gopd

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less assurance about how the published artifact was produced.

Maintainerscaution

Only one account has registry publish access, leaving limited publishing redundancy even though the repository itself is directly matched to the package.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is limited visible organizational continuity behind the package.

Release historycaution

There have been four releases, but none in about 21 months. That may reflect stability for this small utility, but it reduces evidence of ongoing release maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last 3 months. Together with the long release gap, this is a meaningful sign of slowed maintenance, despite a more recent recorded push.