isy-thl/dss-csc-signing

This is a very young, early-stage PHP package: it has only three releases over about 2 days and remains on the 0.x line, so long-term maintenance and compatibility are not yet established. Its source repository is active in the immediate release window, correctly matches and documents the package, includes tests, a changelog, CI scaffolding, licensing, and no install-time scripts or archived status. However, the repository shows no commit activity or active maintainers in the measured three-month window, has no security policy or security-scanning tooling, and its CI workflow does not declare top-level token permissions. It is potentially usable, but should be adopted with version pinning and continued maintenance review rather than treated as a mature dependency.

Latest v0.1.2

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by an individual user rather than an organization, so there is no demonstrated organizational backing or broader maintainer capacity.

Release history

Only three releases have been published since the package first appeared about 2 days ago. This demonstrates active initial iteration but provides little evidence of sustained maintenance or maturity.

Repo commit activity

The repository reports zero commits and zero active maintainers over the measured three-month period. Because the project is only about 2 days old, this is partly explained by limited observation time, but it still leaves sustained maintenance unproven.

Repo popularity

The repository has zero stars, forks, and watchers. For a package released only about 2 days ago this is weak supporting evidence rather than a severe concern, but there is no external adoption signal yet.

Repo tooling

Composer build tooling is present, but no security-scanning tools are configured. The missing scanning coverage is a genuine transparency and security-hygiene gap for a signing-related package.