rc-util

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent.

Lifecycle scriptscaution

The package defines a prepare install lifecycle script. Its behavior is not shown here, so this is a modest supply-chain review concern rather than evidence of harm.

Release historycaution

The package has 218 releases since 2015, but no registry releases in the last 12 months and its latest release was in February 2025. Recent repository commits and pull requests show ongoing work, partly offsetting the slower release cadence.

Security policycaution

No repository security policy was found, which makes vulnerability-reporting expectations less clear for users and maintainers.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts, but three workflows grant top-level write permissions and five of ten action references are unpinned. These are workflow hygiene weaknesses without an observed dangerous trigger or sink.