openpgp

Lifecycle scriptscaution

A prepare script runs during installation, adding build or install-time behavior that deserves awareness, but this signal alone is not evidence of poor maintenance.

Repo bus factorcaution

Two contributors are active, but one made about 85% of recent commits; the organization backing provides some handoff capacity, so this is a moderate rather than severe concern.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts, script injection, or write-all token permissions, and jobs scope permissions. However, all 37 action references are unpinned and high-confidence adhoc-package findings appear in every workflow, creating a moderate reproducibility and workflow hygiene concern.