{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:41:58.460318Z","repo":{"ref":{"host":"github.com","owner":"Tencent","name":"phxsql"},"default_branch":"master","clone_url":"https://github.com/Tencent/phxsql.git","html_url":"https://github.com/Tencent/phxsql","description":"A high availability MySQL cluster that guarantees data consistency between a master and slaves.","stars":2445,"forks":543,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":852,"primary_language":"C++","license_spdx":"NOASSERTION","created_at":"2016-08-29T14:02:56Z","pushed_at":"2018-12-25T10:38:56Z","security_policy_url":null,"distribution":{"owner_created_at":"2016-04-14T10:38:57Z","owner_type":"Organization","release_assets":[{"name":"phxsql-0.8.5-binary-ubuntu.tar.gz","size":56605068,"download_count":325,"release_tag":"v0.8.5","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-binary-ubuntu.tar.gz"},{"name":"phxsql-0.8.5-with-percona-source.tar.gz","size":61284665,"download_count":320,"release_tag":"v0.8.5","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-with-percona-source.tar.gz"},{"name":"phxsql-0.8.5-with-percona-source.zip","size":80022850,"download_count":113,"release_tag":"v0.8.5","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-with-percona-source.zip"},{"name":"phxsql-0.8.5-with-thirdparty.tar.gz","size":6159150,"download_count":129,"release_tag":"v0.8.5","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-with-thirdparty.tar.gz"},{"name":"phxsql-0.8.5-with-thirdparty.zip","size":13917447,"download_count":130,"release_tag":"v0.8.5","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-with-thirdparty.zip"},{"name":"phxsql-ubuntu-64bit-0.8.0.tar.gz","size":308208664,"download_count":455,"release_tag":"v0.8.0","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.0/phxsql-ubuntu-64bit-0.8.0.tar.gz"}]}},"commit_sha":"c5d689756b57d2d8b7f7e3ea932e523970fe59b8","profile":{"lines_by_language":{"C++":49100,"C":7484,"Python":1056,"Shell":241},"files_by_category":{"source":218,"other":49,"config":10,"docs":10,"test":2,"vendored":1},"source_lines":57643,"test_lines":238},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":52.8,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":37.9,"duplication":66.9,"lint":82.8,"testing":35.8,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 32% of function code in complex or long functions; 7% duplicated lines. Weakest area: testing."},"security":{"score":77.5,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":88.0,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 26 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":137.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":72855.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2016-08":{"loc":56840,"attributed_loc":0},"2016-09":{"loc":341,"attributed_loc":0},"2016-10":{"loc":262,"attributed_loc":0},"2016-11":{"loc":989,"attributed_loc":0},"2016-12":{"loc":1444,"attributed_loc":0},"2017-01":{"loc":12830,"attributed_loc":0},"2017-03":{"loc":57,"attributed_loc":0},"2017-05":{"loc":2,"attributed_loc":0},"2017-06":{"loc":0,"attributed_loc":0},"2017-08":{"loc":0,"attributed_loc":0},"2017-11":{"loc":0,"attributed_loc":0},"2017-12":{"loc":53,"attributed_loc":0},"2018-02":{"loc":3,"attributed_loc":0},"2018-05":{"loc":9,"attributed_loc":0},"2018-06":{"loc":9,"attributed_loc":0},"2018-08":{"loc":16,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":57.0,"flagged_units":0.0,"pre_ai_era_bursts":1.0,"pre_ai_era_measured_loc":16459.0,"pre_ai_era_burst_loc":12679.0,"measured_loc":16459.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":3118.4259069481454,"median_loc_per_hour":82.7760624772975,"pr_timed_units":1.0,"excluded_import_loc":56396.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["3eb1c8c30ed728d79586177a3192c42455c012fb"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":2.0,"flagged_releases":0.0,"max_loc_per_day":127.1},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.8.0","to":"v0.8.5","loc":16207,"days":127.56,"loc_per_day":127.1,"flagged":false},{"from":"v0.8.5","to":"v0.8.6","loc":236,"days":518.86,"loc_per_day":0.5,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":57643.0,"index":0.069,"count:narrated_steps":4.0,"per_kloc:narrated_steps":0.069,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: //step 1 : get last gtid in paxos","ref":"phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc:66","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc#L66","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: //step 2 : find all binlog files","ref":"phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc:93","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc#L93","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: //step 3 : truncate binlog files","ref":"phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc:100","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc#L100","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: //step 4 : generate new index file","ref":"phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc:116","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc#L116","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":28.0,"findings_high":26.0,"findings_medium":2.0,"findings_low":0.0,"weighted_findings":21.05,"scanned_lines":57643.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":19,"fingerprint":"dockerfile.security.missing-user-entrypoint:Dockerfile:19"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/binary_installer.py","line":42,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/binary_installer.py:42"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/binary_operator.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/binary_operator.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/binary_operator.py","line":41,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/binary_operator.py:41"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/binary_operator.py","line":76,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/binary_operator.py:76"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/binary_operator.py","line":81,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/binary_operator.py:81"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/binary_operator.py","line":87,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/binary_operator.py:87"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/binary_operator.py","line":94,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/binary_operator.py:94"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/binary_operator.py","line":102,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/binary_operator.py:102"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/binary_operator.py","line":110,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/binary_operator.py:110"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/config_generator.py","line":16,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/config_generator.py:16"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/config_generator.py","line":54,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/config_generator.py:54"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":10,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:10"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":16,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:16"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":22,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:22"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":23,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:23"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":24,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:24"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":25,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:25"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":26,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:26"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":27,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":34,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:34"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":40,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:40"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":41,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:41"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":42,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:42"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"phxrpc_package_config/tools/directory_operator.py","line":43,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:phxrpc_package_config/tools/directory_operator.py:43"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-system-call-audit","severity":"high","message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]","path":"tools/check_install.py","line":81,"fingerprint":"python.lang.security.audit.dangerous-system-call-audit:tools/check_install.py:81"},{"rule_id":"opengrep/bash.lang.security.ifs-tampering","severity":"medium","message":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'. [confidence low]","path":"phxrpc_package_config/bin/mysqld_safe","line":114,"fingerprint":"bash.lang.security.ifs-tampering:phxrpc_package_config/bin/mysqld_safe:114"},{"rule_id":"opengrep/bash.lang.security.ifs-tampering","severity":"medium","message":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'. [confidence low]","path":"phxrpc_package_config/bin/mysqld_safe","line":135,"fingerprint":"bash.lang.security.ifs-tampering:phxrpc_package_config/bin/mysqld_safe:135"}],"evidence":[],"data":{"rulesets":["c","python","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0073,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":2.0,"binary_assets":6.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v0.8.5 ships phxsql-0.8.5-binary-ubuntu.tar.gz (325 downloads)","ref":"phxsql-0.8.5-binary-ubuntu.tar.gz","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-binary-ubuntu.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.8.5 ships phxsql-0.8.5-with-percona-source.tar.gz (320 downloads)","ref":"phxsql-0.8.5-with-percona-source.tar.gz","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-with-percona-source.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.8.5 ships phxsql-0.8.5-with-percona-source.zip (113 downloads)","ref":"phxsql-0.8.5-with-percona-source.zip","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-with-percona-source.zip","weight":0.0},{"kind":"binary-release-asset","description":"release v0.8.5 ships phxsql-0.8.5-with-thirdparty.tar.gz (129 downloads)","ref":"phxsql-0.8.5-with-thirdparty.tar.gz","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-with-thirdparty.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.8.5 ships phxsql-0.8.5-with-thirdparty.zip (130 downloads)","ref":"phxsql-0.8.5-with-thirdparty.zip","url":"https://github.com/Tencent/phxsql/releases/download/v0.8.5/phxsql-0.8.5-with-thirdparty.zip","weight":0.0},{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0},{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.zh_cn.md","url":null,"weight":0.0}],"data":{"signals":["binary-release-assets","readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1921.0,"function_nloc":30299.0,"mean_ccn":3.81,"p90_ccn":8.0,"complex_functions":68.0,"long_functions":44.0,"many_param_functions":10.0,"risky_nloc_share":0.3232},"findings":[],"evidence":[{"kind":"complex-function","description":"mysqld_get_one_option in phx_percona/percona/sql/mysqld.cc: complexity 106, 337 lines","ref":"phx_percona/percona/sql/mysqld.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/mysqld.cc#L8860","weight":1.0},{"kind":"complex-function","description":"THD::decide_logging_format in phx_percona/percona/sql/binlog.cc: complexity 104, 313 lines","ref":"phx_percona/percona/sql/binlog.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/binlog.cc#L8349","weight":1.0},{"kind":"complex-function","description":"init_server_components in phx_percona/percona/sql/mysqld.cc: complexity 102, 361 lines","ref":"phx_percona/percona/sql/mysqld.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/mysqld.cc#L4933","weight":1.0},{"kind":"complex-function","description":"replace_user_table in phx_percona/percona/sql/sql_acl.cc: complexity 96, 415 lines","ref":"phx_percona/percona/sql/sql_acl.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/sql_acl.cc#L3052","weight":1.0},{"kind":"complex-function","description":"mysqld_main in phx_percona/percona/sql/mysqld.cc: complexity 89, 300 lines","ref":"phx_percona/percona/sql/mysqld.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/mysqld.cc#L5578","weight":1.0},{"kind":"complex-function","description":"acl_load in phx_percona/percona/sql/sql_acl.cc: complexity 85, 330 lines","ref":"phx_percona/percona/sql/sql_acl.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/sql_acl.cc#L828","weight":1.0},{"kind":"complex-function","description":"init_common_variables in phx_percona/percona/sql/mysqld.cc: complexity 75, 312 lines","ref":"phx_percona/percona/sql/mysqld.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/mysqld.cc#L4012","weight":1.0},{"kind":"complex-function","description":"acl_authenticate in phx_percona/percona/sql/sql_acl.cc: complexity 69, 253 lines","ref":"phx_percona/percona/sql/sql_acl.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/sql_acl.cc#L11408","weight":1.0},{"kind":"complex-function","description":"mysql_show_grants in phx_percona/percona/sql/sql_acl.cc: complexity 67, 336 lines","ref":"phx_percona/percona/sql/sql_acl.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/sql_acl.cc#L6614","weight":1.0},{"kind":"complex-function","description":"handle_connections_sockets in phx_percona/percona/sql/mysqld.cc: complexity 54, 170 lines","ref":"phx_percona/percona/sql/mysqld.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/mysqld.cc#L6619","weight":0.9}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":37201.0,"duplicated_lines":2487.0,"duplicated_share":0.0669,"files":218.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: include/phxbinlogsvr/client/phxbinlog_client.h:2 and include/phxbinlogsvr/client/phxbinlog_client_factory_interface.h:2","ref":"include/phxbinlogsvr/client/phxbinlog_client.h","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/include/phxbinlogsvr/client/phxbinlog_client.h#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: include/phxbinlogsvr/config/phxbinlog_config.h:3 and include/phxbinlogsvr/config/phxbinlog_svr_base_config.h:3","ref":"include/phxbinlogsvr/config/phxbinlog_config.h","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/include/phxbinlogsvr/config/phxbinlog_config.h#L3","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: include/phxbinlogsvr/define/errordef.h:4 and phxbinlogsvr/core/paxos/paxos_def.h:4","ref":"include/phxbinlogsvr/define/errordef.h","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/include/phxbinlogsvr/define/errordef.h#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: include/phxcomm/base_config.h:3 and include/phxcomm/lock_manager.h:3","ref":"include/phxcomm/base_config.h","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/include/phxcomm/base_config.h#L3","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: include/phxcomm/net.h:4 and include/phxcomm/phx_log_def.h:4","ref":"include/phxcomm/net.h","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/include/phxcomm/net.h#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc:2 and phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.h:2","ref":"phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.cc#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.h:6 and phx_percona/percona/plugin/phxsync_phxrpc/phxsync_utils.h:6","ref":"phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.h","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/plugin/phxsync_phxrpc/init_with_phxbinlogsvr.h#L6","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: phx_percona/percona/plugin/semisync/semisync_master_plugin.cc:5 and phx_percona/percona/sql/binlog.cc:3","ref":"phx_percona/percona/plugin/semisync/semisync_master_plugin.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/plugin/semisync/semisync_master_plugin.cc#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: phx_percona/percona/plugin/semisync/semisync_master_plugin.cc:9 and phx_percona/percona/sql/mysqld.cc:8","ref":"phx_percona/percona/plugin/semisync/semisync_master_plugin.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/plugin/semisync/semisync_master_plugin.cc#L9","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: phx_percona/percona/sql/binlog.cc:7 and phx_percona/percona/sql/binlog.h:8","ref":"phx_percona/percona/sql/binlog.cc","url":"https://github.com/Tencent/phxsql/blob/c5d689756b57d2d8b7f7e3ea932e523970fe59b8/phx_percona/percona/sql/binlog.cc#L7","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":49.0,"weighted_findings":43.5,"scanned_lines":57643.0,"category:best-practice":16.0,"category:correctness":33.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"phxrpc_package_config/tools/binary_operator.py","line":91,"fingerprint":"python.lang.best-practice.arbitrary-sleep:phxrpc_package_config/tools/binary_operator.py:91"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"phxrpc_package_config/tools/binary_operator.py","line":99,"fingerprint":"python.lang.best-practice.arbitrary-sleep:phxrpc_package_config/tools/binary_operator.py:99"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"phxrpc_package_config/tools/binary_operator.py","line":107,"fingerprint":"python.lang.best-practice.arbitrary-sleep:phxrpc_package_config/tools/binary_operator.py:107"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"phxrpc_package_config/tools/install.py","line":103,"fingerprint":"python.lang.best-practice.arbitrary-sleep:phxrpc_package_config/tools/install.py:103"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"phxrpc_package_config/tools/install.py","line":126,"fingerprint":"python.lang.best-practice.arbitrary-sleep:phxrpc_package_config/tools/install.py:126"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"phxrpc_package_config/tools/install.py","line":149,"fingerprint":"python.lang.best-practice.arbitrary-sleep:phxrpc_package_config/tools/install.py:149"},{"rule_id":"opengrep/python.lang.correctness.list-modify-while-iterate","severity":"high","message":"It appears that `u_list` is a list that is being modified while in a for loop. This will likely cause a runtime error or an infinite loop.","path":"tools/create_makefile.py","line":23,"fingerprint":"python.lang.correctness.list-modify-while-iterate:tools/create_makefile.py:23"},{"rule_id":"opengrep/bash.lang.best-practice.iteration-over-ls-output","severity":"medium","message":"Iterating over ls output is fragile. Use globs, e.g. 'dir/*' instead of '$(ls dir)'.","path":"autoinstall.sh","line":26,"fingerprint":"bash.lang.best-practice.iteration-over-ls-output:autoinstall.sh:26"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phxrpc_package_config/tools/config_generator.py","line":53,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phxrpc_package_config/tools/config_generator.py:53"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phxrpc_package_config/tools/config_generator.py","line":63,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phxrpc_package_config/tools/config_generator.py:63"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"phxrpc_package_config/tools/config_generator.py","line":81,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:phxrpc_package_config/tools/config_generator.py:81"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/check_install.py","line":12,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/check_install.py:12"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/check_install.py","line":26,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/check_install.py:26"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"tools/check_install.py","line":45,"fingerprint":"python.lang.correctness.use-sys-exit:tools/check_install.py:45"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"tools/check_install.py","line":71,"fingerprint":"python.lang.correctness.use-sys-exit:tools/check_install.py:71"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"tools/check_install.py","line":78,"fingerprint":"python.lang.correctness.use-sys-exit:tools/check_install.py:78"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"tools/check_install.py","line":87,"fingerprint":"python.lang.correctness.use-sys-exit:tools/check_install.py:87"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"tools/check_install.py","line":95,"fingerprint":"python.lang.correctness.use-sys-exit:tools/check_install.py:95"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/create_makefile.py","line":48,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/create_makefile.py:48"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/create_makefile.py","line":176,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/create_makefile.py:176"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/create_makefile.py","line":255,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/create_makefile.py:255"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"tools/create_makefile.py","line":258,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:tools/create_makefile.py:258"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"tools/create_makefile.py","line":330,"fingerprint":"python.lang.correctness.use-sys-exit:tools/create_makefile.py:330"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":10,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:10"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":19,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:19"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":25,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:25"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":26,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:26"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":30,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:30"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":39,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:39"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":46,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:46"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":52,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:52"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":53,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:53"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":54,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:54"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"autoinstall.sh","line":59,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:autoinstall.sh:59"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"phxrpc_package_config/tools/test_phxsql.sh","line":11,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:phxrpc_package_config/tools/test_phxsql.sh:11"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"phxrpc_package_config/tools/test_phxsql.sh","line":12,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:phxrpc_package_config/tools/test_phxsql.sh:12"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":7,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:7"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":9,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:9"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":14,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:14"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":34,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:34"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":35,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:35"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":36,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:36"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":41,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:41"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":49,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:49"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":50,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:50"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":51,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:51"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":55,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:55"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":64,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:64"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test-with-docker.sh","line":65,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test-with-docker.sh:65"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0083,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0548,"test_lines":238.0,"source_lines":57643.0,"test_ratio":0.0041,"ci_files":1.0,"cochange_share":0.0137,"cochange_commits":73.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":193.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}