.com/go-playground/locales",
"direct": false,
"version": "v0.14.1",
"ecosystem": "go"
},
{
"name": "github.com/go-playground/universal-translator",
"direct": false,
"version": "v0.18.1",
"ecosystem": "go"
},
{
"name": "github.com/go-playground/validator/v10",
"direct": false,
"version": "v10.20.0",
"ecosystem": "go"
},
{
"name": "github.com/go-redis/redis/v8",
"direct": false,
"version": "v8.11.5",
"ecosystem": "go"
},
{
"name": "github.com/goccy/go-json",
"direct": false,
"version": "v0.10.2",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/go-uuid",
"direct": false,
"version": "v1.0.3",
"ecosystem": "go"
},
{
"name": "github.com/ibm/sarama",
"direct": false,
"version": "v1.50.1",
"ecosystem": "go"
},
{
"name": "github.com/jcmturner/aescts/v2",
"direct": false,
"version": "v2.0.0",
"ecosystem": "go"
},
{
"name": "github.com/jcmturner/dnsutils/v2",
"direct": false,
"version": "v2.0.0",
"ecosystem": "go"
},
{
"name": "github.com/jcmturner/gofork",
"direct": false,
"version": "v1.7.6",
"ecosystem": "go"
},
{
"name": "github.com/jcmturner/gokrb5/v8",
"direct": false,
"version": "v8.4.4",
"ecosystem": "go"
},
{
"name": "github.com/jcmturner/rpc/v2",
"direct": false,
"version": "v2.0.3",
"ecosystem": "go"
},
{
"name": "github.com/json-iterator/go",
"direct": false,
"version": "v1.1.12",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/compress",
"direct": false,
"version": "v1.18.6",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/cpuid/v2",
"direct": false,
"version": "v2.2.7",
"ecosystem": "go"
},
{
"name": "github.com/lann/builder",
"direct": false,
"version": "v0.0.0-20180802200727-47ae307949d0",
"ecosystem": "go"
},
{
"name": "github.com/lann/ps",
"direct": false,
"version": "v0.0.0-20150810152359-62de8c46ede0",
"ecosystem": "go"
},
{
"name": "github.com/leodido/go-urn",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/masterminds/squirrel",
"direct": false,
"version": "v1.5.4",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-isatty",
"direct": false,
"version": "v0.0.20",
"ecosystem": "go"
},
{
"name": "github.com/modern-go/concurrent",
"direct": false,
"version": "v0.0.0-20180306012644-bacd9c7ef1dd",
"ecosystem": "go"
},
{
"name": "github.com/modern-go/reflect2",
"direct": false,
"version": "v1.0.2",
"ecosystem": "go"
},
{
"name": "github.com/pelletier/go-toml/v2",
"direct": false,
"version": "v2.2.2",
"ecosystem": "go"
},
{
"name": "github.com/pierrec/lz4/v4",
"direct": false,
"version": "v4.1.26",
"ecosystem": "go"
},
{
"name": "github.com/pmezard/go-difflib",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/prometheus/client_golang",
"direct": false,
"version": "v1.19.0",
"ecosystem": "go"
},
{
"name": "github.com/rcrowley/go-metrics",
"direct": false,
"version": "v0.0.0-20250401214520-65e299d6c5c9",
"ecosystem": "go"
},
{
"name": "github.com/segmentio/kafka-go",
"direct": false,
"version": "v0.4.47",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/testify",
"direct": false,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "github.com/twitchyliquid64/golang-asm",
"direct": false,
"version": "v0.15.1",
"ecosystem": "go"
},
{
"name": "github.com/ugorji/go/codec",
"direct": false,
"version": "v1.2.12",
"ecosystem": "go"
},
{
"name": "github.com/yuin/gopher-lua",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "go.uber.org/atomic",
"direct": false,
"version": "v1.11.0",
"ecosystem": "go"
},
{
"name": "go.uber.org/multierr",
"direct": false,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "go.uber.org/zap",
"direct": false,
"version": "v1.27.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/arch",
"direct": false,
"version": "v0.8.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.48.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.51.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.55.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.42.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.45.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.34.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.37.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/rpc",
"direct": false,
"version": "v0.0.0-20240227224415-6ceb2ff114de",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/rpc",
"direct": false,
"version": "v0.0.0-20260226221140-a57be14db171",
"ecosystem": "go"
},
{
"name": "google.golang.org/protobuf",
"direct": false,
"version": "v1.33.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/protobuf",
"direct": false,
"version": "v1.36.11",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": false,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "com.digitalkey:adapter-core",
"direct": false,
"version": "1.0.0-SNAPSHOT",
"ecosystem": "maven"
},
{
"name": "com.fasterxml.jackson.core:jackson-databind",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "io.grpc:grpc-testing",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "io.grpc:grpc-testing",
"direct": false,
"version": "1.62.2",
"ecosystem": "maven"
},
{
"name": "jakarta.annotation:jakarta.annotation-api",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "org.apache.maven.plugins:maven-compiler-plugin",
"direct": false,
"version": "3.13.0",
"ecosystem": "maven"
},
{
"name": "org.apache.tomcat:annotations-api",
"direct": false,
"version": "6.0.53",
"ecosystem": "maven"
},
{
"name": "org.projectlombok:lombok",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "org.springframework.boot:spring-boot-configuration-processor",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "org.springframework.boot:spring-boot-maven-plugin",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "org.springframework.boot:spring-boot-maven-plugin",
"direct": false,
"version": "3.2.5",
"ecosystem": "maven"
},
{
"name": "org.springframework.boot:spring-boot-starter-actuator",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "org.springframework.boot:spring-boot-starter-test",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "org.springframework.boot:spring-boot-starter-web",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "org.springframework.boot:spring-boot-starter-webflux",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "org.xolstice.maven.plugins:protobuf-maven-plugin",
"direct": false,
"version": null,
"ecosystem": "maven"
},
{
"name": "org.xolstice.maven.plugins:protobuf-maven-plugin",
"direct": false,
"version": "0.6.1",
"ecosystem": "maven"
}
],
"collected": true,
"truncated": false,
"total_count": 100,
"direct_count": 22,
"indirect_count": 78
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "frisky1985",
"commits": 9,
"avatar_url": "https://avatars.githubusercontent.com/u/8830125?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"coverage-monitor.yml",
"frontend-test.yml",
"java-ci.yml",
"lint.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 9,
"reason": "binaries present in source code",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 10,
"reason": "project is fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "0a6e90ab4bee61dc4b62042e133e9d507f1960c2",
"ran_at": "2026-07-25T23:50:57Z",
"aggregate_score": 3.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-25T04:02:09Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": "FAILURE",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/frisky1985/yuleDKCS",
"host": "github.com",
"name": "yuleDKCS",
"owner": "frisky1985"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"security": 35,
"vitality": 64,
"community": 42,
"governance": 35,
"engineering": 82
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 64,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"commits_last_year": 42,
"human_commit_share": 1,
"days_since_last_push": 5,
"active_weeks_last_year": 3
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "3/52 weeks with commits",
"points": 2.1,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 3
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "42 commits in the last year",
"points": 14.7,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 42
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 80,
"inputs": {
"releases_count": 2,
"latest_release_tag": "v2.1.0",
"releases_from_tags": true,
"days_since_latest_release": 9,
"mean_days_between_releases": 51.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "2 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 2
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 9 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 9
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~51.2 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 51.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 42,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 5,
"inputs": {
"forks": 1,
"stars": 3,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "3 stars",
"points": 4.9,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 3
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 35,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution",
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 50,
"inputs": {
"followers": 4,
"owner_type": "User",
"is_verified": null,
"owner_login": "frisky1985",
"public_repos": 129,
"account_age_days": 4327
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "4 followers of frisky1985",
"points": 5,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 4,
"login": "frisky1985"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "129 public repos, account ~11 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 129
}
},
{
"code": "account_age_years",
"params": {
"years": 11
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"packages": [
"github.com/frisky1985/yuleDKCS"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 9
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 9 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 9
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "2 published versions",
"points": 12,
"status": "partial",
"details": [
{
"code": "published_versions",
"params": {
"count": 2
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 82,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 80,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "5 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 5
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"topics": [
"automotive",
"bluetooth",
"ccc",
"connected-car",
"digital-key",
"digital-twin",
"icce",
"iot",
"nfc",
"uwb",
"car-connectivity",
"iccoa"
],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "12 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 12
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 35,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 35,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 3.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "binaries present in source code",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is fuzzed",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "at_risk",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 83 resolved dependencies against OSV; 17 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 83
}
},
{
"code": "advisories_unassessed",
"params": {
"count": 17
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 36,
"inputs": {
"source": "osv",
"advisories": 50,
"affected_packages": 12,
"assessed_packages": 83,
"unassessed_packages": 17,
"affected_by_severity": "critical 4, high 2, moderate 1, unknown 5",
"direct_affected_packages": 5
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "5 affected: google.golang.org/grpc v1.62.0 (critical 9.1), google.golang.org/grpc v1.63.2 (critical 9.1), google.golang.org/grpc v1.81.1 (critical 9.1), +2 more",
"points": 5.2,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 5,
"packages": "google.golang.org/grpc v1.62.0 (critical 9.1), google.golang.org/grpc v1.63.2 (critical 9.1), google.golang.org/grpc v1.81.1 (critical 9.1)"
}
},
{
"code": "advisories_affected_more",
"params": {
"count": 2
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "4 advisory-carrying package(s) unaddressed past 90 days; oldest published 674 days ago",
"points": 21.9,
"status": "partial",
"details": [
{
"code": "advisories_stale",
"params": {
"days": 90,
"count": 4,
"oldest": 674
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 83,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 68,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.976,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "41 of 42 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 41,
"sampled": 42
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 72,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Makefile",
"embedded/tests/Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"backend/adapters/adapter-ccc/pom.xml",
"backend/adapters/adapter-core/pom.xml",
"backend/adapters/adapter-grpc-server/pom.xml",
"backend/adapters/adapter-icce/pom.xml",
"backend/adapters/adapter-iccoa/pom.xml",
"backend/adapters/pom.xml",
"backend/cloud/hub/go.mod",
"backend/cloud/hub/tests/integration/go.mod",
"backend/cloud/hub/tests/stress/go.mod",
"backend/dkcs/go.mod",
"backend/dkcs/proto/go.mod",
"frontend/android-app/build.gradle.kts",
"frontend/android/build.gradle.kts"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile, embedded/tests/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile, embedded/tests/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 42",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 42
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 101443,
"source_files_sampled": 281,
"oversized_source_files": 1
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "1/281 source files over 60KB",
"points": 54.8,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 281,
"oversized": 1
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "good",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 80,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": [
"backend/adapters/adapter-grpc-server/src/main/proto/adapter.proto",
"backend/cloud/hub/api/dk/v1/dk_server.proto",
"backend/cloud/hub/api/v1/hub.proto",
"backend/cloud/protocol/dkcs-hub.proto",
"backend/cloud/protocol/dkcs-tcu.proto",
"backend/dkcs/internal/proto/dkcs.proto",
"docs/api/openapi.yaml"
]
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": "backend/adapters/adapter-grpc-server/src/main/proto/adapter.proto, backend/cloud/hub/api/dk/v1/dk_server.proto, backend/cloud/hub/api/v1/hub.proto, backend/cloud/protocol/dkcs-hub.proto, backend/cloud/protocol/dkcs-tcu.proto, backend/dkcs/internal/proto/dkcs.proto, docs/api/openapi.yaml",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "backend/adapters/adapter-grpc-server/src/main/proto/adapter.proto, backend/cloud/hub/api/dk/v1/dk_server.proto, backend/cloud/hub/api/v1/hub.proto, backend/cloud/protocol/dkcs-hub.proto, backend/cloud/protocol/dkcs-tcu.proto, backend/dkcs/internal/proto/dkcs.proto, docs/api/openapi.yaml"
}
}
],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-25T23:51:03.241803Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/f/frisky1985/yuleDKCS.svg",
"full_name": "frisky1985/yuleDKCS",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — Go.