{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:31:09.517472Z","repo":{"ref":{"host":"github.com","owner":"shadowsocks","name":"ChinaDNS"},"default_branch":"master","clone_url":"https://github.com/shadowsocks/ChinaDNS.git","html_url":"https://github.com/shadowsocks/ChinaDNS","description":"Protect yourself against DNS poisoning in China.","stars":3598,"forks":1248,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1241,"primary_language":"C","license_spdx":"GPL-3.0","created_at":"2014-07-24T06:06:44Z","pushed_at":"2020-05-03T10:00:17Z","security_policy_url":null,"distribution":{"owner_created_at":"2012-12-10T08:51:38Z","owner_type":"Organization","release_assets":[{"name":"chinadns-1.3.2.tar.gz","size":120711,"download_count":41758,"release_tag":"1.3.2","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.2/chinadns-1.3.2.tar.gz"},{"name":"ChinaDNS_1.3.2_ar71xx.ipk","size":26945,"download_count":4171,"release_tag":"1.3.2","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.2/ChinaDNS_1.3.2_ar71xx.ipk"},{"name":"ChinaDNS_1.3.2_brcm47xx.ipk","size":27049,"download_count":1041,"release_tag":"1.3.2","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.2/ChinaDNS_1.3.2_brcm47xx.ipk"},{"name":"ChinaDNS_1.3.2_brcm63xx.ipk","size":26916,"download_count":659,"release_tag":"1.3.2","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.2/ChinaDNS_1.3.2_brcm63xx.ipk"},{"name":"ChinaDNS_1.3.2_ramips_24kec.ipk","size":27019,"download_count":2769,"release_tag":"1.3.2","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.2/ChinaDNS_1.3.2_ramips_24kec.ipk"},{"name":"chinadns-1.3.1.tar.gz","size":119085,"download_count":3363,"release_tag":"1.3.1","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.1/chinadns-1.3.1.tar.gz"},{"name":"ChinaDNS_1.3.1_ar71xx.ipk","size":26103,"download_count":399,"release_tag":"1.3.1","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.1/ChinaDNS_1.3.1_ar71xx.ipk"},{"name":"ChinaDNS_1.3.1_brcm47xx.ipk","size":26282,"download_count":120,"release_tag":"1.3.1","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.1/ChinaDNS_1.3.1_brcm47xx.ipk"},{"name":"ChinaDNS_1.3.1_brcm63xx.ipk","size":26047,"download_count":94,"release_tag":"1.3.1","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.1/ChinaDNS_1.3.1_brcm63xx.ipk"},{"name":"ChinaDNS_1.3.1_ramips_24kec.ipk","size":26238,"download_count":216,"release_tag":"1.3.1","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.1/ChinaDNS_1.3.1_ramips_24kec.ipk"},{"name":"chinadns-1.3.0.tar.gz","size":115994,"download_count":1548,"release_tag":"1.3.0","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.0/chinadns-1.3.0.tar.gz"},{"name":"chinadns-1.2.2.tar.gz","size":105932,"download_count":691,"release_tag":"1.2.2","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.2.2/chinadns-1.2.2.tar.gz"},{"name":"chinadns-c-1.2.1.tar.gz","size":105928,"download_count":1359,"release_tag":"1.2.1","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.2.1/chinadns-c-1.2.1.tar.gz"},{"name":"chinadns-c-1.2.0.tar.gz","size":105934,"download_count":172,"release_tag":"1.2.0","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.2.0/chinadns-c-1.2.0.tar.gz"},{"name":"chinadns-c-1.1.9.tar.gz","size":103131,"download_count":186,"release_tag":"1.1.9","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.1.9/chinadns-c-1.1.9.tar.gz"},{"name":"chinadns-c-1.1.8.tar.gz","size":112198,"download_count":787,"release_tag":"1.1.8","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.1.8/chinadns-c-1.1.8.tar.gz"},{"name":"chinadns-c-1.1.7.tar.gz","size":113882,"download_count":1273,"release_tag":"1.1.7","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.1.7/chinadns-c-1.1.7.tar.gz"},{"name":"chinadns-c-1.1.6.tar.gz","size":114003,"download_count":216,"release_tag":"1.1.6","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.1.6/chinadns-c-1.1.6.tar.gz"}]}},"commit_sha":"9e4261c78e911851f76a9b9113d48fcdc44ce32e","profile":{"lines_by_language":{"C":1174,"Shell":117,"Python":65},"files_by_category":{"other":14,"source":7,"docs":3,"config":2,"test":2},"source_lines":1291,"test_lines":65},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":54.6,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":41.4,"duplication":83.3,"lint":48.4,"testing":39.4,"docs":85.0,"type_safety":null,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.05, no CI test run detected; 29% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing."},"security":{"score":65.2,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":54.3,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: no high-impact findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":199.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":2329.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2014-07":{"loc":800,"attributed_loc":0},"2014-08":{"loc":223,"attributed_loc":0},"2014-09":{"loc":38,"attributed_loc":0},"2014-10":{"loc":0,"attributed_loc":0},"2014-11":{"loc":41,"attributed_loc":0},"2014-12":{"loc":176,"attributed_loc":0},"2015-01":{"loc":318,"attributed_loc":0},"2015-02":{"loc":168,"attributed_loc":0},"2015-03":{"loc":0,"attributed_loc":0},"2015-04":{"loc":541,"attributed_loc":0},"2015-06":{"loc":10,"attributed_loc":0},"2015-07":{"loc":12,"attributed_loc":0},"2015-08":{"loc":2,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":54.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":2329.0,"pre_ai_era_burst_loc":0.0,"measured_loc":2329.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":91.74787052810902,"median_loc_per_hour":64.0,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":20.0,"flagged_releases":0.0,"max_loc_per_day":109.9},"findings":[],"evidence":[],"data":{"releases":[{"from":"1.0.0","to":"1.0.1","loc":9,"days":3.59,"loc_per_day":2.5,"flagged":false},{"from":"1.0.1","to":"1.0.2","loc":20,"days":0.32,"loc_per_day":61.8,"flagged":false},{"from":"1.0.2","to":"1.0.3","loc":7,"days":0.06,"loc_per_day":109.9,"flagged":false},{"from":"1.0.3","to":"1.0.4","loc":13,"days":7.04,"loc_per_day":1.8,"flagged":false},{"from":"1.0.4","to":"1.1.0","loc":151,"days":2.16,"loc_per_day":69.8,"flagged":false},{"from":"1.1.0","to":"1.1.1","loc":2,"days":0.49,"loc_per_day":4.1,"flagged":false},{"from":"1.1.1","to":"1.1.2","loc":3,"days":2.6,"loc_per_day":1.2,"flagged":false},{"from":"1.1.2","to":"1.1.3","loc":45,"days":9.78,"loc_per_day":4.6,"flagged":false},{"from":"1.1.3","to":"1.1.4","loc":9,"days":7.1,"loc_per_day":1.3,"flagged":false},{"from":"1.1.4","to":"1.1.5","loc":12,"days":11.91,"loc_per_day":1.0,"flagged":false},{"from":"1.1.5","to":"1.1.6","loc":24,"days":7.18,"loc_per_day":3.3,"flagged":false},{"from":"1.1.6","to":"1.1.7","loc":2,"days":10.98,"loc_per_day":0.2,"flagged":false},{"from":"1.1.7","to":"1.1.8","loc":41,"days":55.98,"loc_per_day":0.7,"flagged":false},{"from":"1.1.8","to":"1.1.9","loc":1,"days":34.92,"loc_per_day":0.0,"flagged":false},{"from":"1.1.9","to":"1.2.0","loc":175,"days":5.22,"loc_per_day":33.5,"flagged":false},{"from":"1.2.0","to":"1.2.1","loc":1,"days":0.56,"loc_per_day":1.8,"flagged":false},{"from":"1.2.1","to":"1.2.2","loc":14,"days":6.49,"loc_per_day":2.2,"flagged":false},{"from":"1.2.2","to":"1.3.0","loc":301,"days":17.63,"loc_per_day":17.1,"flagged":false},{"from":"1.3.0","to":"1.3.1","loc":170,"days":47.82,"loc_per_day":3.6,"flagged":false},{"from":"1.3.1","to":"1.3.2","loc":563,"days":144.23,"loc_per_day":3.9,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":1291.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":9.0,"findings_high":0.0,"findings_medium":9.0,"findings_low":0.0,"weighted_findings":2.25,"scanned_lines":1291.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/chinadns.c","line":179,"fingerprint":"c.lang.security.insecure-use-memset:src/chinadns.c:179"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/chinadns.c","line":183,"fingerprint":"c.lang.security.insecure-use-memset:src/chinadns.c:183"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/chinadns.c","line":320,"fingerprint":"c.lang.security.insecure-use-memset:src/chinadns.c:320"},{"rule_id":"opengrep/c.lang.security.insecure-use-strtok-fn","severity":"medium","message":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. [confidence low]","path":"src/chinadns.c","line":323,"fingerprint":"c.lang.security.insecure-use-strtok-fn:src/chinadns.c:323"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/chinadns.c","line":326,"fingerprint":"c.lang.security.insecure-use-memset:src/chinadns.c:326"},{"rule_id":"opengrep/c.lang.security.insecure-use-string-copy-fn","severity":"medium","message":"Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker [confidence low]","path":"src/chinadns.c","line":327,"fingerprint":"c.lang.security.insecure-use-string-copy-fn:src/chinadns.c:327"},{"rule_id":"opengrep/c.lang.security.insecure-use-strtok-fn","severity":"medium","message":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. [confidence low]","path":"src/chinadns.c","line":350,"fingerprint":"c.lang.security.insecure-use-strtok-fn:src/chinadns.c:350"},{"rule_id":"opengrep/c.lang.security.insecure-use-strtok-fn","severity":"medium","message":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. [confidence low]","path":"src/chinadns.c","line":355,"fingerprint":"c.lang.security.insecure-use-strtok-fn:src/chinadns.c:355"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/chinadns.c","line":546,"fingerprint":"c.lang.security.insecure-use-memset:src/chinadns.c:546"}],"evidence":[],"data":{"rulesets":["c","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":10.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release 1.3.2 ships chinadns-1.3.2.tar.gz (41758 downloads)","ref":"chinadns-1.3.2.tar.gz","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.2/chinadns-1.3.2.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release 1.3.1 ships chinadns-1.3.1.tar.gz (3363 downloads)","ref":"chinadns-1.3.1.tar.gz","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.1/chinadns-1.3.1.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release 1.3.0 ships chinadns-1.3.0.tar.gz (1548 downloads)","ref":"chinadns-1.3.0.tar.gz","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.3.0/chinadns-1.3.0.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release 1.2.2 ships chinadns-1.2.2.tar.gz (691 downloads)","ref":"chinadns-1.2.2.tar.gz","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.2.2/chinadns-1.2.2.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release 1.2.1 ships chinadns-c-1.2.1.tar.gz (1359 downloads)","ref":"chinadns-c-1.2.1.tar.gz","url":"https://github.com/shadowsocks/ChinaDNS/releases/download/1.2.1/chinadns-c-1.2.1.tar.gz","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":29.0,"function_nloc":884.0,"mean_ccn":6.97,"p90_ccn":16.0,"complex_functions":4.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.2941},"findings":[],"evidence":[{"kind":"complex-function","description":"should_filter_query in src/chinadns.c: complexity 20, 64 lines","ref":"src/chinadns.c","url":"https://github.com/shadowsocks/ChinaDNS/blob/9e4261c78e911851f76a9b9113d48fcdc44ce32e/src/chinadns.c#L752","weight":0.3333333333333333},{"kind":"complex-function","description":"dns_handle_local in src/chinadns.c: complexity 17, 81 lines","ref":"src/chinadns.c","url":"https://github.com/shadowsocks/ChinaDNS/blob/9e4261c78e911851f76a9b9113d48fcdc44ce32e/src/chinadns.c#L565","weight":0.2833333333333333},{"kind":"complex-function","description":"parse_args in src/chinadns.c: complexity 16, 55 lines","ref":"src/chinadns.c","url":"https://github.com/shadowsocks/ChinaDNS/blob/9e4261c78e911851f76a9b9113d48fcdc44ce32e/src/chinadns.c#L242","weight":0.26666666666666666},{"kind":"complex-function","description":"local_ns_parserr in src/local_ns_parser.c: complexity 16, 60 lines","ref":"src/local_ns_parser.c","url":"https://github.com/shadowsocks/ChinaDNS/blob/9e4261c78e911851f76a9b9113d48fcdc44ce32e/src/local_ns_parser.c#L67","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":984.0,"duplicated_lines":30.0,"duplicated_share":0.0305,"files":7.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/chinadns.c:415 and src/chinadns.c:471","ref":"src/chinadns.c","url":"https://github.com/shadowsocks/ChinaDNS/blob/9e4261c78e911851f76a9b9113d48fcdc44ce32e/src/chinadns.c#L415","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":12.0,"weighted_findings":3.75,"scanned_lines":1291.0,"category:correctness":12.0},"findings":[{"rule_id":"opengrep/c.lang.correctness.incorrect-use-ato-fn","severity":"medium","message":"Avoid the 'ato*()' family of functions. Their use can lead to undefined behavior, integer overflows, and lack of appropriate error handling. Instead prefer the 'strtol*()' family of functions.","path":"src/chinadns.c","line":484,"fingerprint":"c.lang.correctness.incorrect-use-ato-fn:src/chinadns.c:484"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".jenkins.sh","line":10,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.jenkins.sh:10"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".jenkins.sh","line":62,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.jenkins.sh:62"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"packaging/build_all.sh","line":11,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:packaging/build_all.sh:11"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"packaging/build_all.sh","line":16,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:packaging/build_all.sh:16"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"packaging/build_all.sh","line":21,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:packaging/build_all.sh:21"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"packaging/build_all.sh","line":27,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:packaging/build_all.sh:27"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"packaging/release.sh","line":10,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:packaging/release.sh:10"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"packaging/release.sh","line":11,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:packaging/release.sh:11"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"packaging/release.sh","line":14,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:packaging/release.sh:14"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"packaging/release.sh","line":15,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:packaging/release.sh:15"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"packaging/release.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:packaging/release.sh:17"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1007,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.1928,"test_lines":65.0,"source_lines":1291.0,"test_ratio":0.0503,"ci_files":1.0,"cochange_share":0.0482,"cochange_commits":83.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":135.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"COPYING","ref":"COPYING","url":null,"weight":0.0},{"kind":"docs","description":"CHANGES","ref":"CHANGES","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}