{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:16:36.601112Z","repo":{"ref":{"host":"github.com","owner":"Carthage","name":"Carthage"},"default_branch":"master","clone_url":"https://github.com/Carthage/Carthage.git","html_url":"https://github.com/Carthage/Carthage","description":"A simple, decentralized dependency manager for Cocoa","stars":15136,"forks":1541,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":20197,"primary_language":"Swift","license_spdx":"NOASSERTION","created_at":"2014-10-10T19:54:55Z","pushed_at":"2025-09-10T15:36:04Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-10-11T04:24:24Z","owner_type":"Organization","release_assets":[{"name":"Carthage.pkg","size":3802827,"download_count":84559,"release_tag":"0.40.0","url":"https://github.com/Carthage/Carthage/releases/download/0.40.0/Carthage.pkg"},{"name":"Carthage.pkg","size":3883019,"download_count":14330,"release_tag":"0.39.1","url":"https://github.com/Carthage/Carthage/releases/download/0.39.1/Carthage.pkg"},{"name":"Carthage.pkg","size":1798952,"download_count":9445,"release_tag":"0.39.0","url":"https://github.com/Carthage/Carthage/releases/download/0.39.0/Carthage.pkg"},{"name":"Carthage.pkg","size":5064561,"download_count":53115,"release_tag":"0.38.0","url":"https://github.com/Carthage/Carthage/releases/download/0.38.0/Carthage.pkg"},{"name":"Carthage.pkg","size":5034637,"download_count":27912,"release_tag":"0.37.0","url":"https://github.com/Carthage/Carthage/releases/download/0.37.0/Carthage.pkg"},{"name":"Carthage.pkg","size":4987426,"download_count":5742,"release_tag":"0.36.1","url":"https://github.com/Carthage/Carthage/releases/download/0.36.1/Carthage.pkg"},{"name":"Carthage.pkg","size":1805280,"download_count":66426,"release_tag":"0.36.0","url":"https://github.com/Carthage/Carthage/releases/download/0.36.0/Carthage.pkg"},{"name":"Carthage.pkg","size":1804888,"download_count":608,"release_tag":"0.35.1","url":"https://github.com/Carthage/Carthage/releases/download/0.35.1/Carthage.pkg"},{"name":"Carthage.pkg","size":4965292,"download_count":8345,"release_tag":"0.35.0","url":"https://github.com/Carthage/Carthage/releases/download/0.35.0/Carthage.pkg"},{"name":"Carthage.pkg","size":4907945,"download_count":30188,"release_tag":"0.34.0","url":"https://github.com/Carthage/Carthage/releases/download/0.34.0/Carthage.pkg"}]}},"commit_sha":"e33e133a5427129b38bfb1ae18d8f56b29a93204","profile":{"lines_by_language":{"Swift":16115,"C":427,"Shell":50},"files_by_category":{"source":95,"other":34,"binary":24,"config":16,"docs":12,"oversized":4},"source_lines":16592,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":0.03},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":57.5,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":49.1,"duplication":72.9,"lint":97.8,"testing":35.0,"docs":80.0,"type_safety":null,"process":25.0},"summary":"Code quality is weak: test-to-source ratio 0.00, CI runs tests; 24% of function code in complex or long functions; 5% duplicated lines. Weakest area: process."},"security":{"score":72.0,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":100.0,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":18.0},"summary":"Security posture is adequate: no high-impact findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":2.2,"check:Maintained":0.0,"check:Code-Review":5.0,"check:Binary-Artifacts":9.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:Fuzzing":0.0,"check:License":9.0,"check:Signed-Releases":0.0,"check:Branch-Protection":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Code-Review: 5/10 (Found 8/15 approved changesets -- score normalized to 5)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":0.5},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 9/10 (binaries present in source code)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":0.1},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 9/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":0.1},{"kind":"scorecard-check","description":"Scorecard Signed-Releases: 0/10 (Project has not signed or included provenance with any releases.)","ref":"Signed-Releases","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/Carthage/Carthage","weight":1.0}],"data":{"date":"2026-11-09","commit":"e33e133a5427129b38bfb1ae18d8f56b29a93204","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":3263.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":105271.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2014-10":{"loc":3609,"attributed_loc":0},"2014-11":{"loc":53184,"attributed_loc":0},"2014-12":{"loc":3208,"attributed_loc":0},"2015-01":{"loc":383,"attributed_loc":0},"2015-02":{"loc":780,"attributed_loc":0},"2015-03":{"loc":2050,"attributed_loc":0},"2015-04":{"loc":101,"attributed_loc":0},"2015-05":{"loc":1247,"attributed_loc":0},"2015-06":{"loc":515,"attributed_loc":0},"2015-07":{"loc":1122,"attributed_loc":0},"2015-08":{"loc":1206,"attributed_loc":0},"2015-09":{"loc":563,"attributed_loc":0},"2015-10":{"loc":2191,"attributed_loc":0},"2015-11":{"loc":356,"attributed_loc":0},"2015-12":{"loc":1453,"attributed_loc":0},"2016-01":{"loc":680,"attributed_loc":0},"2016-02":{"loc":1643,"attributed_loc":0},"2016-03":{"loc":370,"attributed_loc":0},"2016-04":{"loc":1005,"attributed_loc":0},"2016-05":{"loc":191,"attributed_loc":0},"2016-06":{"loc":303,"attributed_loc":0},"2016-07":{"loc":22,"attributed_loc":0},"2016-08":{"loc":1229,"attributed_loc":0},"2016-09":{"loc":684,"attributed_loc":0},"2016-10":{"loc":115,"attributed_loc":0},"2016-11":{"loc":2147,"attributed_loc":0},"2016-12":{"loc":1720,"attributed_loc":0},"2017-01":{"loc":2089,"attributed_loc":0},"2017-02":{"loc":2281,"attributed_loc":0},"2017-03":{"loc":808,"attributed_loc":0},"2017-04":{"loc":336,"attributed_loc":0},"2017-05":{"loc":932,"attributed_loc":0},"2017-06":{"loc":1739,"attributed_loc":0},"2017-07":{"loc":764,"attributed_loc":0},"2017-08":{"loc":1676,"attributed_loc":0},"2017-09":{"loc":590,"attributed_loc":0},"2017-10":{"loc":126,"attributed_loc":0},"2017-11":{"loc":855,"attributed_loc":0},"2017-12":{"loc":679,"attributed_loc":0},"2018-01":{"loc":264,"attributed_loc":0},"2018-02":{"loc":545,"attributed_loc":0},"2018-03":{"loc":822,"attributed_loc":0},"2018-04":{"loc":420,"attributed_loc":0},"2018-05":{"loc":479,"attributed_loc":0},"2018-06":{"loc":387,"attributed_loc":0},"2018-07":{"loc":552,"attributed_loc":0},"2018-08":{"loc":531,"attributed_loc":0},"2018-09":{"loc":192,"attributed_loc":0},"2018-10":{"loc":372,"attributed_loc":0},"2018-11":{"loc":217,"attributed_loc":0},"2018-12":{"loc":123,"attributed_loc":0},"2019-01":{"loc":427,"attributed_loc":0},"2019-02":{"loc":102,"attributed_loc":0},"2019-03":{"loc":222,"attributed_loc":0},"2019-04":{"loc":21,"attributed_loc":0},"2019-05":{"loc":253,"attributed_loc":0},"2019-06":{"loc":36,"attributed_loc":0},"2019-07":{"loc":198,"attributed_loc":0},"2019-09":{"loc":622,"attributed_loc":0},"2019-10":{"loc":0,"attributed_loc":0},"2019-11":{"loc":0,"attributed_loc":0},"2019-12":{"loc":0,"attributed_loc":0},"2020-02":{"loc":609,"attributed_loc":0},"2020-03":{"loc":0,"attributed_loc":0},"2020-04":{"loc":58,"attributed_loc":0},"2020-06":{"loc":755,"attributed_loc":0},"2020-07":{"loc":174,"attributed_loc":0},"2020-08":{"loc":6,"attributed_loc":0},"2020-09":{"loc":423,"attributed_loc":0},"2020-10":{"loc":563,"attributed_loc":0},"2020-11":{"loc":20,"attributed_loc":0},"2020-12":{"loc":103,"attributed_loc":0},"2021-01":{"loc":12,"attributed_loc":0},"2021-02":{"loc":162,"attributed_loc":0},"2021-03":{"loc":103,"attributed_loc":0},"2021-04":{"loc":117,"attributed_loc":0},"2021-05":{"loc":75,"attributed_loc":0},"2021-06":{"loc":0,"attributed_loc":0},"2021-09":{"loc":1,"attributed_loc":0},"2021-11":{"loc":0,"attributed_loc":0},"2022-01":{"loc":0,"attributed_loc":0},"2022-07":{"loc":18,"attributed_loc":0},"2023-01":{"loc":1,"attributed_loc":0},"2023-06":{"loc":59,"attributed_loc":0},"2023-09":{"loc":203,"attributed_loc":0},"2024-03":{"loc":1,"attributed_loc":0},"2024-06":{"loc":69,"attributed_loc":0},"2024-09":{"loc":2,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":1349.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":59095.0,"pre_ai_era_burst_loc":0.0,"measured_loc":59449.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":542.0,"median_loc_per_hour":39.24522912387765,"pr_timed_units":45.0,"excluded_import_loc":45822.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["9a64274442ae705d5267419c56a48c07fa27995f"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":76.0,"flagged_releases":0.0,"max_loc_per_day":3466.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"0.1","to":"0.2","loc":230,"days":1.5,"loc_per_day":153.2,"flagged":false},{"from":"0.2","to":"0.2.1","loc":689,"days":11.95,"loc_per_day":57.7,"flagged":false},{"from":"0.2.1","to":"0.2.2","loc":348,"days":0.1,"loc_per_day":3466.0,"flagged":false},{"from":"0.2.2","to":"0.3","loc":1485,"days":2.37,"loc_per_day":627.4,"flagged":false},{"from":"0.3","to":"0.3.1","loc":174,"days":15.63,"loc_per_day":11.1,"flagged":false},{"from":"0.3.1","to":"0.4","loc":1247,"days":3.05,"loc_per_day":408.4,"flagged":false},{"from":"0.4","to":"0.5","loc":26,"days":2.9,"loc_per_day":9.0,"flagged":false},{"from":"0.5","to":"0.5.1","loc":346,"days":7.44,"loc_per_day":46.5,"flagged":false},{"from":"0.5.1","to":"0.5.2","loc":35,"days":13.61,"loc_per_day":2.6,"flagged":false},{"from":"0.5.2","to":"0.5.3","loc":1400,"days":23.47,"loc_per_day":59.6,"flagged":false},{"from":"0.5.3","to":"0.6","loc":483,"days":5.63,"loc_per_day":85.8,"flagged":false},{"from":"0.6","to":"0.6.1","loc":21,"days":4.43,"loc_per_day":4.7,"flagged":false},{"from":"0.6.1","to":"0.6.2","loc":7,"days":1.89,"loc_per_day":3.7,"flagged":false},{"from":"0.6.2","to":"0.6.3","loc":586,"days":17.58,"loc_per_day":33.3,"flagged":false},{"from":"0.6.3","to":"0.6.4","loc":23,"days":28.39,"loc_per_day":0.8,"flagged":false},{"from":"0.6.4","to":"0.6.5","loc":30,"days":6.0,"loc_per_day":5.0,"flagged":false},{"from":"0.6.5","to":"0.7","loc":1984,"days":23.6,"loc_per_day":84.1,"flagged":false},{"from":"0.7","to":"0.7.1","loc":94,"days":0.96,"loc_per_day":98.3,"flagged":false},{"from":"0.7.1","to":"0.7.2","loc":8,"days":4.08,"loc_per_day":2.0,"flagged":false},{"from":"0.7.2","to":"0.7.3","loc":1,"days":0.71,"loc_per_day":1.4,"flagged":false},{"from":"0.7.3","to":"0.7.4-beta.1","loc":436,"days":13.55,"loc_per_day":32.2,"flagged":false},{"from":"0.7.4-beta.1","to":"0.7.4-beta.2","loc":285,"days":2.2,"loc_per_day":129.4,"flagged":false},{"from":"0.7.4-beta.2","to":"0.7.4","loc":59,"days":8.9,"loc_per_day":6.6,"flagged":false},{"from":"0.7.4","to":"0.7.4-homebrew","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"0.7.4-homebrew","to":"0.7.5","loc":139,"days":11.99,"loc_per_day":11.6,"flagged":false},{"from":"0.7.5","to":"0.8","loc":666,"days":50.44,"loc_per_day":13.2,"flagged":false},{"from":"0.8","to":"0.9","loc":2110,"days":36.38,"loc_per_day":58.0,"flagged":false},{"from":"0.9","to":"0.9.1","loc":5,"days":0.7,"loc_per_day":7.1,"flagged":false},{"from":"0.9.1","to":"0.9.2","loc":238,"days":10.93,"loc_per_day":21.8,"flagged":false},{"from":"0.9.2","to":"0.9.3","loc":70,"days":12.04,"loc_per_day":5.8,"flagged":false},{"from":"0.9.3","to":"0.9.4","loc":440,"days":20.81,"loc_per_day":21.1,"flagged":false},{"from":"0.9.4","to":"0.10","loc":1779,"days":9.65,"loc_per_day":184.3,"flagged":false},{"from":"0.10","to":"0.11","loc":319,"days":25.89,"loc_per_day":12.3,"flagged":false},{"from":"0.11","to":"0.12","loc":2068,"days":60.96,"loc_per_day":33.9,"flagged":false},{"from":"0.12","to":"0.13","loc":87,"days":5.81,"loc_per_day":15.0,"flagged":false},{"from":"0.13","to":"0.14","loc":114,"days":4.94,"loc_per_day":23.1,"flagged":false},{"from":"0.14","to":"0.15","loc":1222,"days":14.95,"loc_per_day":81.7,"flagged":false},{"from":"0.15","to":"0.15.1","loc":41,"days":11.83,"loc_per_day":3.5,"flagged":false},{"from":"0.15.1","to":"0.15.2","loc":1,"days":8.98,"loc_per_day":0.1,"flagged":false},{"from":"0.15.2","to":"0.16","loc":992,"days":23.05,"loc_per_day":43.0,"flagged":false},{"from":"0.16","to":"0.16.1","loc":46,"days":1.94,"loc_per_day":23.7,"flagged":false},{"from":"0.16.1","to":"0.16.2","loc":27,"days":0.98,"loc_per_day":27.5,"flagged":false},{"from":"0.16.2","to":"0.17","loc":257,"days":70.01,"loc_per_day":3.7,"flagged":false},{"from":"0.17","to":"0.17.1","loc":21,"days":1.98,"loc_per_day":10.6,"flagged":false},{"from":"0.17.1","to":"0.17.2","loc":73,"days":6.01,"loc_per_day":12.2,"flagged":false},{"from":"0.17.2","to":"0.18","loc":616,"days":72.53,"loc_per_day":8.5,"flagged":false},{"from":"0.18","to":"0.18.1","loc":13,"days":25.0,"loc_per_day":0.5,"flagged":false},{"from":"0.18.1","to":"0.19.0","loc":6052,"days":131.83,"loc_per_day":45.9,"flagged":false},{"from":"0.19.0","to":"0.19.1","loc":4,"days":0.67,"loc_per_day":5.9,"flagged":false},{"from":"0.19.1","to":"0.20.0","loc":4025,"days":11.99,"loc_per_day":335.7,"flagged":false},{"from":"0.20.0","to":"0.20.1","loc":311,"days":12.23,"loc_per_day":25.4,"flagged":false},{"from":"0.20.1","to":"0.21.0","loc":764,"days":44.77,"loc_per_day":17.1,"flagged":false},{"from":"0.21.0","to":"0.22.0","loc":62,"days":3.0,"loc_per_day":20.7,"flagged":false},{"from":"0.22.0","to":"0.23.0","loc":842,"days":20.99,"loc_per_day":40.1,"flagged":false},{"from":"0.23.0","to":"0.24.0","loc":2055,"days":51.99,"loc_per_day":39.5,"flagged":false},{"from":"0.24.0","to":"0.25.0","loc":1653,"days":56.25,"loc_per_day":29.4,"flagged":false},{"from":"0.25.0","to":"0.26.0","loc":395,"days":36.24,"loc_per_day":10.9,"flagged":false},{"from":"0.26.0","to":"0.26.1","loc":13,"days":2.2,"loc_per_day":5.9,"flagged":false},{"from":"0.26.1","to":"0.26.2","loc":28,"days":0.88,"loc_per_day":31.7,"flagged":false},{"from":"0.26.2","to":"0.27.0","loc":1104,"days":55.68,"loc_per_day":19.8,"flagged":false},{"from":"0.27.0","to":"0.28.0","loc":1459,"days":51.82,"loc_per_day":28.2,"flagged":false},{"from":"0.28.0","to":"0.29.0","loc":906,"days":49.24,"loc_per_day":18.4,"flagged":false},{"from":"0.29.0","to":"0.30.0","loc":1846,"days":104.57,"loc_per_day":17.7,"flagged":false},{"from":"0.30.0","to":"0.30.1","loc":2,"days":0.16,"loc_per_day":12.4,"flagged":false},{"from":"0.30.1","to":"0.31.0","loc":1117,"days":84.37,"loc_per_day":13.2,"flagged":false},{"from":"0.31.0","to":"0.31.1","loc":134,"days":15.04,"loc_per_day":8.9,"flagged":false},{"from":"0.31.1","to":"0.31.2","loc":71,"days":20.95,"loc_per_day":3.4,"flagged":false},{"from":"0.31.2","to":"0.33.0","loc":1414,"days":154.93,"loc_per_day":9.1,"flagged":false},{"from":"0.33.0","to":"0.35.0","loc":2956,"days":442.03,"loc_per_day":6.7,"flagged":false},{"from":"0.35.0","to":"0.35.1","loc":118,"days":89.91,"loc_per_day":1.3,"flagged":false},{"from":"0.35.1","to":"0.36.0","loc":21,"days":1.53,"loc_per_day":13.8,"flagged":false},{"from":"0.36.0","to":"0.37.0","loc":1161,"days":136.39,"loc_per_day":8.5,"flagged":false},{"from":"0.37.0","to":"0.38.0","loc":460,"days":95.28,"loc_per_day":4.8,"flagged":false},{"from":"0.38.0","to":"0.39.0","loc":20,"days":630.37,"loc_per_day":0.0,"flagged":false},{"from":"0.39.0","to":"0.39.1","loc":262,"days":233.33,"loc_per_day":1.1,"flagged":false},{"from":"0.39.1","to":"0.40.0","loc":72,"days":356.91,"loc_per_day":0.2,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":16592.0,"index":0.03,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":1.0,"per_kloc:emoji_in_code":0.06,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":0.0,"scanned_lines":16592.0,"parse_errors":2.0},"findings":[],"evidence":[],"data":{"rulesets":["swift","c","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.23,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":10.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release 0.40.0 ships Carthage.pkg (84559 downloads)","ref":"Carthage.pkg","url":"https://github.com/Carthage/Carthage/releases/download/0.40.0/Carthage.pkg","weight":0.0},{"kind":"binary-release-asset","description":"release 0.39.1 ships Carthage.pkg (14330 downloads)","ref":"Carthage.pkg","url":"https://github.com/Carthage/Carthage/releases/download/0.39.1/Carthage.pkg","weight":0.0},{"kind":"binary-release-asset","description":"release 0.39.0 ships Carthage.pkg (9445 downloads)","ref":"Carthage.pkg","url":"https://github.com/Carthage/Carthage/releases/download/0.39.0/Carthage.pkg","weight":0.0},{"kind":"binary-release-asset","description":"release 0.38.0 ships Carthage.pkg (53115 downloads)","ref":"Carthage.pkg","url":"https://github.com/Carthage/Carthage/releases/download/0.38.0/Carthage.pkg","weight":0.0},{"kind":"binary-release-asset","description":"release 0.37.0 ships Carthage.pkg (27912 downloads)","ref":"Carthage.pkg","url":"https://github.com/Carthage/Carthage/releases/download/0.37.0/Carthage.pkg","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":587.0,"function_nloc":10567.0,"mean_ccn":2.82,"p90_ccn":6.0,"complex_functions":6.0,"long_functions":11.0,"many_param_functions":4.0,"risky_nloc_share":0.2373},"findings":[],"evidence":[{"kind":"complex-function","description":"description in Source/CarthageKit/Errors.swift: complexity 44, 143 lines","ref":"Source/CarthageKit/Errors.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Source/CarthageKit/Errors.swift#L223","weight":0.7333333333333333},{"kind":"complex-function","description":"== in Source/CarthageKit/Errors.swift: complexity 40, 61 lines","ref":"Source/CarthageKit/Errors.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Source/CarthageKit/Errors.swift#L133","weight":0.6666666666666666},{"kind":"complex-function","description":"intersection in Source/CarthageKit/Version.swift: complexity 25, 54 lines","ref":"Source/CarthageKit/Version.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Source/CarthageKit/Version.swift#L534","weight":0.4166666666666667},{"kind":"complex-function","description":"from in Source/CarthageKit/Version.swift: complexity 17, 48 lines","ref":"Source/CarthageKit/Version.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Source/CarthageKit/Version.swift#L110","weight":0.2833333333333333},{"kind":"complex-function","description":"from in Source/CarthageKit/BinaryProject.swift: complexity 16, 53 lines","ref":"Source/CarthageKit/BinaryProject.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Source/CarthageKit/BinaryProject.swift#L10","weight":0.26666666666666666},{"kind":"complex-function","description":"buildScheme in Source/CarthageKit/Xcode.swift: complexity 16, 117 lines","ref":"Source/CarthageKit/Xcode.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Source/CarthageKit/Xcode.swift#L670","weight":0.26666666666666666},{"kind":"complex-function","description":"spec in Tests/CarthageKitTests/XcodeSpec.swift: complexity 14, 321 lines","ref":"Tests/CarthageKitTests/XcodeSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/XcodeSpec.swift#L12","weight":0.23333333333333334},{"kind":"complex-function","description":"spec in Tests/CarthageKitTests/ProjectSpec.swift: complexity 8, 353 lines","ref":"Tests/CarthageKitTests/ProjectSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/ProjectSpec.swift#L15","weight":0.13333333333333333},{"kind":"complex-function","description":"spec in Tests/CarthageKitTests/NetrcSpec.swift: complexity 5, 138 lines","ref":"Tests/CarthageKitTests/NetrcSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/NetrcSpec.swift#L7","weight":0.08333333333333333},{"kind":"complex-function","description":"spec in Tests/CarthageKitTests/ValidateSpec.swift: complexity 3, 120 lines","ref":"Tests/CarthageKitTests/ValidateSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/ValidateSpec.swift#L19","weight":0.05}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":11132.0,"duplicated_lines":585.0,"duplicated_share":0.0526,"files":95.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: Source/CarthageKit/NewResolver.swift:7 and Source/CarthageKit/Resolver.swift:22","ref":"Source/CarthageKit/NewResolver.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Source/CarthageKit/NewResolver.swift#L7","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Source/carthage/Checkout.swift:43 and Source/carthage/Outdated.swift:76","ref":"Source/carthage/Checkout.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Source/carthage/Checkout.swift#L43","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Tests/CarthageKitTests/AlgorithmsSpec.swift:33 and Tests/CarthageKitTests/AlgorithmsSpec.swift:69","ref":"Tests/CarthageKitTests/AlgorithmsSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/AlgorithmsSpec.swift#L33","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Tests/CarthageKitTests/NetrcSpec.swift:12 and Tests/CarthageKitTests/NetrcSpec.swift:28","ref":"Tests/CarthageKitTests/NetrcSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/NetrcSpec.swift#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Tests/CarthageKitTests/ProjectSpec.swift:295 and Tests/CarthageKitTests/ProjectSpec.swift:306","ref":"Tests/CarthageKitTests/ProjectSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/ProjectSpec.swift#L295","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Tests/CarthageKitTests/ProjectSpec.swift:611 and Tests/CarthageKitTests/ValidateSpec.swift:21","ref":"Tests/CarthageKitTests/ProjectSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/ProjectSpec.swift#L611","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Tests/CarthageKitTests/ResolverSpec.swift:94 and Tests/CarthageKitTests/ResolverSpec.swift:206","ref":"Tests/CarthageKitTests/ResolverSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/ResolverSpec.swift#L94","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Tests/CarthageKitTests/Resources/FakeOSSSwift.framework/Headers/FakeSwift-Swift.h:22 and Tests/CarthageKitTests/Resources/FakeOldSwift.framework/Headers/FakeOldSwift-Swift.h:22","ref":"Tests/CarthageKitTests/Resources/FakeOSSSwift.framework/Headers/FakeSwift-Swift.h","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/Resources/FakeOSSSwift.framework/Headers/FakeSwift-Swift.h#L22","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Tests/CarthageKitTests/Resources/FakeOldSwift.framework/Headers/FakeOldSwift-Swift.h:2 and Tests/CarthageKitTests/Resources/FakeSwift.framework/Headers/FakeSwift-Swift.h:2","ref":"Tests/CarthageKitTests/Resources/FakeOldSwift.framework/Headers/FakeOldSwift-Swift.h","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/Resources/FakeOldSwift.framework/Headers/FakeOldSwift-Swift.h#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Tests/CarthageKitTests/SimulatorSpec.swift:21 and Tests/CarthageKitTests/SimulatorSpec.swift:40","ref":"Tests/CarthageKitTests/SimulatorSpec.swift","url":"https://github.com/Carthage/Carthage/blob/e33e133a5427129b38bfb1ae18d8f56b29a93204/Tests/CarthageKitTests/SimulatorSpec.swift#L21","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":6.0,"weighted_findings":1.5,"scanned_lines":16592.0,"category:correctness":6.0},"findings":[{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"IntegrationTests/Utilities/TestFramework.bash","line":6,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:IntegrationTests/Utilities/TestFramework.bash:6"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"IntegrationTests/Utilities/TestFramework.bash","line":15,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:IntegrationTests/Utilities/TestFramework.bash:15"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"IntegrationTests/Utilities/TestFramework.bash","line":16,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:IntegrationTests/Utilities/TestFramework.bash:16"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"IntegrationTests/Utilities/TestFramework.bash","line":23,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:IntegrationTests/Utilities/TestFramework.bash:23"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"IntegrationTests/Utilities/TestFramework.bash","line":24,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:IntegrationTests/Utilities/TestFramework.bash:24"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"IntegrationTests/Utilities/TestFramework.bash","line":36,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:IntegrationTests/Utilities/TestFramework.bash:36"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":16592.0,"test_ratio":0.0,"ci_files":1.0,"cochange_share":0.0,"cochange_commits":236.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (make test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["make test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":301.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE.md","ref":"LICENSE.md","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}