dev-util/scorecard
Security health metrics for open source projects.
Screenshots
-
scorecard-5.5.0~amd64
View 
Download 
Browse License: Apache-2.0 BSD BSD-2 CC-BY-4.0 CC-BY-SA-4.0 ISC MIT MPL-2.0 Unlicense Overlay: tatsh-overlay
ChangeLog
commit 178c4a9a3677b51294a61265ac9f0b1a613fe217
Author: Andrew Udvare <audvare@gmail.com>
Date: Fri Sep 11 16:25:37 2026 -0400
dev-util/scorecard: new package, add 5.5.0
Upstream's Makefile takes the version stamps from git, which a release tarball
cannot answer for, so they are passed to go build explicitly; gitCommit is left
at its default of unknown rather than invented, and the build date is only
claimed when SOURCE_DATE_EPOCH is set. The Makefile also passes -a and
-extldflags=-static, both of which fight the PIE build go-env.eclass sets up.
The licences beyond Apache-2.0 are those of the vendored dependencies, read out
of the vendor tree rather than copied from another package.
Signed-off-by: Andrew Udvare <audvare@gmail.com>
Author: Andrew Udvare <audvare@gmail.com>
Date: Fri Sep 11 16:25:37 2026 -0400
dev-util/scorecard: new package, add 5.5.0
Upstream's Makefile takes the version stamps from git, which a release tarball
cannot answer for, so they are passed to go build explicitly; gitCommit is left
at its default of unknown rather than invented, and the build date is only
claimed when SOURCE_DATE_EPOCH is set. The Makefile also passes -a and
-extldflags=-static, both of which fight the PIE build go-env.eclass sets up.
The licences beyond Apache-2.0 are those of the vendored dependencies, read out
of the vendor tree rather than copied from another package.
Signed-off-by: Andrew Udvare <audvare@gmail.com>