remi/rpminfo

Licensecaution

The package declares PHP-3.01, while the repository license file is detected as BSD-3-Clause. The release is licensed, but the mismatch creates a meaningful transparency concern.

Repo bus factorcaution

All six recent commits came from one contributor, so maintenance depends heavily on a single person. The repository is user-owned rather than organization-owned, providing no shown organizational handoff support.

Repo toolingcaution

Build tooling is present, but no security scanning tooling was detected. For a native extension, that leaves a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

The workflow audit completed fully and found no dangerous triggers or untrusted checkouts. However, all four analyzed references are unpinned, and the low-confidence unpinned-image findings weaken build reproducibility without establishing a severe risk.