@galaxy-tool-util/cli
galaxy-tool-cache CLI — cache and inspect Galaxy tool metadata
18
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
jmchilton
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/commands/cytoscapejs/_template-bundled.d.ts | AI (source-diff): Long line is an inlined HTML template string in a .d.ts declaration file — readable, benign CytoscapeJS visualization template. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from jmchilton to GitHub Actions CI with SLSA provenance; consistent with legitimate automation migration. | ai | |
| provenance | missing-githead | AI (provenance): GitHub Actions CI publish environments often omit gitHead; SLSA provenance attestation provides stronger commit linkage. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Size increase consistent with bundled templates (bundle-templates.mjs build step) and 1.0.0 feature expansion. | ai | |
| source-diff | source-size-tripled | AI (source-diff): 4x size increase explained by template bundling step added to build script alongside nunjucks dep. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped monorepo package; no brand/name similarity to joi beyond edit distance artifact. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 1.10.0 | 9 / 2 | |
| 1.9.0 | 9 / 2 | |
| 1.8.2 | 9 / 2 | |
| 1.8.1 | 9 / 2 | |
| 1.8.0 | 9 / 2 | |
| 1.7.2 | 9 / 2 | |
| 1.7.1 | 9 / 2 | |
| 1.7.0 | 9 / 2 | |
| 1.6.0 | 9 / 2 | |
| 1.5.0 | 9 / 2 | |
| 1.4.0 | 9 / 2 | |
| 1.3.0 | 9 / 2 | |
| 1.2.0 | 9 / 2 | |
| 1.1.0 | 8 / 2 | |
| 1.0.0 | 7 / 2 | |
| 0.4.0 | 7 / 2 | |
| 0.2.0 | 6 / 1 | |
| 0.1.0 | 6 / 1 |
v1.10.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.