k2gl/rekor-client
A PSR-18 client for the Rekor transparency log (v1 and v2) — submit hashedrekord entries and read a v2 log's tiles from PHP
72%
Total Score
80
50
100
100
Health Score Breakdown
Seven runtime dependencies are declared, including HTTP interfaces and two project-specific libraries; this is a meaningful dependency surface but not excessive for a PSR-18 client.
The repository is owned by a user account rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.
One contributor made all 12 commits in the last three months, leaving the project dependent on a single active maintainer.
All three workflows were analyzed successfully, with no untrusted checkout or script-injection findings; however, a high-confidence bot-condition finding affects the auto-merge workflow, and two of five action references are unpinned.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Nick Harin |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/http-client Version ^1.0 | — | — |
k2gl/signed-note Version ^1.1 | — | — |
psr/http-factory Version ^1.0 | — | — |
psr/http-message Version ^1.1|^2.0 | — | — |
k2gl/sigstore-bundle Version ^1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 23 days ago
- Created
- 3 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.