Public recordCritical
Software health reportschema 0.26.0 · metrics 1.13.0 · 2026-07-22 15:34 UTC
zhlynn / zsign
Fast Cross-Platform iOS Code Signing Tool
zhlynn/zsign holds a health index of 28 out of 100, placing it in the Critical band. It scores highest on Vitality (79/100) and lowest on Security (17/100). It was last updated 6 days ago. A single contributor accounts for most of its recent work.
28
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
28
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
High-Risk Jurisdiction Policy applies a 50% multiplier to weighted overall health and gives it an At risk ceiling of 49.
Ownership
zhlynnPersonal account
159 followers3 public repossince Jan 2013
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
79
Development activity
72Good
How it's scored
| 36/36 | Push recency — last push 6 days ago |
| 7.6/36 | Commit cadence — 11/52 weeks with commits |
| 18/18 | Commit volume — 110 commits in the last year |
| 10/10 | OpenSSF Scorecard: Maintained — 24 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 |
Inputs used
| commits_last_year | 110 |
| human_commit_share | 1 |
| days_since_last_push | 6 |
| active_weeks_last_year | 11 |
Release discipline
90Excellent
How it's scored
| 27/27 | Ships releases — 15 releases published |
| 36/36 | Release recency — latest release 6 days ago |
| 27/27 | Release cadence — a release every ~11.6 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases. |
Inputs used
| releases_count | 15 |
| latest_release_tag | v1.1.1 |
| releases_from_tags | no |
| days_since_latest_release | 6 |
| mean_days_between_releases | 11.6 |
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
69
Popularity & adoption
85Excellent
How it's scored
| 52.9/60 | Stars — 1,813 stars |
| 22.4/25 | Forks — 487 forks |
| 9.3/15 | Watchers — 48 watchers |
Inputs used
| forks | 487 |
| stars | 1,813 |
| watchers | 48 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
50Moderate
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (MIT) |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
56
Maintainer resilience (bus factor)
40At risk
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 8/22.5 | Commit distribution — top contributor authored 64% of commits |
| 13.5/13.5 | Contributor breadth — 41 contributors |
| 10/10 | OpenSSF Scorecard: Contributors — project has 3 contributing companies or organizations -- score normalized to 10 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 41 |
| top_contributor_share | 0.645 |
How it's scored
| 46.8/46.8 | Issue resolution — 100% of issues closed |
| 27.7/38.3 | PR acceptance — 87/120 decided PRs merged |
| 4.5/15 | OpenSSF Scorecard: Code-Review — Found 7/20 approved changesets -- score normalized to 3 |
Inputs used
| merged_prs | 87 |
| open_issues | 0 |
| closed_issues | 258 |
| issue_closed_ratio | 1 |
| closed_unmerged_prs | 33 |
Ownership & stewardship
53Moderate
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 15.8/25 | Owner reach — 159 followers of zhlynn |
| 16.4/25 | Track record — 3 public repos, account ~13 yr old |
Inputs used
| followers | 159 |
| owner_type | User |
| is_verified | — |
| owner_login | zhlynn |
| public_repos | 3 |
| account_age_days | 4,925 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Engineering Quality
Are baseline engineering and documentation practices in place?
49
Engineering practices
48At risk
How it's scored
| 24/24 | CI workflows — 1 workflow(s) |
| 24/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — 0 out of 7 merged PRs checked by a CI test -- score normalized to 0 |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Documentation
50Moderate
How it's scored
| 30/30 | README |
| 0/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 0/10 | Topics |
| 10/10 | Wiki |
Inputs used
| topics | — |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | no |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
17
Security posture
17Critical
Jurisdiction risk alert
High-risk jurisdiction exposure detected
1 top contributor profilesRussiaSecurity and overall rating: At risk ceiling
Based on self-published public profile locations. This governance signal does not determine nationality, citizenship, intent, sanctions status, or individual trustworthiness.
How jurisdiction exposure is assessedHow it's scored
| 4.5/7.5 | Binary-Artifacts — binaries present in source code |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 0 out of 7 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 2.2/7.5 | Code-Review — Found 7/20 approved changesets -- score normalized to 3 |
| 2.5/2.5 | Contributors — project has 3 contributing companies or organizations -- score normalized to 10 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 7.5/7.5 | Maintained — 24 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — no data |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 5.2/7.5 | Vulnerabilities — 3 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 3.5 |
| high_risk_jurisdiction_cap | 49 |
| high_risk_jurisdiction_multiplier | 50 |
| security_posture_after_multiplier | 17 |
| security_posture_before_jurisdiction | 34 |
Excluded from scoring (no data or not applicable): packaging. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 50% multiplier and gives Security posture an At risk ceiling of 49.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
55
Agent context & guidance
40At risk
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 80 of 100 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.8 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Verify loop (build / test / typecheck)
51Moderate
How it's scored
| 18/18 | One-command bootstrap — build/linux/Makefile, build/macos/Makefile, test/dylib/demo/Makefile |
| 22/22 | Automated tests |
| 0/11 | Lint / format config |
| 11/11 | Static type checking — C++ (statically typed) |
| 0/10 | Reproducible environment |
| 0/10 | Demonstrated agent practice — no agent-authored commits among the last 100 |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | — |
| has_dockerfile | no |
| typed_language | yes |
| bootstrap_files | build/linux/Makefile, build/macos/Makefile, test/dylib/demo/Makefile |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Code legibility for models
95Excellent
How it's scored
| 45/45 | Type-checkable code — C++ (statically typed) |
| 50.4/55 | Manageable file sizes — 6/71 source files over 60KB |
Inputs used
| primary_language | C++ |
| largest_source_bytes | 591,749 |
| source_files_sampled | 71 |
| oversized_source_files | 6 |
Key facts
1,813GitHub stars
41contributors
110commits, last 12 months
6days since last push
15releases
1bus factor
0open issues
—package ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail
Star and fork history 0 ★ / 487 ⇿
0Stars
487Forks
14Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 1Minor 1Patch 11
Each point covers 7 days.
OpenSSF Scorecard 3.5 / 10
3.5aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 6 | Binary-Artifacts | binaries present in source code |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 0 | CI-Tests | 0 out of 7 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 3 | Code-Review | Found 7/20 approved changesets -- score normalized to 3 |
| 10 | Contributors | project has 3 contributing companies or organizations -- score normalized to 10 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 24 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 |
| n/a | Packaging | packaging workflow not detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 7 | Vulnerabilities | 3 existing vulnerabilities detected |
All dependencies 0
Full resolved dependency set from the GitHub dependency graph: 0 direct and 0 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
| Registry | Package | Version | Relation |
|---|
Dependency advisories not assessed
Advisory matching could not run for this report: No resolved dependencies to assess
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 23931,
"has_wiki": true,
"homepage": null,
"languages": {
"C": 25482,
"C++": 338256,
"Shell": 868,
"Makefile": 5652,
"PowerShell": 543,
"Objective-C": 1103
},
"pushed_at": "2026-07-16T09:57:45Z",
"created_at": "2019-09-19T06:17:27Z",
"owner_type": "User",
"updated_at": "2026-07-22T11:49:23Z",
"description": "Fast Cross-Platform iOS Code Signing Tool",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "master",
"license_spdx_raw": "MIT",
"primary_language": "C++",
"significant_languages": [
"C++"
]
},
"owner": {
"blog": null,
"name": null,
"type": "User",
"login": "zhlynn",
"company": null,
"location": null,
"followers": 159,
"avatar_url": "https://avatars.githubusercontent.com/u/3388663?v=4",
"created_at": "2013-01-26T07:47:08Z",
"is_verified": null,
"public_repos": 3,
"account_age_days": 4925
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.1.1",
"kind": "patch",
"published_at": "2026-07-16T10:01:40Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-15T03:33:52Z"
},
{
"tag": "v1.0.9",
"kind": "patch",
"published_at": "2026-07-14T04:35:49Z"
},
{
"tag": "v1.0.8",
"kind": "patch",
"published_at": "2026-07-08T07:59:08Z"
},
{
"tag": "v1.0.5",
"kind": "patch",
"published_at": "2026-07-07T06:59:31Z"
},
{
"tag": "v1.0.4",
"kind": "patch",
"published_at": "2026-04-14T02:14:56Z"
},
{
"tag": "v1.0.3",
"kind": "patch",
"published_at": "2026-04-12T13:54:04Z"
},
{
"tag": "v1.0.2",
"kind": "patch",
"published_at": "2026-04-07T04:43:33Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-04-03T10:52:06Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-04-03T01:52:01Z"
},
{
"tag": "v0.9.7",
"kind": "patch",
"published_at": "2026-04-03T01:17:05Z"
},
{
"tag": "v0.9.6",
"kind": "patch",
"published_at": "2026-03-09T01:47:37Z"
},
{
"tag": "v0.9.3",
"kind": "patch",
"published_at": "2026-03-08T05:32:50Z"
},
{
"tag": "v0.9.2",
"kind": "patch",
"published_at": "2026-03-07T11:59:42Z"
},
{
"tag": "v0.7",
"kind": "other",
"published_at": "2025-02-13T04:48:09Z"
}
],
"recent_commits": [
{
"oid": "d6e929c97b5b564c2cc1f82afe226a44da7149a0",
"body": null,
"is_bot": false,
"headline": "chore: remove unused SystemExecV after switch to fork/exec install",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-07-16T07:38:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6e7aa71add87dc9fb56cf423ad1e814dde2f856",
"body": "…(#406)",
"is_bot": false,
"headline": "fix: harden zip path validation and replace shell-based install exec …",
"author_name": "ivoidcat",
"author_login": "ivoidcat",
"committed_at": "2026-07-16T07:36:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "704b8aceeae927540ae1d2e501e6ca3942839420",
"body": null,
"is_bot": false,
"headline": "build: link system zlib when SYSTEM_MINIZIP is set (#405)",
"author_name": "Daeho Ro",
"author_login": "daeho-ro",
"committed_at": "2026-07-16T07:36:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fa4591568f65b7b842ec5785f1a3303615ec72b4",
"body": "…uild",
"is_bot": false,
"headline": "ci: escape commas in ExtraResourceDefines to fix MSB1006 on Windows b…",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-07-15T03:30:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8fad0fba65a40fa25749ef3b2bd7db566cf3d911",
"body": null,
"is_bot": false,
"headline": "fix: replace non-ASCII comment chars to avoid MSVC C4819 warning",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-07-15T03:04:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bdbfc5d63ce01a06bc17ed3e056d1f005ea53707",
"body": "…se positives (#394)",
"is_bot": false,
"headline": "feat: embed VERSIONINFO resource in zsign.exe to reduce antivirus fal…",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-07-15T02:53:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a4067631e0fbf508aaa8ad3daf36db517c691228",
"body": null,
"is_bot": false,
"headline": "feat: add -P option to inject dylibs into app extensions",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-07-15T02:34:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9f7a32c7be00297252a7ec4c463520dbb083689c",
"body": null,
"is_bot": false,
"headline": "feat: add -I/--icon option to replace app icon (#389)",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-07-15T02:16:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e696a075b377230256417b3214422ad7e42ceeaa",
"body": null,
"is_bot": false,
"headline": "fix: convert CgBI icons to standard PNG in --metadata extraction (#397)",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-07-15T01:46:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb20fce87fbb52a1afb0733466791bfba697ba3f",
"body": "Fix certificate type detection and ASN.1 failure handling",
"is_bot": false,
"headline": "Merge pull request #403 from ivoidcat/fix/certcheck-asn1-bugs",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-07-14T04:29:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91bca20ff1fc0226032db3c065e9a84d03474b24",
"body": "Fix CLI option parsing and harden file/zip reads",
"is_bot": false,
"headline": "Merge pull request #402 from ivoidcat/fix/cli-zip-fs-bugs",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-07-14T04:29:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "132f45b5daa213ab7527367f78c4b3e2510ed92c",
"body": null,
"is_bot": false,
"headline": "fix: 修复证书识别与 ASN1 崩溃风险",
"author_name": "voidcat",
"author_login": "ivoidcat",
"committed_at": "2026-07-09T10:17:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2df10706b82fe971592f230441f4448f73eccf3b",
"body": null,
"is_bot": false,
"headline": "fix: 修复命令行与文件读取缺陷",
"author_name": "voidcat",
"author_login": "ivoidcat",
"committed_at": "2026-07-09T10:08:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09486af36b0bdfda8f8ffc24c45c1e255530c2f8",
"body": null,
"is_bot": false,
"headline": "build: add SYSTEM_MINIZIP=ng to link minizip-ng via compat layer",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-07-08T07:56:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1faa35c7134c761c5a93b6e7c642397bc08e6910",
"body": null,
"is_bot": false,
"headline": "build: add SYSTEM_MINIZIP=1 to link system minizip and zlib",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-07-08T01:54:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f93674216aed65003b980362e71c0bb41b2cccf1",
"body": "fix: build against OpenSSL 4",
"is_bot": false,
"headline": "Merge pull request #400 from daeho-ro/fix/openssl4-compat",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-07-07T13:42:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "22ea283d3a9c3ad849e74eb53f8ffe99db7307e6",
"body": "Fix silent signing failures and support WWDR G2-G8 issuers",
"is_bot": false,
"headline": "Merge pull request #399 from limrun-inc/upstream-signing-fixes",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-07-07T13:42:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c39607e4231bceffc0e4d7c1dc257ef67dd3c5b7",
"body": "const the affected locals/param and read opaque ASN1 strings via\nASN1_STRING_get0_data()/_length(); still builds on OpenSSL 1.1+/3.x.",
"is_bot": false,
"headline": "fix: build against OpenSSL 4 const-correct X509/ASN1 accessors",
"author_name": "Daeho Ro",
"author_login": "daeho-ro",
"committed_at": "2026-07-07T11:12:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f5eaf3d6765a10090384151f8a2ebe338169e61c",
"body": "Object files depended only on their own .cpp, so a header change (e.g. a\nclass layout change) left stale objects behind and incremental builds\nproduced binaries with mismatched struct sizes that crash at runtime.\nEmit and include .d files via -MMD -MP.",
"is_bot": false,
"headline": "build: track header dependencies in Makefiles",
"author_name": "Hasan Turken",
"author_login": "turkenh",
"committed_at": "2026-07-06T17:17:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3425554b9d57935ff3aa933618a84420153bd493",
"body": "SlotBuildCodeDirectory returns false on invalid input (empty bundle id or\nmissing team id) but both call sites discarded it, leaving the same\nsilently-unusable-signature class as the CMS case: the superblob is written\nwithout a CodeDirectory and zsign exits 0. Check both calls and abort.\n\nAlso drop the now-dead empty-blob check in Sign (BuildCodeSignature always\nappends the superblob header on success) and tidy the CMS failure message.",
"is_bot": false,
"headline": "fix: fail loudly when CodeDirectory build fails",
"author_name": "Hasan Turken",
"author_login": "turkenh",
"committed_at": "2026-07-06T17:17:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57e64639e282e4f37dbb14214debb898d4aa4ed7",
"body": "Harden the CMS chain construction from review findings:\n\n- Only use the p12's CA chain when it actually contains the leaf's issuer\n (X509_check_issued); a root-only or unrelated chain no longer shadows the\n embedded WWDR intermediates, which previously produced an unverifiable\n signature for p12s\n[…]\ns like signing does.\n- Hold uniform ownership in the CMS cert stack (X509_up_ref on borrowed p12\n certs) and free it once the CMS is serialized; parse PEMs through a helper\n that also frees its BIO.",
"is_bot": false,
"headline": "fix: verify the p12 CA chain issued the leaf and pick a matching root",
"author_name": "Hasan Turken",
"author_login": "turkenh",
"committed_at": "2026-07-06T17:17:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6c1870fa4887d81b6be2596f7f1ac4b0119f0014",
"body": "GenerateCMS only recognized WWDR G1 and G3 issuer hashes; leaves issued by\nany other intermediate (G2, G4-G8) hit \">>> Unknown issuer hash!\" and\nproduced a CMS-less signature. Also, PKCS12_parse discarded the CA chain\nbundled in the input p12.\n\nCapture that CA stack at parse time and, in GenerateCMS\n[…]\nation). Otherwise\nfall back to a table of embedded WWDR intermediates keyed by\nX509_issuer_name_hash, now extended with G2 and G4-G8. Apple Root CA is\nstill appended as the trust anchor in both paths.",
"is_bot": false,
"headline": "fix: support WWDR G2-G8 issuers and prefer the p12's own CA chain",
"author_name": "Hasan Turken",
"author_login": "turkenh",
"committed_at": "2026-07-06T14:32:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2d0b08b7e839864d402ca7acce0e43e081327869",
"body": "SlotBuildCMSSignature's return value was discarded in BuildCodeSignature,\nand BuildCodeSignature's own return was discarded in Sign. A failed CMS\nbuild (e.g. unknown issuer) therefore produced a signature silently missing\nits CMS slot while zsign still printed \">>> Signed OK!\" and exited 0.\n\nCheck both return values and fail loudly so a broken signature aborts the\nrun with a non-zero exit code.",
"is_bot": false,
"headline": "fix: propagate CMS signing failure so zsign exits non-zero",
"author_name": "Hasan Turken",
"author_login": "turkenh",
"committed_at": "2026-07-06T14:32:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1075760146063026e4a04524de3142e6f376b179",
"body": "Fix codesign --verify failures on M1-M4 Macs and modern iOS",
"is_bot": false,
"headline": "Merge pull request #391 from GLESign/master",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-07-05T04:56:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe1750d5d4a173b060217d38affd1b196ce1c0ba",
"body": "…-only (M4+ Mac / modern iOS compatibility)\n\nWithout this fix, zsign-signed binaries fail codesign --verify on Apple\nSilicon (M1-M4+) Macs and are rejected by recent iOS/iPadOS/visionOS with\n\"invalid signature (code or signature have been modified)\",\n\"Authority=(unavailable)\" and \"invalid entitlemen\n[…]\n as a no-op for backward compatibility.\n\nVerified on macOS 15 / M4: codesign --verify passes, codesign -dvvv\nreports the full Apple certificate chain, no entitlements warning,\nand Hash choices=sha256.",
"is_bot": false,
"headline": "fix: emit DER entitlements in Apple canonical form, default to SHA256…",
"author_name": "Leeksov",
"author_login": "Leeksov",
"committed_at": "2026-04-19T11:08:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a98b1ceff729bf60fb61617f6a7a0dcf13346da5",
"body": "Two issues caused zsign-produced signatures to be rejected by\n`codesign --verify` on macOS with \"invalid signature (code or\nsignature have been modified)\" even though the payload was accepted by\niOS / TrollStore / AltStore / Sideloadly.\n\n1. execSegFlags (archo.cpp): ALLOW_UNSIGNED (0x10) was set whe\n[…]\nity=(unavailable), Info.plist=not bound,\n Executable Segment flags=0x11\n after: codesign --verify → \"valid on disk, satisfies its DR\"\n full Apple chain, Info.plist bound, flags=0x1",
"is_bot": false,
"headline": "fix: produce signatures that pass macOS codesign --verify",
"author_name": "Leeksov",
"author_login": "Leeksov",
"committed_at": "2026-04-18T00:40:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "28a64217aa52d44a87a47dbc5e3bd59344c14a5d",
"body": null,
"is_bot": false,
"headline": "build: stringify ZSIGN_VERSION in code to avoid cross-platform quoting",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-14T02:12:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "205e8392474409c92357011f477ca9a71fadb04d",
"body": null,
"is_bot": false,
"headline": "ci: fix ZSIGN_VERSION quoting by passing VERSION to Makefile",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-14T02:08:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "24004864891477a17aeb7d72e36d4ccfbf448f67",
"body": null,
"is_bot": false,
"headline": "build: inject ZSIGN_VERSION for Windows vs2022 and keep describe suffix",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-14T01:56:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e50c015817dbc107a3f91979379d3cd69e88c102",
"body": null,
"is_bot": false,
"headline": "build: derive ZSIGN_VERSION from git tag",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-14T01:49:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8ccd35fca0ff28a81ea991afcf8d4cd18b14441",
"body": null,
"is_bot": false,
"headline": "docs: optimize README SEO and add Chinese README",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-14T01:02:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe670c92adb3a8c2255c85eb5f5d3a983a51a835",
"body": "…ble error\n\nApple validates WatchKit stub executables during installation. Re-signing\n_WatchKitStub/WK causes \"InvalidStubExecutable\" install failure. Skip these\nfiles in GetObjectsToSign. Also bump version to 1.0.4 and add -U flag to\ntest scripts.",
"is_bot": false,
"headline": "fix: skip _WatchKitStub during re-signing to avoid InvalidStubExecuta…",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-12T14:51:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "72879bdf7ac297e91ba91f87d04af86b4ff77206",
"body": "…stants\n\n将 requirement blob 构建中的硬编码字节数组替换为具名枚举常量（eReqExprOp、\neReqMatchOp、eSecRequirementType），并用结构化的表达式构建逻辑替代原先的\n拼接方式，使 designated requirement 的生成过程自文档化。",
"is_bot": false,
"headline": "refactor: replace magic bytes in SlotBuildRequirements with named con…",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-12T14:40:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3a61a9c134d34f55f77c2e27baab0857b87bf556",
"body": "Initialize Winsock with WSAStartup before performing OCSP network\noperations, and clean up with WSACleanup afterward.",
"is_bot": false,
"headline": "fix: OCSP check DNS failure on Windows due to missing WSAStartup",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-12T13:41:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88364bf21e1fd16bc9e3536e011c1ae52fab792d",
"body": null,
"is_bot": false,
"headline": "update to version 1.0.3",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-12T13:34:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54c95fd1af560ea9e637d055de84f314f74436ca",
"body": "Expired certificates are shown in red, expiring within 30 days in\nyellow, and valid certificates in green.",
"is_bot": false,
"headline": "feat: colorize certificate expiry status in cert check output",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-12T13:26:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f7dbfb2937cd8f172a032a14c3420d9947b843f",
"body": "Extract OCSP responder URL from certificate AIA extension instead of\nhardcoding paths based on issuer CN (which missed G3 certs where \"G3\"\nis in OU, not CN). Replace OpenSSL BIO with POSIX/Winsock sockets and\nHTTP/1.1 to avoid Apple CDN resetting connections on HTTP/1.0 or\nConnection: close requests. Add cross-platform socket support for\nWindows builds.",
"is_bot": false,
"headline": "fix: OCSP check fails with Apple CDN connection reset",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-12T13:20:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ed43639d67358f34522900b611d29f5f69b4f81",
"body": null,
"is_bot": false,
"headline": "C++11 performance optimization",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-12T12:52:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e9190ea68263b11842e9d610f8371c186ce2868",
"body": null,
"is_bot": false,
"headline": "opti",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-11T09:42:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9e07060e08a4a5c70fc74e40bc70f2808b53ae4",
"body": null,
"is_bot": false,
"headline": "update copyright",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-11T06:59:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f2a624fc3f65a4c9d91a4cab20262a16bc89eeac",
"body": null,
"is_bot": false,
"headline": "fixed: some issues with jvalue",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-11T06:42:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a653ba0e359a6b55095b26441e5a585bed01edf",
"body": null,
"is_bot": false,
"headline": "fixed: some issues with base64",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-11T05:49:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b1948cd3ed63a9e6ffc1bd291852395acc59954b",
"body": "…move external dependencies",
"is_bot": false,
"headline": "vendor: bundle zlib 1.3.1 and minizip source into src/third-party, re…",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-07T04:30:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d06f4c5a37e34063a287e3a74d3f4cc44dab3b85",
"body": "build/linux: use minizip-ng instead of minizip",
"is_bot": false,
"headline": "Merge pull request #386 from chenrui333/fix/linux-minizip-ng",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-04-04T02:53:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d4c32a6c877a62cf4b0b39dcefcd37e898f940b8",
"body": "The README already recommends libminizip-ng-dev for Linux builds,\nand the macOS Makefile was updated to use minizip-ng. Update the\nLinux Makefile to match.\n\nSigned-off-by: Rui Chen <rui@chenrui.dev>",
"is_bot": false,
"headline": "build/linux: use minizip-ng instead of minizip",
"author_name": "Rui Chen",
"author_login": "chenrui333",
"committed_at": "2026-04-03T12:47:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1054ad54e19ccb01bc7f7715b122f8c439f224fc",
"body": "… remove macOS x86_64 build",
"is_bot": false,
"headline": "fix: unify minizip includes to <zip.h> for all non-Windows platforms,…",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T10:49:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4942b6a53b64e763cc6f9d9732f0962c1b8d6ecd",
"body": "…eeds minizip-ng",
"is_bot": false,
"headline": "fix: Linux/FreeBSD use old minizip (pkg-config minizip), only macOS n…",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T10:46:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d2619ff2e57972a629ad8b22bd783a7c7c43022",
"body": null,
"is_bot": false,
"headline": "fix CI: migrate minizip to minizip-ng for all Makefile-based builds",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T10:43:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9690ccd90a90b126be5def511273230cbfdb492",
"body": null,
"is_bot": false,
"headline": "update version to 1.0.1",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T10:26:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e85535d8949de49b5a4e942e612c084f42ea7588",
"body": null,
"is_bot": false,
"headline": "add macOS Intel (x86_64) build target to CI",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T10:25:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f0a572495a3f6e097b8384d2d939ed9261ea0b41",
"body": "- Fix Zip Slip path traversal vulnerability (reject \"..\" in zip entries)\n- Fix undefined behavior when calling .back() on empty string\n- Use thread-safe localtime_r() instead of localtime()\n- Fix int overflow in loop counter for zip entry enumeration",
"is_bot": false,
"headline": "fixed: security vulnerabilities in archive.cpp",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T10:13:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f5aacc292bfb2c5430c6f9972600ccb9184589f",
"body": null,
"is_bot": false,
"headline": "migrate from minizip to minizip-ng",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T10:08:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9dfbf515237b04048723cbd4c194ff9fea11e0bb",
"body": null,
"is_bot": false,
"headline": "fixed: some issues with dylib",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T09:49:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "42818a7d9890b91385e8d5b8f4b6602d5586e7aa",
"body": null,
"is_bot": false,
"headline": "change version to 1.0.0",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T01:48:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "852f8ee7f519ca41f2066a3bd9a2f69a8c187622",
"body": null,
"is_bot": false,
"headline": "revert to 0.9.7 for security issue",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-04-03T01:35:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be5bc1827c3244a7f5db75d51c68265f3e4b45f2",
"body": null,
"is_bot": false,
"headline": "fixed some issues",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-03-10T05:10:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73f5acab84137853579ea188993012a5080aea78",
"body": "feat: rework -C flag — full cert check with OCSP verification",
"is_bot": false,
"headline": "Merge pull request #383 from KupQ/feat/cert-check-clean",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-10T05:03:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "93990eb68223fff63b55dab5cfee42b977f3fadb",
"body": "- Add certcheck.cpp/h: extract signing cert from IPA (direct zip read\n via minizip, no extraction), Mach-O, mobileprovision, P12, CER/PEM\n- Parse CMS signature blob from code signature to find leaf cert\n- Perform OCSP revocation check against ocsp.apple.com\n- Support both legacy and modern OpenSSL \n[…]\nflags, check the signed binary\n after signing but before archiving\n- Properly report unsigned binaries (fixes #381)\n- Update README with -C usage documentation\n- Add certcheck files to VS2022 project",
"is_bot": false,
"headline": "feat: rework -C flag with full cert check and OCSP verification",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-09T13:33:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f7b5a460505157ea50f9727b802690aa6325e11c",
"body": null,
"is_bot": false,
"headline": "fixed: CI issues",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:44:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "deb025cf9227ab9bf37a53267aec93b1efee3ddc",
"body": null,
"is_bot": false,
"headline": "fixed: merge issues",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:31:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "937b54605747d56a8a17a37afe9d4bec2c611df1",
"body": "feat: add -S/--enable_docs for documents support",
"is_bot": false,
"headline": "Merge pull request #380 from KupQ/feat/enable-docs",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:25:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "47888c188039a74a89c45539909704a166660b25",
"body": null,
"is_bot": false,
"headline": "Merge branch 'master' into feat/enable-docs",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:24:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d76255cefbe4708ea8682bd42395fc521953943",
"body": "feat: add -M/--min_version to set MinimumOSVersion",
"is_bot": false,
"headline": "Merge pull request #379 from KupQ/feat/min-version",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:20:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "85c33b3d9e07de5c6f448e6838ccbd620e014c61",
"body": null,
"is_bot": false,
"headline": "Merge branch 'master' into feat/min-version",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:20:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c207b11e80783c862330ab0205b8b8a261c0788b",
"body": "feat: add -E/--rm_extensions to remove app extensions",
"is_bot": false,
"headline": "Merge pull request #378 from KupQ/feat/rm-extensions",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:19:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "843d89513679cc959e1cab1df264bd816ff2a817",
"body": null,
"is_bot": false,
"headline": "Merge branch 'master' into feat/rm-extensions",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:18:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f4b368ed35f49809c1645b887ca6d435f7cd1e29",
"body": "feat: add -W/--rm_watch to remove watch app",
"is_bot": false,
"headline": "Merge pull request #377 from KupQ/feat/rm-watch",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:17:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6a89e3a729633179502857ec7a70c3e3b255e451",
"body": null,
"is_bot": false,
"headline": "Merge branch 'master' into feat/rm-watch",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:16:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc8bbf138c96c6570b3152e40535b9e279022fdc",
"body": "feat: add -U/--rm_uisd to remove UISupportedDevices",
"is_bot": false,
"headline": "Merge pull request #376 from KupQ/feat/rm-uisd",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:14:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f007f1180050ee1e6951820fab17ed0a6d00ce46",
"body": "fix: auto-set version from release tag, fix binary permissions",
"is_bot": false,
"headline": "Merge pull request #374 from KupQ/fix/version-and-permissions",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-09T01:13:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a714678005a2f7cddcc059df32e841af04897555",
"body": null,
"is_bot": false,
"headline": "feat: add -S/--enable_docs for documents support",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-08T19:40:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "76df213d5c4d6b3298e2455dcf7b84074cecd7fc",
"body": null,
"is_bot": false,
"headline": "feat: add -M/--min_version to set MinimumOSVersion",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-08T19:40:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "654738b8c35d94a4b18e3372122cb970e3b49513",
"body": null,
"is_bot": false,
"headline": "feat: add -E/--rm_extensions to remove app extensions",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-08T19:40:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2a37fecdcf40f33ace0a2bc026966e55c5f9190",
"body": null,
"is_bot": false,
"headline": "feat: add -W/--rm_watch to remove watch app",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-08T19:40:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e61d5a688ec08e4e56fe56b19c4445fa3c073d6",
"body": null,
"is_bot": false,
"headline": "feat: add -U/--rm_uisd to remove UISupportedDevices",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-08T19:40:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be536c1c5ed04412697e116f83c12ba5247c022d",
"body": null,
"is_bot": false,
"headline": "fix: auto-set version from release tag, fix binary permissions",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-08T12:16:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af07d648cf814bc43cd7944a744ff0d72b0328c6",
"body": "fix: handle non-Mach-O .dylib files during signing",
"is_bot": false,
"headline": "Merge pull request #372 from KupQ/fix/non-macho-dylib-clean",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-08T05:27:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cebf81b5c4f19db2d2389178a8ab0dea30eb2ff2",
"body": "Fixes #368 — signing fails on IPAs with non-Mach-O .dylib stubs\n(e.g. SubstrateInjection.dylib in VibeTok).\n\n- Validate magic bytes for all files including .dylib\n- Warn and skip non-Mach-O files instead of aborting\n- Print actual magic bytes in error message for debugging",
"is_bot": false,
"headline": "fix: handle non-Mach-O .dylib files gracefully",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-07T12:47:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "07855dc8552344e88d6e52ab2ec1edf01d6a4ae3",
"body": "Add option to remove dylib from the bundle",
"is_bot": false,
"headline": "Merge pull request #369 from KupQ/patch-2",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-07T12:04:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5ee178423fb8fa7cfae003221c9e9f20cebc44e9",
"body": "-D, --rm_dylib Name of dylib to remove. Use -D multiple times to remove multiple dylibs at once.",
"is_bot": false,
"headline": "Add option to remove dylib from the bundle",
"author_name": "Arian",
"author_login": "KupQ",
"committed_at": "2026-03-07T12:02:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af3385b7c9991f7a4d27a11a68f12bcec1a84cee",
"body": "fix: sign all Mach-O binaries regardless of file extension",
"is_bot": false,
"headline": "Merge pull request #366 from KupQ/fix/sign-all-macho",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-07T11:48:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32f14f48d7eafe1b6bbde036fe335d9f66cb1d62",
"body": null,
"is_bot": false,
"headline": "Merge branch 'master' into fix/sign-all-macho",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-07T11:48:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c88c6cfe2a1fb64368638b0e519183bc0d7b5e64",
"body": "feat: add -D/--rm_dylib to remove injected dylibs",
"is_bot": false,
"headline": "Merge pull request #367 from KupQ/feat/rm-dylib",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-07T11:42:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "79a2d0370fae6c93a0e9d60eea9c8e0fff73af6a",
"body": "fix: skip .dSYM files during signing",
"is_bot": false,
"headline": "Merge pull request #365 from KupQ/fix/dsym-skip",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-07T11:41:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a683f2f9b38e642493f6350f91b5f4e9e18f76fd",
"body": null,
"is_bot": false,
"headline": "feat: add -D/--rm_dylib flag to remove injected dylibs (fixes #255)",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-06T23:43:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "296c459bce6b4305b1db9b009ebe7124a7d0ba64",
"body": null,
"is_bot": false,
"headline": "fix: use fopen_s on windows for Mach-O check",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-06T23:04:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef2f7c1ab96c2f17bb98681278b71e7a077efc06",
"body": null,
"is_bot": false,
"headline": "fix: sign all Mach-O binaries regardless of file extension (fixes #275)",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-06T23:02:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f57cfa08917fdc9a6b232f4b2c6634b5009a9d8e",
"body": null,
"is_bot": false,
"headline": "fix: skip .dSYM files during signing (fixes #358)",
"author_name": "KupQ",
"author_login": "KupQ",
"committed_at": "2026-03-06T22:32:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1784ea481fbf1be1f77a0567a96a1c63c5d9eca9",
"body": null,
"is_bot": false,
"headline": "ci: only trigger build on tag push, remove branch/PR triggers",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T14:12:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9611771a1c970d4c481b252f24c15a7a73b31875",
"body": null,
"is_bot": false,
"headline": "version: 0.9.1",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T14:00:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "71fdb219a53f85ce6dc1889b8842636f52ece23e",
"body": null,
"is_bot": false,
"headline": "auto release",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:44:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2fd79d65973d3bc97197be8b7c038c5e6dd6df2e",
"body": null,
"is_bot": false,
"headline": "Fix some issues",
"author_name": "lynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:28:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8d86ddd9e54bf4ab505430f3687625ffe14d509",
"body": "feat: provisioning extension support (multiple -m profiles)",
"is_bot": false,
"headline": "Merge pull request #364 from KupQ/feat/provision-extensions",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:10:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2820d277c75a8d6d155544cba0401c0bd7c9130e",
"body": null,
"is_bot": false,
"headline": "Merge branch 'master' into feat/provision-extensions",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:10:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "10fb709537daa95ce47796165c32c41577d2e2a8",
"body": "fix: increase ReallocCodeSignSpace buffer from 16K to 32K",
"is_bot": false,
"headline": "Merge pull request #363 from iStarCc/master",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:09:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f15a0949061371686b4979567603c0f3d02546fa",
"body": "feat: add -R/--rm_provision flag to remove mobileprovision after signing",
"is_bot": false,
"headline": "Merge pull request #362 from KupQ/feat/rm-provision",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:09:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e932ac114da69e236bfa252ad75c2c9c00d6a287",
"body": null,
"is_bot": false,
"headline": "Merge branch 'master' into feat/rm-provision",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:08:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e030245dac805e96c2c484f8239cc28a790c9ea",
"body": "feat: add -x flag for metadata and icon extraction after signing",
"is_bot": false,
"headline": "Merge pull request #361 from KupQ/feat/metadata-extraction",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:05:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e00476c2acd497d1d861d2ba9d602b826ace3664",
"body": "ci: add multi-platform build workflow",
"is_bot": false,
"headline": "Merge pull request #360 from KupQ/ci/build-workflow",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:05:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6507e348ebbc5e195c3f55782ed0689d67c24399",
"body": "…head\n\nperf: reduce heap allocations in code directory hashing and improve I/O throughput",
"is_bot": false,
"headline": "Merge pull request #359 from KupQ/perf/reduce-heap-allocs-and-io-over…",
"author_name": "zhlynn",
"author_login": "zhlynn",
"committed_at": "2026-03-06T13:04:43Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 15,
"commits_last_year": 110,
"latest_release_at": "2026-07-16T10:01:40Z",
"latest_release_tag": "v1.1.1",
"releases_from_tags": false,
"days_since_last_push": 6,
"active_weeks_last_year": 11,
"days_since_latest_release": 6,
"mean_days_between_releases": 11.6
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 487,
"stars": 1813,
"watchers": 48,
"fork_history": {
"days": [
{
"date": "2019-09-19",
"count": 2
},
{
"date": "2019-09-20",
"count": 3
},
{
"date": "2019-09-21",
"count": 4
},
{
"date": "2019-09-22",
"count": 2
},
{
"date": "2019-09-23",
"count": 2
},
{
"date": "2019-09-24",
"count": 1
},
{
"date": "2019-09-25",
"count": 1
},
{
"date": "2019-09-26",
"count": 3
},
{
"date": "2019-09-27",
"count": 2
},
{
"date": "2019-09-29",
"count": 5
},
{
"date": "2019-09-30",
"count": 1
},
{
"date": "2019-10-06",
"count": 1
},
{
"date": "2019-10-08",
"count": 1
},
{
"date": "2019-10-11",
"count": 1
},
{
"date": "2019-10-12",
"count": 2
},
{
"date": "2019-10-14",
"count": 2
},
{
"date": "2019-10-16",
"count": 1
},
{
"date": "2019-10-18",
"count": 1
},
{
"date": "2019-10-22",
"count": 3
},
{
"date": "2019-10-25",
"count": 1
},
{
"date": "2019-10-31",
"count": 1
},
{
"date": "2019-11-02",
"count": 1
},
{
"date": "2019-11-11",
"count": 2
},
{
"date": "2019-11-12",
"count": 2
},
{
"date": "2019-11-14",
"count": 1
},
{
"date": "2019-11-15",
"count": 1
},
{
"date": "2019-11-21",
"count": 1
},
{
"date": "2019-11-25",
"count": 1
},
{
"date": "2019-11-26",
"count": 1
},
{
"date": "2019-11-27",
"count": 1
},
{
"date": "2019-12-05",
"count": 1
},
{
"date": "2019-12-06",
"count": 1
},
{
"date": "2019-12-09",
"count": 1
},
{
"date": "2019-12-10",
"count": 2
},
{
"date": "2019-12-11",
"count": 1
},
{
"date": "2019-12-15",
"count": 1
},
{
"date": "2019-12-16",
"count": 1
},
{
"date": "2019-12-17",
"count": 1
},
{
"date": "2019-12-24",
"count": 1
},
{
"date": "2019-12-26",
"count": 1
},
{
"date": "2019-12-31",
"count": 1
},
{
"date": "2020-01-01",
"count": 1
},
{
"date": "2020-01-09",
"count": 1
},
{
"date": "2020-01-12",
"count": 1
},
{
"date": "2020-01-15",
"count": 1
},
{
"date": "2020-01-17",
"count": 2
},
{
"date": "2020-01-19",
"count": 1
},
{
"date": "2020-02-23",
"count": 1
},
{
"date": "2020-02-26",
"count": 2
},
{
"date": "2020-02-27",
"count": 1
},
{
"date": "2020-02-29",
"count": 1
},
{
"date": "2020-03-03",
"count": 1
},
{
"date": "2020-03-05",
"count": 1
},
{
"date": "2020-03-06",
"count": 1
},
{
"date": "2020-03-10",
"count": 5
},
{
"date": "2020-03-12",
"count": 1
},
{
"date": "2020-03-17",
"count": 1
},
{
"date": "2020-03-18",
"count": 1
},
{
"date": "2020-03-19",
"count": 1
},
{
"date": "2020-03-22",
"count": 1
},
{
"date": "2020-03-23",
"count": 1
},
{
"date": "2020-03-25",
"count": 2
},
{
"date": "2020-03-26",
"count": 2
},
{
"date": "2020-03-27",
"count": 1
},
{
"date": "2020-03-28",
"count": 1
},
{
"date": "2020-03-29",
"count": 1
},
{
"date": "2020-04-06",
"count": 1
},
{
"date": "2020-04-08",
"count": 1
},
{
"date": "2020-04-15",
"count": 1
},
{
"date": "2020-04-16",
"count": 3
},
{
"date": "2020-04-17",
"count": 2
},
{
"date": "2020-04-20",
"count": 1
},
{
"date": "2020-04-21",
"count": 1
},
{
"date": "2020-04-23",
"count": 2
},
{
"date": "2020-04-26",
"count": 1
},
{
"date": "2020-05-10",
"count": 3
},
{
"date": "2020-05-12",
"count": 3
},
{
"date": "2020-05-16",
"count": 1
},
{
"date": "2020-05-19",
"count": 1
},
{
"date": "2020-06-11",
"count": 1
},
{
"date": "2020-06-16",
"count": 2
},
{
"date": "2020-06-21",
"count": 1
},
{
"date": "2020-06-23",
"count": 1
},
{
"date": "2020-06-24",
"count": 1
},
{
"date": "2020-06-30",
"count": 2
},
{
"date": "2020-07-01",
"count": 1
},
{
"date": "2020-07-17",
"count": 1
},
{
"date": "2020-07-20",
"count": 1
},
{
"date": "2020-07-24",
"count": 1
},
{
"date": "2020-07-27",
"count": 1
},
{
"date": "2020-07-29",
"count": 2
},
{
"date": "2020-08-06",
"count": 1
},
{
"date": "2020-08-21",
"count": 1
},
{
"date": "2020-08-27",
"count": 1
},
{
"date": "2020-09-01",
"count": 2
},
{
"date": "2020-09-07",
"count": 1
},
{
"date": "2020-09-10",
"count": 1
},
{
"date": "2020-09-22",
"count": 1
},
{
"date": "2020-09-28",
"count": 1
},
{
"date": "2020-10-06",
"count": 1
},
{
"date": "2020-10-13",
"count": 1
},
{
"date": "2020-10-14",
"count": 1
},
{
"date": "2020-10-23",
"count": 1
},
{
"date": "2020-11-03",
"count": 1
},
{
"date": "2020-11-05",
"count": 1
},
{
"date": "2020-11-25",
"count": 1
},
{
"date": "2020-12-09",
"count": 1
},
{
"date": "2020-12-28",
"count": 1
},
{
"date": "2021-01-11",
"count": 1
},
{
"date": "2021-01-15",
"count": 1
},
{
"date": "2021-01-17",
"count": 1
},
{
"date": "2021-01-19",
"count": 1
},
{
"date": "2021-01-30",
"count": 1
},
{
"date": "2021-01-31",
"count": 2
},
{
"date": "2021-02-01",
"count": 1
},
{
"date": "2021-02-04",
"count": 1
},
{
"date": "2021-02-16",
"count": 1
},
{
"date": "2021-02-18",
"count": 1
},
{
"date": "2021-02-19",
"count": 1
},
{
"date": "2021-02-20",
"count": 1
},
{
"date": "2021-02-24",
"count": 1
},
{
"date": "2021-02-25",
"count": 2
},
{
"date": "2021-02-28",
"count": 3
},
{
"date": "2021-03-01",
"count": 2
},
{
"date": "2021-03-12",
"count": 1
},
{
"date": "2021-03-13",
"count": 1
},
{
"date": "2021-03-14",
"count": 1
},
{
"date": "2021-03-18",
"count": 1
},
{
"date": "2021-03-19",
"count": 1
},
{
"date": "2021-04-15",
"count": 1
},
{
"date": "2021-04-29",
"count": 1
},
{
"date": "2021-05-03",
"count": 1
},
{
"date": "2021-05-14",
"count": 1
},
{
"date": "2021-05-22",
"count": 1
},
{
"date": "2021-05-31",
"count": 1
},
{
"date": "2021-06-03",
"count": 1
},
{
"date": "2021-06-08",
"count": 1
},
{
"date": "2021-06-09",
"count": 1
},
{
"date": "2021-06-17",
"count": 1
},
{
"date": "2021-06-18",
"count": 1
},
{
"date": "2021-06-19",
"count": 1
},
{
"date": "2021-06-21",
"count": 1
},
{
"date": "2021-06-24",
"count": 2
},
{
"date": "2021-06-25",
"count": 2
},
{
"date": "2021-07-05",
"count": 1
},
{
"date": "2021-07-09",
"count": 1
},
{
"date": "2021-07-14",
"count": 3
},
{
"date": "2021-07-18",
"count": 1
},
{
"date": "2021-07-19",
"count": 1
},
{
"date": "2021-07-23",
"count": 1
},
{
"date": "2021-07-26",
"count": 1
},
{
"date": "2021-08-10",
"count": 1
},
{
"date": "2021-09-12",
"count": 1
},
{
"date": "2021-09-20",
"count": 1
},
{
"date": "2021-09-23",
"count": 1
},
{
"date": "2021-09-25",
"count": 1
},
{
"date": "2021-09-27",
"count": 1
},
{
"date": "2021-09-30",
"count": 1
},
{
"date": "2021-10-06",
"count": 1
},
{
"date": "2021-10-09",
"count": 1
},
{
"date": "2021-10-10",
"count": 1
},
{
"date": "2021-10-11",
"count": 2
},
{
"date": "2021-10-13",
"count": 1
},
{
"date": "2021-10-14",
"count": 1
},
{
"date": "2021-10-27",
"count": 1
},
{
"date": "2021-10-28",
"count": 1
},
{
"date": "2021-11-12",
"count": 1
},
{
"date": "2021-11-15",
"count": 1
},
{
"date": "2021-12-02",
"count": 2
},
{
"date": "2021-12-06",
"count": 1
},
{
"date": "2021-12-10",
"count": 2
},
{
"date": "2021-12-14",
"count": 1
},
{
"date": "2021-12-27",
"count": 1
},
{
"date": "2021-12-29",
"count": 1
},
{
"date": "2021-12-31",
"count": 1
},
{
"date": "2022-01-17",
"count": 1
},
{
"date": "2022-01-20",
"count": 1
},
{
"date": "2022-01-24",
"count": 1
},
{
"date": "2022-01-26",
"count": 1
},
{
"date": "2022-02-08",
"count": 1
},
{
"date": "2022-02-19",
"count": 1
},
{
"date": "2022-03-03",
"count": 1
},
{
"date": "2022-03-15",
"count": 1
},
{
"date": "2022-03-18",
"count": 1
},
{
"date": "2022-03-24",
"count": 1
},
{
"date": "2022-03-27",
"count": 1
},
{
"date": "2022-03-30",
"count": 1
},
{
"date": "2022-04-02",
"count": 1
},
{
"date": "2022-04-07",
"count": 1
},
{
"date": "2022-04-10",
"count": 1
},
{
"date": "2022-04-19",
"count": 1
},
{
"date": "2022-04-30",
"count": 1
},
{
"date": "2022-06-13",
"count": 1
},
{
"date": "2022-06-16",
"count": 1
},
{
"date": "2022-06-19",
"count": 1
},
{
"date": "2022-06-21",
"count": 1
},
{
"date": "2022-06-23",
"count": 1
},
{
"date": "2022-07-01",
"count": 1
},
{
"date": "2022-07-02",
"count": 1
},
{
"date": "2022-07-12",
"count": 2
},
{
"date": "2022-07-13",
"count": 1
},
{
"date": "2022-08-04",
"count": 1
},
{
"date": "2022-08-17",
"count": 1
},
{
"date": "2022-08-20",
"count": 1
},
{
"date": "2022-08-25",
"count": 1
},
{
"date": "2022-08-26",
"count": 1
},
{
"date": "2022-09-03",
"count": 1
},
{
"date": "2022-09-06",
"count": 2
},
{
"date": "2022-09-08",
"count": 1
},
{
"date": "2022-09-10",
"count": 1
},
{
"date": "2022-09-20",
"count": 1
},
{
"date": "2022-09-22",
"count": 1
},
{
"date": "2022-09-28",
"count": 1
},
{
"date": "2022-10-07",
"count": 1
},
{
"date": "2022-10-09",
"count": 1
},
{
"date": "2022-10-19",
"count": 1
},
{
"date": "2022-11-09",
"count": 1
},
{
"date": "2022-11-10",
"count": 1
},
{
"date": "2022-11-21",
"count": 1
},
{
"date": "2022-12-19",
"count": 1
},
{
"date": "2022-12-23",
"count": 1
},
{
"date": "2022-12-26",
"count": 1
},
{
"date": "2022-12-28",
"count": 1
},
{
"date": "2022-12-30",
"count": 2
},
{
"date": "2022-12-31",
"count": 1
},
{
"date": "2023-01-10",
"count": 1
},
{
"date": "2023-01-20",
"count": 1
},
{
"date": "2023-01-27",
"count": 1
},
{
"date": "2023-02-02",
"count": 1
},
{
"date": "2023-02-27",
"count": 1
},
{
"date": "2023-03-01",
"count": 1
},
{
"date": "2023-03-09",
"count": 1
},
{
"date": "2023-03-13",
"count": 1
},
{
"date": "2023-03-15",
"count": 1
},
{
"date": "2023-03-28",
"count": 1
},
{
"date": "2023-04-25",
"count": 1
},
{
"date": "2023-05-04",
"count": 1
},
{
"date": "2023-05-12",
"count": 2
},
{
"date": "2023-05-19",
"count": 1
},
{
"date": "2023-05-22",
"count": 1
},
{
"date": "2023-06-16",
"count": 1
},
{
"date": "2023-07-12",
"count": 1
},
{
"date": "2023-07-13",
"count": 1
},
{
"date": "2023-07-17",
"count": 1
},
{
"date": "2023-07-20",
"count": 1
},
{
"date": "2023-07-22",
"count": 1
},
{
"date": "2023-07-27",
"count": 1
},
{
"date": "2023-07-29",
"count": 1
},
{
"date": "2023-08-24",
"count": 1
},
{
"date": "2023-08-28",
"count": 1
},
{
"date": "2023-08-31",
"count": 1
},
{
"date": "2023-09-01",
"count": 1
},
{
"date": "2023-09-07",
"count": 1
},
{
"date": "2023-09-14",
"count": 1
},
{
"date": "2023-10-12",
"count": 1
},
{
"date": "2023-10-21",
"count": 1
},
{
"date": "2023-10-31",
"count": 1
},
{
"date": "2023-11-14",
"count": 1
},
{
"date": "2023-12-18",
"count": 1
},
{
"date": "2023-12-22",
"count": 1
},
{
"date": "2024-01-06",
"count": 1
},
{
"date": "2024-01-09",
"count": 1
},
{
"date": "2024-01-19",
"count": 1
},
{
"date": "2024-02-03",
"count": 1
},
{
"date": "2024-02-05",
"count": 1
},
{
"date": "2024-02-07",
"count": 1
},
{
"date": "2024-02-12",
"count": 1
},
{
"date": "2024-04-03",
"count": 1
},
{
"date": "2024-04-07",
"count": 1
},
{
"date": "2024-04-29",
"count": 1
},
{
"date": "2024-05-03",
"count": 1
},
{
"date": "2024-05-23",
"count": 1
},
{
"date": "2024-05-29",
"count": 1
},
{
"date": "2024-06-06",
"count": 1
},
{
"date": "2024-06-07",
"count": 1
},
{
"date": "2024-06-11",
"count": 1
},
{
"date": "2024-06-13",
"count": 1
},
{
"date": "2024-06-16",
"count": 1
},
{
"date": "2024-06-24",
"count": 1
},
{
"date": "2024-06-27",
"count": 1
},
{
"date": "2024-06-29",
"count": 1
},
{
"date": "2024-07-04",
"count": 1
},
{
"date": "2024-08-11",
"count": 1
},
{
"date": "2024-08-14",
"count": 1
},
{
"date": "2024-09-03",
"count": 1
},
{
"date": "2024-09-13",
"count": 1
},
{
"date": "2024-09-17",
"count": 1
},
{
"date": "2024-09-19",
"count": 1
},
{
"date": "2024-09-22",
"count": 1
},
{
"date": "2024-09-25",
"count": 1
},
{
"date": "2024-09-27",
"count": 1
},
{
"date": "2024-10-01",
"count": 1
},
{
"date": "2024-10-14",
"count": 2
},
{
"date": "2024-10-23",
"count": 1
},
{
"date": "2024-10-27",
"count": 1
},
{
"date": "2024-11-12",
"count": 1
},
{
"date": "2024-11-18",
"count": 1
},
{
"date": "2024-12-04",
"count": 1
},
{
"date": "2024-12-09",
"count": 1
},
{
"date": "2024-12-16",
"count": 1
},
{
"date": "2024-12-23",
"count": 1
},
{
"date": "2024-12-24",
"count": 1
},
{
"date": "2024-12-26",
"count": 1
},
{
"date": "2025-01-01",
"count": 1
},
{
"date": "2025-01-09",
"count": 1
},
{
"date": "2025-01-13",
"count": 1
},
{
"date": "2025-01-20",
"count": 1
},
{
"date": "2025-02-11",
"count": 1
},
{
"date": "2025-02-12",
"count": 1
},
{
"date": "2025-02-13",
"count": 1
},
{
"date": "2025-03-22",
"count": 1
},
{
"date": "2025-03-23",
"count": 1
},
{
"date": "2025-03-28",
"count": 1
},
{
"date": "2025-04-11",
"count": 1
},
{
"date": "2025-04-12",
"count": 1
},
{
"date": "2025-04-16",
"count": 1
},
{
"date": "2025-05-12",
"count": 1
},
{
"date": "2025-05-15",
"count": 1
},
{
"date": "2025-05-18",
"count": 1
},
{
"date": "2025-05-21",
"count": 1
},
{
"date": "2025-05-31",
"count": 1
},
{
"date": "2025-06-23",
"count": 2
},
{
"date": "2025-07-02",
"count": 1
},
{
"date": "2025-07-04",
"count": 1
},
{
"date": "2025-07-09",
"count": 1
},
{
"date": "2025-07-10",
"count": 1
},
{
"date": "2025-07-17",
"count": 1
},
{
"date": "2025-07-28",
"count": 1
},
{
"date": "2025-08-03",
"count": 1
},
{
"date": "2025-08-18",
"count": 1
},
{
"date": "2025-08-22",
"count": 1
},
{
"date": "2025-08-24",
"count": 1
},
{
"date": "2025-08-25",
"count": 1
},
{
"date": "2025-09-05",
"count": 1
},
{
"date": "2025-09-06",
"count": 1
},
{
"date": "2025-09-20",
"count": 1
},
{
"date": "2025-09-22",
"count": 1
},
{
"date": "2025-09-23",
"count": 1
},
{
"date": "2025-09-25",
"count": 1
},
{
"date": "2025-09-28",
"count": 1
},
{
"date": "2025-10-09",
"count": 1
},
{
"date": "2025-10-24",
"count": 1
},
{
"date": "2025-11-02",
"count": 1
},
{
"date": "2025-11-04",
"count": 1
},
{
"date": "2025-11-07",
"count": 1
},
{
"date": "2025-12-01",
"count": 1
},
{
"date": "2025-12-02",
"count": 1
},
{
"date": "2025-12-09",
"count": 1
},
{
"date": "2025-12-10",
"count": 1
},
{
"date": "2025-12-20",
"count": 1
},
{
"date": "2025-12-26",
"count": 2
},
{
"date": "2026-01-09",
"count": 1
},
{
"date": "2026-02-13",
"count": 1
},
{
"date": "2026-02-21",
"count": 2
},
{
"date": "2026-02-25",
"count": 1
},
{
"date": "2026-02-26",
"count": 1
},
{
"date": "2026-03-03",
"count": 1
},
{
"date": "2026-03-10",
"count": 2
},
{
"date": "2026-03-16",
"count": 1
},
{
"date": "2026-03-26",
"count": 1
},
{
"date": "2026-04-03",
"count": 1
},
{
"date": "2026-04-07",
"count": 1
},
{
"date": "2026-04-16",
"count": 1
},
{
"date": "2026-04-18",
"count": 1
},
{
"date": "2026-04-21",
"count": 1
},
{
"date": "2026-04-24",
"count": 2
},
{
"date": "2026-04-25",
"count": 1
},
{
"date": "2026-04-29",
"count": 2
},
{
"date": "2026-05-01",
"count": 1
},
{
"date": "2026-06-05",
"count": 1
},
{
"date": "2026-06-10",
"count": 2
},
{
"date": "2026-06-16",
"count": 2
},
{
"date": "2026-07-02",
"count": 1
},
{
"date": "2026-07-06",
"count": 2
},
{
"date": "2026-07-07",
"count": 1
},
{
"date": "2026-07-15",
"count": 1
},
{
"date": "2026-07-16",
"count": 2
},
{
"date": "2026-07-22",
"count": 1
}
],
"complete": true,
"collected": 447,
"total_forks": 487
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"build/linux/Makefile",
"build/macos/Makefile",
"test/dylib/demo/Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 591749,
"source_files_sampled": 71,
"oversized_source_files": 6,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [],
"advisories": {
"error": "No resolved dependencies to assess",
"scope": "repository_graph",
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [],
"dependencies": [],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [],
"collected": true,
"truncated": false,
"total_count": 0,
"direct_count": 0,
"indirect_count": 0
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 87,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 258,
"closed_unmerged_prs": 33
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "zhlynn",
"commits": 216,
"avatar_url": "https://avatars.githubusercontent.com/u/3388663?v=4"
},
{
"type": "User",
"login": "KupQ",
"commits": 18,
"avatar_url": "https://avatars.githubusercontent.com/u/126740753?v=4"
},
{
"type": "User",
"login": "gyke69",
"commits": 16,
"avatar_url": "https://avatars.githubusercontent.com/u/58794647?v=4"
},
{
"type": "User",
"login": "ddzobov",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/9539529?v=4"
},
{
"type": "User",
"login": "jalopezg-zimperium",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/264185125?v=4"
},
{
"type": "User",
"login": "turkenh",
"commits": 5,
"avatar_url": "https://avatars.githubusercontent.com/u/9900707?v=4"
},
{
"type": "User",
"login": "jeremy-zangla-ts3d",
"commits": 5,
"avatar_url": "https://avatars.githubusercontent.com/u/207542866?v=4"
},
{
"type": "User",
"login": "lunaynx",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/148620615?v=4"
},
{
"type": "User",
"login": "xieqinda",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/144226187?v=4"
},
{
"type": "User",
"login": "ivoidcat",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/19281566?v=4"
}
],
"contributors_sampled": 41,
"top_contributor_share": 0.645
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"build.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 6,
"reason": "binaries present in source code",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 7 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 3,
"reason": "Found 7/20 approved changesets -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 3 contributing companies or organizations -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "24 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 7,
"reason": "3 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "d6e929c97b5b564c2cc1f82afe226a44da7149a0",
"ran_at": "2026-07-22T15:33:54Z",
"aggregate_score": 3.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-16T10:01:42Z",
"oldest_open_prs": [
{
"number": 407,
"created_at": "2026-07-22T02:22:16Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-16T07:36:31Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/zhlynn/zsign",
"host": "github.com",
"name": "zsign",
"owner": "zhlynn"
},
"metrics": {
"overall": {
"key": "overall",
"band": "critical",
"name": "Overall health",
"note": "High-Risk Jurisdiction Policy applies a 50% multiplier to weighted overall health and gives it an At risk ceiling of 49.",
"notes": [
{
"code": "jurisdiction_overall_adjustment",
"params": {
"cap": 49,
"pct": 50
}
}
],
"value": 28,
"inputs": {
"security": 17,
"vitality": 79,
"community": 69,
"governance": 56,
"engineering": 49,
"high_risk_jurisdiction_cap": 49,
"high_risk_jurisdiction_multiplier": 50,
"weighted_overall_before_jurisdiction": 56,
"overall_after_jurisdiction_multiplier": 28
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 79,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 72,
"inputs": {
"commits_last_year": 110,
"human_commit_share": 1,
"days_since_last_push": 6,
"active_weeks_last_year": 11
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "11/52 weeks with commits",
"points": 7.6,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 11
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "110 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 110
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "24 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 15,
"latest_release_tag": "v1.1.1",
"releases_from_tags": false,
"days_since_latest_release": 6,
"mean_days_between_releases": 11.6
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "15 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 15
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~11.6 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 11.6
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 6,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 6 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 6
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 69,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "excellent",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"forks": 487,
"stars": 1813,
"watchers": 48,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1,813 stars",
"points": 52.9,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 1813
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "487 forks",
"points": 22.4,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 487
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "48 watchers",
"points": 9.3,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 48
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 56,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 41,
"top_contributor_share": 0.645
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 64% of commits",
"points": 8,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 64
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "41 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 41
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 79,
"inputs": {
"merged_prs": 87,
"open_issues": 0,
"closed_issues": 258,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 33
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "87/120 decided PRs merged",
"points": 27.7,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 87,
"decided": 120
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 7/20 approved changesets -- score normalized to 3",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 53,
"inputs": {
"followers": 159,
"owner_type": "User",
"is_verified": null,
"owner_login": "zhlynn",
"public_repos": 3,
"account_age_days": 4925
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "159 followers of zhlynn",
"points": 15.8,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 159,
"login": "zhlynn"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "3 public repos, account ~13 yr old",
"points": 16.4,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 3
}
},
{
"code": "account_age_years",
"params": {
"years": 13
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 49,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 48,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 7 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 17,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 50% multiplier to Security posture and gives it an At risk ceiling of 49.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "jurisdiction_posture_adjustment",
"params": {
"cap": 49,
"pct": 50
}
}
],
"value": 17,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 3.5,
"high_risk_jurisdiction_cap": 49,
"high_risk_jurisdiction_multiplier": 50,
"security_posture_after_multiplier": 17,
"security_posture_before_jurisdiction": 34
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "binaries present in source code",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 7 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 7/20 approved changesets -- score normalized to 3",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "24 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "3 existing vulnerabilities detected",
"points": 5.2,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "moderate",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 50,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": true,
"exposures": [
{
"role": "top_contributor",
"count": 1,
"country": "Russia"
}
],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 3
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "Russia: top_contributor (1)",
"points": 50,
"status": "partial",
"details": [
{
"code": "jurisdiction_exposure",
"params": {
"role": "top_contributor",
"count": 1,
"country": "Russia"
}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 55,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.8,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "80 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 80,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"build/linux/Makefile",
"build/macos/Makefile",
"test/dylib/demo/Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "build/linux/Makefile, build/macos/Makefile, test/dylib/demo/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "build/linux/Makefile, build/macos/Makefile, test/dylib/demo/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "C++ (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "C++"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 95,
"inputs": {
"primary_language": "C++",
"largest_source_bytes": 591749,
"source_files_sampled": 71,
"oversized_source_files": 6
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "C++ (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "C++"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "6/71 source files over 60KB",
"points": 50.4,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 71,
"oversized": 6
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-22T15:34:24.577740Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/z/zhlynn/zsign.svg",
"full_name": "zhlynn/zsign",
"license_state": "standard",
"license_spdx": "MIT"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.26.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics.